toolroll 0.9.103 → 0.9.105

package/dist/proof.d.ts

@@ -1,457 +0,0 @@
-/**
- * The build's own claim, adjudicated against evidence the plane captured
- * itself (`docs/PRIORITIES.md` Priority 2). Modelled line-for-line on the
- * scout's report (`scout-report.ts`): fail closed, every problem reported at
- * once, stable reasons, byte caps, control-character rejection on every
- * string.
- *
- * The proof is a distinct deliverable from the terminal handoff every
- * attempt writes (including `failed` ones, whose lists are deliberately
- * compacted prose) — only a `completed` attempt owes one, and the plane
- * judges it. A missing or malformed proof never fails the attempt or
- * touches the commit; it only keeps the verdict off "verified".
- *
- * `adjudicate` is pure and does no I/O: every fact it reasons over — whether
- * the proof artifact exists, whether the handoff and terminal diff exist,
- * what the sealed diff-stat says, whether a screenshot's bytes actually are
- * a PNG or JPEG, whether an approved verification command ran and what it
- * returned — is gathered by the caller (`builder.ts`) and handed in as data,
- * so the review itself stays testable without a filesystem or a database.
- */
-import type { EvidenceKind } from "./scope.js";
-import { type ContractProblem } from "./contracts/contract.js";
-import type { VerifyCommandFacts } from "./contracts/verification-receipt.js";
-import { type CriterionEvidenceRef, type ParsedProof } from "./contracts/proof.js";
-export { PROOF_LIMITS, type CriterionEvidenceRef, type ParsedCheck, type ParsedCriterion, type ParsedProof, type ParsedScreenshot } from "./contracts/proof.js";
-export type ProofVerdict = "verified" | "attested" | "short" | "refuted";
-/** v39: the rubric side of a criterion, as `adjudicate` reads it — the
- * SIGNED id, statement, and required evidence kinds. Never `how` (never
- * signed). Empty = nothing signed: `adjudicate` runs the v1 rules,
- * byte for byte. */
-export type ApprovedCriterion = {
-    id: string;
-    statement: string;
-    evidence: readonly EvidenceKind[];
-};
-/** Only submission defects. A truthful not-met answer is not malformed. */
-export declare function proofSubmissionProblems(proof: ParsedProof, rubric: readonly ApprovedCriterion[]): string[];
-export type ProofProblem = ContractProblem;
-export type ProofParseResult = {
-    ok: true;
-    proof: ParsedProof;
-} | {
-    ok: false;
-    problems: ProofProblem[];
-};
-/**
- * Read a proof: the payload byte cap and JSON first, then the proof schema (version 2 as itself, the version 1 a
- * builder writes upgraded, a newer one refused plainly), then the plain-code rules. Every problem names its path and
- * is reported at once; fail closed.
- */
-export declare function parseProof(raw: string): ProofParseResult;
-/** Serialize the validated shape, never the agent's raw bytes (the scout report's rule, `scout.ts`): what is stored
- * and later hash-verified is exactly what the schema admitted, in its key order. */
-export declare function serializeProof(proof: ParsedProof): string;
-/** One caveat that admits an exception to a criterion the same proof marks
- * `met` — the proof's own verdict disagreeing with its own words (atomic
- * authority closure). A caveat NAMES a criterion when the criterion's exact
- * id appears in it as a standalone token (`c1: …`, `(c1)`, `c1,c4`); a
- * named criterion must then be `not-met` or `not-checked`. Nothing here is
- * semantic — the machine cannot read a free-text caveat's meaning, so the
- * contract is the token, stated in the brief and refused by the preflight
- * before the attempt ends. */
-export type BlockingCaveat = {
-    caveat: string;
-    index: number;
-    criterionId: string;
-};
-/** Every (caveat, criterion) pair where the caveat names a criterion the
- * proof marks `met` — the proof contradicts itself and cannot verify. In
- * caveat order, then criterion order; `[]` for a proof at peace with its
- * own caveats. */
-export declare function blockingCaveats(proof: Pick<ParsedProof, "criteria" | "caveats">): BlockingCaveat[];
-/** One check a criterion marked `met` cites that exited nonzero — the
- * criterion's id, the exact cited command, and the exit code the proof
- * itself reported. */
-export type FailedCheckCitation = {
-    criterionId: string;
-    ref: string;
-    exitCode: number;
-};
-/**
- * Every check a criterion marked `met` cites that the proof's own `checks`
- * list says exited nonzero (proof preflight closure): a met criterion
- * resting on a failing command is not evidence, it is a contradiction the
- * adjudicator fails the row for. A not-met or not-checked criterion may
- * cite a failed check honestly — it is reporting, not claiming — so only
- * `met` and `pending-verification` count here: pending asserts the agent's
- * own checks already passed. A ref that resolves to no check is a different
- * problem (an unresolved ref), not this one. In criterion order, then
- * evidence order.
