toolroll 0.5.0

package/dist/proof.d.ts

@@ -0,0 +1,513 @@
+/**
+ * The build's own claim, adjudicated against evidence the plane captured
+ * itself (`docs/PRIORITIES.md` Priority 2). Modelled line-for-line on the
+ * scout's report (`scout-report.ts`): fail closed, every problem reported at
+ * once, stable reasons, byte caps, control-character rejection on every
+ * string.
+ *
+ * The proof is a distinct deliverable from the terminal handoff every
+ * attempt writes (including `failed` ones, whose lists are deliberately
+ * compacted prose) — only a `completed` attempt owes one, and the plane
+ * judges it. A missing or malformed proof never fails the attempt or
+ * touches the commit; it only keeps the verdict off "verified".
+ *
+ * `adjudicate` is pure and does no I/O: every fact it reasons over — whether
+ * the proof artifact exists, whether the handoff and terminal diff exist,
+ * what the sealed diff-stat says, whether a screenshot's bytes actually are
+ * a PNG or JPEG, whether an approved verification command ran and what it
+ * returned — is gathered by the caller (`builder.ts`) and handed in as data,
+ * so the review itself stays testable without a filesystem or a database.
+ */
+import { type EvidenceKind } from "./scope.js";
+export type ProofVerdict = "verified" | "attested" | "short" | "refuted";
+/** One typed reference the proof cites to answer a criterion's required
+ * evidence: `ref` names an existing check's command, an existing
+ * screenshot's path, a path inside `changed`, or (kind `manual-review`)
+ * free-text pointing at nothing machine-checkable. Additive (v39): a
+ * criterion with no `evidence` array parses the same as one that always
+ * had none — legacy proofs, and every proof against a rubric-less scope,
+ * are untouched. */
+export type CriterionEvidenceRef = {
+    kind: EvidenceKind;
+    ref: string;
+};
+export type ParsedCriterion = {
+    id: string;
+    statement: string;
+    /** pending-verification asserts all agent-owned work is met; only the
+     * machine-owned final check remains. It never upgrades a legacy failure. */
+    verdict: "met" | "not-met" | "not-checked" | "pending-verification";
+    how: string;
+    /** v39: typed references answering a SIGNED criterion by exact id.
+     * `[]` for a criterion the agent added beyond the rubric, or for any
+     * proof written before this migration. */
+    evidence: CriterionEvidenceRef[];
+};
+/** v39: the rubric side of a criterion, as `adjudicate` reads it — the
+ * SIGNED id, statement, and required evidence kinds. Never `how` (never
+ * signed). Empty = nothing signed: `adjudicate` runs the v1 rules,
+ * byte for byte. */
+export type ApprovedCriterion = {
+    id: string;
+    statement: string;
+    evidence: readonly EvidenceKind[];
+};
+/** Only submission defects. A truthful not-met answer is not malformed. */
+export declare function proofSubmissionProblems(proof: ParsedProof, rubric: readonly ApprovedCriterion[]): string[];
+export type ParsedCheck = {
+    command: string;
+    exitCode: number;
+    summary: string;
+};
+/** A screenshot the agent claims proves UI-facing work. `path` is the
+ * repository-relative path the file lived at in the worktree when the
+ * agent wrote the proof — validated as a path shape here; validated as an
+ * actual bounded PNG/JPEG, and read, by the caller. */
+export type ParsedScreenshot = {
+    path: string;
+    caption: string;
+};
+export type ParsedProof = {
+    version: 1;
+    criteria: ParsedCriterion[];
+    checks: ParsedCheck[];
+    changed: string[];
+    caveats: string[];
+    screenshots: ParsedScreenshot[];
+};
+export type ProofProblem = {
+    reason: string;
+    message: string;
+};
+export type ProofParseResult = {
+    ok: true;
+    proof: ParsedProof;
+} | {
+    ok: false;
+    problems: ProofProblem[];
+};
+/** Caps are BYTES of UTF-8, matching the scout report's rule: a payload is
+ * the same size whatever script it is written in. */
+export declare const PROOF_LIMITS: {
+    readonly payload: number;
+    readonly criteria: 12;
