import type { RoleId } from "../domain/role-policy.js";
import type { EvidenceReference } from "../evidence/store.js";
import type { FrozenVerificationPlan } from "./plan.js";
import { type VerificationResult } from "./runner.js";
export interface ProtectedVerificationBinding {
    readonly goal_id: string;
    readonly goal_version: number;
    readonly dispatch_id: string;
    readonly dispatch_version: number;
    readonly ticket_id: string;
    readonly attempt: number;
    readonly lease_token: string;
    readonly session_id: string;
    readonly worker_record_id: string;
    readonly worker_id: string;
    readonly worktree_id: string;
    readonly worktree_root: string;
    readonly worktree_branch: string;
    readonly worktree_base_commit: string;
    readonly expected_commit: string;
    readonly executor_role: Extract<RoleId, "oms.ticket-executor" | "oms.goal-long-executor">;
    readonly executor_engine: "claude" | "codex";
    readonly executor_evidence: EvidenceReference;
}
export interface WorktreeVerificationProof {
    readonly worktree_root: string;
    readonly worktree_branch: string;
    readonly head_commit: string;
    readonly clean: true;
}
export interface ProtectedVerificationRun {
    readonly binding: ProtectedVerificationBinding;
    readonly policy_version: number;
    readonly policy_digest: string;
    readonly verification: VerificationResult;
    readonly preflight: WorktreeVerificationProof;
    readonly postflight: WorktreeVerificationProof;
}
export interface RunProtectedVerificationOptions {
    packageRoot: string;
    frozenPlan: FrozenVerificationPlan;
    policyVersion: number;
    policyDigest: string;
    binding: ProtectedVerificationBinding;
}
/** Certifying path: caller cannot replace the process runner or installed tool paths. */
export declare function runProtectedVerification(options: RunProtectedVerificationOptions): ProtectedVerificationRun;
export declare function assertProtectedVerificationRun(value: unknown): asserts value is ProtectedVerificationRun;
export declare function captureProtectedVerificationBinding(value: ProtectedVerificationBinding): ProtectedVerificationBinding;
export declare function probeProtectedVerificationWorktree(binding: ProtectedVerificationBinding): WorktreeVerificationProof;