- */
-export declare function failedMetChecks(proof: Pick<ParsedProof, "criteria" | "checks">): FailedCheckCitation[];
-/** The one actionable fact a failed check citation is reported as — the
- * adjudicator's matrix detail and the agent's exit preflight say exactly
- * this, so what the preflight refuses is what the plane would have said. */
-export declare function failedCheckWords(one: FailedCheckCitation): string;
-/**
- * One caveat the machine cannot attribute (final authority closure): every
- * caveat is an exception to a signed criterion, and it names that
- * criterion's exact id as a standalone token — so a caveat that names NO
- * known criterion (`unassigned`), or whose leading tag names an id nobody
- * signed (`unknown`), is a claim the verdict cannot be reconciled with.
- * An idea that is not an exception to any criterion belongs in the
- * handoff's follow-ups, not here.
- *
- * THE KNOWN IDS ARE THE SIGNED ONES (final admission closure): when a
- * rubric was signed, only its ids count — an extra criterion the proof
- * authored for itself is the proof's own word, never signed authority, so
- * a caveat tagged with it alone is unknown in preflight and adjudication
- * alike. Only a proof with NO signed rubric may attribute its caveats to
- * the criteria it answered.
- */
-export type CaveatAttributionProblem = {
-    caveat: string;
-    index: number;
-    kind: "unassigned" | "unknown";
-    tags: string[];
-    /** The unknown tags the proof answered for itself (present only when a
-     * rubric was signed and at least one such tag exists): the words say
-     * the criterion is the proof's own, not that nobody answered it. */
-    answered?: string[];
-};
-export declare function caveatAttributionProblems(proof: Pick<ParsedProof, "criteria" | "caveats">, signedIds?: readonly string[]): CaveatAttributionProblem[];
-/** The words one attribution problem refuses in — shared by the plane's
- * adjudication and the agent's exit preflight so both say the same thing. */
-export declare function caveatAttributionWords(problem: CaveatAttributionProblem): string;
-/** One claimed screenshot's fate once the caller has read its bytes off the
- * worktree and checked them against the PNG/JPEG signature and size cap. */
-export type ScreenshotOutcome = {
-    path: string;
-    ok: boolean;
-    /** Set when ok is false — why the claimed file did not become evidence. */
-    problem?: string;
-    /** v39: set when ok is true — the bytes actually read, for the
-     * "meaningful byte size" half of the screenshot-evidence rule. */
-    bytes?: number;
-    /** v39: set when ok is true and dimensions could be read from the
-     * image header; null when the format parsed but dimensions could not
-     * be determined. Absent entirely for a pre-v39 caller. */
-    dims?: {
-        width: number;
-        height: number;
-    } | null;
-};
-/** v39: the floor a criterion's screenshot evidence must clear — "real,
- * not placeholder-sized" in exact numbers (scope: "meaningful byte size
- * and at least 320 by 200 dimensions"). */
-export declare const SCREENSHOT_EVIDENCE_MIN_BYTES = 1024;
-export declare const SCREENSHOT_EVIDENCE_MIN_WIDTH = 320;
-export declare const SCREENSHOT_EVIDENCE_MIN_HEIGHT = 200;
-/** What `captureTerminalDiff` gives back, restated for adjudication:
- * whether the sealed stat parsed at all, whether the file list was cut to
- * fit the cap, and the set of paths it names. A truncated stat cannot prove
- * a claimed path is ABSENT, so rule 4 does not fire against one. */
-export type DiffStatFacts = {
-    captured: boolean;
-    truncated: boolean;
-    paths: ReadonlySet<string>;
-    /** Old name → destination for every entry git paired as a rename or
-     * move. The old name is provenance the stat keeps; it is never one of
-     * `paths`. Absent on a stat that recorded no renames. */
-    renames?: ReadonlyMap<string, string>;
-};
-/** How a proof's `changed` list compares with the sealed diff-stat, read
- * before the first review so the same session can correct a receipt the
- * sealed facts themselves explain (the Goose FinalOutputTool pattern: a
- * precise error plus the exact expected value, never a silent rewrite).
