moflo 4.8.31 → 4.8.33

package/src/@claude-flow/guidance/dist/ledger.d.ts

@@ -1,162 +0,0 @@
-/**
- * Run Ledger + Evaluators
- *
- * Logs every run as an event with a minimum schema, then runs evaluators
- * to assess compliance and quality.
- *
- * Objective evaluators:
- * 1. Tests pass
- * 2. Lint pass
- * 3. Forbidden dependency scan
- * 4. Forbidden command scan
- * 5. Required sections present in plan
- *
- * Subjective evaluators:
- * 1. Reviewer rating (pass/fail)
- * 2. Architecture compliance (pass/fail)
- *
- * @module @claude-flow/guidance/ledger
- */
-import type { RunEvent, EvaluatorResult, TaskIntent, OptimizationMetrics, ViolationRanking } from './types.js';
-export interface IEvaluator {
-    /** Evaluator name */
-    name: string;
-    /** Whether this is objective (automated) or subjective (human) */
-    type: 'objective' | 'subjective';
-    /** Run the evaluation */
-    evaluate(event: RunEvent): Promise<EvaluatorResult>;
-}
-/**
- * Tests Pass evaluator - checks test results
- */
-export declare class TestsPassEvaluator implements IEvaluator {
-    name: string;
-    type: "objective";
-    evaluate(event: RunEvent): Promise<EvaluatorResult>;
-}
-/**
- * Forbidden command scan evaluator
- */
-export declare class ForbiddenCommandEvaluator implements IEvaluator {
-    name: string;
-    type: "objective";
-    private forbiddenPatterns;
-    constructor(forbiddenPatterns?: RegExp[]);
-    evaluate(event: RunEvent): Promise<EvaluatorResult>;
-}
-/**
- * Forbidden dependency scan evaluator
- */
-export declare class ForbiddenDependencyEvaluator implements IEvaluator {
-    name: string;
-    type: "objective";
-    private forbiddenPackages;
-    constructor(forbiddenPackages?: string[]);
-    evaluate(event: RunEvent): Promise<EvaluatorResult>;
-}
-/**
- * Violation rate evaluator - checks violation count
- */
-export declare class ViolationRateEvaluator implements IEvaluator {
-    name: string;
-    type: "objective";
-    private maxViolations;
-    constructor(maxViolations?: number);
-    evaluate(event: RunEvent): Promise<EvaluatorResult>;
-}
-/**
- * Diff quality evaluator - checks rework ratio
- */
-export declare class DiffQualityEvaluator implements IEvaluator {
-    name: string;
-    type: "objective";
-    private maxReworkRatio;
-    constructor(maxReworkRatio?: number);
-    evaluate(event: RunEvent): Promise<EvaluatorResult>;
-}
-export declare class RunLedger {
-    private events;
-    private evaluators;
-    private readonly maxEvents;
-    /**
-     * @param maxEvents - Maximum events to retain in memory (0 = unlimited).
-     *   When the limit is exceeded the oldest events are evicted.
-     */
-    constructor(maxEvents?: number);
-    /**
-     * Add a custom evaluator
-     */
-    addEvaluator(evaluator: IEvaluator): void;
-    /**
-     * Remove an evaluator by name
-     */
-    removeEvaluator(name: string): void;
-    /**
-     * Log a run event
-     */
-    logEvent(event: RunEvent | Omit<RunEvent, 'eventId'>): RunEvent;
-    /**
-     * Create a new run event with defaults
-     */
-    createEvent(taskId: string, intent: TaskIntent, guidanceHash: string): RunEvent;
-    /**
-     * Finalize and store an event
-     */
-    finalizeEvent(event: RunEvent): RunEvent;
-    /**
-     * Evict oldest events when maxEvents is exceeded.
-     * Trims 10% in a batch to amortize the O(n) splice cost.
-     */
-    private evictIfNeeded;
-    /**
-     * Run all evaluators against an event
-     */
-    evaluate(event: RunEvent): Promise<EvaluatorResult[]>;
-    /**
-     * Get all events
-     */
-    getEvents(): RunEvent[];
-    /**
-     * Get events by task ID
-     */
-    getEventsByTask(taskId: string): RunEvent[];
-    /**
-     * Get events within a time range
-     */
-    getEventsInRange(startMs: number, endMs: number): RunEvent[];
-    /**
-     * Get recent events
-     */
-    getRecentEvents(count: number): RunEvent[];
-    /**
-     * Compute optimization metrics from events
-     */
-    computeMetrics(events?: RunEvent[]): OptimizationMetrics;
-    /**
-     * Rank violations by frequency and cost (rework lines)
-     */
-    rankViolations(windowEvents?: RunEvent[]): ViolationRanking[];
-    /**
-     * Get event count
-     */
-    get eventCount(): number;
-    /**
-     * Export events for persistence
-     */
-    exportEvents(): RunEvent[];
-    /**
-     * Import events from persistence
-     */
-    importEvents(events: RunEvent[]): void;
-    /**
-     * Clear all events
-     */
-    clear(): void;
-}
-/**
- * Create a run ledger instance
- *
- * @param maxEvents - Maximum events to retain in memory (0 = unlimited).
