memeloop 0.0.1 → 0.1.1

package/dist/orchestration-portable-mvYBvGBb.d.cts

@@ -0,0 +1,2192 @@
+import './interface-IrKBFtL1.cjs';
+import { aE as ArtifactTrust, aD as ArtifactReviewKind, ax as ArtifactDestination, aC as ArtifactReviewEvidence, az as ArtifactRecordResource, b9 as DataClassification, bv as ModelClassSpec, k as ILLMProvider, bH as NetworkAttachmentResource, bL as NetworkClassResource, bJ as NetworkAttachmentStatus, A as AgentFrameworkContext, f as AgentLoopInput, e as AgentLoopGenerator, cB as ToolAdmissionPolicy, cS as ToolOperationResource, cP as ToolOperationApprovalEvidence, cT as ToolOperationResult, aT as ControlStoreActor, m as IToolRegistry, bh as InfrastructureDriverType, aq as AgentWorkloadResource, aS as ControlStore, bP as NodeTrustClass, z as ToolOperationEffect, by as ModelEndpointResource, a1 as AgentRunResource, b$ as RuntimeClassSpec, bq as ModelCallRecordSpec, br as ModelCallRecordStatus, d2 as VolumeAccessMode, cY as ToolRiskLevel } from './scriptDeploymentPipeline-yG1ZhVVI.cjs';
+import { D as Device } from './types-7pYti-k9.cjs';
+import './remoteClient-CBggnRy3.cjs';
+
+declare function artifactTrustRank(trust: ArtifactTrust): number;
+/** The trust of a derived artifact: the lowest of its parents and producer. */
+declare function deriveArtifactTrust(parents: ArtifactRecordResource[], producerTrust: ArtifactTrust): ArtifactTrust;
+interface ArtifactDestinationPolicy {
+    /** Minimum producer/lineage trust accepted by default. */
+    minimumTrust: ArtifactTrust;
+    /** Exact policy revision review evidence must be bound to. */
+    policyDigest: string;
+    requiredReviews: ArtifactReviewKind[];
+    /** Explicitly allow lower lineage trust after every required review passes. */
+    allowLowerTrust?: boolean;
+}
+declare const DEFAULT_DESTINATION_POLICIES: Record<ArtifactDestination, ArtifactDestinationPolicy>;
+interface ArtifactAdmissionDecision {
+    admitted: boolean;
+    reason: string;
+}
+/**
+ * Decide whether an artifact may enter a destination. Evidence is valid only
+ * for the exact content hash, policy revision, and destination it names.
+ */
+declare function canArtifactEnter(artifact: ArtifactRecordResource, destination: ArtifactDestination, policy?: ArtifactDestinationPolicy): ArtifactAdmissionDecision;
+/** Throwing variant for driver/controller enforcement points. */
+declare function assertArtifactAdmission(artifact: ArtifactRecordResource, destination: ArtifactDestination, policy?: ArtifactDestinationPolicy): void;
+/**
+ * Content storage does not own review or promotion authority. Implementations
+ * stream through a hard byte limit and return a digest they computed.
+ */
+interface ArtifactContentStore {
+    put(content: AsyncIterable<Uint8Array>, options: {
+        mimeType?: string;
+        maxBytes: number;
+    }): Promise<{
+        contentHash: string;
+        sizeBytes: number;
+    }>;
+    get(contentHash: string): Promise<AsyncIterable<Uint8Array> | null>;
+    delete(contentHash: string): Promise<void>;
+}
+interface ArtifactInspectionRequest {
+    contentHash: string;
+    policyDigest: string;
+    destinations: ArtifactDestination[];
+    maxBytes: number;
+}
+interface ArtifactInspectionResult {
+    contentHash: string;
+    policyDigest: string;
+    reviews: ArtifactReviewEvidence[];
+}
+/** Host adapter that parses content in a separate sandbox, never a controller. */
+interface ArtifactInspectionExecutor {
+    inspect(request: ArtifactInspectionRequest): Promise<ArtifactInspectionResult>;
+}
+/** Narrow trusted writer; workers and inspection sandboxes never receive it. */
+interface ArtifactReviewWriter {
+    appendReview(contentHash: string, evidence: ArtifactReviewEvidence): Promise<void>;
+    quarantine(contentHash: string, reason: string): Promise<void>;
+}
+/** Execute inspection externally, validate its binding, and quarantine failures. */
+declare function inspectAndRecordArtifact(artifact: ArtifactRecordResource, request: Omit<ArtifactInspectionRequest, 'contentHash'>, executor: ArtifactInspectionExecutor, writer: ArtifactReviewWriter): Promise<ArtifactInspectionResult>;
+
+declare function classificationRank(value: DataClassification): number;
+interface ModelProviderDataPolicy {
+    /** Requests above this classification are rejected with FORBIDDEN. */
+    maxInputClassification?: DataClassification;
+    /** Classification stamped on outputs produced by this endpoint. */
+    outputClassification?: DataClassification;
+}
+declare function assertClassificationAllowed(policy: ModelProviderDataPolicy | undefined, classification: DataClassification | undefined): void;
+interface ModelGenerateMessage {
+    role: 'system' | 'user' | 'assistant' | 'tool';
+    content: string;
+}
+interface ModelGenerateRequest {
+    /** ModelCallRecord name; correlates the call and anchors idempotency. */
+    callId: string;
+    modelClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    /** Required digest from the ModelClass; drivers must not serve a mismatch. */
+    modelDigest?: string;
+    messages: ModelGenerateMessage[];
+    maxOutputTokens?: number;
+    temperature?: number;
+    inputClassification?: DataClassification;
+    signal?: AbortSignal;
+}
+interface ModelStreamChunk {
+    type: 'delta' | 'usage' | 'error' | 'done';
+    delta?: string;
+    usage?: {
+        inputTokens?: number;
+        outputTokens?: number;
+    };
+    error?: {
+        code: string;
+        message: string;
+        retryable: boolean;
+    };
+}
+interface ModelProviderHealth {
+    healthy: boolean;
+    detail?: string;
+    checkedAt: string;
+}
+/**
+ * Portable model provider contract. Local runtimes (in-process, ollama) and
+ * gateway-mediated remote models implement the same interface; loops select
+ * models declaratively via ModelClass/ModelEndpoint and never touch provider
+ * SDK objects. Drivers enforce input classification before any token leaves
+ * the node.
+ */
+interface ModelProviderDriver {
+    listModels(): Promise<ModelClassSpec[]>;
+    getHealth(): Promise<ModelProviderHealth>;
+    generate(request: ModelGenerateRequest): AsyncIterable<ModelStreamChunk>;
+    cancel?(callId: string): Promise<void>;
+}
+interface LegacyLLMProviderDriverOptions {
+    /** ModelClass specs this legacy provider can serve. */
+    models: ModelClassSpec[];
+    dataPolicy?: ModelProviderDataPolicy;
+    /** Map a portable generate request into the legacy provider's request shape. */
+    toLegacyRequest?: (request: ModelGenerateRequest) => unknown;
+    /** Extract a text delta from a legacy stream chunk; return undefined to skip. */
+    toDelta?: (chunk: unknown) => string | undefined;
+}
+/**
+ * Adapt an existing `ILLMProvider` to the portable `ModelProviderDriver`
+ * contract so current runtimes can be scheduled and policy-enforced without
+ * rewriting providers. Classification is enforced in the adapter, before the
+ * legacy provider is invoked.
+ */
+declare function createModelProviderDriverFromLLMProvider(provider: ILLMProvider, options: LegacyLLMProviderDriverOptions): ModelProviderDriver;
+
+/**
+ * NetworkDriver: the CNI-like contract between the runtime and node network
+ * implementations (process env, proxy, netns, firewall, eBPF, ...). Drivers
+ * declare what they can enforce; the control plane validates a NetworkClass
+ * against driver capabilities before scheduling, and never starts a workload
+ * whose `enforcement: required` class cannot be fully enforced.
+ */
+type NetworkEnforceableFeature = 'dns' | 'proxy' | 'ingress' | 'egress' | 'bandwidth' | 'service-access';
+type NetworkEnforcementLevel = 'none' | 'process' | 'namespace' | 'host' | 'external';
+interface NetworkDriverCapabilities {
+    /** Driver name referenced by NetworkClass.spec.driver. */
+    name: string;
+    /** Features this driver can enforce. */
+    enforcedFeatures: NetworkEnforceableFeature[];
+    /** Strongest isolation boundary the driver actually controls. */
+    enforcementLevel: NetworkEnforcementLevel;
+}
+interface NetworkAttachRequest {
+    attachment: NetworkAttachmentResource;
+    networkClass: NetworkClassResource;
+    /** Opaque sandbox handle (process, container, namespace) to attach. */
+    sandboxRef: string;
+}
+interface NetworkDriverHealth {
+    healthy: boolean;
+    detail?: string;
+    checkedAt: string;
+}
+interface NetworkDriver {
+    getCapabilities(): Promise<NetworkDriverCapabilities>;
+    /**
+     * Attach a workload sandbox to the network described by its class. On
+     * success the status carries an opaque `handle` consumers must not parse;
+     * degraded features (best-effort classes only) are listed in `degraded`.
+     */
+    prepare(request: NetworkAttachRequest): Promise<NetworkAttachmentStatus>;
+    check(handle: string): Promise<NetworkAttachmentStatus | null>;
+    update(handle: string, request: NetworkAttachRequest): Promise<NetworkAttachmentStatus>;
+    resolveService(name: string, handle?: string): Promise<string | undefined>;
+    /** Idempotently release the handle; status CAS retries may call this again. */
+    release(handle: string): Promise<void>;
+    getHealth(): Promise<NetworkDriverHealth>;
+}
+interface NetworkClassSatisfaction {
+    satisfied: boolean;
+    /** Features present in the class that the driver cannot enforce. */
+    unsupportedFeatures: NetworkEnforceableFeature[];
+    reason?: string;
+}
+/** Features configured by the class that require driver enforcement. */
+declare function featuresRequiredByClass(networkClass: NetworkClassResource): NetworkEnforceableFeature[];
+/**
+ * Validate that a driver can satisfy a NetworkClass. For
+ * `enforcement: required` every configured feature must be enforceable and
+ * the driver must support required enforcement; for `best-effort` the check
+ * reports which features would degrade instead of failing.
+ */
+declare function canDriverSatisfyClass(capabilities: NetworkDriverCapabilities, networkClass: NetworkClassResource): NetworkClassSatisfaction;
+
+/**
+ * Context passed to builtin tool implementations.
+ * Extends AgentFrameworkContext with optional capabilities for MCP proxy, spawn and remote agent.
+ */
+interface BuiltinToolContext extends AgentFrameworkContext {
+    /**
+     * Cooperative cancellation for the current durable ToolOperation.
+     * Implementations that block on I/O should pass this signal downstream.
+     */
+    operationSignal?: AbortSignal;
+    /**
+     * 当前工具执行时对应的 conversationId（由宿主/运行时注入）。
+     * IM 会话工具依赖该值定位会话来源；缺失时工具返回错误而不是抛异常。
+     */
+    activeToolConversationId?: string;
+    /**
+     * Run the local task agent (for spawnAgent). If not provided, spawnAgent tool will return an error.
+     */
+    runLocalAgent?(input: AgentLoopInput): AgentLoopGenerator;
+    /**
+     * List known peer devices (for remoteAgent). If not provided, remoteAgent returns empty list / "not configured".
+     */
+    getPeers?(): Promise<Device[]>;
+    /**
+     * Send JSON-RPC to a peer node (for remoteAgent and MCP proxy). If not provided, remote calls fail.
+     */
+    sendRpcToNode?(nodeId: string, method: string, parameters: unknown): Promise<unknown>;
+    /**
+     * Call a tool on a remote MCP server on the given node (for mcpClient). If not provided, mcpClient returns error.