- *
- * `problems` names every discrepancy, one line per path. `recoverable` is
- * true only when the stat is complete and EVERY discrepancy is one the
- * sealed input establishes on its own: the old name of a rename git
- * paired (the diff holds its destination once), or a sealed path the
- * list left out. Then `sealed` is the one admissible correction — the
- * complete sealed inventory, sorted — and nothing else is. A claimed path
- * the diff never had is an unexplained contradiction: reported, never
- * recoverable, so adjudication refutes it by name. An unavailable or
- * truncated stat proves nothing either way: no problems, not recoverable. */
-export type ChangedListReview = {
-    problems: string[];
-    recoverable: boolean;
-    sealed: string[] | null;
-};
-export declare function changedListProblems(changed: readonly string[], stat: DiffStatFacts | null): ChangedListReview;
-/** What a receipt-only correction may never touch: the exact criterion
- * id/verdict pairs the agent submitted (comment 397, run 1648). A
- * correction restates a signed statement or repairs an evidence reference
- * against the exact rubric; it cannot move an answer (not-met or
- * not-checked becoming pending-verification, or any other change of
- * word), drop a criterion — an extra negative answer is a finding, not a
- * formatting defect — or add one. One line per frozen pair broken. */
-export declare function frozenCriterionProblems(submitted: ParsedProof, corrected: ParsedProof): string[];
-/** Whether two readings of the sealed diff-stat state the same facts:
- * the same capture standing, the same paths and the same rename
- * provenance. Settlement reads the stat once before the receipt
- * correction and re-reads it after that correction and after the final
- * gate; a reading that differs is never adjudicated from the cached one. */
-export declare function sameDiffStatFacts(a: DiffStatFacts | null, b: DiffStatFacts | null): boolean;
-/** What the approved verification command did (the receipt's `result`); its schema lives with the receipt. */
-export type { VerifyCommandFacts } from "./contracts/verification-receipt.js";
-export type AdjudicateInput = {
-    /** New captures may assess the signed goal directly when the builder wrote
-     * no optional proof. Historical calls retain their original contract. */
-    directAssessment?: boolean;
-    /** Controller-owned command label, never a builder-reported check. */
-    verificationCommand?: string;
-    /** Whether a `proof` artifact was stored at all for this run. */
-    proofArtifactPresent: boolean;
-    /** null when no proof artifact exists; otherwise the parse of its bytes. */
-    proofParse: ProofParseResult | null;
-    handoffPresent: boolean;
-    terminalDiffPresent: boolean;
-    terminalDiffCaptureStatus: "ok" | "failed" | null;
-    diffStat: DiffStatFacts | null;
-    verifyCommand: VerifyCommandFacts;
-    /** One entry per screenshot the proof claimed, in the order claimed.
-     * Empty when the proof named none. */
-    screenshots: readonly ScreenshotOutcome[];
-    /** v39: the SIGNED rubric this run's scope carried at dispatch, in id
-     * order. `[]` (the default) is the grandfathering promise made good:
-     * every rule below that reads this is skipped whole, and adjudication
-     * runs exactly the v1 rules that follow it. */
-    approvedCriteria?: readonly ApprovedCriterion[];
-    /** v51: the sealed review-context inventory's per-criterion coverage,
-     * when this run captured one. Attached to the matrix rows verbatim; it
-     * never moves the verdict — context is for the reviewer, the verdict is
-     * the machine's. Absent = no coverage key on any row. */
-    reviewContext?: readonly ({
-        id: string;
-    } & CriterionCoverage)[];
-};
-export type AdjudicateResult = {
-    verdict: ProofVerdict;
-    reasons: string[];
-    matrix: CriterionMatrixRow[];
-    machineVerdict?: ProofVerdict;
-};
-export declare const GOAL_ASSESSMENT_PENDING = "The saved evidence is awaiting independent goal assessment.";
-/** Legacy folds could only lower a verdict. Direct assessment also records an
- * ordinary wait between green machine checks and the goal judgement. */
-export declare function reviewConflict(matrix: readonly CriterionMatrixRow[], machine: ProofVerdict | null, verdict: ProofVerdict | null): boolean;
-/** One row of the criterion-to-evidence matrix every result-facing surface
- * renders identically (task, run, done, builds, board, inbox, chat —
- * Priority 2's "one surface, six places" rule, extended). `pass`: every
- * required evidence kind resolved. `missing`: the criterion went
- * unanswered, or a required kind has no reference at all. `failed`: a
- * reference exists but did not resolve (wrong check exit code, invalid
- * screenshot, a changed-path claim the sealed diff does not back).
