export declare const X402_PROTECTED_TOOL_ACCEPTANCE_VERSION: "handshake.product.x402-protected-tool-acceptance.v1"; export type X402ProtectedToolAcceptanceAuthorityPosture = "distribution_only" | "setup_evidence_only" | "local_probe_evidence_only" | "pre_contract_readiness" | "health_read_only" | "host_profile_only" | "proposal_only" | "policy_authority" | "gateway_authority" | "terminal_evidence_only"; export type X402ProtectedToolAcceptanceStep = { readonly id: string; readonly label: string; readonly surfaceOwner: string; readonly authorityPosture: X402ProtectedToolAcceptanceAuthorityPosture; readonly inputEvidence: readonly string[]; readonly outputRecord: string; readonly requiredNonAuthorityFlags: readonly string[]; readonly bypassPosture: string; readonly proofGaps: readonly string[]; readonly validationGate: string; readonly stopCondition: string; }; export declare const x402ProtectedToolAcceptanceMatrix: readonly [{ readonly id: "package_install"; readonly label: "Install published package"; readonly surfaceOwner: "package.json, server.json, bin, package surface checks"; readonly authorityPosture: "distribution_only"; readonly inputEvidence: readonly ["published package version", "package allowlist", "server metadata"]; readonly outputRecord: "installed artifact and command/subpath availability"; readonly requiredNonAuthorityFlags: readonly ["does_not_create_policy_decision", "does_not_create_greenlight", "does_not_perform_gateway_check", "does_not_resolve_credential", "does_not_invoke_signer", "does_not_create_payment_material", "does_not_mutate", "does_not_export_receipt", "does_not_mint_terminal_certificate", "does_not_claim_hosted_operation", "does_not_claim_provider_custody", "does_not_claim_settlement", "does_not_claim_marketplace_certification", "does_not_claim_host_wide_containment"]; readonly bypassPosture: "Package availability names no protected path and controls no raw sibling route."; readonly proofGaps: readonly ["MCP Registry acceptance", "live host behavior", "provider custody"]; readonly validationGate: "pack:check verifies clean installed imports and no source/tests/planning/secrets in the artifact."; readonly stopCondition: "Stop if package exports signer, gateway, policy, raw records, receipt export, or authority writers."; }, { readonly id: "init_doctor"; readonly label: "Initialize project and inspect readiness"; readonly surfaceOwner: "src/cli/local-project, src/cli/main, src/cli/command-manifest"; readonly authorityPosture: "setup_evidence_only"; readonly inputEvidence: readonly ["project id", "state root", "role credential profile refs without token values"]; readonly outputRecord: ".handshake/project.json plus doctor readiness report"; readonly requiredNonAuthorityFlags: readonly ["does_not_create_policy_decision", "does_not_create_greenlight", "does_not_perform_gateway_check", "does_not_resolve_credential", "does_not_invoke_signer", "does_not_create_payment_material", "does_not_mutate", "does_not_export_receipt", "does_not_mint_terminal_certificate", "does_not_claim_hosted_operation", "does_not_claim_provider_custody", "does_not_claim_settlement", "does_not_claim_marketplace_certification", "does_not_claim_host_wide_containment"]; readonly bypassPosture: "Doctor can report missing or unsafe posture; it does not install containment."; readonly proofGaps: readonly ["state-root tamper evidence", "directory ownership posture", "live gateway custody"]; readonly validationGate: "CLI tests prove init/doctor output does not contain credential values or authority-shaped fields."; readonly stopCondition: "Stop if doctor output can be used as permission or exposes raw credentials."; }, { readonly id: "install_x402_payment"; readonly label: "Compile local x402 install evidence"; readonly surfaceOwner: "src/cli/x402 and x402 install proposal compiler"; readonly authorityPosture: "setup_evidence_only"; readonly inputEvidence: readonly ["x402 install proposal", "endpoint evidence", "payment requirement digest", "gateway profile", "spend bound"]; readonly outputRecord: "local x402 install posture ref"; readonly requiredNonAuthorityFlags: readonly ["does_not_create_policy_decision", "does_not_create_greenlight", "does_not_perform_gateway_check", "does_not_resolve_credential", "does_not_invoke_signer", "does_not_create_payment_material", "does_not_mutate", "does_not_export_receipt", "does_not_mint_terminal_certificate", "does_not_claim_hosted_operation", "does_not_claim_provider_custody", "does_not_claim_settlement", "does_not_claim_marketplace_certification", "does_not_claim_host_wide_containment"]; readonly