yam-flow 2.8.3 → 2.8.5

package/AGENTS.md

@@ -24,6 +24,10 @@
 22. When an artifact changed, put `Next step` immediately after Study Note. Ordinary advisory work may use a short concrete action or state that none remains. For risky changes, explicit strict reports and structured receipts, build it from a quick whole-process scan with current situation, forward outlook, a concrete critical opinion, improvement recommendations, and ordered fix-first then planned actions with evidence and ownership. Keep report validation separate from actual security verification.
 23. Work on the current branch by default. Create or switch branches, create worktrees, or create pull requests only when the user explicitly requests that action or an applicable project rule explicitly requires it. A commit/push request, release version bump, route selection, branch-name prefix, or branch protection alone is not authorization. If protection blocks the requested operation, report the blocker and ask for direction; do not silently choose a PR workflow, bypass checks, or change protection settings.
 
+## Test check completion gate
+
+After implementation and before claiming changed work complete, follow `references/test-check.md`: identify the exact starting revision, map changed targets to required scenarios, run the project Test check adapter and require a current PASS plus its explained note. Missing real DB/runtime evidence, skipped required scenarios, stale source/environment or note-write failures block completion approval. Report `Test check: BLOCKED` for an incomplete handoff; it does not grant commit/push/deployment approval. Recheck source identity before those operations. Do not treat report formatting, mock results, or operator-declared receipts as actual runtime verification. Projects need their own policy and adapters; an unavailable configuration is not a security or completion approval.
+
 ## Security check gate
 
 Before commit, push, CI approval, or deployment, run the configured `yam security check` gate for the exact stage and record its Security check block. Use `references/security-check.md`; preserve every SEC explanation, evidence reference, and unresolved status. Missing required evidence or a note-write failure blocks the stage. Local hooks are bypassable; enforce protected merge/deployment with a trusted CI policy and required checks. Never present a validated supplied report as an independent vulnerability scan.

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 All notable changes to yam-flow are documented here.
 
+## v2.8.5 - 2026-10-28
+
+### Added
+
+- Add the Test check completion gate with project-owned scenario policies, measured subprocess observations, source/environment bindings and private append-only notes.
+- Require current Test check evidence before configured commit, push, CI and deployment security approval; CI verifies an administrator-reviewed test policy pin before executing project code.
+- Add an optional isolated PostgreSQL simulation that reproduces SQLSTATE 42702 and checks normal writes, authorization, rollback, migration freshness and function drift using synthetic data.
+
+### Fixed
+
+- Keep private `.yam` research receipts and temporary tools outside the public-product terminology scan while retaining checks for public source and documentation.
+
+### Verification
+
+- 49 gate regression cases and full self-verification passed. Real PostgreSQL 17.10 simulations cover ten workflow scenarios and a 16-case role/brand/quantity matrix.
+- Exact-target security integration and package checks passed locally. Production application behavior and hosted rollout require their own project evidence.
+
+## v2.8.4 - 2026-10-26
+
+### Improved
+
+- Scrapling updates select the browser CLI for 0.4 or 0.5+, preflight candidate version/help before browser dependency installation, and preserve the existing atomic-link/rollback boundary.
+- Update smokes extract the document title instead of relying on a body heading; a zero exit with missing expected content is recorded as a failed check.
+- Scout guidance connects consequential claims to inspected evidence, separates reported/tested/inferred conclusions, retains version conflicts and adds cheap falsification checks without mandatory reviewers or a new receipt schema.
+- Research guidance makes outbound-data authority and sensitive session/network-state handling explicit; updater documentation distinguishes recorded PyPI hashes from a fully hash-locked dependency installation.
+
+### Verification
+
+- Focused update fixtures cover 0.4 compatibility, 0.4.15-to-0.5 variants, missing CLI/browser failures, post-switch failure and receipt-write rollback.
+- Isolated macOS/Python 3.14 checks exercised actual 0.4.15-to-0.5 installation, HTTP/headless extraction and receipt-failure rollback. A later isolated public suffix-list retry passed after a local CA-path repair; that environment-only repair is not shipped by this package.
+
 ## v2.8.3 - 2026-10-06
 