+     */
+    mcpCallRemote?(nodeId: string, serverName: string, toolName: string, arguments_: Record<string, unknown>): Promise<unknown>;
+    /**
+     * `remoteAgent` 等待远端流式输出的超时（毫秒）。默认 30000。
+     */
+    remoteAgentStreamTimeoutMs?: number;
+    /** 本节点 ID（用于 `spawnAgent` / `remoteAgent` 的 `detailRef.nodeId`）。未设时 spawn 使用 `"local"`。 */
+    localNodeId?: string;
+    /** `askQuestion` 阻塞前回调（可将 questionId 推送到 IM / UI，供 `resolveQuestion` RPC 回填）。 */
+    notifyAskQuestion?(payload: {
+        questionId: string;
+        question: string;
+        conversationId?: string;
+        inputType?: 'single-select' | 'multi-select' | 'text';
+        options?: Array<{
+            label: string;
+            description?: string;
+        }>;
+        allowFreeform?: boolean;
+    }): void;
+}
+/** Tool implementation: (args, context) => result. Context is bound at registration time. */
+type BuiltinToolImpl = (arguments_: Record<string, unknown>, context: BuiltinToolContext) => Promise<unknown> | AsyncIterable<unknown>;
+
+interface ToolExecutionDriver {
+    execute(operation: ToolOperationResource, options?: {
+        signal?: AbortSignal;
+        /** Required by managed routes; ignored by legacy narrow drivers. */
+        actor?: ControlStoreActor;
+        leaseEpoch?: string;
+    }): Promise<ToolOperationResource>;
+}
+type ToolOperationApprovalDecision = ToolOperationApprovalEvidence;
+interface ToolOperationApprovalRequest {
+    operation: ToolOperationResource;
+    /** Trusted policy explanation; never interpreted as authority by itself. */
+    reason?: string;
+    signal?: AbortSignal;
+}
+/** Host-owned approval boundary. Implementations bind authenticated users and durable audit. */
+interface ToolOperationApprovalBroker {
+    requestApproval(request: ToolOperationApprovalRequest): Promise<ToolOperationApprovalDecision>;
+}
+interface InProcessToolExecutionDriverOptions {
+    context: BuiltinToolContext;
+    /**
+     * Host-bound trusted admission policy. Enforced before approval checks and
+     * tool lookup; the model, scripts, and agent configuration cannot override
+     * it. Denied operations fail with `FORBIDDEN` and are still audited.
+     */
+    admission?: ToolAdmissionPolicy;
+    approvalBroker?: ToolOperationApprovalBroker;
+    auditor?: (operation: ToolOperationResource, result: ToolOperationResult) => Promise<void> | void;
+    maxOutputLength?: number;
+}
+declare function createInProcessToolExecutionDriver(registry: IToolRegistry, options: InProcessToolExecutionDriverOptions): ToolExecutionDriver;
+
+interface DriverManifest {
+    name: string;
+    version: string;
+    kind: InfrastructureDriverType;
+    capabilities: Record<string, boolean | string | number>;
+    supportsCancellation: boolean;
+    supportsBackpressure: boolean;
+    supportsAdoption: boolean;
+    supportsFencing: boolean;
+}
+interface DriverConformanceTest {
+    name: string;
+    description: string;
+    run: (driver: unknown) => Promise<void>;
+}
+interface DriverConformanceSuite {
+    interfaceKind: DriverManifest['kind'];
+    tests: DriverConformanceTest[];
+}
+interface FakeDriverOptions {
+    latencyMs?: number;
+    failureRate?: number;
+    supportsCancellation?: boolean;
+    supportsBackpressure?: boolean;
+    supportsAdoption?: boolean;
+    supportsFencing?: boolean;
+}
+/**
+ * Create a fake network driver for conformance testing.
+ */
+declare function createFakeNetworkDriver(options?: FakeDriverOptions): NetworkDriver;
+/**
+ * Create a fake model provider driver for conformance testing.
+ */
+declare function createFakeModelProviderDriver(options?: FakeDriverOptions): ModelProviderDriver;
+/**
+ * Create a fake tool execution driver for conformance testing.
+ */
+declare function createFakeToolExecutionDriver(options?: FakeDriverOptions): ToolExecutionDriver;
+/**
+ * Run a conformance suite against a driver.
+ */
+declare function runConformanceSuite(suite: DriverConformanceSuite, driver: unknown): Promise<{
+    passed: number;
+    failed: number;
+    failures: Array<{
+        name: string;
+        error: string;
+    }>;
+}>;
+/**
+ * Standard conformance tests for network drivers.
+ */
+declare function createNetworkDriverConformanceSuite(): DriverConformanceSuite;
+/**
+ * Standard conformance tests for model provider drivers.
+ */
+declare function createModelProviderDriverConformanceSuite(): DriverConformanceSuite;
+/**
+ * Standard conformance tests for tool execution drivers.
+ */
+declare function createToolExecutionDriverConformanceSuite(): DriverConformanceSuite;
+/**
+ * Standard lifecycle and crash-adoption contract for optional external
+ * orchestrators. Resource factories keep backend-specific runtime-image
+ * annotations out of portable core while allowing this exact suite to run
+ * against Swarm, Kubernetes, and future plugins.
+ */
+declare function createExternalOrchestrationDriverConformanceSuite(options: {
+    createWorkload: (name: string) => AgentWorkloadResource;
+    createToolOperation: (name: string) => ToolOperationResource;
+    actor?: ControlStoreActor;
+}): DriverConformanceSuite;
+
+declare const DRIVER_REQUEST_API_VERSION = "drivers.memeloop.io/v1alpha1";
+interface DriverRequestEnvelope<TPayload = unknown> {
+    apiVersion: typeof DRIVER_REQUEST_API_VERSION;
+    method: string;
+    resource: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        uid: string;
+        generation: number;
+    };
+    run?: {
+        uid: string;
+        attempt: number;
+    };
+    fencingEpoch?: number;
+    requestId: string;
+    idempotencyKey: string;
+    deadline: string;
+    actor: ControlStoreActor;
+    session?: {
+        id: string;
+        keyFingerprint?: string;
+    };
+    capabilityHandleRef?: string;
+    trace: {
+        traceId: string;
+        spanId: string;
+        parentSpanId?: string;
+    };
+    payloadSchemaDigest: string;
+    payload: TPayload;
+}
+/** Stable JSON-compatible representation used when a host binds a digest or idempotency key. */
+declare function canonicalDriverValue(value: unknown): string;
+/**
+ * Validate the common §10 driver request envelope before a driver interprets
+ * its payload. Unknown top-level fields and newer versions fail closed so an
+ * old driver cannot silently weaken policy.
+ */
+declare function assertDriverRequestEnvelope<TPayload = unknown>(value: unknown, options?: {
+    now?: () => Date;
+    maxFutureDeadlineMs?: number;
+    requireRun?: boolean;
+    requireFencing?: boolean;
+    requireCapability?: boolean;
+    expectedMethod?: string;
+}): asserts value is DriverRequestEnvelope<TPayload>;
+
+interface CredentialManagementCapabilities {
+    name: string;
+    supportsRenewal: boolean;
+    supportsProofOfPossession: boolean;
+    supportsMaterialization: boolean;
+    supportedExposures: CredentialIssuePayload['exposure'][];
+    maxTtlMs: number;
+    persistence: 'process' | 'host' | 'external';
+    threatAssumptions: string[];
+}
+interface CredentialIssuePayload {
+    runRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        uid: string;
+    };
+    workerKey: string;
+    target: string;
+    targetMethod: string;
+    targetDriver: string;
+    audience: string;
+    policyDigest: string;
+    ttlMs: number;
+    exposure: 'none' | 'worker-visible' | 'potentially-exposed';
+}
+interface ManagedCredentialGrant {
+    grantHandle: string;
+    resourceUid: string;
+    runUid: string;
+    attempt: number;
+    workerKey: string;
+    target: string;
+    targetMethod: string;
+    targetDriver: string;
+    audience: string;
+    policyDigest: string;
+    issuedAt: string;
+    expiresAt: string;
+    revoked: boolean;
+    exposure: CredentialIssuePayload['exposure'];
+    rotationRequired: boolean;
+}
+interface ManagedCredentialMaterialization {
+    materializationHandle: string;
+    grantHandle: string;
+    resourceUid: string;
+    targetDriver: string;
+    expiresAt: string;
+}
+/** §10.7 broker surface. No method returns raw credential material. */
+interface CredentialManagementDriver {
+    getCapabilities(): Promise<CredentialManagementCapabilities>;
+    issue(request: DriverRequestEnvelope<CredentialIssuePayload>): Promise<ManagedCredentialGrant>;
+    renew(request: DriverRequestEnvelope<{
+        grantHandle: string;
+        ttlMs: number;
+    }>): Promise<ManagedCredentialGrant>;
+    revoke(request: DriverRequestEnvelope<{
+        grantHandle: string;
+    }>): Promise<void>;
+    inspect(request: DriverRequestEnvelope<{
+        grantHandle: string;
+    }>): Promise<ManagedCredentialGrant | undefined>;
+    materialize(request: DriverRequestEnvelope<{
+        grantHandle: string;
+        targetDriver: string;
+        proof: {
+            challengeId: string;
+            signature: string;
+        };
+    }>): Promise<ManagedCredentialMaterialization>;
+}
+interface FakeCredentialManagementState {
+    grants: Map<string, ManagedCredentialGrant>;
+    materializations: Map<string, ManagedCredentialMaterialization>;
+    idempotency: Map<string, string>;
+    fences: Map<string, number>;
+    consumedChallenges: Set<string>;
+    nextHandle: number;
+}
+declare function createFakeCredentialManagementState(): FakeCredentialManagementState;
+/** Durable-state reference broker used by the portable conformance harness. */
+declare function createFakeCredentialManagementDriver(options?: {
+    state?: FakeCredentialManagementState;
+    now?: () => Date;
+    maxTtlMs?: number;
+}): CredentialManagementDriver;
+declare function createCredentialManagementConformanceSuite(options: {
+    createRequest<T>(method: string, payload: T, idempotencyKey: string, fencingEpoch?: number, resourceUid?: string): DriverRequestEnvelope<T>;
+    recreate(driver: CredentialManagementDriver): CredentialManagementDriver;
+}): DriverConformanceSuite;
+
+/**
+ * ModelAccessHandle: a short-lived opaque credential issued by a trusted
+ * CredentialBroker. It authorizes model calls through a ModelGateway without
+ * ever handing the worker a provider API key. The handle binds the Run,
+ * attempt, worker proof-of-possession key, model, audience, policy digest,
+ * budgets, and expiry. Handles must never be written to logs, checkpoints,
+ * status, or resource specs.
+ */
+interface ModelAccessHandleBudget {
+    maxInputTokens?: number;
+    maxOutputTokens?: number;
+    maxCost?: number;
+    currency?: string;
+    maxConcurrent?: number;
+}
+interface ModelAccessHandleClaims {
+    handleId: string;
+    runRef?: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        uid?: string;
+    };
+    attempt?: number;
+    /** Fingerprint of the worker's ephemeral public key (proof-of-possession binding). */
+    workerKey?: string;
+    modelClassRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+    };
+    modelDigest?: string;
+    /** Gateway/endpoint audience this handle is valid for. */
+    audience: string;
+    /** Digest of the admission/policy snapshot the handle was issued under. */
+    policyDigest?: string;
+    budget?: ModelAccessHandleBudget;
+    issuedAt: string;
+    expiresAt: string;
+}
+interface ModelAccessHandle {
+    /** Opaque token presented to the gateway. */
+    token: string;
+    claims: ModelAccessHandleClaims;
+}
+interface IssueModelAccessHandleRequest {
+    handleId?: string;
+    runRef?: ModelAccessHandleClaims['runRef'];
+    attempt?: number;
+    workerKey?: string;
+    modelClassRef: ModelAccessHandleClaims['modelClassRef'];
+    modelDigest?: string;
+    policyDigest?: string;
+    budget?: ModelAccessHandleBudget;
+    /** Lifetime override in milliseconds; capped by the broker's max TTL. */
+    ttlMs?: number;
+}
+/**
+ * Injectable crypto port. Core stays platform-neutral; Node hosts plug in an
+ * HMAC/Ed25519 implementation, tests use fakes.
+ */
+interface ModelHandleSigner {
+    sign(payload: Uint8Array): Promise<Uint8Array>;
+    verify(payload: Uint8Array, signature: Uint8Array): Promise<boolean>;
+}
+interface ModelAccessHandleBroker {
+    issueModelAccessHandle(request: IssueModelAccessHandleRequest): Promise<ModelAccessHandle>;
+    verifyModelAccessHandle(token: string, options?: VerifyModelAccessHandleOptions): Promise<ModelAccessHandleClaims>;
+    /**
+     * Revoke a handle by id (e.g. on Run cancellation or worker compromise).
+     * Verification of a revoked handle fails with FORBIDDEN before expiry.
