/** * Guard-produced execution proof block. * * Assembled ONLY from state the guard itself observed while handling a call. Callers cannot supply * fields into this object: builders take GuardOutcome-internal facts, not a host "proof" option. * The returned object is deeply frozen so post-return mutation of proof fields is rejected. * * What this block proves (when the corresponding fields are present): * - preflight happened → preflighted + decision_id * - receipt was fresh → receipt.status === 'VERIFIED_CURRENT' + expires_at * - scope matched → binds_to.operation + currently_authorized * - ran on the guarded path → execution.enforced === true (runtime-asserted only with * receipt.verified + preflighted; same invariant the types encode) * - artifact checked vs executed → change_fp is WHAT WAS CHECKED; execution_result_hash is NOT a * general claim that the applied side effect matched that fp * * What this block must never claim: that the change is safe, that the host cannot bypass the * package, or that an absent field means compliance. Those limits are explicit on every block. */ import type { GuardVerdict } from './types.js'; import type { CommitObservation } from './commit-observation.js'; import type { MonitoringDelivery } from './monitoring-delivery.js'; import type { CasEvidence } from './cas-attestation.js'; /** Machine-readable schema id for this block. */ export declare const EXECUTION_PROOF_SPEC: "guard-execution-proof.v1"; /** * Hash of the factory return value — only when the value is already byte-stable. * * Not hashed (and the block says so) when: * - the factory did not run / threw / produced no result * - the result is an object, array, number, boolean, null, bigint, symbol, function — any of these * would require a serialization choice (key order, undefined, non-JSON values) that reformats * the value rather than hashing the bytes the factory returned * * A hash of a string/Buffer does NOT prove the contract artifacts applied match change_fp_checked. * That gap is named on limits. */ export type ExecutionResultHash = { status: 'hashed'; algorithm: 'sha256'; value: string; } | { status: 'not_hashed'; reason: 'not_executed' | 'execution_threw' | 'result_not_byte_stable' | 'result_type_unsupported'; }; export type GuardExecutionProof = { proof_spec: typeof EXECUTION_PROOF_SPEC; /** Observed: true iff this call completed a preflight round-trip that produced a decision envelope. */ preflighted: boolean; /** Observed from the decision envelope when preflighted; null otherwise. */ decision_id: string | null; receipt: { /** * Observed: true only when the guard's verify+bind step branded the envelope * (requires valid signature, status VERIFIED_CURRENT, body hash + fp + scope match). */ verified: boolean; /** * Observed derivation: bind requires status === 'VERIFIED_CURRENT', so verified ⇒ this value. * null when the receipt was not verified (or no receipt path). */ status: 'VERIFIED_CURRENT' | null; /** Observed from the envelope when present; null when no envelope. */ expires_at: string | null; }; /** * Observed from the authenticated envelope fields when an envelope exists. * change_fp is the fingerprint of WHAT WAS CHECKED (preflighted), not of what the factory applied. * null when no envelope (SKIPPED / unavailable without envelope). */ binds_to: { operation: string | null; change_fp: string | null; } | null; /** * Observed at verify time: true iff receipt.verified (VERIFIED_CURRENT + bind). * false when an envelope/receipt was present but did not verify. * null when there was no receipt path to evaluate (SKIPPED, no envelope). */ currently_authorized: boolean | null; execution: { attempted: boolean; executed: boolean; enforced: boolean; }; /** * Observed: kind of the guard verdict that produced this outcome. * On a blocked call this is how the block is named (BLOCK / APPROVAL / UNAVAILABLE / …). */ verdict_kind: string; execution_result_hash: ExecutionResultHash; /** * Explicit non-claims. Readers that treat missing fields as "ok" are wrong; these are always set. */ limits: { does_not_claim_change_safe: true; does_not_claim_host_cannot_bypass: true; does_not_claim_absent_field_is_compliance: true; change_fp_is_what_was_checked_not_what_executed: true; calls_outside_guarded_path_invisible: true; execution_result_hash_is_not_artifact_match_proof: true; /** * conditional_write:true is the HOST's assertion that it conditioned the write on a version * token. The guard does NOT and CANNOT independently verify that a compare-and-swap actually * occurred at commit time — the guard never writes. Absence is reported as 'not_reported', * never as false. (ID781 option A: honesty label; real CAS attestation is separate work.) */ conditional_write_is_host_asserted_not_cas_verified: true; /** * commit_observation is