 ### Improved

package/COMMANDS.md

@@ -176,6 +176,8 @@ yam update apply --all --json
 
 `yam update check` is read-only. Its component result preserves the registry artifact source receipt: npm integrity/`gitHead` for yam, PyPI release-file SHA-256 values for Scrapling, and the Git-pinned manifest commit for Insane Search. Yam also compares `latest` with exact-version metadata and probes the official exact tarball URL; a 404 is `pending_distribution`, while network/auth/metadata mismatch is `check_failed`. The bounded HEAD probe confirms availability only and does not hash tarball bytes. Every `apply` needs explicit authorization, pins the official npm registry or isolated PyPI index, uses a concurrent-run lock, records a component receipt, and stops on failed/manual results. `--all` runs yam last. A yam install verifies the effective executable identity before any yam-side install command and repeats that check during rollback. This identity contract currently supports POSIX symlink layouts; Windows npm `.cmd` shims fail closed as unverified. Insane Search requires a clean tracked local manifest whose bytes match Git and matching pre/post-add commits, is never remove-first, and never edits `.codex/plugins/cache` directly.
 
+Scrapling preflights the candidate version and browser CLI before installing browser dependencies, then uses `extract stealthy-fetch` for 0.4 or `extract fetch` for 0.5+. HTTP/browser smoke checks must pass before the managed link changes; failures retain or restore the previous link. Recorded PyPI hashes do not imply a complete hash-locked dependency install; see README's hash-enforcement boundary.
+
 ## Release Supply Chain
 
 ```bash
@@ -351,3 +353,7 @@ yam hook disable study-note --global
 - `yam template security` / `yam template security-ci`: explained note and CI setup templates.
 
 See `references/security-check.md` for stage arguments, trusted policy requirements and limitations. This validates supplied evidence; it does not automatically scan application vulnerabilities.
+
+## Test check
+
+Before changed-work completion: `yam test-check plan --base <exact starting commit> --json`, then `yam test-check run --base <exact starting commit> --json` and `yam test-check check --json`. Configure `testing/policy.json` or `.yam/testing/policy.json` and a reviewed JSON-report adapter first. `yam template test-check` prints a blocked-until-configured starter. See `references/test-check.md` for scenario floors, real DB manifests, Stop integration and stage-specific identity checks. `check --stage commit` verifies index equality; push/CI/deploy require `--source <exact commit>` and CI/deploy also require a trusted `--policy-digest`. No global hook, branch protection or deployment is silently installed.

package/README.md

@@ -177,7 +177,9 @@ A yam update is successful only after the installed version and status checks pl
 
 Effective yam identity currently verifies POSIX-style executable/symlink layouts through `which` and canonical realpaths. Windows npm `.cmd` shim identity is intentionally unverified and fails closed until a dedicated shim parser and fixture exist.
 
-Scrapling updates install an exact stable PyPI version into a new versioned virtual environment. `pip check`, ordinary HTTP extraction, and headless browser extraction must pass before the executable symlink changes atomically; the previous environment is retained. An existing environment must have a matching `.yam-scrapling-install.json` ownership marker before yam will replace its link. Insane Search uses only the official `codex plugin` commands. yam never edits `.codex/plugins/cache`, never removes the plugin first, and returns `manual_plugin_update_required` when the installed Codex CLI cannot update it safely in place.
+Scrapling updates install an exact stable PyPI version into a new versioned virtual environment. Candidate version and browser-command help are checked before browser dependency installation: 0.4 uses `extract stealthy-fetch`, while 0.5 and later use `extract fetch`. An unavailable command fails without trying legacy aliases. `pip check`, ordinary HTTP extraction, and headless browser extraction must pass before the executable symlink changes atomically; the previous environment is retained. An existing environment must have a matching `.yam-scrapling-install.json` ownership marker before yam will replace its link. Insane Search uses only the official `codex plugin` commands. yam never edits `.codex/plugins/cache`, never removes the plugin first, and returns `manual_plugin_update_required` when the installed Codex CLI cannot update it safely in place.
+
+Scrapling hash-enforcement boundary: the check receipt records PyPI release-file SHA-256 values, but apply does not bind pip's selected artifact to that prior receipt or lock transitive dependencies. Native index hashes and TLS are not an independently reviewed lock. Full `--require-hashes` enforcement needs exact versions and accepted hashes for every dependency, plus Python/platform-specific wheel and rollback coverage; adding a single top-level hash is not sufficient. That installer change remains deferred rather than claiming stronger supply-chain proof. See [pip secure installs](https://pip.pypa.io/en/stable/topics/secure-installs/).
 
 There is no unattended updater. The exact project trigger in `AGENTS.md` grants one-time authorization for a checked `--all` run, and Codex is never restarted automatically.
 
@@ -198,8 +200,9 @@ The isolated executable can be used directly from the shell:
 
