toolroll 0.5.0

package/dist/scope.d.ts

@@ -0,0 +1,695 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { Store, Mutation } from "./store.js";
+import type { QualityMode } from "./quality.js";
+import type { AuthMode } from "./keys.js";
+import type { ProviderId } from "./provider.js";
+import { type PhaseRoute, type ReadinessLookup, type RiskLevel } from "./phase-routing.js";
+export declare function hashToken(token: string): string;
+/**
+ * A person's chosen password gets a real KDF. Bare sha256 is fine for the
+ * minted 256-bit tokens — nothing brute-forces that space — but a password a
+ * human picked lives in a much smaller one, so it is salted and stretched
+ * (scrypt), and the stored string names its own scheme so both generations
+ * of credential verify side by side.
+ */
+export declare function hashPassword(password: string): string;
+/** Verify a presented secret against a stored hash of either scheme. */
+export declare function verifyCredential(stored: string, presented: string): boolean;
+/**
+ * The execution profile (Parity II foundations, findings 1/2/13/14/22):
+ * WHAT RUNS, bound into what the operator signs. A discriminated union —
+ * each variant asserts only what its provider actually supports, with the
+ * EFFECTIVE constants the argv will carry, never aspirations. The model
+ * is always an exact string and always emitted on the argv: nothing in an
+ * approved profile is left for later resolution to decide (ruling 10).
+ * providerVersion and resolvedFrom are PROVENANCE and live outside these
+ * shapes (finding 20) — they never enter a digest.
+ */
+export declare const CLAUDE_LIMITS: {
+    readonly maxTurns: 1000;
+    readonly repairMaxTurns: 4;
+    readonly timeoutSeconds: 1200;
+    readonly repairTimeoutSeconds: 300;
+};
+export declare const CODEX_SHAPED_LIMITS: {
+    readonly timeoutSeconds: 1200;
+    readonly repairTimeoutSeconds: 300;
+};
+export declare const GEMINI_LIMITS: {
+    readonly timeoutSeconds: 1200;
+    readonly repairTimeoutSeconds: 300;
+};
+export type ClaudeProfile = {
+    provider: "claude";
+    /** The exact model string the argv carries. Never empty, never "default". */
+    model: string;
+    /** Claude's real argv semantic. `auto` is the safe unattended posture:
+     * Claude's classifier allows routine project work and stops risky acts.
+     * `acceptEdits` remains readable for approvals created before auto mode;
+     * bypass is still a separate, explicitly signed escalation. */
+    permissionArgv: "auto" | "acceptEdits" | "bypassPermissions";
+    maxTurns: number;
+    repairMaxTurns: number;
+    timeoutSeconds: number;
+    /** Absent on legacy approvals, where timeoutSeconds remains an absolute
+     * wall clock. New approvals bind an activity watchdog instead. */
+    timeoutKind?: "idle";
+    repairTimeoutSeconds: number;
+    /** Exact model for repairs, or the stable literal "inherit" (= the
+     * build model, which is itself exact). */
+    repairModel: string;
+};
+export type CodexShapedProfile = {
+    provider: "codex" | "openrouter";
+    model: string;
+    /** Codex's real constraint surface. Full access is rendered with the
+     * CLI's combined --dangerously-bypass-approvals-and-sandbox switch; the
+     * value here records the resulting sandbox posture in the signed profile. */
+    sandboxMode: "workspace-write" | "danger-full-access";
+    /** The tool has no argv turn limit. New approvals use an inactivity
+     * watchdog; legacy approvals retain their signed wall-clock bound. */
+    maxTurns: "unsupported";
+    repairMaxTurns: "unsupported";
+    timeoutSeconds: number;
+    timeoutKind?: "idle";
+    repairTimeoutSeconds: number;
+    repairModel: string;
+};
+export type GeminiProfile = {
+    provider: "gemini";
+    model: string;
+    /** Gemini's real dial (`--approval-mode`): auto_edit auto-approves edit
+     * tools only (the acceptEdits parallel); yolo auto-approves everything
+     * and files only where claude files bypassPermissions. `default` and
+     * `plan` are not profile values — headless `default` just fails tools,
+     * and `plan` is read-only while the protocol requires workspace writes. */
+    approvalArgv: "auto_edit" | "yolo";
+    /** No argv turn bound exists (v0.57.0 audit); new approvals use an