bypassPosture: "Install names the protected path but proves no raw sibling control by itself."; readonly proofGaps: readonly ["control-plane registration", "gateway custody proof", "host-specific probes"]; readonly validationGate: "Install command records setup evidence and requires later probes/readiness before facade use."; readonly stopCondition: "Stop if install creates policy, greenlight, gateway check, signer use, or mutation authority."; }, { readonly id: "local_probes"; readonly label: "Record local bypass and custody probes"; readonly surfaceOwner: "src/cli/x402, x402 bypass probes, protected-path posture evidence"; readonly authorityPosture: "local_probe_evidence_only"; readonly inputEvidence: readonly ["signer custody probe", "raw key exposure probe", "direct x402 client probe", "sibling MCP/payment probe", "wrapper drift probe"]; readonly outputRecord: "local x402 probe posture report"; readonly requiredNonAuthorityFlags: readonly ["does_not_create_policy_decision", "does_not_create_greenlight", "does_not_perform_gateway_check", "does_not_resolve_credential", "does_not_invoke_signer", "does_not_create_payment_material", "does_not_mutate", "does_not_export_receipt", "does_not_mint_terminal_certificate", "does_not_claim_hosted_operation", "does_not_claim_provider_custody", "does_not_claim_settlement", "does_not_claim_marketplace_certification", "does_not_claim_host_wide_containment"]; readonly bypassPosture: "Named raw sibling posture is evidence; detected is not controlled."; readonly proofGaps: readonly ["live host raw sibling behavior", "external witness", "provider-side bypass proof"]; readonly validationGate: "Probe tests classify unsafe posture and preserve named raw sibling evidence."; readonly stopCondition: "Stop if missing probes default to protected or if detected bypass is treated as contained."; }, { readonly id: "register_gateway_readiness"; readonly label: "Register trusted gateway readiness"; readonly surfaceOwner: "src/cli/x402/local-state and protected-tool readiness contract"; readonly authorityPosture: "pre_contract_readiness"; readonly inputEvidence: readonly ["install digest", "probe posture digest", "gateway registration", "GatewayCredentialRef digest", "GatewayCustodyProofPacket digest", "policy version", "gateway registry entry", "operating envelope", "selected payment requirement digest", "expiry"]; readonly outputRecord: "X402ProtectedToolReadinessSnapshot"; readonly requiredNonAuthorityFlags: readonly ["readiness_scope_is_pre_contract", "readiness_creates_no_authority", "does_not_create_policy_decision", "does_not_create_greenlight", "does_not_perform_gateway_check", "does_not_resolve_credential", "does_not_invoke_signer", "does_not_create_payment_material", "does_not_mutate", "does_not_export_receipt", "does_not_mint_terminal_certificate", "does_not_claim_hosted_operation", "does_not_claim_provider_custody", "does_not_claim_settlement", "does_not_claim_marketplace_certification", "does_not_claim_host_wide_containment"]; readonly bypassPosture: "Readiness carries raw sibling posture but does not claim host-wide containment."; readonly proofGaps: readonly ["customer gateway evidence", "provider gateway evidence", "signed or tamper-evident local state"]; readonly validationGate: "Readiness schema and profile/facade tests refuse stale, unsafe, missing, drifted, or overclaimed readiness."; readonly stopCondition: "Stop if trusted_gateway_ready alone can reach signer use or policy authority."; }, { readonly id: "install_health"; readonly label: "Read install health"; readonly surfaceOwner: "src/cli/x402, MCP install-health resources"; readonly authorityPosture: "health_read_only"; readonly inputEvidence: readonly ["local install posture", "probe posture", "gateway readiness record"]; readonly outputRecord: "redacted install health projection"; readonly requiredNonAuthorityFlags: readonly ["does_not_create_policy_decision", "does_not_create_greenlight", "does_not_perform_gateway_check", "does_not_resolve_credential", "does_not_invoke_signer", "does_not_create_payment_material", "does_not_mutate", "does_not_export_receipt", "does_not_mint_terminal_certificate", "does_not_claim_hosted_operation", "does_not_claim_provider_custody", "does_not_claim_settlement", "does_not_claim_marketplace_certification", "does_not_claim_host_wide_containment"]; readonly