/**
 * S1 value-verdict harness — the HIDDEN OBJECTIVE ORACLE (the measure, NEVER an LLM). SPEC-S1-value-harness.md §4.
 *
 * ONE standalone oracle, shared by ALL three arms; ONLY the profile (arms.ts) differs. The oracle is:
 *   - OBJECTIVE: it runs `runExecGate` (real exit codes; null-exit never passes; an empty suite never passes —
 *     `exec-gate.d.ts`). There is NO model/LLM parameter ANYWHERE in this type (objective-oracle discipline,
 *     [ref] §2.2.1 — the LLM is a GATE inside an arm, never the MEASURE in the numerator).
 *   - DECORRELATED + ANTI-REWARD-HACK: it grades in a DISTINCT grader env (`ctx.newGraderEnv()`), never the
 *     worker's own env — the SAME isolation the repair-loop §5.1 identity check enforces.
 *   - HIDDEN + RESTORED-BEFORE-SCORING: the worker never sees `task.hiddenTestFiles`; the oracle WRITES them into
 *     the grader checkout, overwriting any worker-authored same-named file (anti-rewrite, [ref] §2.2).
 *
 * The repair leg needs core's `RepairOracle = (graderEnv, evidence) => OracleResult` shape — a DIFFERENT
 * signature. `repair-oracle-adapter.ts` wraps this standalone oracle into that closure (do NOT pass `runOracle`
 * straight to `runRepairLoop` — it would not type-check + the repair leg would be miswired, SPEC Risk MEDIUM).
 */
import { type ExecutionEnv, type ExecStep, type ExecStepResult } from "@sema-agent/core";
import { type OracleVerdicts } from "./row.js";
/**
 * The objective verdict — the 4 s1.v1 `OracleVerdicts` booleans PLUS the derived `trulyCorrect` and the raw exec
 * steps (provenance). `trulyCorrect` is the AND of every objective signal — it is the numerator gate. The 4
 * boolean field names (hiddenTestsGreen / buildPassed / invariantsOk / delivered) ARE the s1.v1 contract names.
 */
export interface OracleVerdict extends OracleVerdicts {
    /** = delivered && hiddenTestsGreen && buildPassed && invariantsOk. The ONLY thing that counts as value. */
    trulyCorrect: boolean;
    raw: {
        steps: ExecStepResult[];
    };
}
/** The slice of a TrapSpec the oracle needs (avoids a circular import on the full tasks.ts shape). */
export interface OracleTask {
    id: string;
    /** Hidden test files the oracle restores into the grader checkout BEFORE scoring (worker never sees these). */
    hiddenTestFiles: Array<{
        path: string;
        content: string;
    }>;
    /** The build step(s) — exit 0 = `buildPass`. Empty ⇒ `buildPass:true` (no build to fail). */
    buildSteps: ExecStep[];
    /** The hidden-test step(s) — exit 0 = `hiddenTestsPass`. MUST be non-empty (an empty suite never passes). */
    oracleSteps: ExecStep[];
    /** Optional property-harness invariant step(s) — exit 0 = `invariantsOk`. Empty ⇒ `invariantsOk:true` (N/A). */
    invariantSteps?: ExecStep[];
    /** Repo dir inside the grader env where the worker's committed tree was cloned/pulled. */
    graderRepoDir: string;
    /** The base ref to diff against for `delivered` (HEAD must differ AND be in the committed tree). */
    baseRef: string;
    /** 🔴 tar-worktree path (firm-v1/C4): when the grader receives a tar of the WORKTREE (no .git — to dodge the E2B
     *  grader-clone heisenbug + Kata virtiofs st_dev limit), `delivered` can't run `git rev-parse` in the grader. The
     *  worker (where git works) computes HEAD + s1-base shas up front; `delivered` = head≠base from THESE. When set,
     *  the grader does no git at all. Absent ⇒ the legacy `cd REPO && git rev-parse` path (mock tests). */
    deliveredShas?: {
        head: string;
        base: string;
    };
}
/**
 * A minimal grader-side helper the oracle needs the env to expose to clone/pull the worker's COMMITTED tree IN
 * and to write hidden tests. The real E2B/Kata env satisfies this via its exec/writeFile; the shape test passes
 * a deterministic fake. (We DON'T reuse `ExecutionEnv.writeFile` directly only because the file-write path is
 * env-specific — but we DO require the `ExecutionEnv` itself for `runExecGate`, the actual measure.)
 */
export interface GraderTransport {
    /** Run a setup command in the grader (clone the worker's committed tree, checkout the SHA). Returns exit code. */
    exec: (command: string) => Promise<{
        exitCode: number;
        stdout: string;
        stderr: string;
    }>;
    /** Write a hidden test file into the grader checkout (overwriting a worker-authored same-named file). */
    writeFile: (path: string, content: string) => Promise<void>;
}
/**
 * Run the hidden objective oracle against the worker's COMMITTED tree, IN a distinct grader env.
 *
 * @param graderEnv  the distinct grader execution env (for `runExecGate` — the real measure).
 * @param transport  the grader's clone/checkout/writeFile seam (restore hidden tests + pull the committed tree in).
 * @param workerEnv  the worker's env — passed ONLY so we can assert `graderEnv !== workerEnv` (anti-reward-hack).
 * @param task       the trap's oracle config (hidden tests + build/oracle/invariant steps + repo + base ref).
 */
export declare function runOracle(graderEnv: ExecutionEnv, transport: GraderTransport, workerEnv: ExecutionEnv, task: OracleTask): Promise<OracleVerdict>;
//# sourceMappingURL=oracle.d.ts.map