+     * inactivity watchdog, while legacy approvals keep their signed clock. */
+    maxTurns: "unsupported";
+    repairMaxTurns: "unsupported";
+    timeoutSeconds: number;
+    timeoutKind?: "idle";
+    repairTimeoutSeconds: number;
+    repairModel: string;
+};
+export type ExecutionProfile = ClaudeProfile | CodexShapedProfile | GeminiProfile;
+/** The durable unattended permission choices exposed by the console. The
+ * provider-specific argv is still what gets sealed into an approval; this
+ * small cross-provider type is only the operator-facing policy. */
+export type UnattendedPermissionMode = "auto" | "bypassPermissions";
+export declare const PROFILE_DIGEST_VERSION = 2;
+/** The stored snapshot bytes: version embedded IN the snapshot (finding 17). */
+export declare function canonicalProfileJson(profile: ExecutionProfile): string;
+/** sha256 over a domain-separated canonical encoding, truncated to the
+ * same 128 bits every other safety digest here uses (finding 21). */
+export declare function profileDigestOf(profile: ExecutionProfile): string;
+export declare const CHAIN_DIGEST_VERSION = 1;
+/** One entry of an approved fallback chain: the WHOLE execution profile
+ * (so a claude->codex switch cannot inherit one provider's repair config)
+ * and the auth mode it runs under. Order is authority. */
+export type ChainEntry = {
+    profile: ExecutionProfile;
+    authMode: "subscription" | "api-key";
+};
+/** The stored snapshot bytes for a chain: the version rides IN the
+ * snapshot, exactly like a single profile's. */
+export declare function canonicalChainJson(entries: readonly ChainEntry[]): string;
+/** sha256 over a domain-separated canonical chain encoding — a DIFFERENT
+ * domain from a single profile ("standing-orders:chain:" vs
+ * ":profile:"), so a chain digest can never collide with a profile
+ * digest, truncated to the same 128 bits. */
+export declare function chainDigestOf(entries: readonly ChainEntry[]): string;
+/**
+ * One chain entry's BINDING digest (E3d): the profile digest + auth mode
+ * under their own domain. A run row pins this at admission (or base-cycle
+ * open), and the dispatch proof re-derives it from the approved chain at
+ * the run's index — so nothing downstream can swap WHICH entry a run
+ * spends as, in model or in credential.
+ */
+export declare function entryDigestOf(entry: ChainEntry): string;
+/** Strict re-hydration of a stored chain — every entry proved through the
+ * single-profile rehydrator; anything unexpected is null. */
+export declare function chainFromJson(json: string | null): ChainEntry[] | null;
+/**
+ * THE STRICT RAW TERMS READ (raw authority repair): the stored columns of
+ * a scope or a standing order, proved EXACTLY — a JSON list is a list of
+ * strings and nothing else, a rubric is a list of whole criteria carrying
+ * exactly the keys this code writes and parsing with zero problems, a
+ * budget is a safe integer or null. Nothing is filtered, defaulted, or
+ * coerced on the way to an authority: the words say what is wrong, and
+ * the caller refuses.
+ */
+export declare function exactStringList(value: unknown, what: string): {
+    ok: true;
+    list: string[];
+} | {
+    ok: false;
+    problem: string;
+};
+export declare function exactAcceptance(value: unknown): {
+    ok: true;
+    criteria: AcceptanceCriterion[];
+} | {
+    ok: false;
+    problem: string;
+};
+export declare function exactSafeIntegerOrNull(value: unknown, what: string): string | null;
+/**
+ * The longest clock a snapshot may bind, in seconds: a JavaScript timer
+ * holds at most 2^31 − 1 milliseconds, and a bound past that fires at
+ * once instead of never — a "timeout" that is not one. Every stored
+ * clock is proved against this before it is believed (v48 integrity).
+ */
+export declare const MAX_TIMER_SECONDS: number;
+/** A positive integer the platform can represent exactly. */
+export declare function safePositiveInteger(v: unknown): v is number;
+/** A positive whole number of seconds a timer can actually wait. */
+export declare function timerSafeSeconds(v: unknown): v is number;
+/**
+ * Whether an object carries exactly the named keys: every required key
+ * present, only optional keys otherwise, nothing unknown. Stored snapshots
+ * are proved this way so a key this code never writes is a refusal, never
+ * an ignorable extra.