+     */
+    revokeModelAccessHandle(handleId: string): void;
+}
+interface VerifyModelAccessHandleOptions {
+    /** Required audience; defaults to the broker's own audience. */
+    audience?: string;
+    /** Presented worker key fingerprint; must match the claim when the claim exists. */
+    workerKey?: string;
+    now?: () => Date;
+}
+declare function base64UrlEncode(bytes: Uint8Array): string;
+declare function base64UrlDecode(value: string): Uint8Array;
+interface InMemoryModelAccessHandleBrokerOptions {
+    signer: ModelHandleSigner;
+    /** Gateway audience handles are issued for and verified against. */
+    audience: string;
+    /** Default TTL when the request does not specify one (default 15min). */
+    defaultTtlMs?: number;
+    /** Hard cap on any requested TTL (default 60min). */
+    maxTtlMs?: number;
+    now?: () => Date;
+}
+/**
+ * In-memory reference CredentialBroker for model access. Suitable for tests
+ * and single-process hosts; multi-node deployments replace it with a broker
+ * backed by the control plane's signing key (see plan 24.34/24.35).
+ */
+declare function createInMemoryModelAccessHandleBroker(options: InMemoryModelAccessHandleBrokerOptions): ModelAccessHandleBroker;
+
+/**
+ * CredentialGrant broker contract (plan 24.46).
+ *
+ * Generalizes the ModelAccessHandle pattern to arbitrary scoped credentials
+ * (tool operations, SSH, cloud APIs, model access). Every grant is bound to
+ * Run/attempt/worker key/target/method/audience/policy digest/expiry, and the
+ * broker records exposure and post-task rotation requirements. Grants resolve
+ * to opaque handles; raw secret material never appears here — the broker only
+ * signs and verifies scoped claims.
+ */
+interface CredentialGrantScope {
+    runRef: {
+        apiVersion: string;
+        kind: string;
+        name: string;
+        uid: string;
+    };
+    attempt: number;
+    /** Fingerprint of the worker's ephemeral public key (proof-of-possession binding). */
+    workerKey: string;
+    target: string;
+    method: string;
+    audience: string;
+    policyDigest: string;
+}
+interface CredentialGrantProof {
+    /** Broker-issued, one-time challenge identifier. */
+    challengeId: string;
+    signature: Uint8Array;
+}
+interface CredentialProofVerifier {
+    /** Verify the worker signature and atomically consume the challenge. */
+    verifyAndConsume(request: {
+        workerKey: string;
+        grantId: string;
+        audience: string;
+        proof: CredentialGrantProof;
+    }): Promise<boolean>;
+}
+interface CredentialGrantVerification extends CredentialGrantScope {
+    proof: CredentialGrantProof;
+}
+interface CredentialGrantClaims extends CredentialGrantScope {
+    grantId: string;
+    issuedAt: string;
+    expiresAt: string;
+    renewedAt?: string;
+}
+interface CredentialGrantHandle {
+    /** Opaque token presented to the target driver. */
+    token: string;
+    claims: CredentialGrantClaims;
+}
+interface CredentialGrantInspection {
+    grantId: string;
+    scope: CredentialGrantScope;
+    issuedAt: string;
+    expiresAt: string;
+    revoked: boolean;
+    expired: boolean;
+    /** Exposure assessment used to decide post-task rotation. */
+    exposure: 'none' | 'worker-visible' | 'potentially-exposed';
+    rotationRequired: boolean;
+    rotationReason?: string;
+}
+interface IssueCredentialGrantRequest extends CredentialGrantScope {
+    grantId?: string;
+    ttlMs?: number;
+}
+interface CredentialBrokerDriver {
+    issue(request: IssueCredentialGrantRequest): Promise<CredentialGrantHandle>;
+    /** Renew an unexpired, unrevoked grant; returns a new token with a fresh expiry. */
+    renew(token: string, options?: {
+        ttlMs?: number;
+        now?: () => Date;
+    }): Promise<CredentialGrantHandle>;
+    revoke(grantId: string): void;
+    inspect(token: string): Promise<CredentialGrantInspection>;
+    /** Verify the token's entire scope and the worker's proof of possession. */
+    verify(token: string, requirements: CredentialGrantVerification): Promise<CredentialGrantClaims>;
+}
+interface InMemoryCredentialBrokerOptions {
+    signer: ModelHandleSigner;
+    proofVerifier: CredentialProofVerifier;
+    defaultTtlMs?: number;
+    maxTtlMs?: number;
+    now?: () => Date;
+}
+declare function createInMemoryCredentialBroker(options: InMemoryCredentialBrokerOptions): CredentialBrokerDriver;
+
+interface ArtifactManagementCapabilities {
+    name: string;
+    maxArtifactBytes: number;
+    supportsStreaming: boolean;
+    supportsScan: boolean;
+    supportsSanitize: boolean;
+    supportsVerify: boolean;
+    supportsMount: boolean;
+    inspectionIsolation: 'none' | 'process' | 'namespace' | 'container' | 'external';
+    persistence: 'process' | 'host' | 'external';
+    threatAssumptions: string[];
+}
+interface ArtifactPutPayload {
+    expectedContentHash?: string;
+    mimeType: string;
+    trust: ArtifactTrust;
+    producerRunUid?: string;
+    parentContentHashes?: string[];
+    maxBytes: number;
+}
+interface ManagedArtifact {
+    artifactHandle: string;
+    resourceUid: string;
+    contentHash: string;
+    sizeBytes: number;
+    mimeType: string;
+    trust: ArtifactTrust;
+    parentContentHashes: string[];
+    reviews: ArtifactReviewEvidence[];
+    quarantined: boolean;
+    quarantineReason?: string;
+    promotedDestinations: ArtifactDestination[];
+    createdAt: string;
+}
+interface ManagedArtifactMount {
+    mountHandle: string;
+    artifactHandle: string;
+    resourceUid: string;
+    destination: ArtifactDestination;
+    readOnly: true;
+}
+interface ArtifactInspectionInput {
+    bytes: Uint8Array;
+    contentHash: string;
+    mimeType: string;
+}
+interface ArtifactSanitizationResult {
+    bytes: Uint8Array;
+    mimeType: string;
+    properties: string[];
+}
+/**
+ * Host-owned hostile-content inspection boundary. Production implementations
+ * run this port outside the controller process and apply their own resource
+ * and parser limits.
+ */
+interface ArtifactInspector {
+    scan(input: ArtifactInspectionInput): Promise<string[]>;
+    sanitize(input: ArtifactInspectionInput): Promise<ArtifactSanitizationResult>;
+    verify(input: ArtifactInspectionInput, properties: string[]): Promise<boolean>;
+}
+interface ArtifactManagementDriver {
+    getCapabilities(): Promise<ArtifactManagementCapabilities>;
+    put(request: DriverRequestEnvelope<ArtifactPutPayload>, content: AsyncIterable<Uint8Array>): Promise<ManagedArtifact>;
+    resolve(request: DriverRequestEnvelope<{
+        contentHash: string;
+    }>): Promise<ManagedArtifact | undefined>;
+    read(request: DriverRequestEnvelope<{
+        artifactHandle: string;
+    }>): AsyncIterable<Uint8Array>;
+    scan(request: DriverRequestEnvelope<{
+        artifactHandle: string;
+        policyDigest: string;
+        destinations: ArtifactDestination[];
+    }>): Promise<ArtifactReviewEvidence>;
+    sanitize(request: DriverRequestEnvelope<{
+        artifactHandle: string;
+        outputResource: {
+            uid: string;
+            name: string;
+            generation: number;
+        };
+        policyDigest: string;
+        destinations: ArtifactDestination[];
+    }>): Promise<ManagedArtifact>;
+    verify(request: DriverRequestEnvelope<{
+        artifactHandle: string;
+        policyDigest: string;
+        destinations: ArtifactDestination[];
+        properties: string[];
+    }>): Promise<ArtifactReviewEvidence>;
+    promote(request: DriverRequestEnvelope<{
+        artifactHandle: string;
+        destination: ArtifactDestination;
+    }>): Promise<ManagedArtifact>;
+    quarantine(request: DriverRequestEnvelope<{
+        artifactHandle: string;
+        reason: string;
+    }>): Promise<ManagedArtifact>;
+    mount(request: DriverRequestEnvelope<{
+        artifactHandle: string;
+        destination: ArtifactDestination;
+    }>): Promise<ManagedArtifactMount>;
+    unmount(request: DriverRequestEnvelope<{
+        mountHandle: string;
+    }>): Promise<void>;
+    delete(request: DriverRequestEnvelope<{
+        artifactHandle: string;
+    }>): Promise<void>;
+}
+interface ArtifactRecord {
+    descriptor: ManagedArtifact;
+    bytes: Uint8Array;
+}
+interface FakeArtifactManagementState {
+    artifacts: Map<string, ArtifactRecord>;
+    byContentHash: Map<string, Map<string, string>>;
+    mounts: Map<string, ManagedArtifactMount>;
+    idempotency: Map<string, string>;
+    fences: Map<string, number>;
+    nextMount: number;
+}
+declare function createFakeArtifactManagementState(): FakeArtifactManagementState;
+interface ArtifactManagementStateSnapshot {
+    version: 1;
+    artifacts: Array<{
+        descriptor: ManagedArtifact;
+        bytesHex: string;
+    }>;
+    mounts: ManagedArtifactMount[];
+    idempotency: Array<[string, string]>;
+    fences: Array<[string, number]>;
+    nextMount: number;
+}
+/** JSON-safe snapshot for a trusted host store; content hashes are rechecked on restore. */
+declare function snapshotArtifactManagementState(state: FakeArtifactManagementState): ArtifactManagementStateSnapshot;
+/** Restore only structurally valid state; every content digest is verified. */
+declare function restoreArtifactManagementState(snapshot: ArtifactManagementStateSnapshot): Promise<FakeArtifactManagementState>;
+/** Stateful content-addressed reference driver with bounded hostile-input handling. */
+declare function createFakeArtifactManagementDriver(options?: {
+    state?: FakeArtifactManagementState;
+    now?: () => Date;
+    maxArtifactBytes?: number;
+    reviewer?: string;
+    destinationPolicies?: Partial<Record<ArtifactDestination, ArtifactDestinationPolicy>>;
+    inspector?: ArtifactInspector;
+    capabilities?: Partial<ArtifactManagementCapabilities>;
+}): ArtifactManagementDriver;
+declare function createArtifactManagementConformanceSuite(options: {
+    createRequest<T>(method: string, payload: T, idempotencyKey: string, fencingEpoch?: number, resourceUid?: string): DriverRequestEnvelope<T>;
+    recreate(driver: ArtifactManagementDriver): ArtifactManagementDriver;
+}): DriverConformanceSuite;
+
+type AuditTelemetryRecordKind = 'audit' | 'event' | 'metric' | 'trace';
+type AuditEffect = 'read' | 'create' | 'update' | 'delete' | 'execute' | 'decision' | 'security';
+interface AuditTelemetryCapabilities {
+    name: string;
+    recordKinds: AuditTelemetryRecordKind[];
+    appendOnly: true;
+    trustedReceiverTime: true;
+    tamperEvident: true;
+    maxRecordsPerResource: number;
+    maxAttributes: number;
+    persistence: 'process' | 'host' | 'external';
+    threatAssumptions: string[];
+}
+interface AuditProvenance {
+    source: 'controller' | 'gateway' | 'driver' | 'worker' | 'operator';
+    producer: string;
+    subject?: string;
+}
+interface AuditTelemetryRecord {
+    sequence: number;
+    recordHandle: string;
+    resourceUid: string;
+    kind: AuditTelemetryRecordKind;
+    receivedAt: string;
+    actor: {
+        id: string;
+        kind: 'controller' | 'verifier' | 'admin';
+    };
+    policyDigest: string;
+    capabilityDigest: string;
+    effect: AuditEffect;
+    provenance: AuditProvenance;
+    attributes: Record<string, string>;
+    data: {
+        kind: 'audit';
+        action: string;
+        outcome: 'success' | 'denied' | 'failure';
+        reasonCode?: string;
+    } | {
+        kind: 'event';
+        name: string;
+        severity: 'debug' | 'info' | 'warning' | 'error' | 'critical';
+    } | {
+        kind: 'metric';
+        name: string;
+        value: number;
+        unit: string;
+    } | {
+        kind: 'trace';
+        name: string;
+        traceId: string;
+        spanId: string;
+        durationMs: number;
+        status: 'ok' | 'error';
+    };
+    previousDigest?: string;
+    recordDigest: string;
+}
+interface CommonRecordPayload {
+    policyDigest: string;
+    effect: AuditEffect;
+    provenance: AuditProvenance;
+    attributes?: Record<string, string>;
+}
+interface AuditTelemetryManagementDriver {
+    getCapabilities(): Promise<AuditTelemetryCapabilities>;
+    appendAudit(request: DriverRequestEnvelope<CommonRecordPayload & {
+        action: string;
+        outcome: 'success' | 'denied' | 'failure';
+        reasonCode?: string;
+    }>): Promise<AuditTelemetryRecord>;
+    emitEvent(request: DriverRequestEnvelope<CommonRecordPayload & {
+        name: string;
+        severity: 'debug' | 'info' | 'warning' | 'error' | 'critical';
+    }>): Promise<AuditTelemetryRecord>;
+    emitMetric(request: DriverRequestEnvelope<CommonRecordPayload & {
+        name: string;
+        value: number;
+        unit: string;
+    }>): Promise<AuditTelemetryRecord>;
+    emitTrace(request: DriverRequestEnvelope<CommonRecordPayload & {
+        name: string;
+        traceId: string;
+        spanId: string;
+        durationMs: number;
+        status: 'ok' | 'error';
+    }>): Promise<AuditTelemetryRecord>;
+    readRecords(request: DriverRequestEnvelope<{
+        afterSequence?: number;
+        limit: number;
+        kinds?: AuditTelemetryRecordKind[];
+    }>): Promise<{
+        records: AuditTelemetryRecord[];
+        chainHead?: string;
+    }>;
+}
+interface FakeAuditTelemetryState {
+    records: AuditTelemetryRecord[];
+    idempotency: Map<string, number>;
+    idempotencyFingerprints: Map<string, string>;
+    fences: Map<string, number>;
+    appendTail: Promise<void>;
+}
+declare function createFakeAuditTelemetryState(): FakeAuditTelemetryState;
+/**
+ * Durable-state, append-only reference sink. It deliberately accepts only
+ * bounded metadata, never arbitrary log payloads or worker-supplied timestamps.