bypassPosture: "Health can say ready for runtime facade, never ready to mutate."; readonly proofGaps: readonly ["live provider custody", "MCP Registry lookup", "host-native behavior"]; readonly validationGate: "Health tests preserve not_ready, local_posture_evidence_present, and trusted_gateway_ready distinctions."; readonly stopCondition: "Stop if install health emits policy, greenlight, gateway check, payment material, or receipt fields."; }, { readonly id: "host_profile_generation"; readonly label: "Generate host profile artifact"; readonly surfaceOwner: "src/x402-protected-tool and protected-tool profile builders"; readonly authorityPosture: "host_profile_only"; readonly inputEvidence: readonly ["readiness snapshot", "host family", "command/config target", "tool-list digest"]; readonly outputRecord: "host-specific activation artifact"; readonly requiredNonAuthorityFlags: readonly ["does_not_create_policy_decision", "does_not_create_greenlight", "does_not_perform_gateway_check", "does_not_resolve_credential", "does_not_invoke_signer", "does_not_create_payment_material", "does_not_mutate", "does_not_export_receipt", "does_not_mint_terminal_certificate", "does_not_claim_hosted_operation", "does_not_claim_provider_custody", "does_not_claim_settlement", "does_not_claim_marketplace_certification", "does_not_claim_host_wide_containment"]; readonly bypassPosture: "Profile records raw sibling posture and native-host proof gaps instead of claiming containment."; readonly proofGaps: readonly ["live user host mutation", "native host certification", "host-wide containment"]; readonly validationGate: "Profile tests prove Codex, Claude, Hermes, and OpenClaw artifacts bind readiness and deny authority."; readonly stopCondition: "Stop if a profile writes live config by default or claims host-wide containment."; }, { readonly id: "protected_tool_proposal"; readonly label: "Prepare protected tool proposal"; readonly surfaceOwner: "protected-tool facade, MCP proposal tool, runtime ingress"; readonly authorityPosture: "proposal_only"; readonly inputEvidence: readonly ["host profile artifact", "readiness digest", "runtime identity", "x402 tool input", "metadata digest", "idempotency key"]; readonly outputRecord: "runtime dispatch block, runtime evidence, tool-call draft, candidate/action-contract proposal"; readonly requiredNonAuthorityFlags: readonly ["does_not_create_policy_decision", "does_not_create_greenlight", "does_not_perform_gateway_check", "does_not_resolve_credential", "does_not_invoke_signer", "does_not_create_payment_material", "does_not_mutate", "does_not_export_receipt", "does_not_mint_terminal_certificate", "does_not_claim_hosted_operation", "does_not_claim_provider_custody", "does_not_claim_settlement", "does_not_claim_marketplace_certification", "does_not_claim_host_wide_containment"]; readonly bypassPosture: "Raw payload input, sibling direct payment, dynamic params, stale metadata, or unsupported body posture refuse before policy."; readonly proofGaps: readonly ["full generated code coverage", "host parallel-call enforcement", "external runtime transcript"]; readonly validationGate: "Facade/MCP/runtime tests prove proposal surfaces cannot create authority or payment material."; readonly stopCondition: "Stop if proposal output includes greenlight, gateway check input, payment payload, signature, or receipt export."; }, { readonly id: "policy_decision"; readonly label: "Evaluate exact policy and one-use greenlight or refusal"; readonly surfaceOwner: "protocol policy-greenlight area and role-scoped PolicyClient"; readonly authorityPosture: "policy_authority"; readonly inputEvidence: readonly ["exact ActionContract", "operating envelope", "delegated authority ref", "idempotency scope", "isolation state"]; readonly outputRecord: "PolicyDecision plus one-use Greenlight or durable refusal/review/halt/quarantine/proof gap"; readonly requiredNonAuthorityFlags: readonly ["does_not_perform_gateway_check", "does_not_resolve_credential", "does_not_invoke_signer", "does_not_create_payment_material", "does_not_mutate", "does_not_export_receipt", "does_not_mint_terminal_certificate", "does_not_claim_hosted_operation", "does_not_claim_provider_custody", "does_not_claim_settlement", "does_not_claim_marketplace_certification", "does_not_claim_host_wide_containment"]; readonly