+ */
+export declare function exactKeys(value: object, required: readonly string[], optional: readonly string[]): boolean;
+/** Strict re-hydration of a stored snapshot — every field type-proved;
+ * anything unexpected is null, never a guess. */
+export declare function profileFromJson(json: string | null): ExecutionProfile | null;
+export type EvidenceKind = "check" | "screenshot" | "changed-path" | "manual-review";
+export declare const EVIDENCE_KINDS: readonly EvidenceKind[];
+export type AcceptanceCriterion = {
+    id: string;
+    /** The signed outcome statement. Restating it differently in a proof is
+     * refuted, not short — the same severity as any other altered term. */
+    statement: string;
+    /** Advisory guidance for HOW to satisfy the statement. Never enters the
+     * digest and is never a term the approval binds — an operator can leave
+     * it, change it, or ignore it without touching what was signed. */
+    how: string | null;
+    /** SIGNED: the evidence kinds a proof must reference, by exact id, to
+     * answer this criterion. Never empty. */
+    evidence: EvidenceKind[];
+};
+export declare const ACCEPTANCE_LIMITS: {
+    readonly criteria: 12;
+    readonly id: 40;
+    readonly statement: 1000;
+    readonly how: 500;
+    readonly evidenceKinds: number;
+};
+export type AcceptanceProblem = {
+    reason: string;
+    message: string;
+};
+/**
+ * Parse a rubric from already-JSON-parsed input (the planner's handoff, a
+ * console form, a routine or template definition): fail closed, every
+ * problem reported at once, stable reasons — the same discipline as every
+ * other quoted-data parser in this codebase (`plan.ts`, `proof.ts`). An
+ * absent or empty `value` parses to `[]` with no problems: whether that is
+ * ALLOWED is a question for the caller (`propose` says yes; every authoring
+ * road says no), never for this parser.
+ */
+export declare function parseAcceptanceCriteria(value: unknown): {
+    criteria: AcceptanceCriterion[];
+    problems: AcceptanceProblem[];
+};
+/** The exact bytes a rubric's SIGNED terms reduce to for the digest: sorted
+ * by id, `how` dropped (advisory, never signed), evidence kinds sorted so
+ * two equivalent lists never digest differently. */
+/**
+ * The plain-text rubric encoding shared by every non-JSON authoring
+ * surface — the console's rubric textarea (one line each) and the CLI's
+ * `--acceptance` flag (one line per `;`-separated entry): one criterion
+ * per line, shaped
+ *
+ *   [id:] statement | evidence,kinds [| how]
+ *
+ * `id` is optional — auto-numbered `c1`, `c2`, ... in encounter order when
+ * every line omits it, so a person can write the rubric without inventing
+ * ids by hand. This function never validates; it only turns text into the
+ * same plain-object shape `parseAcceptanceCriteria` already validates, so
+ * both entry points can never drift on what counts as a valid criterion.