+    readonly criterionId: 40;
+    readonly criterionStatement: 300;
+    readonly criterionHow: 500;
+    readonly evidencePerCriterion: 4;
+    readonly evidenceRef: 300;
+    readonly checks: 12;
+    readonly checkCommand: 300;
+    readonly checkSummary: 300;
+    readonly changed: 64;
+    readonly changedPath: 300;
+    readonly caveats: 8;
+    readonly caveat: 300;
+    readonly screenshots: 8;
+    readonly screenshotPath: 300;
+    readonly screenshotCaption: 300;
+};
+export declare function parseProof(raw: string): ProofParseResult;
+/** Re-serialize the validated shape, never the agent's raw bytes (the
+ * scout report's rule, `scout.ts`): what is stored and later hash-verified
+ * is exactly what this parser admitted, key order and all. */
+export declare function serializeProof(proof: ParsedProof): string;
+/** One caveat that admits an exception to a criterion the same proof marks
+ * `met` — the proof's own verdict disagreeing with its own words (atomic
+ * authority closure). A caveat NAMES a criterion when the criterion's exact
+ * id appears in it as a standalone token (`c1: …`, `(c1)`, `c1,c4`); a
+ * named criterion must then be `not-met` or `not-checked`. Nothing here is
+ * semantic — the machine cannot read a free-text caveat's meaning, so the
+ * contract is the token, stated in the brief and refused by the preflight
+ * before the attempt ends. */
+export type BlockingCaveat = {
+    caveat: string;
+    index: number;
+    criterionId: string;
+};
+/** Every (caveat, criterion) pair where the caveat names a criterion the
+ * proof marks `met` — the proof contradicts itself and cannot verify. In
+ * caveat order, then criterion order; `[]` for a proof at peace with its
+ * own caveats. */
+export declare function blockingCaveats(proof: Pick<ParsedProof, "criteria" | "caveats">): BlockingCaveat[];
+/** One check a criterion marked `met` cites that exited nonzero — the
+ * criterion's id, the exact cited command, and the exit code the proof
+ * itself reported. */
+export type FailedCheckCitation = {
+    criterionId: string;
+    ref: string;
+    exitCode: number;
+};
+/**
+ * Every check a criterion marked `met` cites that the proof's own `checks`
+ * list says exited nonzero (proof preflight closure): a met criterion
+ * resting on a failing command is not evidence, it is a contradiction the
+ * adjudicator fails the row for. A not-met or not-checked criterion may
+ * cite a failed check honestly — it is reporting, not claiming — so only
+ * `met` and `pending-verification` count here: pending asserts the agent's
+ * own checks already passed. A ref that resolves to no check is a different
+ * problem (an unresolved ref), not this one. In criterion order, then
+ * evidence order.
+ */
+export declare function failedMetChecks(proof: Pick<ParsedProof, "criteria" | "checks">): FailedCheckCitation[];
+/** The one actionable fact a failed check citation is reported as — the
+ * adjudicator's matrix detail and the agent's exit preflight say exactly
+ * this, so what the preflight refuses is what the plane would have said. */
+export declare function failedCheckWords(one: FailedCheckCitation): string;
+/**
+ * One caveat the machine cannot attribute (final authority closure): every
+ * caveat is an exception to a signed criterion, and it names that
+ * criterion's exact id as a standalone token — so a caveat that names NO
+ * known criterion (`unassigned`), or whose leading tag names an id nobody
+ * signed (`unknown`), is a claim the verdict cannot be reconciled with.
+ * An idea that is not an exception to any criterion belongs in the
+ * handoff's follow-ups, not here.
+ *
+ * THE KNOWN IDS ARE THE SIGNED ONES (final admission closure): when a
+ * rubric was signed, only its ids count — an extra criterion the proof
+ * authored for itself is the proof's own word, never signed authority, so
+ * a caveat tagged with it alone is unknown in preflight and adjudication
+ * alike. Only a proof with NO signed rubric may attribute its caveats to
+ * the criteria it answered.
