/**
 * PrincipalGuard — cross-principal attribution detector (EXO 3.0 / "Know Your
 * Principal" standard, Phase 1 brain).
 *
 * The "Caroline" incident (2026-06-05, topic 19437): an autonomous session
 * silently adopted a real OTHER principal as its operator and credited the
 * actual operator's decisions to her across three docs — and no gate watched,
 * because the contamination was in the agent's OWN output, not an inbound
 * message. This module is the pure-logic detector for that failure: given a
 * piece of agent-authored text, it finds operator-ROLE-decision attributions
 * ("X approved", "locked with X", "mandate (X)", "X dropped a token") and
 * flags any whose attributed principal is NOT the topic's bound operator and
 * does NOT resolve to a known user.
 *
 * Pure + deterministic so it is unit-testable in isolation; it performs no I/O
 * and is not wired into the live request path here (that is a later increment).
 * The constitution standard it enforces: "Know Your Principal — An Unverified
 * Identity Is a Guess" (docs/STANDARDS-REGISTRY.md). Spec:
 * docs/specs/OPERATOR-IDENTITY-BINDING-SPEC.md.
 */
/** A verified operator, established ONLY from an authenticated channel — never
 *  from a name read in content (that is the whole point). */
export interface VerifiedOperator {
    /** The platform-verified sender id (e.g. Telegram uid). */
    uid: string;
    /** Display name(s) the operator is known by, lowercased for matching. */
    names: string[];
}
/**
 * Establish a topic's operator from the AUTHENTICATED sender — never from a
 * content name. The uid is the authority; names are only for matching the
 * agent's prose against the verified principal. A blank uid yields no operator
 * (an unbound topic), which the guard treats as "everything is unverified".
 */
export declare function establishOperator(authenticatedUid: string, displayName?: string): VerifiedOperator | null;
/** The kind of operator-role decision an attribution carries — drives warn vs block. */
export type AttributionKind = 'approval' | 'mandate' | 'credential' | 'lock' | 'acting-for';
export interface Attribution {
    /** The principal name the decision was attributed to (lowercased). */
    principal: string;
    kind: AttributionKind;
    /** The matched snippet, for the audit trail. */
    snippet: string;
}
/** Find every operator-role-decision attribution in agent-authored text. */
export declare function detectAttributions(text: string): Attribution[];
export type Verdict = 'ok' | 'warn' | 'block';
export interface PrincipalFinding {
    attribution: Attribution;
    verdict: Verdict;
    reason: string;
}
/**
 * Evaluate a piece of agent-authored text against the topic's verified
 * operator and the known-user registry. An attribution to the bound operator
 * (or any known user) is fine; an attribution to anyone else is the Caroline
 * failure — warn for prose, block for authority/credential decisions.
 *
 * `knownUserNames` are lowercased display names from UserManager (the
 * authoritative registry). Resolution against it is what the "Know Your
 * Principal" standard requires before any principal is accepted.
 */
export declare function evaluatePrincipalCoherence(text: string, operator: VerifiedOperator | null, knownUserNames?: string[]): PrincipalFinding[];
//# sourceMappingURL=PrincipalGuard.d.ts.map