+ */
+/** The one criterion a filing may carry when nobody has written the rubric
+ * yet: the console's scout follow-ups file with it, and `--acceptance plan`
+ * on the command line expands to it. A mode with planAuto sends such a
+ * filing to the planner instead of building against it. */
+export declare const PLACEHOLDER_RUBRIC_STATEMENT = "The operator has reviewed this follow-up and written a real rubric before approving it.";
+export declare const PLACEHOLDER_RUBRIC: AcceptanceCriterion[];
+export declare function rubricIsPlaceholder(acceptance: readonly {
+    statement: string;
+    evidence: readonly string[];
+}[]): boolean;
+/** Split a `--acceptance` rubric into criteria. Criteria are `;`-separated,
+ * but a `;` inside a statement must not split it: every criterion ends with
+ * its `|<evidence kinds>` part, so a segment with no `|` is the front of the
+ * next one and is glued back on. The single word `plan` means the placeholder. */
+export declare function splitAcceptanceRubric(text: string): string[];
+export declare const isCommitSha: (value: string) => boolean;
+export declare function acceptanceLinesToInput(lines: readonly string[]): unknown[];
+/** The inverse of `acceptanceLinesToInput`, for pre-filling an editor from
+ * a stored rubric — round-trips through `parseAcceptanceCriteria` exactly. */
+export declare function acceptanceToLines(criteria: readonly AcceptanceCriterion[]): string[];
+export declare function canonicalAcceptance(criteria: readonly AcceptanceCriterion[]): {
+    id: string;
+    statement: string;
+    evidence: EvidenceKind[];
+}[];
+export type Scope = {
+    taskId: string;
+    /** What success looks like, in the operator's words. */
+    goal: string;
+    /** What this task is explicitly not allowed to turn into. */
+    outOfScope: string | null;
+    /** Paths the work is expected to touch. Advisory, and worth stating. */
+    touches: string[];
+    /** v39: the signed acceptance rubric. `[]` on every scope proposed before
+     * this migration and on any legacy road that still calls `propose`
+     * directly — a scope-producing ROAD enforces non-emptiness, never this
+     * type, never `propose`, never the digest. */
+    acceptance: AcceptanceCriterion[];
+    /** v41: evidence policy, signed with the scope. Default is omitted from
+     * the digest so every pre-v41 approval remains byte-for-byte valid. */
+    qualityMode?: QualityMode;
+    /** The dollar cap per build attempt, integer micro-dollars (v15) —
+     * approved spend, restated at the yes, enforced by the provider's own
+     * stop. NULL = no per-attempt cap was asked for. */
+    budgetMicrousd: number | null;
+    proposedAt: string;
+    /** Of the scope as written. Approval is bound to this exact value. */
+    digest: string;
+    approvedAt: string | null;
+    approvedBy: string | null;
+    /** The digest that was actually agreed to, which may now be stale. */
+    approvedDigest: string | null;
+    /** How the approval happened (v29): 'password' = the ceremony;
+     * 'mode' = sealed by the signer's live mode (modeDigest names it). */
+    approvalBasis?: "password" | "mode" | null;
+    modeDigest?: string | null;
+    /** v24 (optional so hand-built scopes in tests stay valid): the working
+     * execution profile, its resolution state, and the immutable snapshot
+     * the approval act sealed. */
+    profile?: ExecutionProfile | null;
+    profileState?: "resolved" | "unresolved";
+    unresolvedReason?: string | null;
+    approvedProfile?: ExecutionProfile | null;
+    /** The raw snapshot bytes the row carries (v48 integrity): what the
+     * strict stored-scope projection proves, exactly, before any seal or
+     * consent surface believes the rehydrated `profile`. */
+    profileJson?: string | null;
+    approvedProfileJson?: string | null;
+    digestVersion?: number;
+    /** v30 fallback chains. `proposedChainJson` is the WORKING chain snapshot
+     * the digest bound (present only when the repo has configured fallbacks);
+     * `approvedChainJson` is the immutable snapshot the seal COPIED from it;
+     * `approvalKind` names which the approval sealed. All undefined/null on a
+     * legacy single-profile scope — every scope until an operator configures a
+     * fallback chain. The runtime re-derives the active entry from
+     * `approvedChainJson`, never from mutable config. */
+    proposedChainJson?: string | null;
+    approvedChainJson?: string | null;
+    approvalKind?: "profile" | "chain";
+    /** v47 phase routing: the signed risk level, the WORKING canonical route
+     * the digest bound, and the immutable snapshot the seal COPIED from it.