+ */
+export type CaveatAttributionProblem = {
+    caveat: string;
+    index: number;
+    kind: "unassigned" | "unknown";
+    tags: string[];
+    /** The unknown tags the proof answered for itself (present only when a
+     * rubric was signed and at least one such tag exists): the words say
+     * the criterion is the proof's own, not that nobody answered it. */
+    answered?: string[];
+};
+export declare function caveatAttributionProblems(proof: Pick<ParsedProof, "criteria" | "caveats">, signedIds?: readonly string[]): CaveatAttributionProblem[];
+/** The words one attribution problem refuses in — shared by the plane's
+ * adjudication and the agent's exit preflight so both say the same thing. */
+export declare function caveatAttributionWords(problem: CaveatAttributionProblem): string;
+/** One claimed screenshot's fate once the caller has read its bytes off the
+ * worktree and checked them against the PNG/JPEG signature and size cap. */
+export type ScreenshotOutcome = {
+    path: string;
+    ok: boolean;
+    /** Set when ok is false — why the claimed file did not become evidence. */
+    problem?: string;
+    /** v39: set when ok is true — the bytes actually read, for the
+     * "meaningful byte size" half of the screenshot-evidence rule. */
+    bytes?: number;
+    /** v39: set when ok is true and dimensions could be read from the
+     * image header; null when the format parsed but dimensions could not
+     * be determined. Absent entirely for a pre-v39 caller. */
+    dims?: {
+        width: number;
+        height: number;
+    } | null;
+};
+/** v39: the floor a criterion's screenshot evidence must clear — "real,
+ * not placeholder-sized" in exact numbers (scope: "meaningful byte size
+ * and at least 320 by 200 dimensions"). */
+export declare const SCREENSHOT_EVIDENCE_MIN_BYTES = 1024;
+export declare const SCREENSHOT_EVIDENCE_MIN_WIDTH = 320;
+export declare const SCREENSHOT_EVIDENCE_MIN_HEIGHT = 200;
+/** What `captureTerminalDiff` gives back, restated for adjudication:
+ * whether the sealed stat parsed at all, whether the file list was cut to
+ * fit the cap, and the set of paths it names. A truncated stat cannot prove
+ * a claimed path is ABSENT, so rule 4 does not fire against one. */
+export type DiffStatFacts = {
+    captured: boolean;
+    truncated: boolean;
+    paths: ReadonlySet<string>;
+    /** Old name → destination for every entry git paired as a rename or
+     * move. The old name is provenance the stat keeps; it is never one of
+     * `paths`. Absent on a stat that recorded no renames. */
+    renames?: ReadonlyMap<string, string>;
+};
+/** How a proof's `changed` list compares with the sealed diff-stat, read
+ * before the first review so the same session can correct a receipt the
+ * sealed facts themselves explain (the Goose FinalOutputTool pattern: a
+ * precise error plus the exact expected value, never a silent rewrite).
+ *
+ * `problems` names every discrepancy, one line per path. `recoverable` is
+ * true only when the stat is complete and EVERY discrepancy is one the
+ * sealed input establishes on its own: the old name of a rename git
+ * paired (the diff holds its destination once), or a sealed path the
+ * list left out. Then `sealed` is the one admissible correction — the
+ * complete sealed inventory, sorted — and nothing else is. A claimed path
+ * the diff never had is an unexplained contradiction: reported, never
+ * recoverable, so adjudication refutes it by name. An unavailable or
+ * truncated stat proves nothing either way: no problems, not recoverable. */
+export type ChangedListReview = {
+    problems: string[];
+    recoverable: boolean;
+    sealed: string[] | null;
+};
+export declare function changedListProblems(changed: readonly string[], stat: DiffStatFacts | null): ChangedListReview;
+/** What a receipt-only correction may never touch: the exact criterion
+ * id/verdict pairs the agent submitted (comment 397, run 1648). A
+ * correction restates a signed statement or repairs an evidence reference
+ * against the exact rubric; it cannot move an answer (not-met or
+ * not-checked becoming pending-verification, or any other change of
+ * word), drop a criterion — an extra negative answer is a finding, not a
+ * formatting defect — or add one. One line per frozen pair broken. */
+export declare function frozenCriterionProblems(submitted: ParsedProof, corrected: ParsedProof): string[];
+/** Whether two readings of the sealed diff-stat state the same facts:
+ * the same capture standing, the same paths and the same rename
+ * provenance. Settlement reads the stat once before the receipt
+ * correction and re-reads it after that correction and after the final
+ * gate; a reading that differs is never adjudicated from the cached one. */
+export declare function sameDiffStatFacts(a: DiffStatFacts | null, b: DiffStatFacts | null): boolean;
+/** The plane's own re-run of the repository's approved verification
+ * command, when one is configured. `ran: false` covers both "none
+ * configured" and "configured but the run could not attempt it" — the
+ * latter is distinguished by `attemptFailed`, which downgrades to `short`
+ * rather than `refuted`: "we could not check" is not "the claim is false". */
+export type VerifyCommandFacts = {
+    configured: false;
+} | {
+    configured: true;
+    ran: false;
+    attemptFailed: true;
+    failure?: "spawn-failed" | "timed-out" | "dependency-missing" | "setup-stale" | "setup-failed" | "tracked-files-changed" | "setup-changed-files" | "checkout-moved" | "cleanliness-unavailable" | "dependency-still-missing" | "retry-spawn-failed" | "retry-timed-out" | "custody-lost";
+} | {
+    configured: true;
+    ran: true;
+    exitCode: number;
+    setupReplayed?: true;
+};
+export type AdjudicateInput = {
+    /** New captures may assess the signed goal directly when the builder wrote
+     * no optional proof. Historical calls retain their original contract. */
+    directAssessment?: boolean;
+    /** Controller-owned command label, never a builder-reported check. */
+    verificationCommand?: string;
+    /** Whether a `proof` artifact was stored at all for this run. */
+    proofArtifactPresent: boolean;
+    /** null when no proof artifact exists; otherwise the parse of its bytes. */
+    proofParse: ProofParseResult | null;
+    handoffPresent: boolean;
+    terminalDiffPresent: boolean;
+    terminalDiffCaptureStatus: "ok" | "failed" | null;
+    diffStat: DiffStatFacts | null;
+    verifyCommand: VerifyCommandFacts;
+    /** One entry per screenshot the proof claimed, in the order claimed.
