/** Serialized compiled guard for this role. Its presence — even empty — puts the PI process in
 *  guarded mode, where no branch may return allow by default (design §13 GT6, §6.8 G3). */
export declare const PI_POLICY_GUARD_ENV = "CORTEX_PI_POLICY_GUARD";
/** The guard's lease-state input (§6.8 G4). */
export declare const PI_LEASE_STATE_ENV = "CORTEX_PI_LEASE_STATE";
/** Resolved MCP composition for this spawn; the bridge derives its server set from it (§5.6 P1). */
export declare const PI_MCP_COMPOSITION_ENV = "CORTEX_PI_MCP_COMPOSITION";
/** D-GUARD-STATIC: Gate 2 lands the guard mechanism, not the lease transition, so the state is a
 *  constant the factory supplies. Gates 3/6/7 vary this same parameter without reshaping the guard. */
export declare const GATE2_LEASE_STATE = "parent-writable";
export interface GuardDecision {
    allow: boolean;
    reason: string;
}
export type PolicyGuardEvaluator = (toolName: string, leaseState: string) => GuardDecision;
/**
 * Read a compiled guard as the per-lease-state allow-list of §6.6, in PI-native names. Throws on
 * anything else: an unreadable guard must not be turned into a permissive one.
 */
export declare function compilePiPolicyGuard(raw: unknown): PolicyGuardEvaluator;
/**
 * The decision every guarded PI tool dispatch goes through. A missing evaluator, an evaluator that
 * throws and an evaluator that answers with anything other than an explicit allow all deny — there
 * is deliberately no branch here that yields allow without one (§6.8 G3, battery T8).
 */
export declare function guardDecision(evaluator: PolicyGuardEvaluator | null, toolName: string, leaseState: string): GuardDecision;
export interface PiToolGate {
    /** True when the benchmark policy guard governs this process. */
    readonly guarded: boolean;
    decide(nativeToolName: string, claudeLabel?: string): GuardDecision;
}
/** The guarded gate every benchmark PI process runs under. Exported so a caller can install an
 *  evaluator that is not env-derived; the decision path is the same `guardDecision` either way. */
export declare function benchmarkToolGate(evaluator: PolicyGuardEvaluator | null, leaseState: string): PiToolGate;
/**
 * Pick the gate this PI process runs under. The selection is total and ordered: a guard present in
 * the environment always wins, and the guarded branch never falls through to the allowlist gate.
 * That is what removes §6.6 defect 4 — the empty-value allow-all — from the benchmark path.
 */
export declare function resolvePiToolGate(env: NodeJS.ProcessEnv): PiToolGate;