+     * `routeEra` is the durable marker: null on a row PROVEN to predate v47
+     * (legacy — its sealed profile alone governs), the route version on every
+     * row filed since — for those, a missing or unreadable route is corrupt
+     * and fails closed everywhere. */
+    riskLevel?: RiskLevel;
+    /** A prepared commit the machine checks out instead of running an agent
+     * (v69). Signed into the digest; must descend from the task's base. */
+    candidate?: string | null;
+    proposedRouteJson?: string | null;
+    approvedRouteJson?: string | null;
+    routeEra?: number | null;
+    /** THE RAW TERMS VERDICT (raw authority repair): null when every stored
+     * term and metadata column read back EXACTLY — touches a JSON list of
+     * strings, the rubric a list of whole criteria with no unknown key, the
+     * budget a safe integer or null, the quality mode, risk level, approval
+     * kind, profile state, digest version, and route era each one of the
+     * words this code writes — and the words when one did not. The lenient
+     * fields above (`touches`, `acceptance`, …) are the console's reading;
+     * every authority — consent, seal, chain, dispatch — refuses on a
+     * non-null verdict, so filtering, defaulting, or coercion can never
+     * turn a corrupt row into authority. Undefined on a hand-built scope. */
+    termsProblem?: string | null;
+    /** Who wrote the text (mate arc, ruling 2): a confirmed mate proposal,
+     * the coordinator, a scout, or a person (null). Read raw and proved by
+     * `termsProblem` — a word outside these is a stated problem, never a
+     * value that slips past the mate quarantine at a mode seal. */
+    proposedVia?: "mate" | "coordinator" | "scout" | null;
+};
+export type Approval = {
+    approved: true;
+    at: string;
+    by: string;
+} | {
+    approved: false;
+    reason: "none" | "changed" | "never-proposed";
+};
+export type ScopeInput = {
+    taskId: string;
+    /** v102: the person writing these words (a web edit, a chat confirmation, a coding hand-off); the requester rule refuses them. */
+    author?: string;
+    goal: string;
+    outOfScope?: string | null;
+    touches?: readonly string[];
+    /** v24: an EXPLICIT profile skips resolution in the store (routine
+     * firings and the demo's illustrative scopes use this road). */
+    profile?: ExecutionProfile;
+    /** A task-level permission choice. When absent, the task's stored choice
+     * (if any), then the installation default, decides the concrete profile. */
+    permissionMode?: UnattendedPermissionMode;
+    /** Concrete task quality choice. When absent, the task override and then
+     * the installation default are resolved by the store. */
+    qualityMode?: QualityMode;
+    /** v69: a prepared commit to install as this attempt — no agent runs. */
+    candidate?: string | null;
+    /** v47: the task's declared risk. When absent, the task's stored choice
+     * (if any), else routine. A durable TASK choice, like qualityMode. */
+    riskLevel?: RiskLevel;
+    /** Integer micro-dollars per build attempt; digest-bound when present. */
+    budgetMicrousd?: number | null;
+    /** The mode road's escalated filing default (C7): the resolved profile
+     * seals claude bypassPermissions / gemini yolo; codex-shaped unchanged. */
+    posture?: "escalated";
+    /** Who wrote this text (mate arc, ruling 2): `mate` for a confirmed mate
+     * proposal — mode coverage then never seals it; a human rewrite clears it. */
+    proposedVia?: "mate" | "coordinator" | null;
+    /** v39: the signed acceptance rubric. Absent digests exactly like `[]` —
+     * see `Scope.acceptance`. `propose` itself never requires this to be
+     * non-empty; the roads that call it do. */
+    acceptance?: readonly AcceptanceCriterion[];
+    now: Date;
+    mutation?: Mutation;
+};
+/**
+ * The exact bytes an operator agreed to.
+ *
+ * Every field that constrains the work goes in. If a change to a field would
+ * change what an operator would have said, it has to move the digest, or the
+ * approval it invalidates would be an approval of something else.
+ */
+export declare function digestOf(scope: Pick<Scope, "goal" | "outOfScope" | "touches"> & {
+    budgetMicrousd?: number | null;
+    /** v39: the rubric, folded in ONLY when non-empty — the same absent/`[]`
+     * equivalence budgetMicrousd has always used, so a scope proposed before
+     * this migration, or by a road that never sends one, digests to exactly
+     * what it digested to before this field existed. `how` never enters
+     * here (advisory, never signed); evidence kinds do. */
+    acceptance?: readonly AcceptanceCriterion[];
+    qualityMode?: QualityMode;
+    /** v69: a prepared commit, folded in only when present so every earlier
+     * digest is untouched. */
+    candidate?: string | null;
+}, target?: ExecutionProfile | null | {
+    chain: readonly ChainEntry[];
+}, route?: PhaseRoute | null): string;
+export declare function propose(store: Store, input: ScopeInput): Scope;
+export type GuardedProposeResult = {
+    ok: true;
+    scope: Scope;
+} | {
+    ok: false;
+    reason: "changed" | "claimed" | "bad-goal" | "bad-out-of-scope" | "bad-touches" | "bad-acceptance" | "acceptance-required";
+    message?: string;
+};
+/**
+ * A scope edit from a surface where the editor might be stale — two browser
+ * tabs, a form submitted after the world moved. `sawDigest` names the version
+ * the editor was looking at (null: they saw no scope at all); a mismatch is a
+ * refusal, never a silent overwrite of somebody else's words. Edits are also
+ * refused while a live claim holds the task: the running build read its scope
+ * at start, and rewording the agreement under it would make the digest lie
+ * about what the work was agreed to. Field caps and control-character rules
+ * live here because every one of these strings will later be rendered.