- * `manual-review`: every required kind resolved EXCEPT at least one
- * `manual-review` kind, which is never machine-verifiable by design — the
- * row still needs a human's eyes even though nothing failed. */
-export type CriterionMatrixState = "pass" | "missing" | "failed" | "manual-review";
-/** Human sign-off is owed, with no other recorded evidence failure. This is
- * presentation only; it never changes a verdict or grants acceptance. */
-export declare function manualReviewOnly(proof: {
-    verdict: string;
-    reasons: readonly string[];
-    matrix?: readonly CriterionMatrixRow[];
-} | null): boolean;
-/** The criterion id a stored "needs a person's check" reason names, or null
- * for any other reason. The stored words stay as recorded; pages say them
- * through `personCheckWords`. */
-export declare function manualReviewCriterionOf(reason: string): string | null;
-/** A stored verification reason as a person would say it, for pages and
- * cards. The record keeps its exact words; unknown reasons pass through. */
-export declare function plainReasonWords(reason: string): string;
-/** A requirement only a person can confirm, as a person would say it. */
-export declare function personCheckWords(statement: string | null): string;
-export type CriterionMatrixRow = {
-    /** Controller-captured evidence for direct goal assessment. Kept separately
-     * from the final row state: available evidence is not a satisfied goal. */
-    assessment?: {
-        evidenceState: CriterionMatrixState;
-        detail: string[];
-    };
-    id: string;
-    statement: string;
-    requiredEvidence: readonly EvidenceKind[];
-    state: CriterionMatrixState;
-    /** Why this row is not a plain pass — empty for `pass`. */
-    detail: string[];
-    /** The proof's OWN typed evidence references for this criterion, exactly
-     * as it answered them — never only the required kinds, so a render can
-     * show what was actually cited (and link the artifact behind it, where
-     * one exists). `[]` when the criterion went unanswered. */
-    answered: readonly CriterionEvidenceRef[];
-    /** v40: the independent reviewer's judgement on this criterion, folded in
-     * by `foldReview` after `adjudicate` has already run — `null` until a
-     * review has settled, and for every criterion no review addressed. */
-    review: {
-        judgement: CriterionJudgementWord;
-        note: string;
-        author: string;
-    } | null;
-    /** v51 (inherited review context): where an independent reviewer's
-     * evidence for this criterion comes from — this run's own patch, a
-     * sealed context inventory, or nowhere (a named gap). Present only on
-     * runs that captured an inventory (revisions); absent on every other
-     * run, which reads exactly as before: judged from the patch. */
-    coverage?: CriterionCoverage;
-};
-/** The per-criterion context projection stored on the matrix row (v51),
- * copied from the sealed inventory's coverage at adjudication. */
-export type CriterionCoverage = {
-    state: "patch" | "context" | "gap";
-    /** Same id AND statement as the source run's signed rubric. */
-    inherited: boolean;
-    /** Provenance tokens (`ctx-<n>`) for complete files or explicitly partial
-     * ancestor patches. A partial patch keeps state `gap`, even with eligible
-     * prior support; neither property supplies a current judgement. */
-    items: string[];
-    /** Why context is missing or partial — empty for `patch` and `context`. */
-    gaps: string[];
-    /** Whether an earlier review of the source run may be weighed as
-     * context: eligible only with the same text, verified ancestry, and
-     * byte-identical relevant code. Never a judgement on this run. */
-    priorSupport: "eligible" | "invalid" | "none";
-    /** The change's images and other binary files in one line, when it has any. */
-    assets?: string;
-};
-/** v40: the three words an evidence reviewer can say about one signed
- * criterion, and nothing else — `cannot-tell` is a CORRECT answer whenever
- * the sealed patch alone cannot settle a criterion, not a hedge. */
-export type CriterionJudgementWord = "upholds" | "contradicts" | "cannot-tell";
-/** One reviewer's typed judgement on one signed criterion (v40), ready to
- * fold into an already-adjudicated result. */
-export type CriterionJudgement = {
-    id: string;
-    judgement: CriterionJudgementWord;
-    note: string;
-    author: string;
-};
-/**
- * Ordered rules; the first that fires wins. Every reason is a sentence the
- * surfaces print verbatim — this function is the only place that decides
- * wording, so the task page, run page, board, CLI, and chat cards cannot
- * drift from each other (Priority 2, the "one surface, six places" rule).
