/**
 * A Todo's verify policy: its shape, and the one validator both write
 * boundaries use.
 *
 * `verify_policy` is a JSON TEXT column, so its schema lives in code rather than
 * in the DDL. It used to live in code TWICE — once in the MCP tool layer, once
 * in the gateway route layer — as an exact duplicate, which meant a new key had
 * to be added in two places and could refuse a value at one boundary while
 * accepting it at the other. This module is that single copy; the MCP side turns
 * a refusal into its own error type, and nothing else differs.
 *
 * `deliverable` declares WHERE the Todo's product lands. A `repo` Todo is
 * verified the ordinary way, from the diff. A `workspace` Todo delivers into the
 * operator's instance home — a Note, a skill, an org file — which the build
 * pipeline's verifier deliberately cannot read, so its acceptance is routed to
 * an actor that already has that access and the verifier rules on the diff, the
 * gates and the repo-side evidence manifest instead. The field records the
 * route; it grants no access to anything.
 */
export declare const VERIFY_MODES: readonly ["trust", "verify", "thorough"];
export type VerifyMode = (typeof VERIFY_MODES)[number];
export declare const DELIVERABLE_ROUTES: readonly ["repo", "workspace"];
export type DeliverableRoute = (typeof DELIVERABLE_ROUTES)[number];
/** Absent means `repo`, so every Todo written before this field existed keeps
 *  its exact meaning and is persisted byte-identically. */
export declare const DEFAULT_DELIVERABLE_ROUTE: DeliverableRoute;
export interface VerifyPolicy {
    mode: VerifyMode;
    verifier?: {
        employee?: string;
        engine?: string;
        model?: string;
    };
    maxRounds?: number;
    deliverable?: DeliverableRoute;
}
export type VerifyPolicyResult = {
    ok: true;
    value: VerifyPolicy | null;
} | {
    ok: false;
    error: string;
};
export declare function deliverableRoute(policy: VerifyPolicy | null | undefined): DeliverableRoute;
/**
 * Whether `submitted` changes nothing about `stored` except where the product
 * lands. This is what lets a Todo's own assignee or creator declare a route
 * while `mode`, `verifier` and `maxRounds` stay the operator's: the caller sends
 * a whole policy, so without this the same request could move a review mode.
 *
 * `fallbackMode` is the mode the Todo already has by provenance, so a first
 * declaration on a Todo with no stored policy cannot quietly choose its own.
 */
export declare function declaresOnlyDeliverable(stored: VerifyPolicy | null | undefined, submitted: VerifyPolicy | null, fallbackMode: VerifyMode): boolean;
/** Null and undefined mean "no policy", which is a legal value: provenance
 *  supplies the default mode. Anything else must be a policy in full. */
export declare function validateVerifyPolicy(value: unknown): VerifyPolicyResult;
//# sourceMappingURL=verify-policy.d.ts.map