/** * enforcement-coverage report (#9) — the PURE tetrad aggregator (enforcement-coverage-SPEC §1–5). * The capstone of scope honesty: it composes the four primitives' ALREADY-COMPUTED states into ONE * honest picture — where is the system actually inescapable, and where isn't it? * * Thesis: complete ≠ enforced. A primitive installed or green for one commit is not the same as * ENFORCING for that placement. * * PURE aggregator — NO I/O; it NEVER re-decides and NEVER re-runs a gate / resolver / registry (C7). * It reads only the input structs the primitives already emit (registry report.coverage + * inescapable_runtime; merge/deploy enforcement_state + inescapable_*; resolver report.coverage). * Same input → same report (C9; residuals sorted). Fail-closed: the weakest applicable placement caps * the overall, and a missing/unobservable applicable state is UNKNOWN — never treated as "fine". * * Applicability-aware: a placement that is not in scope for this target is EXCLUDED and NEVER * contributes a residual or a cap (C4/C5). Scope honesty is paramount: every residual is named, and * even FULLY_ENFORCED does not claim "nothing can ever bypass" — an infra residual always exists. * * Public source (ships in the npm package): reads only placement state fields — no scoring logic, * weights, thresholds, pattern names, endpoints, or secrets. */ import type { EnforcementState } from './merge-gate.js'; export type PlacementId = 'runtime' | 'merge' | 'deploy' | 'content'; export type Applicability = { runtime: boolean; merge: boolean; deploy: boolean; content: boolean; }; export type RuntimePlacementInput = { coverage: 'COMPLETE' | 'PARTIAL' | 'BYPASSED' | 'UNKNOWN' | string; inescapable_runtime: boolean; residuals?: string[]; }; export type MergePlacementInput = { enforcement_state: EnforcementState | string; inescapable_merge: boolean; residuals?: string[]; }; export type DeployPlacementInput = { enforcement_state: EnforcementState | string; inescapable_deploy: boolean; residuals?: string[]; }; export type ContentPlacementInput = { coverage: 'COMPLETE' | 'PARTIAL' | 'UNRESOLVED' | 'EMPTY' | 'UNKNOWN' | string; artifacts_ready?: boolean; residuals?: string[]; }; export type CoverageReportInput = { applicability: Applicability; /** * Host attestation that the `applicability` map is complete and intentional (RT-P-16). * * **Absence semantics (not_reported discipline):** missing or any value other than * strictly `true` is false-equivalent for claims. Unattested applicability can never * support `FULLY_ENFORCED` (downgraded to `PARTIALLY_ENFORCED` when placements would * otherwise all be ENFORCING) and always names residual `applicability_unattested` * when at least one placement is applicable. Absence is not attestation. */ applicability_attested?: boolean; runtime?: RuntimePlacementInput | null; merge?: MergePlacementInput | null; deploy?: DeployPlacementInput | null; content?: ContentPlacementInput | null; }; export type PlacementStrength = 'ENFORCING' | 'WEAK' | 'UNKNOWN' | 'EXCLUDED'; export type OverallCoverage = 'FULLY_ENFORCED' | 'PARTIALLY_ENFORCED' | 'ADVISORY_ONLY' | 'CONTENT_BLOCKED' | 'UNKNOWN' | 'NOT_APPLICABLE'; export type HonestClaimKey = 'claim_fully_enforced' | 'claim_partially_enforced' | 'claim_advisory_only' | 'claim_content_blocked' | 'claim_unknown' | 'claim_not_applicable'; export type PerPlacementRow = { placement: PlacementId; applicable: boolean; strength: PlacementStrength; summary: { enforcement_or_coverage: string; inescapable_flag?: boolean | null; }; residuals: string[]; }; export type CoverageReport = { overall_coverage: OverallCoverage; per_placement: PerPlacementRow[]; residuals: string[]; honest_claim_key: HonestClaimKey; honest_claim_language: string; flags: { may_claim_inescapable_runtime: boolean; may_claim_inescapable_merge: boolean; may_claim_inescapable_deploy: boolean; may_claim_full_tetrad: boolean; }; }; /** * §1–5 — the pure tetrad aggregator. Deterministic; no I/O; reads only the primitives' emitted states. */ export declare function coverageReport(input: CoverageReportInput): CoverageReport; //# sourceMappingURL=coverage-report.d.ts.map