bypassPosture: "Policy must refuse stale registry, stale readiness, stale credential posture, isolation, replay conflict, or overbroad scope."; readonly proofGaps: readonly ["aggregate spend ledger", "review renderer registry when review is required"]; readonly validationGate: "Policy tests bind contract digest, params digest, credential ref, gateway registry, policy version, expiry, idempotency, and maxUses 1."; readonly stopCondition: "Stop if policy can evaluate vague intent or emit reusable/ambient authority."; }, { readonly id: "gateway_check_signer"; readonly label: "Gateway check before signer use"; readonly surfaceOwner: "gateway-gate area and x402 wallet gateway adapter"; readonly authorityPosture: "gateway_authority"; readonly inputEvidence: readonly ["one-use greenlight", "exact contract digest", "observed request params", "credential-ref digest", "custody proof freshness", "isolation state"]; readonly outputRecord: "VerifiedGatewayCheck, CredentialResolutionEvidence, MutationAttempt, Receipt or Refusal/ProofGap"; readonly requiredNonAuthorityFlags: readonly ["does_not_claim_settlement", "does_not_claim_provider_custody_without_external_proof", "does_not_claim_hosted_operation", "does_not_export_reusable_authority", "does_not_mint_terminal_certificate"]; readonly bypassPosture: "Any raw sibling payment or changed observed parameters must leave signer invocation count unchanged."; readonly proofGaps: readonly ["settlement finality", "facilitator operation", "provider custody", "downstream business success"]; readonly validationGate: "Gateway tests prove signer/payment material appears only after VerifiedGatewayCheck and replay/drift refuses first."; readonly stopCondition: "Stop if signer use can occur before a verified gate or a greenlight can be reused."; }, { readonly id: "redacted_readback_support"; readonly label: "Read terminal evidence and support bundle"; readonly surfaceOwner: "evidence projections, MCP resources, CLI evidence/support bundle"; readonly authorityPosture: "terminal_evidence_only"; readonly inputEvidence: readonly ["terminal receipt/refusal/proof gap/replay refusal/isolation refs"]; readonly outputRecord: "redacted evidence projection and support bundle"; readonly requiredNonAuthorityFlags: readonly ["does_not_create_policy_decision", "does_not_create_greenlight", "does_not_perform_gateway_check", "does_not_invoke_signer", "does_not_mutate", "does_not_export_raw_receipt", "does_not_mint_permission", "does_not_claim_hosted_operation", "does_not_claim_provider_custody", "does_not_claim_settlement", "does_not_claim_marketplace_certification", "does_not_claim_host_wide_containment"]; readonly bypassPosture: "Readback preserves bypass evidence and proof gaps without granting retry permission."; readonly proofGaps: readonly ["downstream finality", "cross-org trust", "compliance-grade audit"]; readonly validationGate: "Evidence/support tests separate gateway check from downstream observation and redact raw records/payment material."; readonly stopCondition: "Stop if readback collapses gateway evidence into business success or exposes reusable authority."; }]; export declare const x402ProtectedToolForbiddenProductionClaims: readonly ["readiness_is_permission", "package_install_authorizes_payment", "mcp_tool_visibility_is_authorization", "host_profile_is_host_wide_containment", "certificate_is_permission_or_settlement", "receipt_is_downstream_business_success", "x402_proof_is_broad_x402_compatibility", "per_call_bound_is_aggregate_spend_enforcement", "local_fixture_is_provider_custody", "self_hosted_path_is_hosted_operation", "activation_artifact_is_native_host_certification", "auth_md_is_authority_without_gateway_contract", "support_bundle_is_retry_permission"]; export declare const x402ProtectedToolReleaseBlockers: readonly ["signer_invocation_before_verified_gateway_check", "reusable_greenlight_or_changed_params_after_greenlight", "trusted_readiness_used_as_mutation_permission", "raw_sibling_payment_path_claimed_as_contained_without_evidence", "policy_drift_broadens_existing_authority", "active_isolation_not_checked_before_policy_or_gateway", "receipt_or_support_bundle_cannot_distinguish_gateway_check_from_downstream_finality", "package_or_profile_exports_signer_payment_payload_raw_record_or_authority_writer"];