+     * Empty when the proof named none. */
+    screenshots: readonly ScreenshotOutcome[];
+    /** v39: the SIGNED rubric this run's scope carried at dispatch, in id
+     * order. `[]` (the default) is the grandfathering promise made good:
+     * every rule below that reads this is skipped whole, and adjudication
+     * runs exactly the v1 rules that follow it. */
+    approvedCriteria?: readonly ApprovedCriterion[];
+    /** v51: the sealed review-context inventory's per-criterion coverage,
+     * when this run captured one. Attached to the matrix rows verbatim; it
+     * never moves the verdict — context is for the reviewer, the verdict is
+     * the machine's. Absent = no coverage key on any row. */
+    reviewContext?: readonly ({
+        id: string;
+    } & CriterionCoverage)[];
+};
+export type AdjudicateResult = {
+    verdict: ProofVerdict;
+    reasons: string[];
+    matrix: CriterionMatrixRow[];
+    machineVerdict?: ProofVerdict;
+};
+export declare const GOAL_ASSESSMENT_PENDING = "The saved evidence is awaiting independent goal assessment.";
+/** Legacy folds could only lower a verdict. Direct assessment also records an
+ * ordinary wait between green machine checks and the goal judgement. */
+export declare function reviewConflict(matrix: readonly CriterionMatrixRow[], machine: ProofVerdict | null, verdict: ProofVerdict | null): boolean;
+/** One row of the criterion-to-evidence matrix every result-facing surface
+ * renders identically (task, run, done, builds, board, inbox, chat —
+ * Priority 2's "one surface, six places" rule, extended). `pass`: every
+ * required evidence kind resolved. `missing`: the criterion went
+ * unanswered, or a required kind has no reference at all. `failed`: a
+ * reference exists but did not resolve (wrong check exit code, invalid
+ * screenshot, a changed-path claim the sealed diff does not back).