 ```bash
 scrapling --version
-scrapling extract get https://example.com example.txt --css-selector h1
-scrapling extract stealthy-fetch https://example.com example-browser.txt --css-selector h1 --headless
+scrapling extract get https://example.com example.txt --css-selector title
+# Scrapling 0.5+ (use stealthy-fetch instead of fetch on 0.4)
+scrapling extract fetch https://example.com example-browser.txt --css-selector title --headless
 ```
 
 From Python inside the installed environment:
@@ -208,10 +211,10 @@ From Python inside the installed environment:
 from scrapling.fetchers import Fetcher, StealthyFetcher
 
 page = Fetcher.get("https://example.com")
-print(page.css("h1::text").get())
+print(page.css("title::text").get())
 
 browser_page = StealthyFetcher.fetch("https://example.com", headless=True)
-print(browser_page.css("h1::text").get())
+print(browser_page.css("title::text").get())
 ```
 
 Use `Fetcher` for ordinary HTTP pages and `StealthyFetcher` only when a real browser or stronger anti-bot behavior is needed; the browser path is heavier.

package/dist/bin/yam.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { runTestCheckCommand, testCheckStop, testCheckConfigured } from '../lib/test-check.js';
 import { spawnSync } from 'node:child_process';
 import { studyNoteTurnScope } from '../lib/study-note-scope.js';
 import { selectHookNode, probeHookDiscovery, inspectHookObservation, recordHookObservation } from '../lib/hook-readiness.js';
@@ -149,6 +150,7 @@ Usage:
   yam proof [dir|--from file] [--route route] [--truth status] [--command text] [--evidence text]
   yam proof write [dir] [--format json|md] [--out file] [--route route] [--truth status] [--command text]
   yam study-note check [dir] [--report file|--text text] [--json]
+  yam test-check <plan|run|check|status> [--base commit] [--json]
   yam security <init|check|hooks|status> [--stage commit|push|ci|deploy] [--json]
   yam next-step <report|verify> [--spec file|--receipt file] [--json]
   yam loop report [--route route] [--intent text] [--stage id:status:note] [--evidence text] [--json]
@@ -175,7 +177,7 @@ Usage:
   yam safety [text...]
   yam memory <init|add|list|summary|resolve> [dir] [options]
   yam hook <status|enable|disable|run> [lite|study-note] [--global|--project dir]
-  yam template <project|ueye|mission|proof|tuning|security|security-ci>
+  yam template <project|ueye|mission|proof|tuning|security|security-ci|test-check>
   yam tune-log [dir]
   yam install [--dry-run] [--json] [--replace-user-skill name]
   yam uninstall
@@ -495,6 +497,7 @@ async function verify({ quiet = false } = {}) {
         'markdown-management.md',
         'study-note.md',
         'security-check.md',
+        'test-check.md',
         'final-report.md',
         'token-budget-reporter.md',
         'memory.md'
@@ -513,7 +516,7 @@ async function verify({ quiet = false } = {}) {
                 issues.push(`project template missing section: ${section}`);
         }
     }
-    for (const template of ['ueye-review.md', 'ueye-comparison.md', 'mission-plan.md', 'runtime-proof.md', 'tuning-log.md', 'security-check-note.md', 'security-gate.yml']) {
+    for (const template of ['ueye-review.md', 'ueye-comparison.md', 'mission-plan.md', 'runtime-proof.md', 'tuning-log.md', 'security-check-note.md', 'security-gate.yml', 'test-check-policy.json']) {
         if (!await exists(path.join(ROOT, 'templates', template)))
             issues.push(`missing template: ${template}`);
     }
@@ -2477,6 +2480,9 @@ async function buildYamLiteContext({ cwd, prompt }) {
 async function buildStudyNoteStopOutput(input = {}, cwd = process.cwd()) {
     const lastAssistantMessage = String(input?.last_assistant_message || input?.lastAssistantMessage || '');
     const scope = studyNoteTurnScope(input, cwd);
+    const testGate = testCheckStop(cwd, !scope.available || scope.files.length > 0, lastAssistantMessage);
