@sema-agent/core/dist/core/safety-axis-vocab.d.ts

Stateless, task-oriented AI agent core

/**
 * `SAFETY_AXIS_VOCABULARY` — the PUBLISHED safety-axis vocabulary as a zero-logic, zero-runtime-dependency DATA
 * artifact (pure string / number / boolean literal constants).
 *
 * **design/99 center control-plane seam (2026-06-27).** The web-admin control plane's per-field
 * safety-classification table lives in `@sema-agent/registry-core` and, for every safety-critical config field, cites a
 * core axis VALUE (e.g. `effect: "write"`, `irreversibility: "always"`). That contract package **must not depend on
 * `@sema-agent/core` (the engine) at runtime** — so it dev-imports THIS const (test-only) and runs a conformance test
 * asserting every `coreAxis` string it ships is a legal value here, failing CI if core ever drops / renames one.
 *
 * Anti-drift discipline (mirrors {@link import("./safety-merge-corpus.js").SAFETY_MERGE_CONFORMANCE_CORPUS}, design/87):
 * the arrays are pinned to the engine's safety-axis source unions; `test/safety-axis-vocab.test.ts` regression-tests
 * them in lockstep with the engine version, and the `_AssertEqual` below fails `tsc` if `toolEffect` drifts from the
 * {@link ToolEffect} union (either direction). The const carries NO logic and imports NO runtime value — the emitted
 * JS is pure data, so a consumer can `JSON`-shaped-read it without pulling any engine code.
 */
export declare const SAFETY_AXIS_VOCABULARY: {
    /** `ToolSpec.effect` — the data-flow effect class ({@link ToolEffect}, types.ts:74). */
    readonly toolEffect: readonly ["read", "write", "idempotent"];
    /** `ToolSpec.egress` — marks an external write (push / open PR / send a message). */
    readonly egress: readonly [true, false];
    /** `ToolSpec.irreversibility` — reversibility class (types.ts:128; the `toolAxes` record uses the {never,always} subset). */
    readonly irreversibility: readonly ["never", "maybe", "always"];
    /** `SafetyAxis` keys — which axes a gated call trips, for the escalation inbox (checkpoint-store.ts). */
    readonly safetyAxis: readonly ["egress", "irreversible", "shell"];
    /** `RiskDescriptor.severity` — ToolEmu-style tier (5 = most severe), the inbox triage key (checkpoint-store.ts:85). */
    readonly severity: readonly [1, 2, 3, 4, 5];
    /** `TaskSpec.shellGate` (declared in core/types.ts) — the operator's shell floor; one value (`always`). */
    readonly shellGate: readonly ["always"];
    /** `ToolPolicy` decision — per-tool adjudication; `deny` short-circuits the `deny > ask > allow` fold (tool-policy.ts). */
    readonly permissionDecision: readonly ["allow", "ask", "deny"];
};
/** The mark tighten's sentence — the ONE spelling of each safety-mark frame (an egress-marked tool = an external write; an
 *  always-irreversible tool; a tool whose server declared that a call must be put to a person), read by the gate's two tighten arms (`gate-fold.ts`) and by the inherited lane's card for a
 *  marked tool (`judgeInheritedClassifier`): a person who answers a card for a marked call is told what the mark means,
 *  whichever lane minted the card. */
export declare function markTightenMessage(toolName: string, mark: "egress" | "irreversible" | "interaction"): string;