observed at T3, not atomic: another writer may act between write * and observation; token-only adapters compare version token not content; host attestation * is a host claim layered on the measurement. */ commit_observation_is_observed_at_t3_not_atomic: true; }; /** T3 post-commit observation. Always present; not_observed when nothing was re-read. */ commit_observation: CommitObservation; /** * CWM monitoring delivery (N-4). Present only on CONTINUE_WITH_MONITORING arms. * Observation-side — never a verdict/preimage field. delivered_acked ≠ human attention. */ monitoring_delivery?: MonitoringDelivery; /** * S2-F2a R3 CAS evidence class (observation). Present when a CAS outcome was * observed. Not a preimage field. executor_attested only after registry verify. */ cas_evidence?: CasEvidence; /** * ENFORCING_STRICT only (P0-3). Observation-side success name from the existing * CasAttestation.derived vocabulary. Absent on non-strict proofs (byte-identical to 9.0.0). * authorized_and_committed requires cas_evidence.class === executor_attested AND a kernel * grant/receipt cross-check. enforced remains the pre-write fact. */ commit_label?: import('./cas-attestation.js').CommitLabel; commit_evidence_reason?: 'commit_evidence_missing'; /** cr.monitor.attest.v1 token (observation). Present when the host signed a CWM delivery. */ monitoring_attestation?: string; /** * S6 auto-recheck trail (observation). Present when the wrap-layer loop ran. * Additive; not a preimage field. Final outcome is the last decision. */ recheck_trail?: ReadonlyArray<{ attempt: number; decision_id: string | null; fingerprint: string | null; execution_action: string | null; }>; /** * Observed tool-traffic coverage (withCodeRifts run). Observation only; omitted * when no observer is wired. Not a preimage field. */ coverage_observed?: import('./coverage-observed.js').CoverageObserved; }; export type ProofBuildInput = { preflighted: boolean; executionAttempted: boolean; executed: boolean; enforced: boolean; verdict: GuardVerdict; /** Present only when executed:true (factory returned). */ result?: unknown; /** Present only when factory threw. */ error?: unknown; /** Optional conditional-write basis for the enforced+policy invariant. */ conditionalWriteBasis?: { require_conditional_write: boolean; write_style: boolean; mutating?: boolean; conditional_write: true | false | 'not_reported'; }; /** T3 observation assembled by the guard after executeFactory (or not_observed). */ commitObservation?: CommitObservation; /** CWM delivery evidence; omit on non-MONITOR arms. */ monitoringDelivery?: MonitoringDelivery; /** S2-F2a R3 CAS evidence (observation). */ casEvidence?: CasEvidence; /** ENFORCING_STRICT only — omit on non-strict (byte-identical proofs). */ commitLabel?: import('./cas-attestation.js').CommitLabel; commitEvidenceReason?: 'commit_evidence_missing'; monitoringAttestation?: string; /** S6 trail passthrough (observation). */ recheckTrail?: ReadonlyArray<{ attempt: number; decision_id: string | null; fingerprint: string | null; execution_action: string | null; }>; /** Coverage snapshot (observation). Omit when no observer. */ coverageObserved?: import('./coverage-observed.js').CoverageObserved; }; /** * Runtime twin of the type-level enforced⟺receiptVerified invariant. * Throws if enforced:true is paired with anything other than receiptVerified+preflighted. * When requireConditionalWrite + the call MUTATES: enforced:true also requires conditional_write:true * (same refusal class as the permission gate — not a parallel path). Gated on `mutating`, not * `writeStyle`: both sides of a change being present says nothing about the commit being atomic. * The proof block is read by consumers that do not have our TypeScript brands. */ export declare function assertEnforcedReceiptInvariant(input: { enforced: boolean; preflighted: boolean; receiptVerified: boolean; /** Policy requireConditionalWrite for this call (optional; omit = not checked here). */ requireConditionalWrite?: boolean; writeStyle?: boolean; /** Artifact-independent mutation classification. Defaults to writeStyle when omitted. */ mutating?: boolean; /** Host report: true | false | 'not_reported'. */ conditionalWrite?: true | false | 'not_reported'; }): void; /** * Honest byte hash of a factory return. Only string / Buffer / Uint8Array are hashed as raw bytes. * Everything else is not_hashed with an explicit reason — never a JSON reformat hash. */ export declare function hashExecutionResult(result: unknown): ExecutionResultHash; /** * Build the proof block from guard-observed outcome facts only. * Never accepts a caller-supplied proof object or partial field map. */ export declare function buildExecutionProof(input: ProofBuildInput): GuardExecutionProof; //# sourceMappingURL=execution-proof.d.ts.map