+    if (testGate)
+        return testGate;
     const result = await buildStudyNoteGuardResult(path.resolve(cwd), lastAssistantMessage, 'stop_hook_last_assistant_message', scope);
     if (result.truth_status === 'partial' && !result.changed_file_detection.available) {
         return {
@@ -2507,9 +2513,10 @@ async function buildStudyNoteStopOutput(input = {}, cwd = process.cwd()) {
 }
 async function buildStudyNoteTurnContext(input, cwd) {
     const scope = studyNoteTurnScope(input, cwd, true);
+    const testReminder = testCheckConfigured(cwd) ? ' Test check active: before completion run yam test-check run --base <exact starting commit> --json and yam test-check check --json. Missing required tests/evidence block completion; report Test check: BLOCKED if unable to verify. This is separate from report formatting and Security check.' : '';
     if (!scope.available)
         return 'yam Study Note: turn scope is unavailable; do not treat this as a clean project. Inspect changed artifacts manually; no strict block will be applied without a baseline.';
-    return `yam Study Note turn baseline saved (hash-only). Mode: ${scope.mode}. Only changes since this prompt count; known generated logs, mission/security receipts and screenshots are excluded unless explicitly included. Include a concise Study Note followed by Next step when product artifacts change. ${scope.mode === 'strict' ? 'Risk work uses the detailed report contract and one correction pass.' : 'Ordinary work is advisory: a short explanation, verification/limits and remaining work (or none) suffice.'}`;
+    return `yam Study Note turn baseline saved (hash-only). Mode: ${scope.mode}. Only changes since this prompt count; known generated logs, mission/security receipts and screenshots are excluded unless explicitly included. Include a concise Study Note followed by Next step when product artifacts change. ${scope.mode === 'strict' ? 'Risk work uses the detailed report contract and one correction pass.' : 'Ordinary work is advisory: a short explanation, verification/limits and remaining work (or none) suffice.'}${testReminder}`;
 }
 function yamLiteRouteHint(prompt = '') {
     const text = String(prompt || '').toLowerCase();
@@ -6132,11 +6139,12 @@ async function printTemplate(name = '') {
         runtime: 'runtime-proof.md',
         tuning: 'tuning-log.md',
         security: 'security-check-note.md',
-        'security-ci': 'security-gate.yml'
+        'security-ci': 'security-gate.yml',
+        'test-check': 'test-check-policy.json'
     };
     const file = map[key];
     if (!file) {
-        console.error('usage: yam template <project|ueye|ueye-comparison|mission|proof|tuning|security|security-ci>');
+        console.error('usage: yam template <project|ueye|ueye-comparison|mission|proof|tuning|security|security-ci|test-check>');
         process.exitCode = 1;
         return;
     }
@@ -6433,6 +6441,17 @@ function showRequestedHelp(args) {
 async function main() {
     const args = process.argv.slice(2);
     const command = args[0] || 'help';
+    if (command === 'test-check') {
+        if (!args[1] || ['help', '--help', '-h'].includes(args[1])) {
+            console.log('yam test-check run --base <exact commit> [--policy file --policy-digest sha256] [--json]\nyam test-check check [--stage complete|commit|push|ci|deploy --source <exact commit> --policy-digest sha256 --receipt file] [--json]\nyam test-check status\nyam test-check plan --base <exact commit> --json\nSee references/test-check.md for required scenarios, adapters and activation.');
+            return;
+        }
+        const result = runTestCheckCommand(args.slice(1));
+        console.log(JSON.stringify(result, null, 2));
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
     if (showRequestedHelp(args))
         return;
     if (command === 'help')

