opencode-swarm 7.170.2 → 7.171.1

package/dist/observability/catalog.d.ts

@@ -1,7 +1,7 @@
 /**
  * The event catalog (issue #2029).
  *
- * Exactly 61 entries, matching the `TelemetryEvent` union at
+ * Exactly 62 entries, matching the `TelemetryEvent` union at
  * `src/telemetry.ts:20-172`. Thirty-eight predate the #2029 contract; the 39th is
  * `agent_conflict_detected` (previously emitted through a force-cast past the
  * type system), the 40th is `close_archive_result` (issue #2030 — the
@@ -29,7 +29,7 @@
  * (issue #2046 item 9 — canonical council attempt / accepted-transition
  * observations joined to the lifecycle correlation system via the
  * server-derived `councilRoundId`). The 60th is
- * `context_source_attribution` and the 61st is `verdict_row_pipe_recovery`
+ * `context_source_attribution` and the 61st is `verdict_row_pipe_recovery` and the 62nd is `training_vault_health`
  * (issue #2482 — D3: honest savings attribution with the omit-when-unknown
  * rule, and the #2184 verdict-row pipe-recovery fidelity class in the event
  * lifecycle). These late
@@ -88,7 +88,7 @@ export interface CatalogEntry {
     /**
      * Whether an event of this kind must carry `trace.parentSpanId`.
      *
-     * `false` for all 61 entries today, and that is a truthful statement about
+     * `false` for all 62 entries today, and that is a truthful statement about
      * the current system rather than a placeholder: no producer supplies a
      * parent span, so `createObservation` never sets one. Setting this to `true`
      * for a kind whose producer cannot supply a parent would make every

package/dist/observability/index.d.ts

@@ -50,7 +50,7 @@ export type { TraceAndSpanId } from './ids.js';
 export { newEventId, newSpanId, pseudonymousRef, SPAN_ID_HEX_LENGTH, TRACE_ID_HEX_LENGTH, } from './ids.js';
 export { adaptLegacyTelemetryPayload, extractOutcome, extractWorkflowIds, KNOWN_TELEMETRY_KEYS, LEGACY_ADAPTER_RULES, NON_OBJECT_PAYLOAD_MARKER, } from './legacy.js';
 export type { InitObservabilityInput } from './observe.js';
-export { createObservation, initObservability, resetObservabilityForTesting, toLegacyTelemetryLine, } from './observe.js';
+export { canonicalLineContent, createObservation, initObservability, resetObservabilityForTesting, toLegacyTelemetryLine, } from './observe.js';
 export { mappingForEntry, OPENINFERENCE_ATTRIBUTES, OPENINFERENCE_MAPPING_VERSION, OTEL_GENAI_ATTRIBUTES, OTEL_GENAI_MAPPING_VERSION, } from './otel-mapping.js';
 export type { RelationshipValidationResult } from './relationships.js';
 export { RELATIONSHIP_VIOLATION_CODES, validateEventRelationships, } from './relationships.js';

package/dist/observability/observe.d.ts

@@ -101,6 +101,12 @@ export declare function createObservation(kind: string, data: unknown): Observab
  * those inputs.
  */
 export declare function toLegacyTelemetryLine(event: ObservabilityEvent): Record<string, unknown>;
+/**
+ * The exact JSONL line content `emit()` writes, without the EOL. Single
+ * definition so the writer (src/telemetry.ts) and the observability store's
+ * content-derived `line_hash` correlation (issue #2487) can never drift apart.
+ */
+export declare function canonicalLineContent(event: ObservabilityEvent): string;
 /**
  * Reset all four module-scoped variables.
  *

