/**
 * Fail-closed availability decision (subagent-os-sandbox D8; task 5.6).
 *
 * Pure resolver mapping (policy validity, provider availability,
 * on-unavailable) to one of four spawn dispositions. No partial tier is ever
 * reported as enforced: filesystem-only would lie about a deny-default
 * network policy, proxy-only would lie about host-path/IPC containment (spec
 * "Provider availability is atomic and fail-closed by default").
 */
import type { ResolvedSandboxPolicy, SandboxAvailability } from "#src/sandbox/types";
export type SandboxDisposition = 
/** Sandbox disabled — launch unchanged, no scrub, no provider. */
{
    kind: "unchanged";
}
/** Enforce the full OS boundary. */
 | {
    kind: "enforce";
}
/** Refuse the spawn before window creation with a sanitized reason. */
 | {
    kind: "refuse";
    reason: string;
}
/** Launch WITHOUT OS isolation (env scrub still applies) + persist reason. */
 | {
    kind: "degrade";
    reason: string;
};
export interface AvailabilityDecisionInput {
    policy: ResolvedSandboxPolicy;
    /** Security-relevant policy errors (from resolution + path planning). */
    policyErrors: string[];
    /** Cached provider probe result; undefined if never enabled. */
    availability?: SandboxAvailability;
}
/**
 * Decide the spawn disposition. Malformed security policy ALWAYS refuses —
 * `on-unavailable` governs host capability, not policy validity (D2/D8).
 */
export declare function decideSandboxDisposition(input: AvailabilityDecisionInput): SandboxDisposition;
//# sourceMappingURL=availability.d.ts.map