import type { ExecutionMode, AgentAccessProfile } from './config.js';
export interface PolicyResult {
    mode: ExecutionMode;
    reason: string;
    sandboxReadOnly: boolean;
    canWriteArtifacts: boolean;
}
/**
 * Resolve the effective execution mode for a job.
 *
 * Profile-based resolution:
 *   readonly  -> sandbox with read-only codebase mount
 *   readwrite -> sandbox with read-write codebase mount
 *   trusted   -> host read-write, outside the codebase sandbox
 *
 * Role checks happen before this function via roles[role][agent].
 */
export declare function resolveExecutionPolicy(profile: AgentAccessProfile | null | undefined): PolicyResult;
export declare function validateSandboxAvailability(mode: ExecutionMode, sandboxAvailable: boolean): string | null;
/**
 * Single source of truth for fail-closed preflight checks that must run
 * identically at job start and job resume. Returns the first error message, or
 * null when all checks pass. Add future preflights here so both paths stay in
 * sync.
 */
export declare function validateJobRunPreconditions(params: {
    agentName: string;
    providerName: string;
    effectiveMode: ExecutionMode;
    policyReason: string;
    sandboxAvailable: boolean;
    sandboxRunnerName: string;
    providerSandboxImage: string | undefined;
}): string | null;
//# sourceMappingURL=execution-policy.d.ts.map