package/dist/pr-review/reducer.d.ts

@@ -1,24 +1,30 @@
 /**
- * PR-review transition authority (issue #2385).
+ * PR-review transition authority (issues #2385, #2512).
  *
  * Pure `(state, event) -> { state, effects }` reducer over the closed
  * `PrReviewEvent` union. Rule computation is delegated to the focused
  * boundary modules (`circuit.ts`, `completion.ts` via its settlement inputs,
  * `critic-routing.ts`, `lifecycle.ts`); this module owns transition
  * composition and the explicit rejection of every invalid transition class
- * named by issue #2385:
+ * named by issue #2385 that is reducer-observable:
  *
- * - observer deadline / client absence → terminal child failure
- * - raw transcript / parser failure → provider circuit signal
- * - one lane → multiple circuit samples (delegated to circuit.ts's
- *   distinct-`(generation, batch, lane)` scan; asserted by property tests)
  * - unresolved/live lane → terminal coverage report
- * - partial/no coverage → approval
+ * - partial coverage → approval; zero coverage → anything but INCOMPLETE
  * - ordinary MEDIUM → critic without typed high-impact/vulnerability evidence
  *   (enforced where critic inventory is composed, via critic-routing.ts)
- * - stale/foreign authorization → reviewer or publication access
+ * - stale/foreign authorization → armed-recovery transition
  * - late old-generation result → current-state mutation
- * - structured receipt → downgrade by later transcript parsing
+ *
+ * Rules that depend on facts this pure boundary cannot observe live at
+ * richer executors and are NOT reducer events (issue #2512 wire-or-retire
+ * census; see docs/pr-review-transition-authority.md): observer-deadline /
+ * client-absence / parser / stale-sweep evidence classification
+ * (`classifyPrReviewCircuitSignal`), structured-receipt downgrade protection
+ * (`validateExactStructuredReceiptCoverage`), operator lane cancellation
+ * (`collectOnce` cancel_pending), publication arming/settlement
+ * (`completePrWorkflow` + `allowedPrReviewReportVerdicts`), and reviewer
+ * re-entry consumption (`reservePrReviewReentryAuthorizationAgainstBinding` —
+ * a pure reducer cannot independently observe a concurrent storage mutation).
  *
  * The owning gate and `dispatch-lanes` are orchestration adapters: they build
  * events from real I/O, apply the returned state, and map typed rejections to
@@ -30,7 +36,9 @@
  * `pending-delegations.ts`; `emit_diagnostic` describes the collect
  * observer's bounded diagnostics channel; `block_dispatch` describes the
  * circuit-open admission refusal. No effect kind is emitted without a real
- * executor (reviewer finding 1, issue #2385 Phase 8b).
+ * executor (reviewer finding 1, issue #2385 Phase 8b), and no event member is
+ * declared without a production construction site (issue #2512; enforced by
+ * tests/unit/pr-review/reducer-adapter-authority.test.ts).
  *
  * Probe outcomes other than an admission rollback are processed by the
  * machine on the NEXT staged admission: the gate feeds the recorded probe's