+ *
+ * v39: this is a scope-producing ROAD, not the `propose` primitive, so it is
+ * where the rubric becomes mandatory — every edit through here (a fresh
+ * proposal or a rewrite of an already-approved one) must carry at least one
+ * criterion, or it is refused with a clear `acceptance-required` reason
+ * rather than silently filing without one. A scope that already carries a
+ * live, unrewritten approval from before this code existed never reaches
+ * this function again unless somebody edits it — which is exactly when the
+ * requirement should start applying.
+ */
+export declare function proposeGuarded(store: Store, input: Omit<ScopeInput, "acceptance"> & {
+    sawDigest: string | null;
+    taskRef: number | null;
+    acceptance?: unknown;
+}): GuardedProposeResult;
+/**
+ * A person says yes.
+ *
+ * Takes the digest they were shown, so agreeing to a scope that changed while
+ * they were reading it fails rather than silently approving the new one.
+ */
+/**
+ * Register somebody who is allowed to agree to scopes.
+ *
+ * The token is shown once and stored only as a hash, exactly like a runner's.
+ * It exists because an approval nobody has to authenticate is not a gate: an
+ * agent that can run these commands can read a scope's digest out of `task
+ * show` and approve its own brief with it. Requiring a credential the agent
+ * was never given is what keeps "a person agreed to this" true.
+ */
+export type AddApproverResult = {
+    ok: true;
+    name: string;
+    token: string;
+    bootstrap: boolean;
+    chosen: boolean;
+} | {
+    ok: false;
+    reason: "not-an-approver" | "weak-password";
+};
+export declare function addApprover(store: Store, name: string, now: Date, by?: {
+    name: string;
+    token: string;
+}, newToken?: () => string, mutation?: Mutation, 
+/** A password the person chose. Absent, a token is minted and shown once. */
+password?: string): AddApproverResult;
+export type ApproveResult = {
+    ok: true;
+    scope: Scope;
+} | {
+    ok: false;
+    reason: "no-scope" | "changed" | "no-approvers" | "not-an-approver" | "profile-unresolved" | "unrouted";
+}
+/** v102: the project's approval rules stopped it — the requester can't approve, protected work needs a person —
+ * or recorded this person's yes and needs a second one (`second-approver`). */
+ | {
+    ok: false;
+    reason: "requester" | "person-required";
+} | {
+    ok: false;
+    reason: "second-approver";
+    have: number;
+    need: number;
+    already: boolean;
+}
+/** Sprint 8: the organisation policy stops these terms (a provider, a model, the permission ceiling); `message` says which. */
+ | {
+    ok: false;
+    reason: "policy";
+    message: string;
+};
+/**
+ * Whether this name-and-token pair is a person the store knows. Shared by
+ * every act that requires a human's authority — approving a scope, answering
+ * a decision — because "who said yes" must never be a string the caller
+ * typed. Fails closed: with no approver registered there is nobody who can
+ * agree to anything, and treating that as "authority is not required here"
+ * would make the gate optional — which is the same as not having one.
+ */
+/**
+ * IDENTITY, split from authority (modes chain, D2/E2): who this credential
+ * belongs to and what standing they hold. Viewers authenticate here and
+ * read; every consequential act goes through authenticateApprover below,
+ * which additionally demands ACTIVE approver standing — so the forty
+ * ceremony sites enforce the role without one of them changing.