- *
- * v39: `input.approvedCriteria` empty runs the rules below byte for byte —
- * the grandfathering promise. Non-empty inserts the rubric rules AFTER the
- * diff-stat and verify-command rules and BEFORE the legacy unmet check,
- * exactly as approved in the v2 plan: a proof that alters a signed
- * criterion's statement is REFUTED (the same severity as any other
- * altered term); an unanswered criterion, an evidence reference that does
- * not resolve, or a criterion capped at manual-review is SHORT (a gap, or
- * a review a machine cannot finish, never a lie). The legacy self-declared
- * `verdict` field still runs afterward and can only downgrade further,
- * never upgrade past what the evidence proved.
- *
- * The changed[] vs. sealed-diff exactness check (review finding, post-v39)
- * runs GLOBALLY, ahead of the rubric rules and independent of whether any
- * criterion cites changed-path evidence at all — a rubric with none of
- * those must not let an untruthful or incomplete changed[] through
- * unchecked. An unavailable or truncated diff-stat cannot prove either
- * direction, so it can only ever produce SHORT, never REFUTED.
- */
-/** An optional screenshot inventory carries no builder-authored completion
- * claims. The existing bounded parser still validates every supplied field. */
-export declare function artifactManifestOnly(proof: ParsedProof): boolean;
-export declare function adjudicate(input: AdjudicateInput): AdjudicateResult;
-/**
- * Folds an independent reviewer's per-criterion judgements into an ALREADY
- * ADJUDICATED result (v40, evidence-review-v1) — pure, and never re-derives
- * verdict facts that were not persisted (verify-command outcome, screenshot
- * bytes): it folds over the STORED result, it does not re-run `adjudicate`.
- *
- * Three rules, and they are the whole contract:
- *  - `contradicts` -> refuted. A second reader saying a signed term is not
- *    met is the same severity as a proof that altered the term: the
- *    matching row becomes `failed`, with the reviewer's note as an
- *    attributed `detail` line.
- *  - `cannot-tell` changes nothing. Recorded and rendered, never moves the
- *    verdict — "we could not check" is not "the claim is false" (the same
- *    maxim `adjudicate` already lives by for an unavailable diff or a
- *    failed verify-command attempt).
- *  - `upholds` never upgrades. A `short` (or `attested`) run stays exactly
- *    what it was — this is the law that stops a second model laundering a
- *    bad proof, and the reason `foldReview` can only LOWER a verdict, never
- *    raise one.
- *
- * A judgement naming a criterion absent from `base.matrix` is ignored —
- * `parseReview` already refuses a payload naming an unsigned id, so this is
- * belt and suspenders, never a live path.
- */
-export declare function foldReview(base: AdjudicateResult, judgements: readonly CriterionJudgement[]): AdjudicateResult;
-/**
- * SEMANTIC coverage (v51): what an INDEPENDENT reviewer actually settled,
- * shown distinctly from the machine proof the matrix `state` records. One
- * projection for the task page, run page, receipt, chat card, and CLI —
- * never a second status engine: it reads the stored matrix and the run's
- * signed quality mode and moves nothing.
- *
- * The policy is explicit and unchanged from v41: under `default` an
- * independent review is optional, so absent or uncertain judgements are
- * reported and nothing is "unsatisfied"; under `strict` (Strict / release)
- * independent coverage is REQUIRED, and only `upholds` satisfies it — a
- * `cannot-tell` is an honest answer that leaves the criterion uncovered,
- * a `contradicts` is a failure, and an unreviewed criterion is uncovered.