package/dist/pr-review/types.d.ts

@@ -78,7 +78,7 @@ export type PrReviewEffect = {
     replay?: boolean;
 } | {
     kind: 'emit_diagnostic';
-    source: 'collection_observer' | 'legacy_transcript_adapter';
+    source: 'collection_observer';
     code: string;
     boundedDetail?: string | undefined;
 } | {
@@ -104,11 +104,38 @@ export type PrReviewCircuitProbeOutcome = {
 } | {
     result: 'rolled_back_admission';
 };
+/**
+ * A settled critic receipt: a critic verdict that terminates its assigned
+ * coverage obligation (issue #2512). UPHELD, DOWNGRADED, and DISPROVED each
+ * satisfy the critic coverage their finding was assigned; NEEDS_MORE_EVIDENCE
+ * is deliberately nonterminal and is not representable here. The digest is the
+ * authoritative reviewer verdict row the critic claim was bound to at
+ * composition time (`reviewerVerdictRowDigest`; composition rejects unbound
+ * claims), so a receipt can only be built from the current authoritative
+ * reviewer rows.
+ */
+export interface PrReviewCriticSettledReceipt {
+    findingId: string;
+    status: 'UPHELD' | 'DOWNGRADED' | 'DISPROVED';
+    reviewerRowDigest: string;
+}
+/**
+ * The closed event vocabulary for the PR-review transition authority
+ * (`reducer.ts`), issue #2512's registered-path contract: every declared event
+ * member has a production construction site (see
+ * docs/pr-review-transition-authority.md for the wire-or-retire table). Events
+ * whose production authority lives at a richer executor boundary — transcript
+ * downgrade protection (`validateExactStructuredReceiptCoverage`), provider
+ * terminal evidence classification (`classifyPrReviewCircuitSignal`),
+ * operator lane cancellation (`collectOnce` cancel_pending), publication
+ * arming/settlement (`completePrWorkflow`), and reviewer re-entry consumption
+ * (`reservePrReviewReentryAuthorizationAgainstBinding`) — are deliberately
+ * RETIRED from this union rather than declared without a dispatch site.
+ */
 export type PrReviewEvent = {
     type: 'base_admission_requested';
     batchId: string;
     lanes: PrReviewBaseDispatchLane[];
-    depthTier: 'S' | 'M' | 'L';
     maxBatches: number;
     validatedAt: string;
 } | {
@@ -128,34 +155,6 @@ export type PrReviewEvent = {
     semanticEnvelopeDigest: string;
     outcome: 'CLEAN' | 'FINDINGS' | 'INCOMPLETE';
     existingReceiptDigest?: string | undefined;
-} | {
-    type: 'transcript_evidence_presented';
-    batchId: string;
-    laneId: string;
-    laneHasStructuredReceipt: boolean;
-} | {
-    type: 'provider_terminal_observed';
-    batchId: string;
-    laneId: string;
-    generation: number;
-    evidence: {
-        source: 'typed_terminal_error_class';
-        category: string;
-        kind: string;
-    } | {
-        source: 'observer_deadline';
-    } | {
-        source: 'client_unavailable';
-    } | {
-        source: 'parser_or_transcript';
-    } | {
-        source: 'stale_observation';
-    };
-} | {
-    type: 'lane_cancelled';
-    batchId: string;
-    laneId: string;
-    generation: number;
 } | {
     type: 'circuit_advance_requested';
     nowMs: number;
@@ -187,29 +186,26 @@ export type PrReviewEvent = {
 } | {
     type: 'critic_result_recorded';
     criticRequiredFindingIds: readonly string[];
-    criticConfirmedFindingIds: readonly string[];
-} | {
-    type: 'publication_armed';
-    coverageKind: PrReviewTerminalCoverageKind;
-    verdict: PrReviewReportVerdict;
-} | {
-    type: 'publication_published';
-    binding: PrReviewAuthorizationBinding;
+    criticSettledReceipts: readonly PrReviewCriticSettledReceipt[];
 } | {
     type: 'armed_recovery_requested';
     binding: PrReviewAuthorizationBinding;
     dimensionsToCancel: PrReviewBaseDimensionId[];
     nowIso: string;
-} | {
-    type: 'reviewer_authorization_consumed';
-    binding: PrReviewAuthorizationBinding;
-    expectedRole: 'reviewer' | 'test_engineer';
-    role: 'reviewer' | 'test_engineer';
+    /** The operator's sanitized reason; the transition persists it verbatim. */
+    reason: string;
 };
 /**
- * The exact-identity binding an armed recovery, publication, or re-entry
- * authorization must carry (issue #2383/#2385). Stale or foreign values are
- * rejected with `stale_foreign_authorization`.
+ * The exact-identity binding an armed recovery authorization must carry
+ * (issues #2383/#2385/#2512). Stale or foreign values are rejected with
+ * `stale_foreign_authorization`.
+ *
+ * Authority split (issue #2512): the reducer validates the fields the workflow
+ * state itself carries — `sessionID`, `workflowInstanceId`, `prHeadSha`, and
+ * `generation` (`bindingRejection` in reducer.ts). `revisionDigest` is only
+ * observable by the executor that resolved it (the armed publication record or
+ * the live binding context), so it is validated THERE — never here; a pure
+ * reducer cannot independently observe a concurrent storage mutation.
  */
 export interface PrReviewAuthorizationBinding {
     sessionID: string;
@@ -218,7 +214,7 @@ export interface PrReviewAuthorizationBinding {
     revisionDigest?: string;
     generation: number;
 }
-export type PrReviewTransitionRejectionCode = 'observer_deadline_not_terminal_evidence' | 'client_absence_not_terminal_evidence' | 'parser_failure_not_provider_signal' | 'stale_observation_not_provider_signal' | 'live_lane_blocks_coverage' | 'partial_coverage_cannot_approve' | 'no_coverage_cannot_approve' | 'critic_required_unfulfilled' | 'stale_foreign_authorization' | 'stale_generation_result' | 'receipt_cannot_be_downgraded' | 'duplicate_conflicting_result' | 'base_batch_limit_reached' | 'rollback_preconditions_failed' | 'lane_not_stale_eligible' | 'unknown_event';
+export type PrReviewTransitionRejectionCode = 'live_lane_blocks_coverage' | 'partial_coverage_cannot_approve' | 'no_coverage_requires_incomplete' | 'critic_required_unfulfilled' | 'stale_foreign_authorization' | 'stale_generation_result' | 'duplicate_conflicting_result' | 'base_batch_limit_reached' | 'rollback_preconditions_failed' | 'unknown_event';
 export interface PrReviewTransitionRejection {
     code: PrReviewTransitionRejectionCode;
     detail: string;