+ */
+declare function createFakeAuditTelemetryManagementDriver(options?: {
+    state?: FakeAuditTelemetryState;
+    now?: () => Date;
+    maxRecordsPerResource?: number;
+    maxAttributes?: number;
+}): AuditTelemetryManagementDriver;
+declare function createAuditTelemetryConformanceSuite(options: {
+    createRequest<T>(method: string, payload: T, idempotencyKey: string, fencingEpoch?: number, resourceUid?: string, actorKind?: 'controller' | 'verifier' | 'admin'): DriverRequestEnvelope<T>;
+    recreate(driver: AuditTelemetryManagementDriver): AuditTelemetryManagementDriver;
+    createQuotaDriver(): AuditTelemetryManagementDriver;
+}): DriverConformanceSuite;
+
+interface ControlStoreConformanceFactory {
+    create(): ControlStore | Promise<ControlStore>;
+    actor: ControlStoreActor;
+    snapshotTarget(testName: string): string | Promise<string>;
+    prefix?: string;
+}
+/**
+ * Backend-neutral §10.1 contract. Every test creates an isolated client/store
+ * instance so the exact same suite can run against Quorum, SQLite, and etcd.
+ */
+declare function createControlStoreConformanceSuite(factory: ControlStoreConformanceFactory): DriverConformanceSuite;
+
+type PolicyDecisionKind = 'resource-admission' | 'placement' | 'tool-operation' | 'approval' | 'transition';
+type PolicyDecisionOutcome = 'allow' | 'deny' | 'pending';
+interface PolicyApprovalCapabilities {
+    name: string;
+    decisions: PolicyDecisionKind[];
+    defaultOutcome: 'deny';
+    supportsDurableApproval: boolean;
+    supportsExplanation: boolean;
+    persistence: 'process' | 'host' | 'external';
+    threatAssumptions: string[];
+}
+interface PolicyDecision {
+    decisionHandle: string;
+    resourceUid: string;
+    kind: PolicyDecisionKind;
+    outcome: PolicyDecisionOutcome;
+    policyDigest: string;
+    inputDigest: string;
+    actorId: string;
+    reasons: string[];
+    obligations: string[];
+    decidedAt: string;
+    approval?: {
+        subjectDigest: string;
+        requestedBy: string;
+        requestedAt: string;
+        expiresAt: string;
+        decidedBy?: string;
+        resolvedAt?: string;
+        resolutionInputDigest?: string;
+    };
+}
+interface PolicyExplanation {
+    decision: PolicyDecision;
+    summary: string;
+}
+interface PolicyApprovalManagementDriver {
+    getCapabilities(): Promise<PolicyApprovalCapabilities>;
+    admitResource(request: DriverRequestEnvelope<{
+        policyDigest: string;
+        resourceApiVersion: string;
+        resourceKind: string;
+    }>): Promise<PolicyDecision>;
+    authorizePlacement(request: DriverRequestEnvelope<{
+        policyDigest: string;
+        nodeId: string;
+        nodeTrustClass: NodeTrustClass;
+        requiredTrustClass: NodeTrustClass;
+        attested: boolean;
+        driverConformancePassed: boolean;
+    }>): Promise<PolicyDecision>;
+    authorizeToolOperation(request: DriverRequestEnvelope<{
+        policyDigest: string;
+        toolName: string;
+        effect: ToolOperationEffect;
+        operationDigest: string;
+        approvalDecisionHandle?: string;
+    }>): Promise<PolicyDecision>;
+    requestApproval(request: DriverRequestEnvelope<{
+        policyDigest: string;
+        subjectKind: 'tool-operation' | 'resource' | 'placement' | 'transition';
+        subjectDigest: string;
+        reason: string;
+        ttlMs: number;
+    }>): Promise<PolicyDecision>;
+    resolveApproval(request: DriverRequestEnvelope<{
+        approvalDecisionHandle: string;
+        outcome: 'allow' | 'deny';
+        reason: string;
+    }>): Promise<PolicyDecision>;
+    verifyTransition(request: DriverRequestEnvelope<{
+        policyDigest: string;
+        transition: string;
+        from: string;
+        to: string;
+        evidenceDigest: string;
+    }>): Promise<PolicyDecision>;
+    explainDecision(request: DriverRequestEnvelope<{
+        decisionHandle: string;
+    }>): Promise<PolicyExplanation>;
+}
+interface FakePolicyApprovalState {
+    decisions: Map<string, PolicyDecision>;
+    idempotency: Map<string, string>;
+    idempotencyFingerprints: Map<string, string>;
+    fences: Map<string, number>;
+    nextHandle: number;
+}
+declare function createFakePolicyApprovalState(): FakePolicyApprovalState;
+/**
+ * Deterministic, durable-state policy reference. Its allow rules are explicit
+ * constructor-owned configuration; request payloads can never grant authority.
+ */
+declare function createFakePolicyApprovalManagementDriver(options?: {
+    state?: FakePolicyApprovalState;
+    now?: () => Date;
+    admittedResourceTypes?: Array<{
+        apiVersion: string;
+        kind: string;
+    }>;
+    allowedTools?: string[];
+    allowedTransitions?: string[];
+}): PolicyApprovalManagementDriver;
+declare function createPolicyApprovalConformanceSuite(options: {
+    createRequest<T>(method: string, payload: T, idempotencyKey: string, fencingEpoch?: number, resourceUid?: string, actorKind?: 'controller' | 'verifier' | 'admin'): DriverRequestEnvelope<T>;
+    recreate(driver: PolicyApprovalManagementDriver): PolicyApprovalManagementDriver;
+}): DriverConformanceSuite;
+
+type IdentityDomain = 'enrollment' | 'workload' | 'device' | 'control-plane';
+interface IdentityAttestationCapabilities {
+    name: string;
+    identityDomains: IdentityDomain[];
+    attestationFormats: string[];
+    supportsProofOfPossession: boolean;
+    supportsChannelBinding: boolean;
+    supportsRotation: boolean;
+    maxChallengeTtlMs: number;
+    maxSessionTtlMs: number;
+    persistence: 'process' | 'host' | 'external';
+    threatAssumptions: string[];
+}
+interface IdentityEnrollment {
+    enrollmentHandle: string;
+    resourceUid: string;
+    domain: IdentityDomain;
+    subject: string;
+    trustClass: NodeTrustClass;
+    bootstrapKeyFingerprint: string;
+    expiresAt: string;
+    consumed: boolean;
+    revoked: boolean;
+}
+interface IdentityChallenge {
+    challengeHandle: string;
+    enrollmentHandle: string;
+    resourceUid: string;
+    nonce: string;
+    channelBinding: string;
+    expiresAt: string;
+    consumed: boolean;
+}
+interface AttestedIdentity {
+    identityHandle: string;
+    resourceUid: string;
+    domain: IdentityDomain;
+    subject: string;
+    trustClass: NodeTrustClass;
+    keyFingerprint: string;
+    channelBinding: string;
+    attestationFormat: string;
+    evidenceDigest: string;
+    issuedAt: string;
+    rotatedAt?: string;
+    revoked: boolean;
+    revokeReason?: string;
+}
+interface IdentitySession {
+    sessionHandle: string;
+    identityHandle: string;
+    resourceUid: string;
+    domain: IdentityDomain;
+    audience: string;
+    channelBinding: string;
+    issuedAt: string;
+    expiresAt: string;
+    revoked: boolean;
+}
+type IdentityInspection = {
+    kind: 'enrollment';
+    value: IdentityEnrollment;
+} | {
+    kind: 'challenge';
+    value: IdentityChallenge;
+} | {
+    kind: 'identity';
+    value: AttestedIdentity;
+} | {
+    kind: 'session';
+    value: IdentitySession;
+};
+interface IdentityAttestationManagementDriver {
+    getCapabilities(): Promise<IdentityAttestationCapabilities>;
+    enroll(request: DriverRequestEnvelope<{
+        domain: IdentityDomain;
+        subject: string;
+        trustClass: NodeTrustClass;
+        bootstrapKeyFingerprint: string;
+        ttlMs: number;
+    }>): Promise<IdentityEnrollment>;
+    challenge(request: DriverRequestEnvelope<{
+        enrollmentHandle: string;
+        channelBinding: string;
+        ttlMs: number;
+    }>): Promise<IdentityChallenge>;
+    attest(request: DriverRequestEnvelope<{
+        challengeHandle: string;
+        publicKeyFingerprint: string;
+        channelBinding: string;
+        attestation: {
+            format: string;
+            evidenceDigest: string;
+        };
+        proof: string;
+    }>): Promise<AttestedIdentity>;
+    issueSession(request: DriverRequestEnvelope<{
+        identityHandle: string;
+        domain: IdentityDomain;
+        audience: string;
+        channelBinding: string;
+        ttlMs: number;
+    }>): Promise<IdentitySession>;
+    rotate(request: DriverRequestEnvelope<{
+        identityHandle: string;
+        newKeyFingerprint: string;
+        channelBinding: string;
+        proof: string;
+    }>): Promise<AttestedIdentity>;
+    revoke(request: DriverRequestEnvelope<{
+        identityHandle: string;
+        reason: string;
+    }>): Promise<AttestedIdentity>;
+    inspect(request: DriverRequestEnvelope<{
+        handle: string;
+    }>): Promise<IdentityInspection | undefined>;
+}
+interface FakeIdentityAttestationState {
+    enrollments: Map<string, IdentityEnrollment>;
+    challenges: Map<string, IdentityChallenge>;
+    identities: Map<string, AttestedIdentity>;
+    sessions: Map<string, IdentitySession>;
+    idempotency: Map<string, string>;
+    idempotencyFingerprints: Map<string, string>;
+    fences: Map<string, number>;
+    nextHandle: number;
+}
+declare function createFakeIdentityAttestationState(): FakeIdentityAttestationState;
+/** Durable-state deterministic reference identity and attestation driver. */
+declare function createFakeIdentityAttestationManagementDriver(options?: {
+    state?: FakeIdentityAttestationState;
+    now?: () => Date;
+    maxChallengeTtlMs?: number;
+    maxSessionTtlMs?: number;
+    allowedEvidenceDigests?: string[];
+}): IdentityAttestationManagementDriver;
+declare function createIdentityAttestationConformanceSuite(options: {
+    createRequest<T>(method: string, payload: T, idempotencyKey: string, fencingEpoch?: number, resourceUid?: string, actorKind?: 'controller' | 'verifier' | 'admin'): DriverRequestEnvelope<T>;
+    recreate(driver: IdentityAttestationManagementDriver): IdentityAttestationManagementDriver;
+}): DriverConformanceSuite;
+
+interface LoopRuntimeCapabilities {
+    name: string;
+    isolation: Array<'none' | 'process' | 'container' | 'wasm' | 'remote'>;
+    supportedTrustClasses: NodeTrustClass[];
+    supportsCheckpoint: boolean;
+    supportsRestore: boolean;
+    supportsAdoption: boolean;
+    persistence: 'none' | 'process' | 'host' | 'external';
+    threatAssumptions: string[];
+}
+interface LoopRuntimePreparePayload {
+    runtimeClass: string;
+    runtimeDigest: string;
+    scriptDigest?: string;
+    isolation: LoopRuntimeCapabilities['isolation'][number];
+    trustClass: NodeTrustClass;
+}
+interface LoopRuntimePrepared {
+    preparationHandle: string;
+}
+interface LoopRuntimeStartPayload {
+    preparationHandle: string;
+}
+interface ManagedLoopRunStatus {
+    runHandle: string;
+    resourceUid: string;
+    phase: 'Prepared' | 'Running' | 'Completed' | 'Failed' | 'Cancelled';
+    fencingEpoch: number;
+    updatedAt: string;
+    summary?: string;
+    error?: {
+        code: string;
+        message: string;
+        retryable: boolean;
+    };
+}
+interface LoopRuntimeCheckpoint {
+    checkpointHandle: string;
+    runHandle: string;
+    resourceUid: string;
+    createdAt: string;
+}
+interface LoopRuntimeManagementDriver {
+    getCapabilities(): Promise<LoopRuntimeCapabilities>;
+    prepare(request: DriverRequestEnvelope<LoopRuntimePreparePayload>): Promise<LoopRuntimePrepared>;
+    start(request: DriverRequestEnvelope<LoopRuntimeStartPayload>): Promise<ManagedLoopRunStatus>;
+    watch(request: DriverRequestEnvelope<{
+        runHandle: string;
+    }>): AsyncIterable<ManagedLoopRunStatus>;
+    checkpoint(request: DriverRequestEnvelope<{
+        runHandle: string;
+    }>): Promise<LoopRuntimeCheckpoint>;
+    restore(request: DriverRequestEnvelope<{
+        checkpointHandle: string;
+    }>): Promise<ManagedLoopRunStatus>;
+    cancel(request: DriverRequestEnvelope<{
+        runHandle: string;
+    }>): Promise<ManagedLoopRunStatus>;
+    inspect(request: DriverRequestEnvelope<{
+        runHandle: string;
+    }>): Promise<ManagedLoopRunStatus | undefined>;
+    adopt(request: DriverRequestEnvelope<{
+        runHandle: string;
+    }>): Promise<ManagedLoopRunStatus>;
+    delete(request: DriverRequestEnvelope<{
+        runHandle: string;
+    }>): Promise<void>;
+}
+interface PreparationRecord {
+    handle: string;
+    resourceUid: string;
+    fence: number;
+}
+interface FakeLoopRuntimeState {
+    preparations: Map<string, PreparationRecord>;
+    runs: Map<string, ManagedLoopRunStatus>;
+    checkpoints: Map<string, LoopRuntimeCheckpoint>;
+    idempotency: Map<string, string>;
+    fences: Map<string, number>;
+    nextHandle: number;
+}
+declare function createFakeLoopRuntimeState(): FakeLoopRuntimeState;
+/**
+ * Stateful portable reference driver. Supplying the same state to a new
+ * instance simulates a driver-host restart and makes adoption testable.