- * `cannot-tell` never satisfies required coverage under either policy.
- * Context gaps (`coverage.state === "gap"`) are listed so a reader sees
- * WHY a reviewer could not tell, in the same words the inventory used.
- */
-export type SemanticCoverage = {
-    policy: "default" | "strict";
-    /** Independent coverage is required by the signed policy. */
-    required: boolean;
-    total: number;
-    upheld: string[];
-    contradicted: string[];
-    uncertain: string[];
-    unreviewed: string[];
-    /** Criterion ids with a named context gap, with the reasons — every
-     * row that carries one, whether or not the patch still judges it. */
-    contextGaps: {
-        id: string;
-        gaps: string[];
-    }[];
-    /** null when no review has folded at all (nothing to satisfy or fail);
-     * otherwise whether every criterion is upheld — the only reading under
-     * which required coverage counts as satisfied. */
-    satisfied: boolean | null;
-};
-export declare function semanticCoverage(matrix: readonly CriterionMatrixRow[], policy: "default" | "strict"): SemanticCoverage;
-/** The coverage in plain words — one line every surface prints the same
- * way. `[]` for a run with no rubric: nothing to cover. */
-export declare function coverageWords(coverage: SemanticCoverage): string[];
-/** The pass fraction of a criterion matrix — the one number every list
- * surface (board, chat) needs, shared so "N/M criteria" is computed in
- * exactly one place (v40 closes the two hand-rolled copies). */
-export declare function passFraction(matrix: readonly CriterionMatrixRow[]): {
-    passed: number;
-    total: number;
-};
-/** The matrix in plain lines, for a text surface (the CLI, `brief`) — the
- * same shared vocabulary `criterionMatrixHtml` renders in the console, so
- * the words never drift between the two (Priority 2's rule, extended). */
-export declare function matrixWords(matrix: readonly CriterionMatrixRow[]): string[];
-/** One criterion's context standing in words — shared by the CLI matrix
- * and the console badge title so the two never drift. */
-export declare function coverageStateWords(coverage: CriterionCoverage): string;
-/** The verdict a result shows today, read from the stored one and the facts recorded since, never written back: a
- * failed check or an unresolved HIGH review finding refutes; a pending review, or any acceptance criterion that has
- * not passed, keeps it short. It only ever lowers the stored verdict. */
-export declare function shownVerdictOf(stored: ProofVerdict | null, facts: {
-    checkFailed: boolean;
-    highFindings: number;
-    reviewPending: boolean;
-    criteriaPassed: boolean;
-}): ProofVerdict | null;
-/** Plain words for a verdict, shared by every surface (the `summary.ts`
- * pattern) so the task page, run page, board, CLI, and chat cannot say
- * three different things about the same run. */
-export declare function verdictWords(verdict: ProofVerdict, reasons: readonly string[]): {
-    word: string;
-    detail: string;
-};
-/** The `data-dispatch-status` token a page's CSS and tests key off. */
-export declare function dispatchStatusToken(verdict: ProofVerdict): "complete-verified" | "complete-with-evidence" | "needs-verification" | "proof-refuted";

package/dist/proposal.d.ts

@@ -1,70 +0,0 @@
-import type { Filer } from "./approval-policy.js";
-export { validateTaskText } from "./task-text.js";
-import type { Store } from "./store.js";
-import type { UnattendedPermissionMode } from "./scope.js";
-import type { QualityMode } from "./quality.js";
-import type { TaskSizing } from "./phase-routing.js";
-export type ProposalRefusal = {
-    ok: false;
-    /** Stable, machine-readable — joins the envelope like every reason. */
-    reason: "bad-title" | "bad-goal" | "bad-id" | "bad-name" | "bad-terms" | "bad-repo" | "outside-ceiling" | "bad-provenance" | "bad-acceptance" | "acceptance-required" | "backlog-full" | "duplicate";
-    message: string;
-};
-export type TaskProposalInput = {
-    id?: string;
-    title: string;
-    repo?: string;
-    goal?: string;
-    outOfScope?: string | null;
-    touches?: string[];
-    /** v39: the signed acceptance rubric — unparsed, checked by
-     * `store.createConsoleTask` the same way every other filing text is
-     * checked here: identically for every caller of this one door. */
-    acceptance?: unknown;
-    /** Which door filed this: 'cli', 'console', 'intake', 'template:<name>'. */
-    filedVia: string;
-    /** v102: who filed it — the person, or the person a coordinator acts for (separation of duties reads it). */