package/dist/telemetry.d.ts

@@ -1,5 +1,5 @@
 import type { ObservabilityEvent } from './observability/envelope.js';
-import { createObservation, toLegacyTelemetryLine } from './observability/index.js';
+import { canonicalLineContent, createObservation, toLegacyTelemetryLine } from './observability/index.js';
 import type { DelegationCostFields } from './services/cost-accounting.js';
 export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activated' | 'delegation_begin' | 'delegation_end' | 'delegation_cost_correction' | 'delegation_cost_binding' | 'delegation_cost_join' | 'task_state_changed' | 'gate_passed' | 'gate_failed' | 'gate_parse_error' | 'reviewer_gate_decision' | 'phase_changed' | 'budget_updated' | 'context_pruned' | 'retrieval_routed' | 'model_fallback'
 /**
@@ -33,7 +33,7 @@ export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activa
  * `prm_hard_stop` TRIGGER emitted by `src/prm/escalation.ts`. A trigger with
  * no matching delivery means the containment never reached the agent.
  */
- | 'prm_hard_stop_delivered' | 'agent_conflict_detected' | 'close_archive_result' | 'knowledge_receipt_transition' | 'knowledge_maintenance' | 'residue_health' | 'context_telemetry_health' | 'skill_usage_health' | 'core_events_health' | 'shell_audit_health' | 'trajectory_health' | 'learning_health_alarm' | 'pr_subscription_health' | 'council_attempt' | 'council_round_transition' | 'council_attempt_unscoped' | 'context_source_attribution' | 'verdict_row_pipe_recovery';
+ | 'prm_hard_stop_delivered' | 'agent_conflict_detected' | 'close_archive_result' | 'knowledge_receipt_transition' | 'knowledge_maintenance' | 'residue_health' | 'context_telemetry_health' | 'skill_usage_health' | 'core_events_health' | 'shell_audit_health' | 'trajectory_health' | 'learning_health_alarm' | 'pr_subscription_health' | 'council_attempt' | 'council_round_transition' | 'council_attempt_unscoped' | 'context_source_attribution' | 'verdict_row_pipe_recovery' | 'training_vault_health';
 /** Stable classification for how a reviewer-gate decision was established. */
 export type ReviewerGateEvidenceKind = 'genuine' | 'fallback' | 'data_quality' | 'block';
 /**
@@ -50,7 +50,14 @@ export type TelemetryListener = (event: TelemetryEvent, data: Record<string, unk
  * two-argument listener stays assignable. The SQLite observability sink
  * (`src/db/observability-event-store.ts`) is the canonical consumer.
  */
-canonical?: ObservabilityEvent) => void;
+canonical?: ObservabilityEvent, 
+/**
+ * The canonical JSONL line content for `canonical` (no trailing EOL),
+ * stringified exactly once by `emit()` and handed to listeners so the
+ * sink's line-hash path never re-stringifies the same envelope (issue
+ * #2487 review PRR-005).
+ */
+canonicalContent?: string) => void;
 export declare function startHeartbeatTracking(): void;
 export declare function getLastHeartbeat(sessionId: string): number | undefined;
 export declare function stopHeartbeatTracking(): void;
@@ -293,6 +300,18 @@ export declare const telemetry: {
      * contract's no-content-in-metrics rule. Enables PR 16 to alarm and PR 20 to
      * report without leaking workspace layout or capsule contents.
      */
+    /**
+     * Training vault health (issue #2486). Emitted on capture-stop transitions
+     * (quota/disk/consent), quarantine aggregates, and withdrawals for the
+     * consented training-content vault. Bounded payload: the pseudonymous
+     * project ref, a reason enum, and a count — no vault content, no raw
+     * paths, matching the observability contract's no-content rule.
+     */
+    trainingVaultHealth(data: {
+        project_ref: string;
+        reason: "quota_bytes" | "quota_records" | "disk_floor" | "consent_missing" | "withdrawal_executed";
+        count: number;
+    }): void;
     contextTelemetryHealth(data: {
         trigger: "compaction" | "close";
         accepted_count: number;
@@ -498,4 +517,5 @@ export declare const _internals: {
     heartbeatListenerCount: () => number;
     createObservation: typeof createObservation;
     toLegacyTelemetryLine: typeof toLegacyTelemetryLine;
+    canonicalLineContent: typeof canonicalLineContent;
 };

