/**
 * Pipeline step: pre-publish run-provenance ownership gate (T2).
 *
 * The runner-side companion to the API gateway gate (T1). Both call the same
 * pure `evaluateProvenance` evaluator, so the verdict a local/dispatched
 * publish faces is identical to the one the gateway enforced — "one rule, two
 * call sites".
 *
 * Why a separate, non-optional step rather than logic inside
 * `PublishReportStep`: the orchestrator aborts the run only on a *non-optional*
 * step that returns `status: "failed"`. `PublishReportStep` is `optional = true`
 * (P5 — a store write never fails the run), so a check inside it could not make
 * the run fail. This step runs immediately before it and is non-optional, so an
 * invalid-attribution rejection aborts the run *before* any write is attempted.
 *
 * P5 carve-out: P5 protects against the store being *unreachable* (transient,
 * non-fatal). Refusing to publish a run with invalid attribution is different —
 * a policy rejection of bad input. So this gate fails only when a publish is
 * actually intended (publishing enabled *and* a report store is wired). A run
 * that never writes (publish disabled, or no token) emits warnings and exits 0.
 *
 * @see docs/design-docs/run-provenance-ownership-enforcement.md (T2)
 * @see packages/core/src/services/provenance-policy.ts — the shared evaluator
 */
import { type AppContext, type PipelineState, type PipelineStep, type StepResult, type ValidationIssue } from "../../_vendor/ailf-core/index.d.ts";
export declare class ProvenanceGateStep implements PipelineStep {
    readonly name = "provenance-gate";
    readonly optional = false;
    check(): ValidationIssue[];
    execute(ctx: AppContext, _state: PipelineState): Promise<StepResult>;
}