-    filedBy?: Filer;
-    /** The scope text's author when it is an LLM's (ruling 2; §10 for a
-     * scout's follow-up): mode coverage never seals it. */
-    proposedVia?: "mate" | "coordinator" | "scout";
-    /** What comes back (v34): 'report' files a scout task. Set once, at filing. */
-    deliverable?: "branch" | "report";
-    /** Planning policy at the filing door. `required` is an explicit
-     * operator choice, `skip` is an explicit direct-to-scope choice, and
-     * `auto` (the default) plans implementation work whose breadth suggests
-     * repository discovery will materially improve the approved scope. */
-    planning?: "auto" | "required" | "skip";
-    /** Concrete per-task unattended permission choice. When absent, the
-     * installation default is resolved as the scope is filed. */
-    permissionMode?: UnattendedPermissionMode;
-    /** Concrete per-task evidence depth. Absent inherits the installation
-     * default when the scope is filed. */
-    qualityMode?: QualityMode;
-    /**
-     * The caller's ceiling as canonical repo paths. undefined = the caller
-     * genuinely has none (the CLI on the operator's own machine). A surface
-     * that HAS a ceiling must pass it — an empty list refuses every repo,
-     * which is the fail-closed reading of an empty ceiling (finding 4).
-     */
-    admittedRepos?: readonly string[];
-    /** A per-task dollar cap in micro-USD, bound into the scope's digest (a
-     * scheduled flow's standing order carries one, v115). */
-    budgetMicrousd?: number | null;
-    /** v2 routing: the task's size when the caller already knows it (a
-     * person's choice). Absent, filing sizes it from the description at
-     * once and the process's classifier refines it within five seconds. */
-    sizing?: TaskSizing;
-};
-/** One deterministic planning policy for console, chat, MCP, and sync
- * filings. A planner needs a repository to inspect; report/scout work is
- * already the discovery phase and never recursively plans itself. With a
- * size (v2 routing), a small change is not planned and a large or risky
- * one is; a medium one keeps the description's signals. */
-export declare function shouldPlanTask(input: TaskProposalInput, sizing?: TaskSizing): boolean;
-export declare function fileTaskProposal(store: Store, input: TaskProposalInput, now: Date): {
-    ok: true;
-    id: string;
-    planning: boolean;
-    sizing: TaskSizing;
-} | ProposalRefusal;

package/dist/protected-storage-look.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/protected-storage.d.ts

@@ -1,98 +0,0 @@
-/** One app's storage, relative to the home folder, per platform. */
-export type ProtectedApp = {
-    app: string;
-    darwin: readonly string[];
-    linux: readonly string[];
-};
-/**
- * Every listed root. Checked against a real Mac (2026-10-25): existence only, never a file's contents. The 1Password
- * containers and the extra Chrome, Edge and other browsers' folders below were found there and added.
- */
-export declare const PROTECTED_STORAGE: readonly ProtectedApp[];
-/** The chat and vault variables no launch gets. */
-export declare const PROTECTED_ENV_PREFIXES: readonly string[];
-export declare function isProtectedEnvName(name: string): boolean;
-/** `env` without a chat or vault variable. */
-export declare function withoutProtectedEnv<T extends Record<string, string | undefined>>(env: T): T;
-/** How far the link walk goes in each present root. */
-export declare const PROTECTED_WALK: {
-    readonly depth: 4;
-    readonly entries: 5000;
-};
-/** The roots by name, under the (real) home folder and the overrides the plane's environment names. */
-export declare function protectedStorageNames(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform): string[];
-/** What one launch keeps out: every root by name (`names`), and every protected path it denies (`denies`). */
-export type ProtectedStorage = {
-    names: string[];
-    denies: string[];
-};
-/**
- * The storage check, run right here: every root by name and by real path, every link inside a present root that leads
- * outward (where it leads, by real path and as spelled), and the overrides. `unfinished` names each present root whose
- * walk met an error other than "not there" or "not allowed": its links aren't all known. A link macOS makes in a
- * sandboxed app's container to the same place under the home folder (its Desktop, Downloads, Fonts…) is the system's
- * own mirror of the person's folders, not the app's data, and isn't followed (systemMirror).