- */
-export declare function createLedger(maxEvents?: number): RunLedger;
-//# sourceMappingURL=ledger.d.ts.map

package/src/@claude-flow/guidance/dist/manifest-validator.d.ts

@@ -1,289 +0,0 @@
-/**
- * Manifest Validator & Conformance Suite
- *
- * Validates AgentCellManifest documents against the Agentic Container spec,
- * computes risk scores, selects execution lanes, and fails closed on any
- * validation error. The ConformanceSuite runs golden traces through an
- * evaluator to prove the platform behaves as specified.
- *
- * @module @claude-flow/guidance/manifest-validator
- */
-/** Data sensitivity levels ordered by severity */
-declare const DATA_SENSITIVITY_LEVELS: readonly ["public", "internal", "confidential", "restricted"];
-type DataSensitivity = typeof DATA_SENSITIVITY_LEVELS[number];
-/** Write modes for memory policy */
-declare const WRITE_MODES: readonly ["append", "overwrite", "merge"];
-type WriteMode = typeof WRITE_MODES[number];
-/** Authority scopes for memory policy */
-declare const AUTHORITY_SCOPES: readonly ["self", "team", "tenant", "global"];
-type AuthorityScope = typeof AUTHORITY_SCOPES[number];
-/** Trace levels for observability */
-declare const TRACE_LEVELS: readonly ["none", "errors", "decisions", "full"];
-/** Execution lanes ordered by privilege (lowest to highest) */
-declare const LANES: readonly ["wasm", "sandboxed", "native"];
-type Lane = typeof LANES[number];
-/**
- * The manifest describing an agent cell per the Agentic Container spec.
- */
-export interface AgentCellManifest {
-    /** API version string (must be 'agentic_cells.v0_1') */
-    apiVersion: string;
-    /** Cell identity */
-    cell: {
-        name: string;
-        purpose: string;
-        ownerTenant: string;
-        codeRef: {
-            kind: string;
-            digest: string;
-            entry: string;
-        };
-    };
-    /** Lane execution policy */
-    lanePolicy: {
-        portabilityRequired: boolean;
-        needsNativeThreads: boolean;
-        preferredLane: Lane;
-        maxRiskScore: number;
-    };
-    /** Resource budgets */
-    budgets: {
-        maxWallClockSeconds: number;
-        maxToolCalls: number;
-        maxBytesEgress: number;
-        maxTokensInMtok: number;
-        maxTokensOutMtok: number;
-        maxMemoryWrites: number;
-    };
-    /** Data handling policy */
-    dataPolicy: {
-        dataSensitivity: DataSensitivity;
-        piiAllowed: boolean;
-        retentionDays: number;
-        exportControls: {
-            allowedRegions: string[];
-            blockedRegions: string[];
-        };
-    };
-    /** Tool usage policy */
-    toolPolicy: {
-        toolsAllowed: string[];
-        networkAllowlist: string[];
-        writeActionsRequireConfirmation: boolean;
-    };
-    /** Memory system policy */
-    memoryPolicy: {
-        namespace: string;
-        authorityScope: AuthorityScope;
-        writeMode: WriteMode;
-        requiresCoherenceGate: boolean;
-        requiresAntiHallucinationGate: boolean;
-    };
-    /** Observability configuration */
-    observability: {
-        traceLevel: typeof TRACE_LEVELS[number];
-        emitArtifacts: boolean;
-        artifactBucket: string;
-    };
-}
-/**
- * A single validation error or warning.
- */
-export interface ValidationError {
-    /** Error code (e.g., 'MISSING_FIELD', 'INVALID_DIGEST', 'BUDGET_EXCEED') */
-    code: string;
-    /** JSON path to the problematic field */
-    field: string;
-    /** Human-readable description */
-    message: string;
-    /** Severity level */
-    severity: 'error';
-}
-/**
- * A single validation warning.
- */
-export interface ValidationWarning {
-    /** Warning code */
-    code: string;
-    /** JSON path to the problematic field */
-    field: string;
-    /** Human-readable description */
-    message: string;
-    /** Severity level */
-    severity: 'warning';
-}
-/**
- * Complete validation result for a manifest.