package/dist/lib/external-updates.js

@@ -767,6 +767,20 @@ async function applyScrapling(deps) {
         checks.push(commandCheck('install_exact_scrapling', install));
         if (!install.ok)
             throw new Error(`Scrapling install failed: ${commandNote(install)}`);
+        const directVersion = await deps.run(candidateScrapling, ['--version'], { env: deps.env, timeout: 30000 });
+        checks.push(commandCheck('candidate_version', directVersion));
+        if (!directVersion.ok || extractVersion(directVersion.stdout) !== check.latest_version) {
+            throw new Error(`candidate Scrapling version mismatch: ${commandNote(directVersion)}`);
+        }
+        const browserCommand = compareVersions(check.latest_version, '0.5') >= 0 ? 'fetch' : 'stealthy-fetch';
+        const browserHelp = await deps.run(candidateScrapling, ['extract', browserCommand, '--help'], {
+            env: deps.env,
+            timeout: 30000
+        });
+        checks.push(commandCheck('browser_cli_compatibility', browserHelp));
+        if (!browserHelp.ok) {
+            throw new Error(`Scrapling browser CLI ${browserCommand} is unavailable: ${commandNote(browserHelp)}`);
+        }
         const browsers = await deps.run(candidateScrapling, ['install', '--force'], {
             env: deps.env,
             timeout: 600000
@@ -785,27 +799,32 @@ async function applyScrapling(deps) {
         const httpOutput = path.join(candidate, '.yam-http-smoke.txt');
         const browserOutput = path.join(candidate, '.yam-browser-smoke.txt');
         const httpSmoke = await deps.run(candidateScrapling, [
-            'extract', 'get', 'https://example.com', httpOutput, '--css-selector', 'h1', '--timeout', '30'
+            'extract', 'get', 'https://example.com', httpOutput, '--css-selector', 'title', '--timeout', '30'
         ], { env: deps.env, timeout: 120000 });
-        checks.push(commandCheck('http_smoke', httpSmoke));
-        if (!httpSmoke.ok || !await fileContains(httpOutput, 'Example Domain')) {
+        const httpContentOk = httpSmoke.ok && await fileContains(httpOutput, 'Example Domain');
+        checks.push({
+            ...commandCheck('http_smoke', httpSmoke),
+            status: httpContentOk ? 'passed' : 'failed',
+            note: httpContentOk ? commandNote(httpSmoke) : boundedNote(`expected extracted title was not confirmed; ${commandNote(httpSmoke)}`)
+        });
+        if (!httpContentOk) {
             throw new Error(`Scrapling HTTP smoke failed: ${commandNote(httpSmoke)}`);
         }
         const browserSmoke = await deps.run(candidateScrapling, [
-            'extract', 'stealthy-fetch', 'https://example.com', browserOutput,
-            '--css-selector', 'h1', '--headless', '--timeout', '30000'
+            'extract', browserCommand, 'https://example.com', browserOutput,
+            '--css-selector', 'title', '--headless', '--timeout', '30000'
         ], { env: deps.env, timeout: 180000 });
-        checks.push(commandCheck('browser_smoke', browserSmoke));
-        if (!browserSmoke.ok || !await fileContains(browserOutput, 'Example Domain')) {
+        const browserContentOk = browserSmoke.ok && await fileContains(browserOutput, 'Example Domain');
+        checks.push({
+            ...commandCheck('browser_smoke', browserSmoke),
+            status: browserContentOk ? 'passed' : 'failed',
+            note: browserContentOk ? commandNote(browserSmoke) : boundedNote(`expected extracted title was not confirmed; ${commandNote(browserSmoke)}`)
+        });
+        if (!browserContentOk) {
             throw new Error(`Scrapling browser smoke failed: ${commandNote(browserSmoke)}`);
         }
         await unlinkIfExists(httpOutput);
         await unlinkIfExists(browserOutput);
-        const directVersion = await deps.run(candidateScrapling, ['--version'], { env: deps.env, timeout: 30000 });
-        checks.push(commandCheck('candidate_version', directVersion));
-        if (!directVersion.ok || extractVersion(directVersion.stdout) !== check.latest_version) {
-            throw new Error(`candidate Scrapling version mismatch: ${commandNote(directVersion)}`);
-        }
         await fsp.writeFile(path.join(candidate, '.yam-scrapling-install.json'), `${JSON.stringify({
             schema: 'yam.scrapling-install.v1',
             version: check.latest_version,