package/dist/tools/repo-map.d.ts

@@ -87,6 +87,11 @@ export declare const _internals: {
             oldest_age_ms: number;
             grammar_counts: Record<string, number>;
         }): void;
+        trainingVaultHealth(data: {
+            project_ref: string;
+            reason: "quota_bytes" | "quota_records" | "disk_floor" | "consent_missing" | "withdrawal_executed";
+            count: number;
+        }): void;
         contextTelemetryHealth(data: {
             trigger: "compaction" | "close";
             accepted_count: number;

package/dist/training/capture.d.ts

@@ -0,0 +1,37 @@
+import { type TrainingConsent } from './consent';
+import { appendTrainingVaultRecord, buildTrainingVaultRecord } from './vault';
+interface MessageLike {
+    info?: {
+        role?: string;
+        id?: string;
+        sessionID?: string;
+    };
+    parts?: Array<{
+        type?: string;
+        text?: string;
+    }>;
+}
+interface ToolExecutionLike {
+    tool: string;
+    sessionID?: string;
+    input?: unknown;
+    output?: unknown;
+    error?: unknown;
+}
+export interface TrainingCaptureObserver {
+    observeMessages(output: {
+        messages?: MessageLike[];
+    }): Promise<void>;
+    observeToolExecution(event: ToolExecutionLike): Promise<void>;
+}
+export declare const _internals: {
+    appendRecord: typeof appendTrainingVaultRecord;
+    readConsent: (directory: string) => TrainingConsent | null;
+    buildRecord: typeof buildTrainingVaultRecord;
+};
+/**
+ * Create the observer. Pure construction — no filesystem access until the
+ * first observation (which itself only reads when a message actually arrives).
+ */
+export declare function createTrainingCaptureObserver(directory: string): TrainingCaptureObserver;
+export {};