+ */
+export declare function authenticateAccount(store: Store, by: string, secret: string): {
+    ok: true;
+    role: "approver" | "viewer";
+    generation: number;
+} | {
+    ok: false;
+    reason: "no-approvers" | "unknown" | "revoked" | "locked";
+};
+/**
+ * v100: someone who signed in with the identity provider moments ago has no
+ * password to type again. The console marks such a request with this, for
+ * that person only, and an EMPTY password then stands for the fresh sign-in
+ * at every step-up that reaches `authenticateApprover` (scope and routine
+ * approval, chat-action review, the console's own ceremonies). A typed
+ * password is always checked, and nothing else stands in.
+ */
+export declare const freshIdentitySignIn: AsyncLocalStorage<{
+    actor: string | null;
+}>;
+export declare const hasFreshIdentitySignIn: (by: string) => boolean;
+export declare function authenticateApprover(store: Store, by: string, token: string, repo?: string | null): {
+    ok: true;
+} | {
+    ok: false;
+    reason: "no-approvers" | "not-an-approver";
+};
+/**
+ * What an approval needs besides the password (v100: an identity-provider
+ * sign-in moments ago stands in for the password; nothing stands in for
+ * this): an active account in the approver role, with access to the project.
+ */
+export declare function approverStanding(store: Store, by: string, repo?: string | null): {
+    ok: true;
+} | {
+    ok: false;
+    reason: "no-approvers" | "not-an-approver";
+};
+/**
+ * C1's atomic road: file the scope AND seal its approval in ONE
+ * transaction, under a mode the SAME transaction re-proves. The caller
+ * has already authenticated the actor and matched channel rules; this
+ * function owns the predicate's transactional half — mode active, actor
+ * IS the signer, repo matches, and the sealed digest is the filed one
+ * (trivially true here: they are the same transaction). Never
+ * sealScopeApproval after a filing — that was the TOCTOU.
+ */
+/**
+ * C1's coverage question, answerable from ANY filing road: does a live
+ * mode make THIS actor's credentialed filing auto-approve here, and with
+ * which defaults? Callers re-ask INSIDE their filing transaction — an
+ * answer carried across transactions would be the TOCTOU again.
+ */
+export declare function modeFilingCoverage(store: Store, repo: string | null, actor: string, now: Date): {
+    digest: string;
+    escalated: boolean;
+    defaultBudgetMicrousd: number | null;
+} | null;
+export declare function fileAndSealUnderMode(store: Store, input: ScopeInput & {
+    repo: string | null;
+    actor: string;
+}): {
+    ok: true;
+    scope: Scope;
+    basis: "mode";
+} | {
+    ok: false;
+    reason: "no-mode" | "not-signer" | "not-covered" | "coordinator-filed" | "acceptance-required" | "profile-unresolved";
+    detail?: string;
+};
+export declare function approve(store: Store, taskId: string, by: string, now: Date, sawDigest: string, token: string, mutation?: Mutation): ApproveResult;
+/**
+ * Whether this task may be built.
+ *
+ * `changed` is the interesting answer and the reason the digest exists: the
+ * scope was approved, and then somebody — possibly an agent, possibly the
+ * operator, possibly a different session — rewrote it. The old yes does not
+ * transfer.
+ */
+export declare function approvalOf(scope: Scope | null): Approval;
+/**
+ * THE STRICT STORED-SCOPE PROJECTION (v48 integrity): the ONE reading of
+ * a filed scope that a seal and every consent surface believe. Nothing
+ * lenient stands in for it — the working profile, chain, and route are
+ * re-parsed from their raw bytes with exact keys, safe integers, and
+ * timer-safe clocks; the chain's entries carry a well-formed auth mode;
+ * the route's build and repair legs ARE the profile's exact pairs; on a
+ * chain filing the profile IS the chain's entry zero; and the row's
+ * digest re-derives, complete, from these very values. A legacy row (no
+ * route era) has no authority a person can newly agree to. One
+ * disagreement is the words, and nothing — no nonce, no password field,
+ * no approve action, no seal — is exposed on it.
