/**
 * Pure derivation of a `check` node's evidence payload — what was compared,
 * where each value came from, and whether that makes the verdict
 * runtime-`"verified"` or agent-`"asserted"`.
 *
 * Ruling: re-running a check is not required to reproduce the same answer,
 * so there is no snapshot materialization, no hashing, and no reproducibility
 * guarantee here — this module records integrity of *what was observed*, not
 * a promise that observing it again would agree. Provenance is derived
 * exclusively from {@link BindingOrigin.obtainedBy}, the flow engine's
 * existing (and only) provenance mechanism, so it can never be influenced by
 * how a flow author names a binding. That label is transitive before it
 * arrives here — a deterministic node that carries an agent's value forward
 * stays agent-obtained — so this module compares origins as given and makes
 * no one-hop caveat.
 *
 * The claim is that provenance cannot be asserted by flow *configuration*.
 * It is not a claim against a caller holding the read-write connector handle:
 * taint now derives from persisted `NodeExecution.inputOrigins`, which the
 * `hydrate` op writes verbatim. Such a caller could already forge `output`
 * itself, so this widens no existing trust boundary.
 *
 * No I/O and no clock: `observedAt` is supplied by the caller so this stays
 * trivially testable and replayable.
 *
 * @docLink packages/flow-engine/concepts#check-provenance
 */
import type { CheckEvidence } from "@skaile/workspaces/types";
import type { ResolvedNodeBindings } from "../contract/expression.js";
/** The check's process facts, captured alongside its verdict so a persisted attempt is self-describing. */
export interface CheckProcessRecord {
    runtime: "shell" | "node" | "python";
    command: string;
    cwd?: string;
    successExit: number[];
    exitStatus: number;
    passed: boolean;
}
/**
 * Derive one check's evidence from its already-resolved bindings and its
 * process outcome. `provenance` and `inputs` are computed only from
 * `bindings.origins` — never from `bindings.values` or their names — so
 * authoring a binding literally named `provenance` or `verified` cannot
 * influence the verdict.
 *
 * `provenance` is `"verified"` iff every origin of every compared value has
 * `obtainedBy: "runtime"`, `"asserted"` if any does not, and **absent** when
 * there are no compared values — neither label is honest about an empty set.
 * `obtainedBy` is already transitive when it reaches here (see
 * `producerOutputObtainedBy`), so `"verified"` means no agent-produced value
 * contributed anywhere in the ancestry, not merely one hop back.
 * `inputs` is `"live"` — the floor for any check that runs a process —
 * unless there is at least one compared value and every one of them has
 * origins that are all `literal`/`default`/`flow-input`, in which case it is
 * `"flow-local"`.
 */
export declare function deriveCheckEvidence(bindings: ResolvedNodeBindings, process: CheckProcessRecord, observedAt: string): CheckEvidence;
//# sourceMappingURL=check-provenance.d.ts.map