package/dist/training/consent.d.ts

@@ -0,0 +1,96 @@
+import { z } from 'zod';
+export declare const TRAINING_CONSENT_SCHEMA_VERSION = 1;
+/** Version of the consent TERMS presented to the human (bump when terms change). */
+export declare const TRAINING_CONSENT_CURRENT_VERSION = 1;
+/** Hard per-project vault maxima (source contract #2050 §6). Lower is allowed; higher is not. */
+export declare const TRAINING_QUOTA_CEILINGS: {
+    readonly maxBytes: 1073741824;
+    readonly maxRecords: 250000;
+    readonly retentionDays: 30;
+};
+/** Hard per-project export maxima. */
+export declare const TRAINING_EXPORT_QUOTA_CEILINGS: {
+    readonly maxBytes: 1073741824;
+    readonly maxExports: 20;
+    readonly retentionDays: 30;
+};
+export declare const TrainingProjectBindingSchema: z.ZodObject<{
+    rootDigest: z.ZodString;
+    projectRef: z.ZodString;
+}, z.core.$strict>;
+export declare const TrainingConsentSchema: z.ZodObject<{
+    schema_version: z.ZodLiteral<1>;
+    consent_id: z.ZodString;
+    state: z.ZodEnum<{
+        granted: "granted";
+        withdrawn: "withdrawn";
+    }>;
+    consent_version: z.ZodLiteral<1>;
+    granted_at: z.ZodString;
+    withdrawn_at: z.ZodOptional<z.ZodString>;
+    expires_at: z.ZodString;
+    purpose: z.ZodString;
+    content_classes: z.ZodArray<z.ZodString>;
+    quotas: z.ZodObject<{
+        maxBytes: z.ZodNumber;
+        maxRecords: z.ZodNumber;
+        retentionDays: z.ZodNumber;
+    }, z.core.$strip>;
+    redaction_version: z.ZodLiteral<1>;
+    project_binding: z.ZodObject<{
+        rootDigest: z.ZodString;
+        projectRef: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type TrainingConsent = z.infer<typeof TrainingConsentSchema>;
+export interface GrantTrainingConsentInput {
+    quotas?: Partial<{
+        maxBytes: number;
+        maxRecords: number;
+        retentionDays: number;
+    }>;
+    expiresAt?: string;
+    now?: Date;
+}
+/**
+ * The project identity a consent is bound to. `rootDigest` pins the canonical
+ * absolute root (clone/copy produces a different digest); `projectRef` reuses
+ * the observability lineage pseudonym so vault records correlate with the
+ * metadata-only event stream without carrying raw paths.
+ */
+export declare function computeProjectBinding(directory: string): {
+    rootDigest: string;
+    projectRef: string;
+};
+/**
+ * Write a new granted consent record (atomically). A prior record — granted or
+ * withdrawn — is replaced; each grant carries a fresh consent_id so vault
+ * records remain attributable to the exact grant they were captured under.
+ */
+export declare function grantTrainingConsent(directory: string, input?: GrantTrainingConsentInput): TrainingConsent;
+/**
+ * Mark the consent withdrawn. Capture stops immediately (every observation
+ * re-reads the active consent); physical content deletion is the withdraw
+ * command's confirmed step, not this write.
+ */
+export declare function revokeTrainingConsent(directory: string, options?: {
+    now?: Date;
+}): void;
+/**
+ * The capture-gating consent read. Fail-closed: missing file, malformed JSON,
+ * schema mismatch, `state !== 'granted'`, expiry, or a project binding issued
+ * for a different canonical root all return null.
+ */
+export declare function readActiveTrainingConsent(directory: string, options?: {
+    now?: Date;
+}): TrainingConsent | null;
+/**
+ * Read a granted, project-bound consent WITHOUT the wall-clock expiry check.
+ * The capture observer uses `readActiveTrainingConsent` (expiry-aware); the
+ * vault's append gate instead validates that the consent was active AT THE
+ * RECORD'S captured_at, so a record legitimately captured before expiry still
+ * lands while any capture attempted under an expired grant is refused.
+ */
+export declare function readGrantedTrainingConsent(directory: string): TrainingConsent | null;
+/** Read the raw consent state for status reporting (never throws). */
+export declare function readTrainingConsentState(directory: string): 'granted' | 'withdrawn' | 'absent';

