/**
 * src/verify/formal/spec-language.ts
 *
 * Sprint-587 — DSL for axiom specifications, compiled to SMT-LIB v2.
 *
 * Design philosophy (inspired by FormalJudge, arXiv:2602.11136) : agent-cycle
 * properties are expressed as small, typed pre/post-condition tuples. Each
 * condition is mapped to an SMT-LIB fragment by {@link compileToSmt}, which
 * frames the property as a NEGATION of the post-conditions under the
 * pre-conditions. This way, Z3 returning `sat` means a counterexample exists
 * (= UNSAFE) and `unsat` means the post-conditions hold (= SAFE).
 *
 * Bound types : Reals for budgets and ratios, Bools for binary properties,
 * Sets-as-symbols for scope subset checks.
 *
 * @module verify/formal/spec-language
 */
/**
 * One verifiable axiom-level property.
 */
export interface AxiomSpec {
    /** Human-readable axiom label (e.g. "Robuste", "Profitable"). */
    axiom: string;
    /** Conditions that must hold for the spec to be meaningful. */
    preconditions: Condition[];
    /** Conditions whose conjunction defines the post-state to verify. */
    postconditions: Condition[];
    /** Solver timeout in ms — see {@link DEFAULT_POLICIES}. */
    timeout_ms?: number;
}
/**
 * Tagged union of all supported condition kinds.
 *
 * `custom_smt` is the escape hatch : the consumer supplies a raw SMT-LIB
 * fragment that will be inlined under an `(assert ...)`. Use sparingly —
 * mistakes here are silent semantic bugs.
 */
export type Condition = {
    type: "budget_constraint";
    child_max_fraction: number;
} | {
    type: "scope_subset";
    parent_scope: string[];
    child_scope: string[];
} | {
    type: "no_pii_in_output";
    pii_count_var?: string;
} | {
    type: "cost_positive_roi";
    min_roi_ratio: number;
} | {
    type: "response_time";
    max_ms: number;
} | {
    type: "custom_smt";
    smt_fragment: string;
};
/**
 * Compile an {@link AxiomSpec} into an SMT-LIB v2 program string.
 *
 * Pattern : preconditions are asserted as-is ; postconditions are joined by
 * conjunction and asserted NEGATED. A counterexample (z3 returns `sat`)
 * therefore means : "pre-conditions hold AND at least one post-condition
 * fails" — i.e. an UNSAFE outcome.
 *
 * Includes `(check-sat)` and `(get-model)` as terminating commands.
 */
export declare function compileToSmt(spec: AxiomSpec): string;
/**
 * Default per-axiom AxiomSpec presets. Consumers can override the timeout
 * or augment with additional conditions before passing to `formalVerify`.
 *
 * Robuste        : 5s — engineering robustness, may need richer checks
 * Institutionnel : 10s — strongest spec, PII + scope-subset + budget
 * SOTA           : 2s  — lightweight (single ROI check on cost)
 * AntiFragile    : 1s  — response-time bound only
 * Profitable     : 1s  — cost-vs-value ROI check
 */
export declare const AXIOM_SPECS: Record<string, AxiomSpec>;
//# sourceMappingURL=spec-language.d.ts.map