- */
-export interface ValidationResult {
-    /** Whether the manifest passed all validation checks */
-    valid: boolean;
-    /** Validation errors (each causes rejection) */
-    errors: ValidationError[];
-    /** Validation warnings (informational, do not block admission) */
-    warnings: ValidationWarning[];
-    /** Admission decision: admit, reject, or review */
-    admissionDecision: 'admit' | 'reject' | 'review';
-    /** Selected execution lane (null if rejected) */
-    laneSelection: Lane | null;
-    /** Computed risk score (0-100) */
-    riskScore: number;
-}
-/**
- * Validates AgentCellManifest documents against the Agentic Container spec.
- *
- * Fails closed: any validation error results in a 'reject' decision.
- * Warnings alone do not block admission but may trigger a 'review' decision
- * when the risk score is between thresholds.
- */
-export declare class ManifestValidator {
-    /** Risk score threshold: below this, admit. Above reject threshold, reject. Between, review. */
-    private readonly admitThreshold;
-    private readonly rejectThreshold;
-    constructor(options?: {
-        admitThreshold?: number;
-        rejectThreshold?: number;
-    });
-    /**
-     * Validate a manifest, compute its risk score, select a lane, and decide admission.
-     *
-     * FAILS CLOSED: any validation error leads to reject.
-     */
-    validate(manifest: AgentCellManifest): ValidationResult;
-    /**
-     * Compute a risk score (0-100) from tool risk, data sensitivity, and privilege surface.
-     *
-     * Components:
-     * - tool_risk (0-40): based on tool types and network access
-     * - data_sensitivity (0-30): based on sensitivity level and PII
-     * - privilege_surface (0-30): based on memory scope, write mode, native threads
-     */
-    computeRiskScore(manifest: AgentCellManifest): number;
-    /**
-     * Select the execution lane based on risk score and manifest policy.
-     *
-     * Lane selection rules:
-     * - If portabilityRequired or risk <= 30: wasm
-     * - If needsNativeThreads and risk > 50: native
-     * - Otherwise: sandboxed
-     * - Always respect preferredLane if risk score allows it
-     * - Risk exceeding maxRiskScore forces the most restrictive lane
-     */
-    selectLane(manifest: AgentCellManifest, riskScore: number): Lane;
-    /**
-     * Validate budget values: no negatives, within sanity limits.
-     */
-    validateBudgets(budgets: AgentCellManifest['budgets']): ValidationError[];
-    /**
-     * Validate tool policy: network allowlist must not contain wildcards
-     * unless the cell explicitly has Bash (privileged).
-     */
-    validateToolPolicy(toolPolicy: AgentCellManifest['toolPolicy']): ValidationError[];
-    /**
-     * Validate data policy fields.
-     */
-    validateDataPolicy(dataPolicy: AgentCellManifest['dataPolicy']): ValidationError[];
-    private validateRequiredFields;
-    private validateApiVersion;
-    private validateDigest;
-    private validateWarnings;
-}
-/**
- * A single event within a golden trace.
- */
-export interface GoldenTraceEvent {
-    /** Sequence number within the trace */
-    seq: number;
-    /** Type of event (e.g., 'command', 'tool-use', 'memory-write', 'budget-check') */
-    eventType: string;
-    /** Event payload */
-    payload: Record<string, unknown>;
-    /** Expected outcome from the platform */
-    expectedOutcome: 'allow' | 'deny' | 'warn';
-}
-/**
- * A complete golden trace including events and expected decisions.
- */
-export interface GoldenTrace {
-    /** Unique trace identifier */
-    traceId: string;
-    /** Human-readable name */
-    name: string;
-    /** Description of what the trace verifies */
-    description: string;
-    /** Ordered sequence of events */
-    events: GoldenTraceEvent[];
-    /** Map from event seq (as string) to expected decision string */
-    expectedDecisions: Record<string, string>;
-    /** Map from memory key to expected parent chain for lineage verification */
-    expectedMemoryLineage: Record<string, string[]>;
-}
-/**
- * Result of running the conformance suite.
- */
-export interface ConformanceResult {
-    /** Whether all events matched their expected outcomes */
-    passed: boolean;
-    /** Total number of events evaluated */
-    totalEvents: number;
-    /** Number of events that matched expectations */
-    matchedEvents: number;
-    /** Details of any mismatches */
-    mismatches: Array<{
-        traceId: string;
-        seq: number;
-        expected: string;
-        actual: string;
-        details: unknown;
-    }>;
-}
-/**
- * Runs golden traces through an evaluator and reports conformance.
