// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
// ══════════════════════════════════════════════════════════════════
// Execution Attestation — Type Definitions (Checkpoint 3)
// ══════════════════════════════════════════════════════════════════
// Closes the authorization→execution gap identified by QueBallSharken
// and desiorac on OWASP#802 and qntm#6.
//
// Problem: PolicyReceipt proves what was AUTHORIZED but NOT what was
// EXECUTED. The receipt is signed before execution — a lying agent can
// do something different than what was authorized.
//
// Solution: The execution environment (sandbox/container/runtime)
// produces a Tier 1 infrastructure attestation of what actually ran,
// signed by the environment — NOT the agent. Infrastructure testimony
// the agent can't fabricate.
// ══════════════════════════════════════════════════════════════════
// ── Default drift rules ──
// Fields that commonly change for benign reasons get lower severity.
export const DEFAULT_DRIFT_RULES = [
    { field: 'timestamp', severity: 'benign', reason: 'Timestamps may differ between intent and execution' },
    { field: 'requestId', severity: 'benign', reason: 'Request IDs are generated at execution time' },
    { field: 'nonce', severity: 'benign', reason: 'Nonces are expected to differ' },
    { field: 'query', severity: 'suspicious', reason: 'Query modification may indicate intent drift' },
    { field: 'target', severity: 'critical', reason: 'Target change indicates possible hijacking' },
    { field: 'recipient', severity: 'critical', reason: 'Recipient change indicates possible exfiltration' },
    { field: 'amount', severity: 'critical', reason: 'Amount change indicates possible theft' },
    { field: '*', severity: 'suspicious', reason: 'Unknown field drift requires investigation' },
];
//# sourceMappingURL=execution-attestation.js.map