package/dist/training/disk.d.ts

@@ -0,0 +1,16 @@
+/** Hard free-space floor: max(2 GiB, 10% of the volume size). */
+export declare const TRAINING_DISK_FLOOR_BYTES = 2147483648;
+export interface DiskFloorCheck {
+    ok: boolean;
+    freeBytes?: number;
+    floorBytes: number;
+    reason?: 'disk_floor';
+}
+/**
+ * Check the free-space floor for the volume holding the training tree.
+ * The reported `floorBytes` is the guaranteed constant floor; the ok/not-ok
+ * decision uses the stricter of that floor and 10% of the volume size.
+ * Never throws: an unprobeable volume reports ok with the byte caps as the
+ * remaining bound (see module doc).
+ */
+export declare function checkTrainingDiskFloor(directory: string): DiskFloorCheck;

package/dist/training/exporter.d.ts

@@ -0,0 +1,88 @@
+import { z } from 'zod';
+import { listTrainingTombstones, type TrainingVaultRecord } from './vault';
+export declare const TRAINING_EXPORT_SCHEMA_VERSION = 1;
+export declare const TrainingExportFiltersSchema: z.ZodObject<{
+    kinds: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        user_message: "user_message";
+        assistant_message: "assistant_message";
+        tool_call: "tool_call";
+        tool_result: "tool_result";
+    }>>>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    taskId: z.ZodOptional<z.ZodString>;
+    since: z.ZodOptional<z.ZodString>;
+    validationRatio: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type TrainingExportFilters = z.infer<typeof TrainingExportFiltersSchema>;
+export interface ExportPreview {
+    exportId: string;
+    recordCount: number;
+    estimatedBytes: number;
+    destination: string;
+    split: {
+        train: number;
+        validation: number;
+    };
+    quarantinedExcluded: number;
+    expiredExcluded: number;
+    requiresConfirm: true;
+}
+export interface ExportExecution {
+    written: boolean;
+    exportId?: string;
+    destination?: string;
+    reason?: 'token_mismatch' | 'token_expired' | 'scope_changed' | 'empty' | 'export_quota' | 'export_revoked';
+}
+export type ExportFiles = Record<'records.jsonl' | 'train.jsonl' | 'validation.jsonl' | 'manifest.json', string>;
+export interface ExportBundle {
+    exportId: string;
+    files: ExportFiles;
+}
+interface PendingOpRecord {
+    schema_version: 1;
+    kind: 'export' | 'withdraw' | 'consent';
+    scope_digest: string;
+    confirm_token: string;
+    created_at: number;
+}
+/**
+ * Build the deterministic export bundle. The export id hashes the schema
+ * versions, the canonical filters, and each included record's id + consent id
+ * (so an identical re-export of identical content under the same consent is
+ * idempotent, while a fresh consent cycle yields a fresh id).
+ */
+export declare function buildTrainingExportBundle(records: TrainingVaultRecord[], filters?: TrainingExportFilters, options?: {
+    quarantinedExcluded?: number;
+    expiredExcluded?: number;
+}): ExportBundle;
+/** Side-effect-free export preview: no files written, no token issued. */
+export declare function previewTrainingExport(directory: string, filters?: TrainingExportFilters): ExportPreview;
+export declare function consumeTrainingPendingOp(directory: string): void;
+/** Arm the single pending-op slot and return the 24-hex confirmation token. */
+export declare function issueTrainingConfirmToken(directory: string, scope: {
+    kind: 'export' | 'withdraw' | 'consent';
+    digest: string;
+}): string;
+type TokenCheck = {
+    ok: true;
+    record: PendingOpRecord;
+} | {
+    ok: false;
+    reason: 'token_mismatch' | 'token_expired';
+};
+export declare function checkTrainingConfirmToken(directory: string, kind: 'export' | 'withdraw' | 'consent', token: string): TokenCheck;
+declare function countExportDirs(directory: string): number;
+export declare const _internals: {
+    countExportDirs: typeof countExportDirs;
+    listTombstones: typeof listTrainingTombstones;
+};
+/**
+ * Execute the confirmed export: consumes the token (single use), re-derives
+ * the CURRENT scope digest from the vault + filters, writes the bundle
+ * atomically under `<root>/exports/<exportId>/`. Identical re-exports are
+ * idempotent (same destination, same bytes).
+ */
+export declare function executeTrainingExport(directory: string, filters: TrainingExportFilters | undefined, options: {
+    confirmToken: string;
+}): ExportExecution;
+export {};