+ */
+export type ScopeAuthority = {
+    ok: true;
+    profile: ExecutionProfile;
+    chain: ChainEntry[] | null;
+    route: PhaseRoute;
+    digest: string;
+    authMode: AuthMode | null;
+} | {
+    ok: false;
+    reason: "terms" | "unrouted" | "unresolved" | "profile" | "chain" | "route" | "parity" | "digest" | "auth-mode";
+    problem: string;
+};
+/** What the strict projection reads OUTSIDE the row (atomic authority
+ * closure): the operator's stored auth mode for a provider, strictly — a
+ * present file that says neither word is a stated problem, never the
+ * default a lenient read would coerce it to. Filing, consent, the seal,
+ * and the spawn all hand in the same reader, so one broken file closes
+ * every door in the same words. */
+export type ScopeAuthorityEnv = {
+    authMode?: (provider: ProviderId) => {
+        ok: true;
+        mode: AuthMode;
+    } | {
+        ok: false;
+        problem: string;
+    };
+};
+/**
+ * THE PARITY every projection proves between a route and the profile and
+ * terms it was filed beside (atomic authority closure): the build and
+ * repair legs ARE the profile's exact pairs, and the route's signed risk
+ * and quality ARE the row's — a row whose risk says high over a route
+ * recommended for routine was not filed by this code, and neither the
+ * seal, the consent door, nor the dispatch proof believes it. One
+ * function, so the working side, the sealed side, and the last-mile
+ * dispatch proof cannot drift. Null when everything agrees.
+ */
+export declare function routeParityProblem(route: PhaseRoute, profile: ExecutionProfile, terms: {
+    riskLevel: RiskLevel;
+    qualityMode: QualityMode;
+}): string | null;
+export declare function scopeAuthorityOf(scope: Scope, env?: ScopeAuthorityEnv): ScopeAuthority;
+/** The rubric's approval-card lines (v39): one per criterion, the id in
+ * front (the exact string a proof must answer by) and its required
+ * evidence kinds after it — `how` is deliberately absent here, the same way
+ * it is absent from the digest: it is guidance, never a signed term. */
+export declare function acceptanceWords(criteria: readonly AcceptanceCriterion[]): string[];
+/** The route's approval-card lines (v47): the WORKING route the digest
+ * bound, projected with whatever readiness the caller can see — the same
+ * bytes the task page and chat render. Empty on a scope with no route. */
+export declare function scopeRouteWords(scope: Pick<Scope, "proposedRouteJson">, readiness?: ReadinessLookup): string[];
+/** The scope, in the words an operator has to be able to agree or disagree with. */
+export declare function describeScope(scope: Scope, readiness?: ReadinessLookup): string[];
+/** The chain's approval-card lines; empty for a single-profile scope. */
+export declare function chainWords(chain: ChainEntry[] | null): string[];
+/**
+ * EVERY rendered term of one watched attempt — what the form shows is what
+ * the password signs, byte for byte. The subset the dispatch proof
+ * re-derives (scopeDigest, profileDigest, profileJson, repo, head) is read
+ * back by the builder and the coordinator; the rest are the product terms
+ * the ceremony renders in words: the budget as a STOP THRESHOLD, the turn
+ * cap, the per-turn clock whose expiry is SESSION-FATAL, and the absolute
+ * expiry. Continuation carries the parent attempt and the follow-up text
+ * INSIDE the signed terms (v3 R7).
+ */
+export type AttendedTerms = {
+    taskId: string;
+    /** v28: HOW liveness is renewed — a SIGNED term, because liveness is an
+     * admission predicate, not decoration. "console-visible" = any open
+     * console page of this server renews use. Legacy terms lack the field
+     * and beat-all refuses them (they were signed as page-bound). */
+    attentionMode: "console-visible";
+    scopeDigest: string;
+    profileDigest: string;
+    profileJson: string;
+    repo: string;
+    runner: string;
+    runnerGeneration: number;
+    head: string;
+    maxSessionTurns: number;
+    budgetMicrousd: number;
+    turnTimeoutSeconds: number;
+    absoluteExpiry: string;
+    parentRun?: number | null;
+    followup?: string | null;
+};
+/** Deterministic bytes: sorted keys, undefined dropped — the signed text. */
+export declare function attendedTermsJson(terms: AttendedTerms): string;
+/** The composite digest one password signs (ruling 12), domain-separated. */
+export declare function attendedDigestOf(terms: AttendedTerms): string;