+ * `manual-review`: every required kind resolved EXCEPT at least one
+ * `manual-review` kind, which is never machine-verifiable by design — the
+ * row still needs a human's eyes even though nothing failed. */
+export type CriterionMatrixState = "pass" | "missing" | "failed" | "manual-review";
+/** Human sign-off is owed, with no other recorded evidence failure. This is
+ * presentation only; it never changes a verdict or grants acceptance. */
+export declare function manualReviewOnly(proof: {
+    verdict: string;
+    reasons: readonly string[];
+    matrix?: readonly CriterionMatrixRow[];
+} | null): boolean;
+export type CriterionMatrixRow = {
+    /** Controller-captured evidence for direct goal assessment. Kept separately
+     * from the final row state: available evidence is not a satisfied goal. */
+    assessment?: {
+        evidenceState: CriterionMatrixState;
+        detail: string[];
+    };
+    id: string;
+    statement: string;
+    requiredEvidence: readonly EvidenceKind[];
+    state: CriterionMatrixState;
+    /** Why this row is not a plain pass — empty for `pass`. */
+    detail: string[];
+    /** The proof's OWN typed evidence references for this criterion, exactly
+     * as it answered them — never only the required kinds, so a render can
+     * show what was actually cited (and link the artifact behind it, where
+     * one exists). `[]` when the criterion went unanswered. */
+    answered: readonly CriterionEvidenceRef[];
+    /** v40: the independent reviewer's judgement on this criterion, folded in
+     * by `foldReview` after `adjudicate` has already run — `null` until a
+     * review has settled, and for every criterion no review addressed. */
+    review: {
+        judgement: CriterionJudgementWord;
+        note: string;
+        author: string;
+    } | null;
+    /** v51 (inherited review context): where an independent reviewer's
+     * evidence for this criterion comes from — this run's own patch, a
+     * sealed context inventory, or nowhere (a named gap). Present only on
+     * runs that captured an inventory (revisions); absent on every other
+     * run, which reads exactly as before: judged from the patch. */
+    coverage?: CriterionCoverage;
+};
+/** The per-criterion context projection stored on the matrix row (v51),
+ * copied from the sealed inventory's coverage at adjudication. */
+export type CriterionCoverage = {
+    state: "patch" | "context" | "gap";
+    /** Same id AND statement as the source run's signed rubric. */
+    inherited: boolean;
+    /** Provenance tokens (`ctx-<n>`) for complete files or explicitly partial
+     * ancestor patches. A partial patch keeps state `gap`, even with eligible
+     * prior support; neither property supplies a current judgement. */
+    items: string[];
+    /** Why context is missing or partial — empty for `patch` and `context`. */
+    gaps: string[];
+    /** Whether an earlier review of the source run may be weighed as
+     * context: eligible only with the same text, verified ancestry, and
+     * byte-identical relevant code. Never a judgement on this run. */
+    priorSupport: "eligible" | "invalid" | "none";
+};
+/** v40: the three words an evidence reviewer can say about one signed
+ * criterion, and nothing else — `cannot-tell` is a CORRECT answer whenever
+ * the sealed patch alone cannot settle a criterion, not a hedge. */
+export type CriterionJudgementWord = "upholds" | "contradicts" | "cannot-tell";
+/** One reviewer's typed judgement on one signed criterion (v40), ready to
+ * fold into an already-adjudicated result. */
+export type CriterionJudgement = {
+    id: string;
+    judgement: CriterionJudgementWord;
+    note: string;
+    author: string;
+};
+/**
+ * Ordered rules; the first that fires wins. Every reason is a sentence the
+ * surfaces print verbatim — this function is the only place that decides
+ * wording, so the task page, run page, board, CLI, and chat cards cannot
+ * drift from each other (Priority 2, the "one surface, six places" rule).
+ *
+ * v39: `input.approvedCriteria` empty runs the rules below byte for byte —
+ * the grandfathering promise. Non-empty inserts the rubric rules AFTER the
+ * diff-stat and verify-command rules and BEFORE the legacy unmet check,
+ * exactly as approved in the v2 plan: a proof that alters a signed
+ * criterion's statement is REFUTED (the same severity as any other
+ * altered term); an unanswered criterion, an evidence reference that does
+ * not resolve, or a criterion capped at manual-review is SHORT (a gap, or
+ * a review a machine cannot finish, never a lie). The legacy self-declared
+ * `verdict` field still runs afterward and can only downgrade further,
+ * never upgrade past what the evidence proved.
+ *
+ * The changed[] vs. sealed-diff exactness check (review finding, post-v39)
+ * runs GLOBALLY, ahead of the rubric rules and independent of whether any
+ * criterion cites changed-path evidence at all — a rubric with none of
+ * those must not let an untruthful or incomplete changed[] through
+ * unchecked. An unavailable or truncated diff-stat cannot prove either
+ * direction, so it can only ever produce SHORT, never REFUTED.
+ */
+/** An optional screenshot inventory carries no builder-authored completion
+ * claims. The existing bounded parser still validates every supplied field. */
+export declare function artifactManifestOnly(proof: ParsedProof): boolean;
+export declare function adjudicate(input: AdjudicateInput): AdjudicateResult;
+/**
+ * Folds an independent reviewer's per-criterion judgements into an ALREADY
+ * ADJUDICATED result (v40, evidence-review-v1) — pure, and never re-derives
+ * verdict facts that were not persisted (verify-command outcome, screenshot
+ * bytes): it folds over the STORED result, it does not re-run `adjudicate`.
