/**
 * Gate Integrity Guard — runtime tamper detection for protected files
 *
 * The applier's protectedFiles filter only constrains what the MODEL writes
 * through file blocks. Gate execution runs project code — including test
 * files the model just created — and that code can `writeFileSync` over a
 * protected spec or helper at runtime, defeating the static filter.
 *
 * This guard snapshots the bytes of every protected file after the baseline
 * run, then re-verifies after each gate run: any mutated protected file is
 * restored from the snapshot and the run's gate result is discarded as a
 * GATE INTEGRITY VIOLATION, with feedback telling the model exactly why.
 * Protected paths that did not exist at snapshot time ("reserved" oracle
 * paths) are restored to absence — a runtime-fabricated golden is removed.
 */
interface IntegrityRecord {
    /** sha256 of the file's bytes; null when the path was absent at capture */
    hash: string | null;
    /** Raw bytes for restoration; null when over budget (hash-verify only) */
    content: Buffer | null;
}
export type IntegritySnapshot = Map<string, IntegrityRecord>;
export interface IntegrityCheck {
    /** Protected files whose on-disk state changed during the gate run */
    tampered: string[];
    /** Subset of tampered that was restored to its snapshot state */
    restored: string[];
    /** Subset of tampered that could not be restored (over budget / IO error) */
    unrecoverable: string[];
}
/**
 * Capture the on-disk state of every protected file (original-case relative
 * paths). Absent paths are recorded as reserved. Fail-soft per file.
 */
export declare function captureIntegrity(projectRoot: string, files: string[]): IntegritySnapshot;
/**
 * Verify every captured file against its snapshot; restore what changed.
 * Returns what was tampered with so the caller can discard gate results.
 */
export declare function verifyAndRestore(projectRoot: string, snapshot: IntegritySnapshot): IntegrityCheck;
/** Render the violation feedback prepended to discarded gate results. */
export declare function integrityViolationFeedback(check: IntegrityCheck): string;
export {};
//# sourceMappingURL=integrity.d.ts.map