- *
- * Each trace contains events with expected outcomes. The suite feeds every
- * event to the evaluator and compares the actual decision to the expectation.
- */
-export declare class ConformanceSuite {
-    private traces;
-    /**
-     * Add a golden trace to the suite.
-     */
-    addTrace(trace: GoldenTrace): void;
-    /**
-     * Run every event in every trace through the evaluator and compare
-     * actual decisions against expected outcomes.
-     */
-    run(evaluator: (event: GoldenTraceEvent) => {
-        decision: string;
-        details: unknown;
-    }): ConformanceResult;
-    /**
-     * Get all registered traces.
-     */
-    getTraces(): GoldenTrace[];
-    /**
-     * Create built-in default golden traces that verify core platform invariants:
-     *
-     * 1. Destructive command blocked
-     * 2. Secret detected and blocked
-     * 3. Budget exceeded and denied
-     * 4. Memory write without evidence blocked
-     * 5. Valid operation allowed
-     */
-    createDefaultTraces(): GoldenTrace[];
-}
-/**
- * Create a new ManifestValidator instance.
- */
-export declare function createManifestValidator(options?: {
-    admitThreshold?: number;
-    rejectThreshold?: number;
-}): ManifestValidator;
-/**
- * Create a new ConformanceSuite instance, optionally pre-loaded with default traces.
- */
-export declare function createConformanceSuite(options?: {
-    includeDefaults?: boolean;
-}): ConformanceSuite;
-export {};
-//# sourceMappingURL=manifest-validator.d.ts.map

package/src/@claude-flow/guidance/dist/memory-gate.d.ts

@@ -1,222 +0,0 @@
-/**
- * Memory Write Gating System
- *
- * Adds authority scope, TTL, decay, and contradiction tracking
- * to memory operations. Ensures that only authorized agents can
- * write to specific namespaces, enforces rate limits, and detects
- * contradictions between memory entries.
- *
- * @module @claude-flow/guidance/memory-gate
- */
-/**
- * Authority definition for a memory-writing agent
- */
-export interface MemoryAuthority {
-    /** Agent identifier */
-    agentId: string;
-    /** Role in the hierarchy */
-    role: 'queen' | 'coordinator' | 'worker' | 'observer';
-    /** Namespaces this agent is allowed to write to */
-    namespaces: string[];
-    /** Maximum writes allowed per minute */
-    maxWritesPerMinute: number;
-    /** Whether this agent can delete entries */
-    canDelete: boolean;
-    /** Whether this agent can overwrite existing entries */
-    canOverwrite: boolean;
-    /** Trust level from 0 (untrusted) to 1 (fully trusted) */
-    trustLevel: number;
-}
-/**
- * A gated memory entry with metadata for TTL, decay, lineage, and contradictions
- */
-export interface MemoryEntry {
-    /** Entry key */
-    key: string;
-    /** Namespace the entry belongs to */
-    namespace: string;
-    /** The stored value */
-    value: unknown;
-    /** SHA-256 hash of the serialized value */
-    valueHash: string;
-    /** Authority that created/last wrote this entry */
-    authority: MemoryAuthority;
-    /** Timestamp when the entry was created (ms since epoch) */
-    createdAt: number;
-    /** Timestamp of the last update (ms since epoch) */
-    updatedAt: number;
-    /** Time-to-live in milliseconds, or null for no expiry */
-    ttlMs: number | null;
-    /** Decay rate from 0 (no decay) to 1 (immediate decay) */
-    decayRate: number;
-    /** Confidence score from 0 to 1, decays over time */
-    confidence: number;
-    /** Lineage tracking for provenance */
-    lineage: {
-        parentKey?: string;
-        derivedFrom?: string[];
-        operation: string;
-    };
-    /** Detected contradictions with other entries */
-    contradictions: Array<{
-        entryKey: string;
-        description: string;
-        resolvedAt?: number;
-    }>;
-}
-/**
- * Result of evaluating a write request
- */
-export interface WriteDecision {
-    /** Whether the write is allowed */
-    allowed: boolean;
-    /** Human-readable reason for the decision */
-    reason: string;
-    /** Contradictions detected with existing entries */
-    contradictions: Array<{
-        existingKey: string;
-        description: string;
-    }>;
-    /** Authority check result */
-    authorityCheck: {
-        passed: boolean;
-        requiredRole: string;
-        actualRole: string;
-    };
-    /** Rate limit check result */
-    rateCheck: {
-        passed: boolean;
-        writesInWindow: number;
-        limit: number;
-    };
-    /** Overwrite permission check result */
-    overwriteCheck: {
-        isOverwrite: boolean;
-        allowed: boolean;
-    };
-}
-/**
- * Configuration for the MemoryWriteGate
- */
-export interface MemoryWriteGateConfig {
-    /** Pre-registered authorities */
-    authorities?: MemoryAuthority[];
-    /** Similarity threshold for contradiction detection (0-1) */
-    contradictionThreshold?: number;
-    /** Default TTL for new entries in ms (null = no expiry) */
-    defaultTtlMs?: number;
-    /** Default decay rate for new entries (0-1) */
-    defaultDecayRate?: number;
-    /** Whether to run contradiction detection on writes */
-    enableContradictionTracking?: boolean;
-}
-/**
- * Memory Write Gate
- *
- * Controls write access to the memory system by enforcing:
- * - Authority checks (namespace access, role hierarchy)
- * - Rate limiting (sliding window per agent)
- * - Overwrite permissions
- * - Contradiction detection against existing entries
- * - TTL and confidence decay tracking
- */
-export declare class MemoryWriteGate {
-    private authorities;
-    private writeTimestamps;
-    private contradictionThreshold;
-    private defaultTtlMs;
-    private defaultDecayRate;
-    private enableContradictionTracking;
-    private contradictionResolutions;
-    constructor(config?: MemoryWriteGateConfig);
-    /**
-     * Evaluate whether a write operation should be allowed.