+ */
+declare function createFakeLoopRuntimeManagementDriver(options?: {
+    state?: FakeLoopRuntimeState;
+    now?: () => Date;
+}): LoopRuntimeManagementDriver;
+declare function createLoopRuntimeManagementConformanceSuite(options: {
+    createRequest<T>(method: string, payload: T, idempotencyKey: string, fencingEpoch?: number, resourceUid?: string): DriverRequestEnvelope<T>;
+    recreate(driver: LoopRuntimeManagementDriver): LoopRuntimeManagementDriver;
+}): DriverConformanceSuite;
+
+interface ManagedCredentialAdapterStateStore {
+    get(key: string): Promise<unknown>;
+    put(key: string, value: unknown): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+interface ManagedCredentialBrokerAdapterOptions {
+    name: string;
+    maxTtlMs: number;
+    now?: () => Date;
+    /**
+     * Resolve the verified grant inside a trusted target driver. The returned
+     * value must be an opaque reference, never raw credential material.
+     */
+    materialize(claims: CredentialGrantClaims, targetDriver: string): Promise<string>;
+    revokeMaterialization?(handle: string): Promise<void>;
+    authorizeRequest(request: DriverRequestEnvelope): boolean | Promise<boolean>;
+    /**
+     * Trusted host storage for restart adoption. The signed token never enters
+     * ControlStore; Electron/Node hosts can back this with their credential vault.
+     */
+    handleStore?: {
+        get(stableHandle: string): Promise<CredentialGrantHandle | undefined>;
+        put(stableHandle: string, handle: CredentialGrantHandle): Promise<void>;
+        delete(stableHandle: string): Promise<void>;
+    };
+    /** Durable non-secret fencing, idempotency, and materialization metadata. */
+    stateStore?: ManagedCredentialAdapterStateStore;
+    stableHandleFor?(request: DriverRequestEnvelope<CredentialIssuePayload>): string;
+    threatAssumptions: string[];
+}
+/**
+ * Adapts the existing signed CredentialBroker to the managed protocol.
+ * Host persistence requires both the secret handleStore and a non-secret
+ * stateStore. A token vault alone can recover a token but cannot preserve
+ * fencing, idempotency, or target-materialization revocation metadata.
+ */
+declare function createManagedCredentialBrokerAdapter(broker: CredentialBrokerDriver, options: ManagedCredentialBrokerAdapterOptions): CredentialManagementDriver;
+
+/**
+ * Loop Runtime Driver (plan §10.2, Phase 4.2).
+ *
+ * The cognition-plane counterpart of the tool execution driver (24.28): a
+ * LoopRuntimeDriver starts an AgentLoopRun-equivalent execution for a bound
+ * AgentWorkload and reports a terminal outcome. The in-process
+ * implementation runs the loop in the current process through the existing
+ * profile/script machinery — the same contracts apply as for remote drivers
+ * (no authorization bypass; scripts re-pass the host load gate on import).
+ */
+interface LoopRunStartRequest {
+    /** Bound workload being executed. */
+    workload: AgentWorkloadResource;
+    /** AgentRun resource tracking this attempt. */
+    run: AgentRunResource;
+    /** Fenced ModelEndpoint selected independently for this run. */
+    modelEndpoint?: ModelEndpointResource;
+    /** Independently bound and prepared network attachment for this run. */
+    networkAttachment?: NetworkAttachmentResource;
+    /** Ephemeral host-resolved mounts; never persisted in ControlStore. */
+    volumeMounts?: Array<{
+        name: string;
+        mountPath: string;
+        readOnly: boolean;
+    }>;
+    /**
+     * Script source resolved by the host for `spec.scriptReference` workloads.
+     * The driver re-admits it through the host script load gate before import.
+     */
+    scriptSource?: string;
+    /** Message delivered to the loop as its input. */
+    message?: string;
+}
+interface LoopRunOutcome {
+    phase: 'Completed' | 'Failed' | 'Cancelled';
+    summary?: string;
+    error?: {
+        code: string;
+        message: string;
+        retryable: boolean;
+    };
+}
+interface LoopRunHandle {
+    /** Terminal outcome of the run. */
+    wait(): Promise<LoopRunOutcome>;
+    /** Request cancellation; the loop observes it through the cancellation set. */
+    cancel(): Promise<void>;
+}
+interface LoopRuntimeDriver {
+    start(request: LoopRunStartRequest): Promise<LoopRunHandle>;
+}
+interface InProcessLoopRuntimeDriverOptions {
+    /**
+     * Resolve a provider for an independently placed endpoint. Downstream hosts
+     * use this port for remote ModelGateway transports. Returning undefined
+     * fails closed.
+     */
+    resolveModelProvider?: (endpoint: ModelEndpointResource, request: LoopRunStartRequest) => Promise<ILLMProvider | undefined>;
+}
+/**
+ * In-process LoopRuntimeDriver: executes profile workloads through the
+ * definition store and script workloads through a synthesized AgentAgent
+ * profile whose source was resolved (and admitted) upstream.
+ */
+declare function createInProcessLoopRuntimeDriver(context: AgentFrameworkContext, options?: InProcessLoopRuntimeDriverOptions): LoopRuntimeDriver;
+interface RuntimeClassRoutingDriverOptions {
+    /**
+     * Driver for profile workloads and for script workloads whose RuntimeClass
+     * declares `isolation: 'none'`.
+     */
+    inProcessDriver: LoopRuntimeDriver;
+    /**
+     * Driver for script workloads whose RuntimeClass declares
+     * `isolation: 'process'` (all built-in classes do). When absent, such
+     * workloads fail closed with UNSUPPORTED rather than silently running
+     * in-process (plan 24.18: declared isolation must be real).
+     */
+    processDriver?: LoopRuntimeDriver;
+    /** RuntimeClass specs by name (defaults to the built-in classes). */
+    runtimeClasses?: Record<string, RuntimeClassSpec>;
+}
+/**
+ * Route a bound workload to the driver that honors its declared RuntimeClass
+ * isolation. Unknown or missing classes fail closed — admission (plan 24.18)
+ * assigns a RuntimeClass before scheduling, and there is no silent fallback
+ * to a weaker isolation level.
+ */
+declare function createRuntimeClassRoutingDriver(options: RuntimeClassRoutingDriverOptions): LoopRuntimeDriver;
+
+interface ManagedLoopRuntimeExecutionRouteOptions extends Omit<ManagedLoopRuntimeAdapterOptions, 'resolveStartRequest'> {
+    createPreparePayload(request: LoopRunStartRequest): LoopRuntimePreparePayload;
+    createRequest<T>(request: LoopRunStartRequest, method: string, payload: T): DriverRequestEnvelope<T>;
+}
+interface ManagedLoopRuntimeExecutionRoute {
+    /** Existing controller-facing facade; every effect traverses management. */
+    executionDriver: LoopRuntimeDriver;
+    /** Complete management surface for host discovery and direct inspection. */
+    managementDriver: LoopRuntimeManagementDriver;
+}
+interface ManagedLoopRuntimeAdapterOptions {
+    capabilities: LoopRuntimeCapabilities;
+    resolveStartRequest(request: DriverRequestEnvelope<LoopRuntimePreparePayload>): Promise<LoopRunStartRequest>;
+    now?: () => Date;
+    requireCapability?: boolean;
+    /** Trusted host verifier for the opaque capability on every lifecycle call. */
+    authorizeRequest?: (request: DriverRequestEnvelope) => boolean | Promise<boolean>;
+}
+/**
+ * Adapt the production narrow execution facade to the complete management
+ * protocol without overstating crash/checkpoint support. Live handles remain
+ * host-memory state, so adoption, checkpoint and restore fail UNSUPPORTED.
+ */
+declare function createManagedLoopRuntimeAdapter(executionDriver: LoopRuntimeDriver, options: ManagedLoopRuntimeAdapterOptions): LoopRuntimeManagementDriver;
+/**
+ * Route the existing controller-facing execution facade through the complete
+ * managed protocol without persisting ephemeral launch material in resources.
+ */
+declare function createManagedLoopRuntimeExecutionRoute(executionDriver: LoopRuntimeDriver, options: ManagedLoopRuntimeExecutionRouteOptions): ManagedLoopRuntimeExecutionRoute;
+
+/**
+ * ModelGateway (plan §12, §21.3): the trusted model path.
+ *
+ * The gateway holds no provider credential itself — it guards an
+ * `ModelGatewayExecutor` (host-provided, e.g. the legacy provider adapter)
+ * that performs the actual call with host-held keys. Workers present a
+ * short-lived `ModelAccessHandle` (24.34) instead of a provider key; the
+ * gateway verifies Run/model/audience/expiry/proof-of-possession and
+ * enforces per-Run token, cost, concurrency, and request-rate budgets at
+ * the gateway (§12.4 — not only in the worker). Every call produces a
+ * `ModelCallRecord` (24.32) via the injected recorder.
+ *
+ * Secret discipline (§12.4): handle tokens, prompts, and model output are
+ * never written to records, logs, or thrown error details.
