/**
 * Thin provider launch contracts for v2.
 * Claude is interactive-only. Codex long work uses interactive pane + native `/goal`
 * (see prepareCodexGoalLaunch + worker pane activate) — never `codex goal run` or headless exec.
 */
import type { RolePolicyConfig } from "../domain/role-policy.js";
import type { Clock, KernelPaths } from "./types.js";
export declare const CONDUCTOR_DISALLOWED_TOOLS: readonly ["Read", "Glob", "Grep", "Edit", "Write", "NotebookEdit", "WebFetch", "WebSearch", "Bash", "Task", "Agent", "mcp__oms__propose_goal", "mcp__oms__prepare_dispatch", "mcp__oms__advise_dispatch", "mcp__oms__propose_dispatch", "mcp__oms__manage_worker", "mcp__oms__start_team", "mcp__oms__request_advice", "mcp__oms__launch_worker", "mcp__oms__process_result"];
/** Exactly the four private conductor tools; routing authority stays in CampaignLoop. */
export declare const CONDUCTOR_ALLOWED_TOOLS: readonly ["mcp__oms__accept_goal", "mcp__oms__read_status", "mcp__oms__request_stop", "mcp__oms__advance_campaign"];
export interface ClaudeInteractiveLaunchPlan {
    readonly mode: "interactive";
    readonly binary: string;
    readonly args: readonly string[];
    readonly cwd: string;
    /** Canonical worker/conductor MCP config path sealed into the launch plan. */
    readonly mcp_config_path: string;
    /** Optional explicit Claude settings file (worker hooks). */
    readonly settings_path?: string;
    readonly uses_print_flag: false;
    readonly uses_agent_sdk: false;
    readonly session_id: string;
    readonly resume: boolean;
    /** Filtered worker environment (no OMS_ vars, secrets, or state paths). */
    readonly env: Readonly<Record<string, string>>;
}
/**
 * Proven Codex Goal delivery: interactive `codex` pane args from native-dispatch,
 * then pane activate sends `/goal …` (workers/panes.ts). Not a CLI subcommand.
 */
export interface CodexGoalLaunchPlan {
    readonly mode: "interactive_native_goal";
    readonly command: "codex";
    readonly args: readonly string[];
    readonly cwd: string;
    /** Canonical worker MCP config path sealed into the launch plan. */
    readonly mcp_config_path: string;
    readonly nativeAction: "goal";
    readonly activate_line: string;
    readonly submit_after_activate: true;
    readonly custom_marathon_loop: false;
    readonly uses_codex_exec: false;
    readonly uses_goal_run_cli: false;
    readonly interactive: true;
    readonly compatibility_version: string;
    readonly capability_digest: string;
    readonly evidence_operation_id: string;
    /** Frozen filtered worker env from configuredProviderEnvironment (no secrets/OMS_*). */
    readonly env: Readonly<Record<string, string>>;
}
/**
 * Sealed Goal capability stored only after live handshake adapter journals it.
 * Callers cannot mint this object for launch — launch resolves by operation id / digest.
 */
export interface GoalCapabilityEvidence {
    readonly binary_path: string;
    readonly binary_version: string;
    readonly binary_hash: string;
    /** Exact read-only runtime root required by the native sandbox. */
    readonly runtime_read_path: string;
    readonly protocol: "interactive_goal";
    readonly live_handshake: "passed";
    readonly evidence_digest: string;
}
/** Exact local CLI handshake result supplied by the production process boundary. */
export interface GoalCapabilityHandshake {
    readonly binary_path: string;
    readonly binary_version: string;
    readonly binary_hash: string;
    readonly runtime_read_path: string;
    readonly goals_feature: "stable_enabled";
    readonly hooks_feature: "stable_enabled";
    readonly auth_mode: "chatgpt_subscription";
}
export interface GoalCapabilityProbeAdapter {
    readonly probe: () => GoalCapabilityHandshake;
}
export declare function assertGoalCapabilityEvidence(evidence: GoalCapabilityEvidence): void;
/** Production Goal evidence authority; fixture authority is never accepted. */
export declare const GOAL_EVIDENCE_AUTHORITY_REAL: "oms.interactive_goal_handshake.v2";
/**
 * Run the trusted local CLI handshake, then atomically bind its exact result to
 * the still-active campaign. The deterministic operation id makes retries
 * idempotent while a changed binary produces new evidence.
 *
 * This is intentionally not exported through the public kernel barrel.
