export type Backend = "kata" | "e2b";
/**
 * The injected exec seam. Mirrors the shape of `RemoteExecutionEnv.exec`'s success value so the live runner can
 * pass a thin wrapper over the real adapter and the unit test can pass a deterministic fake. Returning a typed
 * result (never throwing) matches the adapter contract.
 */
export type ProbeExecResult = {
    stdout: string;
    stderr: string;
    exitCode: number;
};
export type ProbeExec = (command: string) => Promise<ProbeExecResult>;
/** What a real-isolation runtime looks like — kata-qemu / kata-fc are VM boundaries; runc / "" are NOT. */
export declare const REAL_ISOLATION_RUNTIME_CLASSES: readonly ["kata-qemu", "kata-fc", "kata"];
/**
 * The probe definitions — the matrix. `assertsBoundary` documents the REAL boundary; `distinguishes` documents
 * how the probe tells a real kernel/VM/CNI enforcement apart from a typed refusal or a self-declared boolean.
 * `buildable` flags which probes run for real now vs are pending a cross-team seam (honest, never fake-green).
 */
export interface ProbeDef {
    id: "P0" | "P1" | "P2" | "P3" | "P4";
    name: string;
    assertsBoundary: string;
    distinguishes: string;
    buildable: "now" | "pending-adapter-seam" | "pending-cni";
    /** The blocker citation when `buildable !== "now"` — surfaced verbatim in the artifact/pending state. */
    blocker?: string;
}
export declare const PROBE_MATRIX: readonly ProbeDef[];
export declare function probeDef(id: ProbeDef["id"]): ProbeDef;
/** What the adapter SELF-DECLARES vs what L8 must independently establish. */
export interface RuntimeObservation {
    /** The adapter's `capabilities.isolation` — the boolean L8 must NOT trust. */
    declaredIsolation: boolean;
    /** The pod's ACTUAL runtimeClass as read from the live cluster (k8s) — "" / "runc" means no VM boundary. */
    actualRuntimeClass: string;
    /** Guest kernel (`uname -r` inside the sandbox). */
    guestKernel: string;
    /** Host kernel (kata only — captured out-of-band, e.g. `ssh build-host uname -r`); null on e2b (different host). */
    hostKernel: string | null;
    /** `systemd-detect-virt` / DMI product — corroborating VM evidence (best-effort). */
    detectedVirt?: string;
    backend: Backend;
}
export interface RuntimeVerdict {
    /** What L8 PROVED — the load-bearing field. NEVER copied from declaredIsolation. */
    isolationClassVerified: boolean;
    /** The class L8 concluded the runtime actually is. */
    classifiedRuntime: "vm-isolated" | "runc-downgrade" | "unknown";
    /** (kata) guest kernel distinct from host. Meaningless on e2b → null (RISK-7). */
    kernelDistinctFromHost: boolean | null;
    reason: string;
}
/**
 * Classify the REAL runtime from observations — the lying-adapter detector. A runc downgrade still reports
 * `declaredIsolation:true`; this function IGNORES that and decides from `actualRuntimeClass` + kernel-inequality.
 *
 *  - kata: VM-isolated iff the runtimeClass is a real isolation class AND guestKernel != hostKernel. If the
 *    runtimeClass was dropped to "" / "runc" the kernel MATCHES the host → runc-downgrade → NOT verified.
 *  - e2b: the host is not ours, so kernel-vs-host is meaningless (RISK-7). VM-isolation evidence for e2b is the
 *    Firecracker kernel string being present (a non-empty distinct guest kernel) — host-unreachability (P2) is
 *    the corroborating half. We never assert a kata-only kernel-inequality invariant on e2b.
 */
export declare function classifyRuntime(o: RuntimeObservation): RuntimeVerdict;
/**
 * The probe COMMANDS for the runtime read (used by the live runner; shown here so they live with the probe).
 * Every interpolated value is shellQuoted (RISK-9). These are read-only — no side effects.