-     *
-     * Steps:
-     * 1. Check authority (namespace allowed, role sufficient)
-     * 2. Check rate limit
-     * 3. Check overwrite permission
-     * 4. Detect contradictions against existing entries
-     * 5. Return decision
-     */
-    evaluateWrite(authority: MemoryAuthority, key: string, namespace: string, value: unknown, existingEntries?: MemoryEntry[]): WriteDecision;
-    /**
-     * Register a new authority or update an existing one
-     */
-    registerAuthority(authority: MemoryAuthority): void;
-    /**
-     * Compute the current confidence for an entry based on decay over time.
-     *
-     * Uses exponential decay: confidence = initialConfidence * e^(-decayRate * ageHours)
-     * where ageHours is (now - updatedAt) / 3600000
-     */
-    computeConfidence(entry: MemoryEntry): number;
-    /**
-     * Get all entries whose TTL has been exceeded
-     */
-    getExpiredEntries(entries: MemoryEntry[]): MemoryEntry[];
-    /**
-     * Get entries whose decayed confidence has dropped below a threshold
-     */
-    getDecayedEntries(entries: MemoryEntry[], threshold: number): MemoryEntry[];
-    /**
-     * Detect contradictions between a new value and existing entries.
-     *
-     * Uses string-based pattern matching to find conflicting statements
-     * (must vs never, always vs never, require vs forbid, etc.)
-     */
-    detectContradictions(newValue: unknown, existingEntries: MemoryEntry[]): Array<{
-        entryKey: string;
-        description: string;
-    }>;
-    /**
-     * Mark a contradiction as resolved
-     */
-    resolveContradiction(entryKey: string, resolution: string): void;
-    /**
-     * Get the authority for an agent by ID
-     */
-    getAuthorityFor(agentId: string): MemoryAuthority | undefined;
-    /**
-     * Get the current rate limit status for an agent
-     */
-    getRateLimitStatus(agentId: string): {
-        writesInWindow: number;
-        limit: number;
-        resetAt: number;
-    };
-    /** Get the default TTL in ms */
-    getDefaultTtlMs(): number | null;
-    /** Get the default decay rate */
-    getDefaultDecayRate(): number;
-    /** Check if contradiction tracking is enabled */
-    isContradictionTrackingEnabled(): boolean;
-    /** Get the contradiction resolution for an entry key */
-    getContradictionResolution(entryKey: string): string | undefined;
-    /**
-     * Check whether an authority is allowed to write to a namespace
-     */
-    private checkAuthority;
-    /**
-     * Check rate limit using a sliding window of write timestamps
-     */
-    private checkRateLimit;
-    /**
-     * Record a write timestamp for an agent
-     */
-    private recordWrite;
-}
-/**
- * Create a MemoryWriteGate instance with optional configuration
- */
-export declare function createMemoryWriteGate(config?: MemoryWriteGateConfig): MemoryWriteGate;
-/**
- * Create a new MemoryEntry with defaults applied
- */
-export declare function createMemoryEntry(key: string, namespace: string, value: unknown, authority: MemoryAuthority, options?: {
-    ttlMs?: number | null;
-    decayRate?: number;
-    confidence?: number;
-    lineage?: MemoryEntry['lineage'];
-}): MemoryEntry;
-//# sourceMappingURL=memory-gate.d.ts.map