+ *
+ * Three rules, and they are the whole contract:
+ *  - `contradicts` -> refuted. A second reader saying a signed term is not
+ *    met is the same severity as a proof that altered the term: the
+ *    matching row becomes `failed`, with the reviewer's note as an
+ *    attributed `detail` line.
+ *  - `cannot-tell` changes nothing. Recorded and rendered, never moves the
+ *    verdict — "we could not check" is not "the claim is false" (the same
+ *    maxim `adjudicate` already lives by for an unavailable diff or a
+ *    failed verify-command attempt).
+ *  - `upholds` never upgrades. A `short` (or `attested`) run stays exactly
+ *    what it was — this is the law that stops a second model laundering a
+ *    bad proof, and the reason `foldReview` can only LOWER a verdict, never
+ *    raise one.
+ *
+ * A judgement naming a criterion absent from `base.matrix` is ignored —
+ * `parseReview` already refuses a payload naming an unsigned id, so this is
+ * belt and suspenders, never a live path.
+ */
+export declare function foldReview(base: AdjudicateResult, judgements: readonly CriterionJudgement[]): AdjudicateResult;
+/**
+ * SEMANTIC coverage (v51): what an INDEPENDENT reviewer actually settled,
+ * shown distinctly from the machine proof the matrix `state` records. One
+ * projection for the task page, run page, receipt, chat card, and CLI —
+ * never a second status engine: it reads the stored matrix and the run's
+ * signed quality mode and moves nothing.
+ *
+ * The policy is explicit and unchanged from v41: under `default` an
+ * independent review is optional, so absent or uncertain judgements are
+ * reported and nothing is "unsatisfied"; under `strict` (Strict / release)
+ * independent coverage is REQUIRED, and only `upholds` satisfies it — a
+ * `cannot-tell` is an honest answer that leaves the criterion uncovered,
+ * a `contradicts` is a failure, and an unreviewed criterion is uncovered.
+ * `cannot-tell` never satisfies required coverage under either policy.
+ * Context gaps (`coverage.state === "gap"`) are listed so a reader sees
+ * WHY a reviewer could not tell, in the same words the inventory used.
+ */
+export type SemanticCoverage = {
+    policy: "default" | "strict";
+    /** Independent coverage is required by the signed policy. */
+    required: boolean;
+    total: number;
+    upheld: string[];
+    contradicted: string[];
+    uncertain: string[];
+    unreviewed: string[];
+    /** Criterion ids with a named context gap, with the reasons — every
+     * row that carries one, whether or not the patch still judges it. */
+    contextGaps: {
+        id: string;
+        gaps: string[];
+    }[];
+    /** null when no review has folded at all (nothing to satisfy or fail);
+     * otherwise whether every criterion is upheld — the only reading under
+     * which required coverage counts as satisfied. */
+    satisfied: boolean | null;
+};
+export declare function semanticCoverage(matrix: readonly CriterionMatrixRow[], policy: "default" | "strict"): SemanticCoverage;
+/** The coverage in plain words — one line every surface prints the same
+ * way. `[]` for a run with no rubric: nothing to cover. */
+export declare function coverageWords(coverage: SemanticCoverage): string[];
+/** The pass fraction of a criterion matrix — the one number every list
+ * surface (board, chat) needs, shared so "N/M criteria" is computed in
+ * exactly one place (v40 closes the two hand-rolled copies). */
+export declare function passFraction(matrix: readonly CriterionMatrixRow[]): {
+    passed: number;
+    total: number;
+};
+/** The matrix in plain lines, for a text surface (the CLI, `brief`) — the
+ * same shared vocabulary `criterionMatrixHtml` renders in the console, so
+ * the words never drift between the two (Priority 2's rule, extended). */
+export declare function matrixWords(matrix: readonly CriterionMatrixRow[]): string[];
+/** One criterion's context standing in words — shared by the CLI matrix
+ * and the console badge title so the two never drift. */
+export declare function coverageStateWords(coverage: CriterionCoverage): string;
+/** Plain words for a verdict, shared by every surface (the `summary.ts`
+ * pattern) so the task page, run page, board, CLI, and chat cannot say
+ * three different things about the same run. */
+export declare function verdictWords(verdict: ProofVerdict, reasons: readonly string[]): {
+    word: string;
+    detail: string;
+};
+/** The `data-dispatch-status` token a page's CSS and tests key off. */
+export declare function dispatchStatusToken(verdict: ProofVerdict): "complete-verified" | "complete-with-evidence" | "needs-verification" | "proof-refuted";