 */
export declare function runtimeReadCommands(): {
    uname: string;
    detectVirt: string;
    dmi: string;
};
/** The escalations P1 attempts after the initial write (the real test, beyond core's point-in-time probe). */
export declare const P1_ESCALATIONS: readonly ["remount-rw", "chattr-i", "unshare-m", "busybox-mount"];
export type P1Escalation = (typeof P1_ESCALATIONS)[number];
/** Honest mode: whether the real adapter RO-mount seam is present. Absent ⇒ P1 ran against a proxy ⇒ NOT G-c. */
export type P1Mode = "adapter-RO-seam-present" | "adapter-RO-seam-absent";
/** The escalation shell commands for an oracle path — every path shellQuoted (RISK-9). */
export declare function p1EscalationCommand(escalation: P1Escalation, oraclePath: string): string;
/**
 * INDEPENDENT-GRADER input for P1 — the runner observes these OUT-OF-BAND (via the adapter, not the agent's
 * self-report). `oracleProbeFileExistsAfter` and `oracleInodeUnchanged` are the load-bearing facts.
 */
export interface P1Observation {
    mode: P1Mode;
    /** Did the cap-sanity check confirm CAP_SYS_ADMIN is ABSENT? (so a success isn't "we silently had the cap"). */
    capSysAdminAbsent: boolean;
    /** Initial `touch` on the RO oracle must FAIL (RC != 0) — the first necessary condition. */
    initialWriteBlocked: boolean;
    /** Per-escalation: did the escalation command fail (RC != 0)? */
    escalationsBlocked: Record<P1Escalation, boolean>;
    /** INDEPENDENT grader: after all attempts, the .l8-probe file must NOT exist (no byte was written). */
    oracleProbeFileExistsAfter: boolean;
    /** INDEPENDENT grader: the oracle dir/file inode/hash is unchanged vs the pre-probe snapshot. */
    oracleInodeUnchanged: boolean;
}
export interface P1Verdict {
    passed: boolean;
    /** If false, this is necessary-non-sufficient for the GRADER contract — gC must not be claimed on it. */
    validForGraderContract: boolean;
    allBlocked: boolean;
    reason: string;
}
/**
 * P1 verdict — PASS iff the initial write failed AND EVERY escalation failed AND the independent grader confirms
 * no probe file was written and the inode is unchanged AND CAP_SYS_ADMIN was confirmed absent. The pass is only
 * valid for the grader contract when the adapter RO seam is present (mode); on a proxy path it is honest but
 * necessary-non-sufficient.
 */
export declare function gradeP1(o: P1Observation): P1Verdict;
/**
 * The egress vectors P3 attempts — NOT just one curl. Each is a distinct exfil channel a real CNI must block.
 * The verdict comes from the EXTERNAL collector (per-run nonce), never the in-sandbox exit code.
 */
export declare const EGRESS_VECTORS: readonly ["https-tcp", "dns", "udp", "ipv6", "metadata-169254", "unix-socket"];
export type EgressVector = (typeof EGRESS_VECTORS)[number];
/** Build the attempt command for a vector. `host`/`url` carry the per-run nonce; everything shellQuoted (RISK-9). */
export declare function egressAttemptCommand(vector: EgressVector, target: string, nonce: string): string;
/**
 * P3 input. `egressEnforcementPresent` is whether a real enforcement layer exists at all (a CNI that enforces
 * egress NetworkPolicy / an E2B that can restrict egress). `collectorObservedNonce` is the EXTERNAL oracle.
 */
export interface P3Observation {
    /** Is there a real egress-enforcement layer? FALSE today (no NetworkPolicy + E2B allowInternetAccess:true). */
    egressEnforcementPresent: boolean;
    /** EXTERNAL collector: did it log ANY inbound carrying the per-run nonce? true ⇒ exfil leaked (E3). */
    collectorObservedNonce: boolean;
    /** Control case: an ALLOWLISTED host must still work (proves a real allowlist, not blanket-deny). */
    allowlistedWorks: boolean;
    /** A4: only meaningful if a host volume is mounted — by default neither adapter mounts one. */
    a4Applicable: boolean;
    /** A4: the runner stat'd the host-side resource before/after — was it untouched? (only if a4Applicable). */
    a4HostUntouched: boolean;
}
export interface P3Verdict {
    passed: boolean;
    /** The honest enforcement finding — set from the observation, NEVER inferred from a YAML being present. */
    egressEnforced: boolean;
    nonAllowlistedBlocked: boolean;
    reason: string;
}
/**
 * P3 verdict — PASS iff egress is actually enforced AND the collector saw NO nonce AND the allowlisted control
 * works AND (if applicable) the host resource is untouched. Against the CURRENT boundary `egressEnforcementPresent`
 * is FALSE → `egressEnforced:false` → P3 cannot pass. That is a real finding (the G-c blocker), not fake-green.
 */
export declare function gradeP3(o: P3Observation): P3Verdict;
//# sourceMappingURL=probes.d.ts.map