+ */
+interface ModelGatewayGenerateRequest extends ModelGenerateRequest {
+    /** Opaque ModelAccessHandle token presented by the caller. Never recorded. */
+    accessHandle: string;
+    /** Presented worker key fingerprint for the proof-of-possession check. */
+    workerKey?: string;
+}
+interface ModelGatewayCallRecord {
+    /** ModelCallRecord correlation id (ModelGenerateRequest.callId). */
+    callId: string;
+    spec: ModelCallRecordSpec;
+    status: ModelCallRecordStatus;
+}
+/** Audit port; hosts persist ModelCallRecord resources (e.g. ControlStore). */
+interface ModelGatewayRecorder {
+    recordCall(record: ModelGatewayCallRecord): Promise<void> | void;
+}
+/** Performs the actual provider call with host-held credentials. */
+interface ModelGatewayExecutor {
+    listModels?(): Promise<ModelClassSpec[]>;
+    getHealth?(): Promise<ModelProviderHealth>;
+    generate(request: ModelGenerateRequest): AsyncIterable<ModelStreamChunk>;
+    cancel?(callId: string): Promise<void>;
+}
+interface ModelGatewayOptions {
+    /** Handle issuer/verifier (24.34). */
+    broker: ModelAccessHandleBroker;
+    /** Host provider executor holding the real credentials. */
+    executor: ModelGatewayExecutor;
+    /** Audit recorder for ModelCallRecords; recording failures never break calls. */
+    recorder?: ModelGatewayRecorder;
+    /** Host-asserted caller identity stamped on records (never self-reported). */
+    caller?: string;
+    /** Required handle audience (defaults to the broker's audience). */
+    audience?: string;
+    /** Cost charged per token (input + output) when the stream reports usage. */
+    costPerToken?: number;
+    /** Currency stamped on recorded usage. */
+    currency?: string;
+    /** Sliding-window request rate limit per handle (requests/second). */
+    maxRequestsPerSecond?: number;
+    /** Sink for non-fatal gateway errors (e.g. recorder failures). */
+    onError?: (error: unknown) => void;
+    now?: () => Date;
+}
+interface ModelGateway {
+    listModels(): Promise<ModelClassSpec[]>;
+    getHealth(): Promise<ModelProviderHealth>;
+    generate(request: ModelGatewayGenerateRequest): AsyncIterable<ModelStreamChunk>;
+    /** Abort an in-flight call (e.g. Run cancellation). */
+    cancel(callId: string): Promise<void>;
+    /** Revoke a handle immediately (Run completion, cancellation, policy change). */
+    revokeHandle(handleId: string): void;
+    /** Revoke every handle the gateway has verified for the given Run name. */
+    revokeRunHandles(runName: string): void;
+}
+declare function createModelGateway(options: ModelGatewayOptions): ModelGateway;
+
+interface GatewayMediatedLLMProviderOptions {
+    gateway: ModelGateway;
+    broker: ModelAccessHandleBroker;
+    /** ModelClass the loops are bound to; handles are issued for this model. */
+    modelClassRef: ModelAccessHandleClaims['modelClassRef'];
+    modelDigest?: string;
+    /** Admission/policy snapshot digest bound into every issued handle. */
+    policyDigest?: string;
+    /** Worker key fingerprint bound into issued handles (PoP). */
+    workerKey?: string;
+    /** Static Run binding, or derive one per chat request (e.g. workload runs). */
+    runRef?: ModelAccessHandleClaims['runRef'];
+    /** Immutable AgentRun attempt bound into issued handles. */
+    attempt?: number;
+    runRefForRequest?: (request: unknown) => ModelAccessHandleClaims['runRef'] | undefined;
+    /** Budget stamped into every issued handle (enforced at the gateway). */
+    budget?: ModelAccessHandleBudget;
+    /** Per-call handle TTL in milliseconds (broker default applies when unset). */
+    handleTtlMs?: number;
+    /** Display name/model for the ILLMProvider surface. */
+    name?: string;
+    modelId?: string;
+    model?: unknown;
+    /** Customize callId derivation (default: conversationId + sequence). */
+    callIdForRequest?: (request: unknown, sequence: number) => string;
+}
+/**
+ * Route legacy loop model calls through the ModelGateway (plan §12.1, 24.35):
+ * loops keep the `ILLMProvider` surface, but every `chat()` issues a
+ * short-lived handle, streams through the gateway's verification, budget
+ * enforcement, and audit, and revokes the handle when the call ends (§12.1
+ * step 6). No provider key exists on this path by construction.
+ */
+declare function createGatewayMediatedLLMProvider(options: GatewayMediatedLLMProviderOptions): ILLMProvider;
+
+interface ManagedModelDescriptor {
+    modelClass: string;
+    provider: string;
+    model: string;
+    digest: string;
+    modalities: Array<'text' | 'image' | 'audio' | 'video' | 'embedding'>;
+    contextWindow: number;
+    residency: string[];
+    mode: 'local' | 'broker';
+    maxInputClassification: DataClassification;
+    outputClassification: DataClassification;
+    inputTrust: 'untrusted' | 'sanitized' | 'trusted';
+    outputTrust: 'untrusted' | 'sanitized' | 'trusted';
+    inputCostPerMillion?: number;
+    outputCostPerMillion?: number;
+}
+interface ModelManagementCapabilities {
+    name: string;
+    streaming: boolean;
+    cancellation: boolean;
+    usageEstimation: boolean;
+    maxConcurrentCalls: number;
+    maxOutputTokens: number;
+    persistence: 'process' | 'host' | 'external';
+    threatAssumptions: string[];
+}
+interface ManagedModelRequest {
+    modelClass: string;
+    modelDigest: string;
+    messages: Array<{
+        role: 'system' | 'user' | 'assistant' | 'tool';
+        content: string;
+    }>;
+    maxOutputTokens: number;
+    temperature?: number;
+    inputClassification: DataClassification;
+    residency?: string;
+}
+interface ManagedModelEstimate {
+    inputTokens: number;
+    maximumOutputTokens: number;
+    maximumCost: number;
+}
+interface ManagedModelUsage {
+    callHandle: string;
+    resourceUid: string;
+    modelClass: string;
+    modelDigest: string;
+    phase: 'Running' | 'Completed' | 'Cancelled' | 'Failed';
+    inputTokens: number;
+    outputTokens: number;
+    cost: number;
+    fencingEpoch: number;
+    updatedAt: string;
+}
+type ManagedModelChunk = {
+    type: 'started';
+    callHandle: string;
+} | {
+    type: 'delta';
+    delta: string;
+} | {
+    type: 'usage';
+    inputTokens: number;
+    outputTokens: number;
+    cost: number;
+} | {
+    type: 'error';
+    error: {
+        code: string;
+        message: string;
+        retryable: boolean;
+    };
+} | {
+    type: 'done';
+};
+/** Complete §10.4 provider lifecycle; the capability is in the host envelope. */
+interface ModelManagementDriver {
+    getCapabilities(): Promise<ModelManagementCapabilities>;
+    listModels(request: DriverRequestEnvelope<Record<string, never>>): Promise<ManagedModelDescriptor[]>;
+    estimate(request: DriverRequestEnvelope<ManagedModelRequest>): Promise<ManagedModelEstimate>;
+    generate(request: DriverRequestEnvelope<ManagedModelRequest>, options?: {
+        signal?: AbortSignal;
+    }): AsyncIterable<ManagedModelChunk>;
+    cancel(request: DriverRequestEnvelope<{
+        callHandle: string;
+    }>): Promise<ManagedModelUsage>;
+    inspectUsage(request: DriverRequestEnvelope<{
+        callHandle: string;
+    }>): Promise<ManagedModelUsage | undefined>;
+    getHealth(request: DriverRequestEnvelope<Record<string, never>>): Promise<{
+        healthy: boolean;
+        checkedAt: string;
+        detail?: string;
+    }>;
+}
+interface ModelCallRecord {
+    usage: ManagedModelUsage;
+    chunks: ManagedModelChunk[];
+    inputFingerprint: string;
+    capabilityHandleRef: string;
+    sessionKeyFingerprint?: string;
+}
+interface FakeModelManagementState {
+    calls: Map<string, ModelCallRecord>;
+    idempotency: Map<string, string>;
+    fences: Map<string, number>;
+    nextHandle: number;
+}
+declare function createFakeModelManagementState(): FakeModelManagementState;
+declare function createFakeModelManagementDriver(options?: {
+    state?: FakeModelManagementState;
+    now?: () => Date;
+    models?: ManagedModelDescriptor[];
+    authorizeAccess?: (request: DriverRequestEnvelope, model: ManagedModelDescriptor) => boolean | Promise<boolean>;
+    generateText?: (request: ManagedModelRequest, signal?: AbortSignal) => AsyncIterable<string>;
+    capabilities?: Partial<ModelManagementCapabilities>;
+}): ModelManagementDriver;
+declare function createModelManagementConformanceSuite(options: {
+    createRequest<T>(method: string, payload: T, idempotencyKey: string, fencingEpoch?: number, resourceUid?: string): DriverRequestEnvelope<T>;
+    recreate(driver: ModelManagementDriver): ModelManagementDriver;
+}): DriverConformanceSuite;
+
+interface ManagedModelGatewayAccess {
+    /** Opaque signed token presented only to ModelGateway; never retained by the adapter. */
+    token: string;
+    /** Presented proof-of-possession fingerprint when the signed handle requires one. */
+    workerKey?: string;
+    /** Non-secret digest that binds idempotency/inspection to the same authority. */
+    authorityFingerprint: string;
+}
+interface ManagedModelGatewayAdapterOptions {
+    models: ManagedModelDescriptor[];
+    capabilities: ModelManagementCapabilities;
+    /**
+     * Verify the envelope capability against the selected model/Run/session and
+     * return the already-authorized gateway token. Undefined means denial.
+     */
+    resolveAccess(request: DriverRequestEnvelope, model: ManagedModelDescriptor): Promise<ManagedModelGatewayAccess | undefined>;
+    now?: () => Date;
+}
+/**
+ * Adapt the real signed ModelGateway into the complete management protocol.
+ * Stream/idempotency state is process-local, so crash adoption is not claimed.