package/dist/lib/security-integration.js

@@ -1,3 +1,4 @@
+import { checkTestCheck, testCheckConfigured } from './test-check.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs/promises';
@@ -30,7 +31,7 @@ function parseArgs(args) {
     for (let i = 0; i < args.length; i++) {
         if (args[i] === '--json')
             continue;
-        if (!['--policy', '--policy-digest', '--evidence', '--note', '--stage', '--remote', '--destination', '--source', '--base', '--artifact', '--artifact-digest', '--configuration', '--configuration-digest', '--environment', '--cli'].includes(args[i]) || !args[i + 1] || args[i + 1].startsWith('--') || out.has(args[i]))
+        if (!['--policy', '--policy-digest', '--evidence', '--note', '--stage', '--remote', '--destination', '--source', '--base', '--artifact', '--artifact-digest', '--configuration', '--configuration-digest', '--environment', '--cli', '--test-policy-digest'].includes(args[i]) || !args[i + 1] || args[i + 1].startsWith('--') || out.has(args[i]))
             throw new Error('invalid or duplicate security option');
         out.set(args[i], args[++i]);
     }
@@ -381,6 +382,14 @@ async function check(cwd, options, settings) {
         result = validateSecurityCheck(input, binding);
         gateErrors.push('security_input_or_binding_unavailable');
     }
+    if (testCheckConfigured(cwd) || config.test_policy_digest) {
+        const pin = options.get('--test-policy-digest') || config.test_policy_digest;
+        const sources = stage === 'push' ? (binding.push_refs || []).map(ref => ref.local_oid)
+            : [binding.source_revision];
+        const targets = sources.length ? sources : [undefined];
+        if (targets.some(source => !checkTestCheck(cwd, { stage, source, pin, base: stage === 'ci' ? binding.base_revision : undefined, artifact: options.get('--artifact'), configuration: options.get('--configuration') }).ok))
+            gateErrors.push('test_check_blocked');
+    }
     if (gateErrors.length) {
         result.result = 'BLOCKED';
         result.errors = [...new Set([...result.errors, ...gateErrors])];