 */
export declare function ensureGoalCapabilityForLaunch(input: {
    readonly paths: KernelPaths;
    readonly clock: Clock;
    readonly expectedRunId: string;
    readonly expectedRunVersion: number;
    readonly adapter: GoalCapabilityProbeAdapter;
}): {
    readonly operation_id: string;
    readonly evidence_digest: string;
};
/**
 * Production resolver: accepts real interactive-adapter authority with
 * passed handshake + correct digest. Fixture/test authority remains test-only.
 */
export declare function resolveGoalCapabilityEvidence(paths: KernelPaths, ref: {
    readonly operationId?: string;
    readonly evidenceDigest?: string;
}): {
    readonly evidence: GoalCapabilityEvidence;
    readonly operation_id: string;
};
/** Executor tools: code edit/test + attempt-bound worker MCP only. */
export declare const EXECUTOR_ALLOWED_TOOLS: readonly ["Read", "Edit", "Write", "Bash", "Glob", "Grep", "mcp__oms_worker__read_assignment", "mcp__oms_worker__report_state", "mcp__oms_worker__report_pending_verification"];
export declare const EXECUTOR_DISALLOWED_TOOLS: readonly ["Glob", "Grep", "Task", "Agent", "WebFetch", "WebSearch", "NotebookEdit", "mcp__oms__accept_goal", "mcp__oms__read_status", "mcp__oms__request_stop", "mcp__oms__advance_campaign", "mcp__oms__request_advice", "mcp__oms__launch_worker", "mcp__oms__propose_goal", "mcp__oms__prepare_dispatch", "mcp__oms__advise_dispatch", "mcp__oms__propose_dispatch", "mcp__oms__manage_worker", "mcp__oms__start_team", "mcp__oms__process_result"];
export declare function filterWorkerLaunchEnv(input: NodeJS.ProcessEnv): Record<string, string>;
export declare function buildClaudeInteractivePlan(input: {
    readonly binary: string;
    readonly model: string;
    readonly sessionName: string;
    readonly sessionId: string;
    /**
     * Path to MCP config file under the worktree (or other non-repo-state path).
     * Never pass raw JSON / secrets / task text here.
     */
    readonly mcpConfigPath: string;
    readonly settingsPath?: string;
    readonly cwd: string;
    readonly resume?: boolean;
    readonly role: "conductor" | "executor";
    readonly env?: NodeJS.ProcessEnv;
}): ClaudeInteractiveLaunchPlan;
/** Recovery-only resume plan: --resume existing session, never --session-id. */
export declare function buildClaudeResumePlan(input: {
    readonly binary: string;
    readonly model: string;
    readonly sessionName: string;
    readonly existingSessionId: string;
    readonly mcpConfigPath: string;
    readonly cwd: string;
    readonly env?: NodeJS.ProcessEnv;
}): ClaudeInteractiveLaunchPlan;
/**
 * Build a Codex Goal launch from journaled capability evidence.
 * The production probe journals the handshake before this builder runs. Without
 * that journaled real evidence, launch fails closed. The builder binds the
 * sealed evidence and durable policy into the interactive native /goal plan.
 * Worktree cleanliness was already enforced by prepareAttemptWorktree.
 */
export declare function buildIsolatedCodexGoalLaunchPlan(input: {
    readonly paths: KernelPaths;
    readonly config: RolePolicyConfig;
    readonly cwd: string;
    readonly dispatchId: string;
    readonly mcpConfigPath: string;
    readonly worktreeGitDir: string;
    readonly commonGitDir: string;
    readonly branch: string;
    readonly omsRoot: string;
    readonly codexHome: string;
    /** Journaled capability evidence operation id (preferred). */
    readonly evidenceOperationId?: string;
    /** Journaled capability evidence digest (alternate). */
    readonly evidenceDigest?: string;
    readonly env?: NodeJS.ProcessEnv;
    readonly confirmBilledUse?: boolean;
}): CodexGoalLaunchPlan;
export declare function buildCodexWorkerHookConfig(input: {
    readonly nodeExecutable: string;
    readonly entrypoint: string;
    readonly bindingPath: string;
}): string;
export declare function assertNoUntrustedShellInterpolation(argv: readonly string[]): void;
/**
 * Rejects explicit OMS state roots in the worker environment.
 *
 * This is necessary hygiene only. It does **not** prove the worker cannot
 * traverse the filesystem to a sibling repo `.oms` / runtime-v2 path.
 * Real worker plans additionally apply the named `oms_worker` permission
 * profile above; capability-only legacy callers do not receive that claim.
 */
export declare function assertWorkerEnvHidesOms(env: NodeJS.ProcessEnv): void;