+ */
+declare function createManagedModelGatewayAdapter(gateway: ModelGateway, options: ManagedModelGatewayAdapterOptions): ModelManagementDriver;
+
+interface NetworkManagementCapabilities {
+    name: string;
+    enforcedFeatures: NetworkEnforceableFeature[];
+    enforcementLevel: NetworkEnforcementLevel;
+    supportedTrustClasses: NodeTrustClass[];
+    supportsPolicyUpdate: boolean;
+    supportsServiceResolution: boolean;
+    persistence: 'process' | 'host' | 'external';
+    maxPolicyRules: number;
+    threatAssumptions: string[];
+}
+interface ManagedNetworkPolicy {
+    digest: string;
+    dns?: {
+        policy: 'default' | 'custom' | 'none';
+        servers?: string[];
+    };
+    proxy?: {
+        httpProxy?: string;
+        httpsProxy?: string;
+        noProxy?: string[];
+        mandatory?: boolean;
+    };
+    ingress?: {
+        defaultAction: 'allow' | 'deny';
+        rules?: Array<{
+            target: string;
+            ports?: number[];
+            protocol?: string;
+            action?: 'allow' | 'deny';
+        }>;
+    };
+    egress?: {
+        defaultAction: 'allow' | 'deny';
+        rules?: Array<{
+            target: string;
+            ports?: number[];
+            protocol?: string;
+            action?: 'allow' | 'deny';
+        }>;
+    };
+    bandwidth?: {
+        ingressKbps?: number;
+        egressKbps?: number;
+    };
+    serviceAllowlist?: string[];
+    dataClassification?: 'public' | 'internal' | 'confidential' | 'restricted';
+}
+interface NetworkPreparePayload {
+    sandboxHandle: string;
+    networkClass: string;
+    networkClassDigest: string;
+    requestedFeatures: NetworkEnforceableFeature[];
+    minimumEnforcementLevel: NetworkEnforcementLevel;
+    trustClass: NodeTrustClass;
+    policy: ManagedNetworkPolicy;
+}
+interface ManagedNetworkStatus {
+    networkHandle: string;
+    resourceUid: string;
+    phase: 'Ready' | 'Released';
+    enforcementLevel: NetworkEnforcementLevel;
+    verifiedFeatures: NetworkEnforceableFeature[];
+    degradedFeatures: NetworkEnforceableFeature[];
+    policyDigest: string;
+    fencingEpoch: number;
+    updatedAt: string;
+}
+interface ManagedServiceResolution {
+    networkHandle: string;
+    resourceUid: string;
+    serviceName: string;
+    serviceHandle: string;
+    resolvedAt: string;
+}
+/** Complete §10.5 managed CNI-like surface. */
+interface NetworkManagementDriver {
+    getCapabilities(): Promise<NetworkManagementCapabilities>;
+    prepareNetwork(request: DriverRequestEnvelope<NetworkPreparePayload>): Promise<ManagedNetworkStatus>;
+    checkNetwork(request: DriverRequestEnvelope<{
+        networkHandle: string;
+    }>): Promise<ManagedNetworkStatus | undefined>;
+    resolveService(request: DriverRequestEnvelope<{
+        networkHandle: string;
+        serviceName: string;
+    }>): Promise<ManagedServiceResolution>;
+    updatePolicy(request: DriverRequestEnvelope<{
+        networkHandle: string;
+        requestedFeatures: NetworkEnforceableFeature[];
+        minimumEnforcementLevel: NetworkEnforcementLevel;
+        policy: ManagedNetworkPolicy;
+    }>): Promise<ManagedNetworkStatus>;
+    releaseNetwork(request: DriverRequestEnvelope<{
+        networkHandle: string;
+    }>): Promise<void>;
+}
+interface IdempotencyRecord {
+    fingerprint: string;
+    resultHandle: string;
+}
+interface FakeNetworkManagementState {
+    networks: Map<string, ManagedNetworkStatus>;
+    services: Map<string, ManagedServiceResolution>;
+    idempotency: Map<string, IdempotencyRecord>;
+    fences: Map<string, number>;
+    nextHandle: number;
+}
+declare function createFakeNetworkManagementState(): FakeNetworkManagementState;
+declare function countManagedNetworkPolicyRules(policy: ManagedNetworkPolicy): number;
+declare function assertManagedNetworkPolicy(value: unknown): asserts value is ManagedNetworkPolicy;
+/** Fail closed on payload extensions so older drivers cannot ignore new policy fields. */
+declare function assertNetworkPreparePayload(value: unknown): asserts value is NetworkPreparePayload;
+declare function assertNetworkUpdatePayload(value: unknown): void;
+declare function createFakeNetworkManagementDriver(options?: {
+    state?: FakeNetworkManagementState;
+    now?: () => Date;
+    capabilities?: Partial<NetworkManagementCapabilities>;
+}): NetworkManagementDriver;
+declare function createNetworkManagementConformanceSuite(options: {
+    createRequest<T>(method: string, payload: T, idempotencyKey: string, fencingEpoch?: number, resourceUid?: string): DriverRequestEnvelope<T>;
+    recreate(driver: NetworkManagementDriver): NetworkManagementDriver;
+}): DriverConformanceSuite;
+
+interface ResolvedManagedNetworkRequest {
+    attachRequest: NetworkAttachRequest;
+    /** Digest independently calculated from the current NetworkClass desired state. */
+    networkClassDigest: string;
+    /** Digest independently calculated from the effective policy passed to the native driver. */
+    policyDigest: string;
+}
+interface ManagedNetworkAdapterOptions {
+    supportedTrustClasses: NodeTrustClass[];
+    threatAssumptions: string[];
+    maxPolicyRules: number;
+    resolveAttachRequest(request: DriverRequestEnvelope<NetworkPreparePayload>): Promise<ResolvedManagedNetworkRequest>;
+    verifyCapability(request: DriverRequestEnvelope): Promise<boolean> | boolean;
+    now?: () => Date;
+}
+/**
+ * Wrap a host's narrow CNI-like driver in the complete managed protocol.
+ *
+ * The wrapper deliberately advertises process persistence: native handles and
+ * capability/fencing state cannot be adopted after a host process restart.
+ */
+declare function createManagedNetworkAdapter(nativeDriver: NetworkDriver, options: ManagedNetworkAdapterOptions): NetworkManagementDriver;
+
+interface StorageManagementCapabilities {
+    name: string;
+    controllerService: boolean;
+    nodeService: boolean;
+    accessModes: VolumeAccessMode[];
+    supportsSnapshots: boolean;
+    supportsExpansion: boolean;
+    supportsReplication: boolean;
+    supportsBackup: boolean;
+    persistence: 'process' | 'host' | 'external';
+    threatAssumptions: string[];
+}
+interface StorageProvisionPayload {
+    capacityBytes: number;
+    accessMode: VolumeAccessMode;
+    storageClass: string;
+    replicaCount: number;
+}
+interface ManagedVolume {
+    volumeHandle: string;
+    resourceUid: string;
+    capacityBytes: number;
+    accessMode: VolumeAccessMode;
+    fencingEpoch: number;
+    phase: 'Available' | 'Deleted';
+}
+interface ManagedVolumeSnapshot {
+    snapshotHandle: string;
+    volumeHandle: string;
+    resourceUid: string;
+    createdAt: string;
+}
+interface ManagedVolumeBackup {
+    backupHandle: string;
+    volumeHandle: string;
+    resourceUid: string;
+    createdAt: string;
+}
+interface ManagedReplicaHealth {
+    volumeHandle: string;
+    healthy: number;
+    desired: number;
+    rebuilding: boolean;
+    checkedAt: string;
+}
+interface ManagedVolumeStage {
+    stageHandle: string;
+    volumeHandle: string;
+    resourceUid: string;
+    nodeId: string;
+}
+interface ManagedVolumePublication {
+    publishHandle: string;
+    stageHandle: string;
+    resourceUid: string;
+    workloadUid: string;
+    readOnly: boolean;
+}
+interface ManagedVolumeStats {
+    capacityBytes: number;
+    usedBytes: number;
+    availableBytes: number;
+}
+/** Complete §10.6 CSI-like controller and node management surface. */
+interface StorageManagementDriver {
+    getCapabilities(): Promise<StorageManagementCapabilities>;
+    provision(request: DriverRequestEnvelope<StorageProvisionPayload>): Promise<ManagedVolume>;
+    deleteVolume(request: DriverRequestEnvelope<{
+        volumeHandle: string;
+    }>): Promise<void>;
+    createSnapshot(request: DriverRequestEnvelope<{
+        volumeHandle: string;
+    }>): Promise<ManagedVolumeSnapshot>;
+    restoreSnapshot(request: DriverRequestEnvelope<{
+        snapshotHandle: string;
+        capacityBytes?: number;
+    }>): Promise<ManagedVolume>;
+    expand(request: DriverRequestEnvelope<{
+        volumeHandle: string;
+        capacityBytes: number;
+    }>): Promise<ManagedVolume>;
+    getReplicaHealth(request: DriverRequestEnvelope<{
+        volumeHandle: string;
+    }>): Promise<ManagedReplicaHealth>;
+    rebuildReplica(request: DriverRequestEnvelope<{
+        volumeHandle: string;
+        replicaCount: number;
+    }>): Promise<ManagedReplicaHealth>;
+    createBackup(request: DriverRequestEnvelope<{
+        volumeHandle: string;
+    }>): Promise<ManagedVolumeBackup>;
+    stage(request: DriverRequestEnvelope<{
+        volumeHandle: string;
+        nodeId: string;
+    }>): Promise<ManagedVolumeStage>;
+    publish(request: DriverRequestEnvelope<{
+        stageHandle: string;
+        workloadUid: string;
+        readOnly: boolean;
+    }>): Promise<ManagedVolumePublication>;
+    unpublish(request: DriverRequestEnvelope<{
+        publishHandle: string;
+    }>): Promise<void>;
+    unstage(request: DriverRequestEnvelope<{
+        stageHandle: string;
+    }>): Promise<void>;
+    getStats(request: DriverRequestEnvelope<{
+        publishHandle: string;
+    }>): Promise<ManagedVolumeStats>;
+}
+interface VolumeRecord {
+    volume: ManagedVolume;
+    desiredReplicas: number;
+}
+interface FakeStorageManagementState {
+    volumes: Map<string, VolumeRecord>;
+    snapshots: Map<string, ManagedVolumeSnapshot>;
+    backups: Map<string, ManagedVolumeBackup>;
+    stages: Map<string, ManagedVolumeStage>;
+    publications: Map<string, ManagedVolumePublication>;
+    idempotency: Map<string, string>;
+    fences: Map<string, number>;
+    nextHandle: number;
+}
+declare function createFakeStorageManagementState(): FakeStorageManagementState;
+/**
+ * Stateful reference implementation. Reusing its state across instances
+ * simulates a driver-host restart and proves that opaque handles remain
+ * inspectable without relying on process memory.
+ */
+declare function createFakeStorageManagementDriver(options?: {
+    state?: FakeStorageManagementState;
+    now?: () => Date;
+}): StorageManagementDriver;
+declare function createStorageManagementConformanceSuite(options: {
+    createRequest<T>(method: string, payload: T, idempotencyKey: string, fencingEpoch?: number, resourceUid?: string): DriverRequestEnvelope<T>;
+    recreate(driver: StorageManagementDriver): StorageManagementDriver;
+}): DriverConformanceSuite;
+
+interface ManagedToolDescriptor {
+    name: string;
+    version: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    outputSchema: Record<string, unknown>;
+    schemaDigest: string;
+    effect: ToolOperationEffect;
+    risk: ToolRiskLevel;
+    targets: string[];
+    supportsIdempotency: boolean;
+    supportsFencing: boolean;
+    supportsEvidence: boolean;
+}
+interface ToolCatalogSnapshot {
+    catalogDigest: string;
+    tools: ManagedToolDescriptor[];
+}
+interface ToolManagementCapabilities {
+    name: string;
+    supportsStreaming: boolean;
+    supportsCancellation: boolean;
+    supportsBackpressure: boolean;
+    supportsUnknownEffectReconciliation: boolean;
+    maxOutputBytes: number;
+    maxOutputChunks: number;
+    persistence: 'process' | 'host' | 'external';
+    threatAssumptions: string[];
+}
+interface PreparedToolExecution {
+    preparationHandle: string;
+    resourceUid: string;
+    toolName: string;
+    version: string;
+    schemaDigest: string;
+    catalogDigest: string;
+    target: string;
+    effect: ToolOperationEffect;
+    idempotencyKey?: string;
+    cleaned: boolean;
+}
+interface AuthorizedToolExecution {
+    authorizationHandle: string;
+    preparationHandle: string;
+    resourceUid: string;
+    policyDecisionHandle: string;
+    policyDigest: string;
+    authorizedAt: string;
+    expiresAt: string;
+}
+type ManagedToolExecutionPhase = 'Prepared' | 'Running' | 'Completed' | 'Failed' | 'Cancelled' | 'Unknown';
+interface ManagedToolExecution {
+    executionHandle: string;
+    preparationHandle: string;
+    authorizationHandle: string;
+    resourceUid: string;
+    phase: ManagedToolExecutionPhase;
+    startedAt?: string;
+    completedAt?: string;
+    outputBytes: number;
+    outputChunks: number;
+    error?: {
+        code: string;
+        message: string;
+    };
+    cleaned: boolean;
+}
+interface ManagedToolOutputChunk {
+    executionHandle: string;
+    index: number;
+    data: string;
+    final: boolean;
+}
+interface ManagedToolEvidence {
+    evidenceHandle: string;
+    executionHandle: string;
+    resourceUid: string;
+    outcome: ManagedToolExecutionPhase;
+    outputDigest: string;
+    recordedAt: string;
+}
+interface ToolManagementDriver {
+    getCapabilities(): Promise<ToolManagementCapabilities>;
+    discover(request: DriverRequestEnvelope<{
+        namePrefix?: string;
+    }>): Promise<ToolCatalogSnapshot>;
+    describe(request: DriverRequestEnvelope<{
+        name: string;
+        version?: string;
+        catalogDigest: string;
+    }>): Promise<ManagedToolDescriptor | undefined>;
+    prepare(request: DriverRequestEnvelope<{
+        name: string;
+        version: string;
+        schemaDigest: string;
+        catalogDigest: string;
+        target: string;
+        effect: ToolOperationEffect;
+        operationIdempotencyKey?: string;
+    }>): Promise<PreparedToolExecution>;
+    authorize(request: DriverRequestEnvelope<{
+        preparationHandle: string;
+        policyDecisionHandle: string;
+        policyDigest: string;
+        ttlMs: number;
+    }>): Promise<AuthorizedToolExecution>;
+    invoke(request: DriverRequestEnvelope<{
+        preparationHandle: string;
+        authorizationHandle: string;
+        arguments: Record<string, unknown>;
+    }>, options?: {
+        signal?: AbortSignal;
+    }): AsyncIterable<ManagedToolOutputChunk>;
+    inspect(request: DriverRequestEnvelope<{
+        executionHandle?: string;
+        preparationHandle?: string;
+    }>): Promise<ManagedToolExecution | undefined>;
+    reconcileUnknownEffect(request: DriverRequestEnvelope<{
+        executionHandle: string;
+        resultObserved: boolean;
+        evidenceDigest?: string;
+    }>): Promise<ManagedToolExecution>;
+    collectEvidence(request: DriverRequestEnvelope<{
+        executionHandle: string;
+    }>): Promise<ManagedToolEvidence>;
+    cleanup(request: DriverRequestEnvelope<{
+        preparationHandle: string;
+        executionHandle?: string;
+    }>): Promise<void>;
+}
+interface FakeToolManagementState {
+    preparations: Map<string, PreparedToolExecution>;
+    authorizations: Map<string, AuthorizedToolExecution>;
+    executions: Map<string, ManagedToolExecution>;
+    outputs: Map<string, ManagedToolOutputChunk[]>;
+    evidence: Map<string, ManagedToolEvidence>;
+    idempotency: Map<string, string>;
+    idempotencyFingerprints: Map<string, string>;
+    fences: Map<string, number>;
+    nextHandle: number;
+}
+declare function createFakeToolManagementState(): FakeToolManagementState;
+/**
+ * Complete durable-state reference for the §10.3 lifecycle. Policy authority
+ * is supplied by an injected trusted verifier, never by an `allow` payload.