package/dist/lib/test-check.d.ts

@@ -0,0 +1,156 @@
+export declare const TEST_REQUIREMENTS: {
+    readonly docs: readonly ["inspection"];
+    readonly logic: readonly ["success", "invalid", "boundary"];
+    readonly api: readonly ["success", "invalid", "contract"];
+    readonly db: readonly ["success", "denied", "invalid", "readback", "rollback", "migration_upgrade", "migration_fresh"];
+    readonly auth: readonly ["success", "denied", "cross_scope", "revoked"];
+    readonly ui: readonly ["success", "error"];
+    readonly release: readonly ["artifact", "integrity"];
+};
+type Risk = keyof typeof TEST_REQUIREMENTS;
+type Check = {
+    id: string;
+    target: string;
+    scenario: string;
+    explanation: string;
+    evidence: 'static' | 'unit' | 'integration' | 'e2e';
+    command: string[];
+    environment?: string;
+};
+type Surface = {
+    id: string;
+    paths: string[];
+    risks: Risk[];
+    targets: string[];
+    checks: Check[];
+};
+type Policy = {
+    schema: 'yam.test-policy.v1';
+    surfaces: Surface[];
+};
+export declare function planTestCheck(root: string, policy: Policy, base: string): {
+    changed: string[];
+    source_digest: string;
+    checks: Check[];
+    errors: string[];
+};
+export declare function runTestCheck(cwd: string, options?: {
+    policy?: string;
+    pin?: string;
+    base?: string;
+    stage?: string;
+    source?: string;
+    artifact?: string;
+    configuration?: string;
+}): {
+    ok: boolean;
+    result: string;
+    errors: any[];
+    run?: undefined;
+    note?: undefined;
+    receipt?: undefined;
+    changed_files?: undefined;
+    checks?: undefined;
+} | {
+    ok: boolean;
+    result: any;
+    errors: any;
+    run: any;
+    note: string;
+    receipt: string;
+    changed_files: any;
+    checks: number;
+};
+export declare function checkTestCheck(cwd: string, options?: {
+    policy?: string;
+    pin?: string;
+    stage?: string;
+    source?: string;
+    receipt?: string;
+    artifact?: string;
+    configuration?: string;
+    base?: string;
+}): {
+    ok: boolean;
+    result: string;
+    errors: string[];
+    run: any;
+    checks: number;
+} | {
+    ok: boolean;
+    result: string;
+    errors: string[];
+    run?: undefined;
+    checks?: undefined;
+};
+export declare function testCheckConfigured(cwd: string): boolean;
+export declare function testCheckStop(cwd: string, changed: boolean, message: string): {
+    continue: boolean;
+    systemMessage: string;
+    decision?: undefined;
+    reason?: undefined;
+} | {
+    decision: string;
+    reason: string;
+    continue?: undefined;
+    systemMessage?: undefined;
+};
+export declare function runTestCheckCommand(args: string[], cwd?: string): {
+    ok: boolean;
+    result: string;
+    errors: any[];
+    run?: undefined;
+    note?: undefined;
+    receipt?: undefined;
+    changed_files?: undefined;
+    checks?: undefined;
+} | {
+    ok: boolean;
+    result: any;
+    errors: any;
+    run: any;
+    note: string;
+    receipt: string;
+    changed_files: any;
+    checks: number;
+} | {
+    ok: boolean;
+    result: string;
+    errors: string[];
+    run: any;
+    checks: number;
+} | {
+    ok: boolean;
+    result: string;
+    errors: string[];
+    run?: undefined;
+    checks?: undefined;
+} | {
+    checks: {
+        id: string;
+        target: string;
+        scenario: string;
+        explanation: string;
+        evidence: "static" | "unit" | "integration" | "e2e";
+    }[];
+    policy_digest: string;
+    changed: string[];
+    source_digest: string;
+    errors: string[];
+    ok: boolean;
+} | {
+    ok: boolean;
+    result: string;
+    errors: string[];
+    run: any;
+    checks: number;
+    configured: boolean;
+} | {
+    ok: boolean;
+    result: string;
+    errors: string[];
+    run?: undefined;
+    checks?: undefined;
+    configured: boolean;
+};
+export {};