package/dist/training/paths.d.ts

@@ -0,0 +1,20 @@
+/** Root directory name of the governed training tree, relative to `.swarm/`. */
+export declare const TRAINING_ROOT_NAME = ".swarm/training/v1";
+/** Resolved absolute root of the training tree for a project directory. */
+export declare function trainingRootDir(directory: string): string;
+/** `<root>/vault/records.jsonl` — the append-only vault record store. */
+export declare function trainingVaultRecordsPath(directory: string): string;
+/** `<root>/vault/quarantine.jsonl` — journal of quarantined corrupt lines. */
+export declare function trainingQuarantinePath(directory: string): string;
+/** `<root>/consent.json` — the durable, separately-consented grant record. */
+export declare function trainingConsentPath(directory: string): string;
+/** `<root>/tombstones.jsonl` — append-only withdrawal tombstones (never pruned). */
+export declare function trainingTombstonesPath(directory: string): string;
+/** `<root>/health.json` — bounded capture-health state (stop reasons, counters). */
+export declare function trainingHealthPath(directory: string): string;
+/** `<root>/exports` — contained dataset export bundles (`<exports>/<exportId>/`). */
+export declare function trainingExportsDir(directory: string): string;
+/** `<root>/pending-op.json` — single-slot confirmation token store. */
+export declare function trainingPendingOpPath(directory: string): string;
+/** Directory portion of a resolved training path (for mkdir before writes). */
+export declare function parentDirOf(filePath: string): string;

package/dist/training/redact.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Issue #2486: capture-time defense-in-depth redaction for training content.
+ *
+ * Mirrors the URL / credential-pattern classes of
+ * `sanitizeFailureEvidenceDisplay` (`src/failures/invocation-failure.ts`)
+ * WITHOUT that function's 512-byte display bounding — vault records keep the
+ * contracted 4096-char content budget. This is defense-in-depth, not a
+ * security boundary (same honest framing as #2369): the human consenting to
+ * capture is trusting the redactor class, and the recorded
+ * `redaction.version` pins which revision produced each stored record.
+ */
+/** Bumped when the pattern set changes; recorded on every vault record.
+ * v1's pattern set was extended pre-release (quoted-JSON credential shapes,
+ * scheme-prefixed tokens) before any v1 record shipped, so the first released
+ * revision covers the full set and no migration surface exists. */
+export declare const TRAINING_REDACTION_VERSION = 1;
+export interface RedactionResult {
+    content: string;
+    applied: boolean;
+    redactions: number;
+}
+/**
+ * Redact URL and credential patterns from already-bounded capture content
+ * (callers bound FIRST — a placeholder can be longer than the span it
+ * replaces, and truncating after redaction would collapse distinct inputs
+ * onto one identity). Pure; never throws (on internal failure the content is
+ * withheld rather than stored raw).
+ */
+export declare function redactTrainingContent(content: string): RedactionResult;