+ */
+declare function createFakeToolManagementDriver(options?: {
+    state?: FakeToolManagementState;
+    now?: () => Date;
+    tools?: ManagedToolDescriptor[];
+    verifyPolicyDecision?: (input: {
+        handle: string;
+        policyDigest: string;
+        resourceUid: string;
+        tool: ManagedToolDescriptor;
+        target: string;
+    }) => boolean | Promise<boolean>;
+    executor?: (tool: ManagedToolDescriptor, target: string, arguments_: Record<string, unknown>, signal?: AbortSignal, resourceUid?: string) => AsyncIterable<string>;
+    maxOutputBytes?: number;
+    maxOutputChunks?: number;
+    capabilities?: Partial<ToolManagementCapabilities>;
+}): ToolManagementDriver;
+declare function createToolManagementConformanceSuite(options: {
+    createRequest<T>(method: string, payload: T, idempotencyKey: string, fencingEpoch?: number, resourceUid?: string, actorKind?: 'controller' | 'verifier' | 'admin'): DriverRequestEnvelope<T>;
+    recreate(driver: ToolManagementDriver): ToolManagementDriver;
+}): DriverConformanceSuite;
+/**
+ * Catalog discovery is a separately selectable manifest kind. Reuse only the
+ * unified driver's catalog cases; execution evidence cannot admit a catalog.
+ */
+declare function createToolCatalogConformanceSuite(options: Parameters<typeof createToolManagementConformanceSuite>[0]): DriverConformanceSuite;
+
+export { type GatewayMediatedLLMProviderOptions as $, type ArtifactAdmissionDecision as A, type BuiltinToolContext as B, type ControlStoreConformanceFactory as C, type CredentialGrantProof as D, type CredentialGrantScope as E, type CredentialGrantVerification as F, type CredentialIssuePayload as G, type CredentialManagementCapabilities as H, type CredentialManagementDriver as I, type CredentialProofVerifier as J, DEFAULT_DESTINATION_POLICIES as K, DRIVER_REQUEST_API_VERSION as L, type DriverConformanceSuite as M, type DriverConformanceTest as N, type DriverManifest as O, type DriverRequestEnvelope as P, type FakeArtifactManagementState as Q, type FakeAuditTelemetryState as R, type FakeCredentialManagementState as S, type FakeDriverOptions as T, type FakeIdentityAttestationState as U, type FakeLoopRuntimeState as V, type FakeModelManagementState as W, type FakeNetworkManagementState as X, type FakePolicyApprovalState as Y, type FakeStorageManagementState as Z, type FakeToolManagementState as _, type BuiltinToolImpl as a, type ModelGatewayExecutor as a$, type IdentityAttestationCapabilities as a0, type IdentityAttestationManagementDriver as a1, type IdentityChallenge as a2, type IdentityDomain as a3, type IdentityEnrollment as a4, type IdentityInspection as a5, type IdentitySession as a6, type InMemoryCredentialBrokerOptions as a7, type InMemoryModelAccessHandleBrokerOptions as a8, type InProcessLoopRuntimeDriverOptions as a9, type ManagedModelEstimate as aA, type ManagedModelGatewayAccess as aB, type ManagedModelGatewayAdapterOptions as aC, type ManagedModelRequest as aD, type ManagedModelUsage as aE, type ManagedNetworkAdapterOptions as aF, type ManagedNetworkPolicy as aG, type ManagedNetworkStatus as aH, type ManagedReplicaHealth as aI, type ManagedServiceResolution as aJ, type ManagedToolDescriptor as aK, type ManagedToolEvidence as aL, type ManagedToolExecution as aM, type ManagedToolExecutionPhase as aN, type ManagedToolOutputChunk as aO, type ManagedVolume as aP, type ManagedVolumeBackup as aQ, type ManagedVolumePublication as aR, type ManagedVolumeSnapshot as aS, type ManagedVolumeStage as aT, type ManagedVolumeStats as aU, type ModelAccessHandle as aV, type ModelAccessHandleBroker as aW, type ModelAccessHandleBudget as aX, type ModelAccessHandleClaims as aY, type ModelGateway as aZ, type ModelGatewayCallRecord as a_, type InProcessToolExecutionDriverOptions as aa, type IssueCredentialGrantRequest as ab, type IssueModelAccessHandleRequest as ac, type LegacyLLMProviderDriverOptions as ad, type LoopRunHandle as ae, type LoopRunOutcome as af, type LoopRunStartRequest as ag, type LoopRuntimeCapabilities as ah, type LoopRuntimeCheckpoint as ai, type LoopRuntimeDriver as aj, type LoopRuntimeManagementDriver as ak, type LoopRuntimePreparePayload as al, type LoopRuntimePrepared as am, type LoopRuntimeStartPayload as an, type ManagedArtifact as ao, type ManagedArtifactMount as ap, type ManagedCredentialAdapterStateStore as aq, type ManagedCredentialBrokerAdapterOptions as ar, type ManagedCredentialGrant as as, type ManagedCredentialMaterialization as at, type ManagedLoopRunStatus as au, type ManagedLoopRuntimeAdapterOptions as av, type ManagedLoopRuntimeExecutionRoute as aw, type ManagedLoopRuntimeExecutionRouteOptions as ax, type ManagedModelChunk as ay, type ManagedModelDescriptor as az, type ArtifactContentStore as b, createFakeAuditTelemetryManagementDriver as b$, type ModelGatewayGenerateRequest as b0, type ModelGatewayOptions as b1, type ModelGatewayRecorder as b2, type ModelGenerateMessage as b3, type ModelGenerateRequest as b4, type ModelHandleSigner as b5, type ModelManagementCapabilities as b6, type ModelManagementDriver as b7, type ModelProviderDataPolicy as b8, type ModelProviderDriver as b9, type ToolManagementCapabilities as bA, type ToolManagementDriver as bB, type ToolOperationApprovalBroker as bC, type ToolOperationApprovalDecision as bD, type ToolOperationApprovalRequest as bE, type VerifyModelAccessHandleOptions as bF, artifactTrustRank as bG, assertArtifactAdmission as bH, assertClassificationAllowed as bI, assertDriverRequestEnvelope as bJ, assertManagedNetworkPolicy as bK, assertNetworkPreparePayload as bL, assertNetworkUpdatePayload as bM, base64UrlDecode as bN, base64UrlEncode as bO, canArtifactEnter as bP, canDriverSatisfyClass as bQ, canonicalDriverValue as bR, classificationRank as bS, countManagedNetworkPolicyRules as bT, createArtifactManagementConformanceSuite as bU, createAuditTelemetryConformanceSuite as bV, createControlStoreConformanceSuite as bW, createCredentialManagementConformanceSuite as bX, createExternalOrchestrationDriverConformanceSuite as bY, createFakeArtifactManagementDriver as bZ, createFakeArtifactManagementState as b_, type ModelProviderHealth as ba, type ModelStreamChunk as bb, type NetworkAttachRequest as bc, type NetworkClassSatisfaction as bd, type NetworkDriver as be, type NetworkDriverCapabilities as bf, type NetworkDriverHealth as bg, type NetworkEnforceableFeature as bh, type NetworkEnforcementLevel as bi, type NetworkManagementCapabilities as bj, type NetworkManagementDriver as bk, type NetworkPreparePayload as bl, type PolicyApprovalCapabilities as bm, type PolicyApprovalManagementDriver as bn, type PolicyDecision as bo, type PolicyDecisionKind as bp, type PolicyDecisionOutcome as bq, type PolicyExplanation as br, type PreparedToolExecution as bs, type ResolvedManagedNetworkRequest as bt, type RuntimeClassRoutingDriverOptions as bu, type StorageManagementCapabilities as bv, type StorageManagementDriver as bw, type StorageProvisionPayload as bx, type ToolCatalogSnapshot as by, type ToolExecutionDriver as bz, type ArtifactDestinationPolicy as c, createFakeAuditTelemetryState as c0, createFakeCredentialManagementDriver as c1, createFakeCredentialManagementState as c2, createFakeIdentityAttestationManagementDriver as c3, createFakeIdentityAttestationState as c4, createFakeLoopRuntimeManagementDriver as c5, createFakeLoopRuntimeState as c6, createFakeModelManagementDriver as c7, createFakeModelManagementState as c8, createFakeModelProviderDriver as c9, createNetworkDriverConformanceSuite as cA, createNetworkManagementConformanceSuite as cB, createPolicyApprovalConformanceSuite as cC, createRuntimeClassRoutingDriver as cD, createStorageManagementConformanceSuite as cE, createToolCatalogConformanceSuite as cF, createToolExecutionDriverConformanceSuite as cG, createToolManagementConformanceSuite as cH, deriveArtifactTrust as cI, featuresRequiredByClass as cJ, inspectAndRecordArtifact as cK, restoreArtifactManagementState as cL, runConformanceSuite as cM, snapshotArtifactManagementState as cN, createFakeNetworkDriver as ca, createFakeNetworkManagementDriver as cb, createFakeNetworkManagementState as cc, createFakePolicyApprovalManagementDriver as cd, createFakePolicyApprovalState as ce, createFakeStorageManagementDriver as cf, createFakeStorageManagementState as cg, createFakeToolExecutionDriver as ch, createFakeToolManagementDriver as ci, createFakeToolManagementState as cj, createGatewayMediatedLLMProvider as ck, createIdentityAttestationConformanceSuite as cl, createInMemoryCredentialBroker as cm, createInMemoryModelAccessHandleBroker as cn, createInProcessLoopRuntimeDriver as co, createInProcessToolExecutionDriver as cp, createLoopRuntimeManagementConformanceSuite as cq, createManagedCredentialBrokerAdapter as cr, createManagedLoopRuntimeAdapter as cs, createManagedLoopRuntimeExecutionRoute as ct, createManagedModelGatewayAdapter as cu, createManagedNetworkAdapter as cv, createModelGateway as cw, createModelManagementConformanceSuite as cx, createModelProviderDriverConformanceSuite as cy, createModelProviderDriverFromLLMProvider as cz, type ArtifactInspectionExecutor as d, type ArtifactInspectionInput as e, type ArtifactInspectionRequest as f, type ArtifactInspectionResult as g, type ArtifactInspector as h, type ArtifactManagementCapabilities as i, type ArtifactManagementDriver as j, type ArtifactManagementStateSnapshot as k, type ArtifactPutPayload as l, type ArtifactReviewWriter as m, type ArtifactSanitizationResult as n, type AttestedIdentity as o, type AuditEffect as p, type AuditProvenance as q, type AuditTelemetryCapabilities as r, type AuditTelemetryManagementDriver as s, type AuditTelemetryRecord as t, type AuditTelemetryRecordKind as u, type AuthorizedToolExecution as v, type CredentialBrokerDriver as w, type CredentialGrantClaims as x, type CredentialGrantHandle as y, type CredentialGrantInspection as z };