- *
- * On a Mac a listing (or an open) inside another app's data can wait until a person answers a privacy prompt, so there
- * this runs only in the check's own child process (prepareProtectedStorage), never on a thread that serves anything.
- * `at` is told each root before its walk starts, so a check that runs out of time can name the app it was waiting on.
- */
-export declare function protectedStorageHere(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, say?: (line: string) => void, list?: (path: string) => import("node:fs").Dirent[], at?: (root: string) => void): ProtectedStorage & {
-    unfinished: string[];
-};
-/** Every protected path, checked right here (protectedStorageHere), for a caller that has no prepared check. */
-export declare function protectedStorageDenies(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, say?: (line: string) => void, list?: (path: string) => import("node:fs").Dirent[]): string[];
-/** How long the storage check may take before the launch is refused (a slow Mac finishes well inside it). */
-export declare const STORAGE_LOOK_MS = 10000;
-/** What the check asked of its child, and how the child's run ended. */
-export type StorageLookRequest = {
-    home: string;
-    env: Record<string, string>;
-    platform: NodeJS.Platform;
-};
-export type StorageLookResult = {
-    kind: "done";
-    storage: ProtectedStorage;
-    unfinished: string[];
-} | {
-    kind: "timed-out";
-    at: string | null;
-} | {
-    kind: "failed";
-    detail: string;
-};
-export type StorageLook = (request: StorageLookRequest) => Promise<StorageLookResult>;
-/** Why a launch didn't start: the storage check couldn't finish. Its words survive every catch (storageRefusalOf). */
-export declare class ProtectedStorageRefusal extends Error {
-    readonly apps: readonly string[];
-    readonly why: "timed-out" | "unfinished" | "failed";
-    readonly code: "protected-storage";
-    constructor(apps: readonly string[], why: "timed-out" | "unfinished" | "failed", message: string);
-}
-/** The storage refusal inside a caught error, when it is one. */
-export declare function storageRefusalOf(error: unknown): ProtectedStorageRefusal | null;
-/** Which program macOS must allow: the one this plane runs as. A launchd service is its program itself; a plane started
- * from a terminal asks as that terminal app. */
-export declare function storageAccessHolder(env?: Readonly<Record<string, string | undefined>>, execPath?: string, versions?: NodeJS.ProcessVersions): string;
-/** Why nothing was launched, and what the person does about it. Never says macOS is asking: that isn't known. */
-export declare function storageRefusalWords(apps: readonly string[], why: ProtectedStorageRefusal["why"], holder: string): string;
-/**
- * The storage check for one launch, awaited: what it denies, from a walk that finished just now. On a Mac the whole check
- * (finding the roots, reading profiles.ini, every walk) runs in a child process, so a listing that waits on a privacy
- * prompt holds up only that child; the thread that asked keeps serving. A check that doesn't finish within
- * STORAGE_LOOK_MS, fails, or leaves a present root's walk unfinished refuses the launch (ProtectedStorageRefusal): no
- * earlier walk stands in for it, since a link can move inside a root at any time. Checks asked for at once share one child.
- */
-export declare function prepareProtectedStorage(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, look?: StorageLook, holder?: string): Promise<ProtectedStorage>;
-/** Where the check's child script is: beside this module once built, else the built copy (a run from source). */
-export declare function storageLookScript(): string;
-/** A finished child's lines as the check's answer: `at\t<root>` before each walk, `done\t<answer>` once at the end. */
-export declare function readLook(ran: SpawnedLook): StorageLookResult;
-/** How a child ran: everything it wrote, and whether it finished, ran out of time (killed) or failed some other way. */
-export type SpawnedLook = {
-    stdout: string;
-    outcome: "done" | "timed-out" | "failed";
-    detail: string;
-};
-/** Run a child without waiting on this thread: its output, bounded, and how it ended. Killed at `limitMs`. */
-export declare function spawnLook(command: string, args: readonly string[], limitMs: number): Promise<SpawnedLook>;