/**
 * Live probe for the `filesystemPolicyProjection` capability (ADR 0041).
 *
 * Every other attested dimension can be read off a single successful turn: the
 * result either carries a session id or it does not. Projection cannot. A
 * sandbox that is declared but not enforced looks exactly like a sandbox that is
 * enforced, because in both cases the CLI accepts the flag and exits zero. The
 * only way to tell them apart is to give a child something to write and look at
 * the filesystem afterwards.
 *
 * That introduces its own confound. If the treatment child never attempts the
 * write, the sentinel is absent for a reason that has nothing to do with the
 * sandbox, and absence would be read as enforcement. So the probe runs a control
 * first, under a mode that permits the write. Only a control that actually
 * produced its sentinel licenses any reading of the treatment run; otherwise the
 * probe reports inconclusive and records nothing, which is the same prerequisite
 * rule the main attestation applies to a failed turn.
 */
import type { SpawnRequest, SpawnResult } from "../workflow/types.js";
import type { Adapter } from "./types.js";
export declare function projectionPrompt(sentinel: string): string;
export type ProjectionObservation = "supported" | "unsupported" | "inconclusive";
export interface ProjectionProbeResult {
    observation: ProjectionObservation;
    /** Why, in one line, suitable for an attestation note or a report row. */
    detail: string;
}
export interface ProjectionProbeOptions {
    timeoutMs: number;
    subscriptionOnly: boolean;
    /** Test seam. Defaults to the adapter's production spawner. */
    spawn?: (request: SpawnRequest) => Promise<SpawnResult>;
    /** Test seam. Defaults to a fresh directory under the OS temp root. */
    workdir?: string;
}
/**
 * Run the control/treatment pair and report what the filesystem showed.
 *
 * Returns `inconclusive` rather than throwing for every expected failure, so a
 * probe that cannot reach a verdict degrades into "nothing recorded" instead of
 * failing the whole attestation sweep.
 */
export declare function probeFilesystemProjection(adapter: Adapter, opts: ProjectionProbeOptions): Promise<ProjectionProbeResult>;
//# sourceMappingURL=attest-projection.d.ts.map