/** A single verification outcome produced by a probe action or `doctor`. */
export type Verdict = "pass" | "fail" | "skip";
/**
 * Closed taxonomy of routable verification outcomes. Each member maps 1:1 to a
 * real `fail`/`skip` emitter (see docs/research/check-code-taxonomy-plan.md) so a
 * consumer — support templates, run-ledger findings — can `switch` over it
 * exhaustively rather than string-match `detail` (which rots on a reword). Keep it
 * sealed: a new failure mode means a new member here PLUS the `code` set at the
 * emitter; never derive a code by matching `detail`.
 */
export type CheckCode = "env.node-runtime" | "env.git-missing" | "env.git-bash-missing" | "env.dev-tool-missing" | "env.tool-install-blocked" | "cert.ca-missing" | "tls.verify-failed" | "npm.runtime-broken" | "path.missing" | "mcp.blocked" | "mcp.uv-missing" | "mcp.config-missing" | "mcp.config-invalid" | "mcp.unvendored-offline" | "mcp.policy-denied" | "mcp.compliant-config-read" | "mcp.compliant-stale-denied" | "mcp.hardcoded-secret" | "mcp.allowlist-drift" | "mcp.allowlist-generation-delta" | "mcp.version-drift" | "mcp.pin-unattested" | "mcp.pin-stale" | "mcp.projection-stale" | "cli.not-detected" | "cli.config-only" | "cli.binary-broken" | "cli.bootloader-missing" | "cli.bootloader-drift" | "cli.bootloader-unmanaged" | "cli.wont-load" | "canon.router-missing" | "canon.generated-missing" | "canon.generated-drift" | "canon.context-dir-missing" | "canon.lint-failed" | "canon.adoptable" | "canon.cli-native-unmigrated" | "config.marker-invalid" | "secrets.plaintext-detected" | "guardrails.gitleaks-missing" | "usage.no-data" | "usage.recorder-missing" | "usage.kiro-hook-runtime-unverified" | "usage.metrics-tool-missing" | "scale.code-review-graph-missing" | "contract.path-unportable" | "contract.stale" | "org-policy.drift" | "org-policy.dropped-target-residue" | "org-policy.dropped-target-unowned" | "org-policy.generation-delta" | "org-policy.invalid" | "org-policy.bundle-invalid" | "org-policy.effective-blocked" | "bundle.signature" | "report.context-over-budget" | "report.low-adoption" | "report.contract-untrue" | "docs.banned-phrase" | "docs.vague-absolute" | "docs.unsupported-callout-claim" | "docs.rules-missing" | "docs.claim-mapping-missing" | "docs.claim-matrix-row-missing" | "docs.claim-test-missing" | "docs.feature-ledger-drift" | "truth.sidecar-missing" | "truth.bound-commit-drift" | "truth.version-drift" | "truth.claim-matrix-row-missing" | "truth.decision-supersession-missing" | "truth.acceptance-blocked-environment" | "truth.acceptance-blocked-vendor-specific" | "truth.agent-evidence-mismatch" | "truth.pack-invalid" | "ready.blocked" | "baseline.registry-missing" | "baseline.registry-invalid" | "baseline.undeclared-surface" | "baseline.evidence-missing" | "baseline.evidence-mismatch" | "baseline.evidence-blocked" | "baseline.evidence-schema-unsupported" | "trust.fetch-blocked" | "trust.detector-unavailable" | "trust.detector-finding" | "trust.legal-text-detector-finding" | "trust.sandbox-smoke-unavailable" | "trust.sandbox-smoke-failed" | "trust.cisco-finding" | "trust.skill-metadata-license" | "trust.hidden-unicode" | "trust.visible-unicode" | "trust.external-egress" | "trust.permission-risk" | "trust.prompt-injection" | "trust.source-changed" | "trust.auto-exec-hook" | "trust.dependency-confusion" | "trust.typosquat" | "trust.malicious-code" | "trust.source-drift" | "trust.unpinned-dependency" | "trust.untrusted-publisher" | "trust.unsigned-source" | "trust.license-missing" | "trust.unapproved-skill" | "pack.duplicate-name" | "pack.pin-mismatch" | "pack.missing-approval" | "pack.unknown-manifest" | "pack.required-checks-unsupported" | "marketplace.manifest-parse" | "marketplace.path-traversal" | "marketplace.missing-file" | "marketplace.checksum-mismatch" | "marketplace.sums-coverage" | "marketplace.unapproved-verdict" | "marketplace.signature" | "binding.contaminated" | "binding.host-off-tuple" | "binding.host-version-drift" | "binding.framework-drift" | "binding.no-adapter" | "binding.deny-stale" | "binding.hook-chain" | "binding.settings-drift" | "binding.mcp-inventory" | "ecc.install-drift";
export interface Check {
    name: string;
    verdict: Verdict;
    detail?: string;
    /**
     * Stable machine code for routing (support templates, run-ledger findings). Set
     * ONLY on `fail`/`skip` emitters a consumer keys off — never on a `pass`, and
     * never derived from `detail`. Absent ⇒ not yet ticket-routed. Optional by
     * design, so a Check that omits it serializes byte-for-byte as before.
     */
    code?: CheckCode;
    /** Optional repo-relative artifact location for file-backed findings. */
    location?: {
        uri: string;
        startLine?: number;
    };
    /** Optional stable fingerprint for code-scanning de-dupe. */
    fingerprint?: string;
}
/**
 * Accumulates {@link Check}s and renders a fail-closed report. `skip` never fails
 * the run (used when a tool/daemon is absent); only `fail` flips the exit code.
 */
export declare class VerificationReport {
    readonly checks: Check[];
    add(check: Check): this;
    pass(name: string, detail?: string): this;
    fail(name: string, detail?: string): this;
    skip(name: string, detail?: string): this;
    get ok(): boolean;
    counts(): Record<Verdict, number>;
    /** 0 when no check failed, 1 otherwise. */
    exitCode(): number;
    toJSON(): {
        ok: boolean;
        counts: Record<Verdict, number>;
        checks: Check[];
    };
    summary(): string;
}