/**
 * `opensquid gate commit|push` — the owned-boundary EXECUTE gate (GF.2 — F2 + F3 + F4).
 *
 * Invoked by the opensquid-managed git `pre-commit` / `pre-push` hooks. Instead of
 * pattern-matching tool calls (a denylist over an unbounded input — the F2/F3/F4 hole),
 * enforcement moves to the boundary git OWNS: git runs these hooks on EVERY commit/push
 * unconditionally and the gate reads the REAL changed files (ground truth — no
 * path-guessing) plus the same session FSM / phase / active-task state, and blocks there.
 *
 * Contract (total):
 *   - NON-gated repo (no `.opensquid/active.json` opting into `coding-flow`) → ALLOW (0).
 *     Never block an unrelated commit on the machine.
 *   - No changed files, or a docs-only change (flow artifacts: pre-research / spec /
 *     CHANGELOG live under docs/) → ALLOW (0).
 *   - GATED repo with code changes: FAIL CLOSED — block (2) unless the live session has an
 *     active task whose FSM reached `phases_complete` with a complete 7-phase ledger. A
 *     terminal `phases_complete` is unreachable without SCOPE (guess-audit) + AUTHOR
 *     (spec-audit) having passed, so this one check transitively enforces all three stages.
 *   - No resolvable session in a gated repo → block (cannot prove the flow ran).
 *
 * The only honest escape is `git commit --no-verify`, a single closed opt-out token a
 * narrow PreToolUse detector covers (GF.3). Session resolution out-of-band:
 * `resolveMcpSessionId` (CLAUDE_PROJECT_DIR → project-scoped pointer → global).
 *
 * Imported by: src/cli.ts (registerGate); the installed git hooks (`exec opensquid gate …`).
 */
import type { Command } from 'commander';
/** GDC.2 — is this invocation gated? The gate binds to the AGENT, not to a
 *  location (user directive 2026-06-11: "all agents in any harness; git on
 *  the terminal behaves normally"): `coding-flow` in the USER scope
 *  (~/.opensquid/active.json — the agent's own config) gates the agent in
 *  EVERY repo; a project-scope opt-in still works too (e.g. a team gating
 *  one repo for all agents). Humans pass upstream regardless
 *  (isAgentInvocation, GDC.1). */
export declare function isGatedRepo(cwd: string): Promise<boolean>;
/** GDC.1 — the flow protects CODE: the same boundary set the in-session write
 *  gates arm on (scope-lifecycle/skill.yaml:284 — keep the two lists in sync;
 *  the drift pin in gate.test.ts enforces it). Those matchers are deliberately
 *  loose substrings; THIS layer is "the precise boundary" (skill.yaml's own
 *  framing), so startsWith over git's repo-relative paths is the exact form.
 *  A change touching NONE of these is not the flow's subject (README, banner,
 *  docs/, LICENSE, CI config…) → allowed, attested under the existing
 *  `docs_only` wire reason (now meaning "non-code"). [] still fails closed
 *  (commitFiles' git-error contract). */
export declare const PROTECTED_PREFIXES: readonly ["src/", "packs/", "test/"];
/** GDC.1 — the gate's subject is the AGENT, never the human (user directive
 *  2026-06-11: "I should be able to use the commands naturally"). Agent hosts
 *  mark their spawned shells (live-probed: Claude Code sets CLAUDECODE +
 *  AI_AGENT; codex exec sets CODEX_THREAD_ID + AI_AGENT); a human terminal
 *  sets none. Env-scrubbing evasion is the --no-verify class — policed
 *  in-session (GF.3), not here. Seam injectable for tests. */
export declare const AGENT_ENV_MARKERS: readonly ["AI_AGENT", "CLAUDECODE", "CODEX_THREAD_ID"];
export declare const isAgentInvocation: (env?: NodeJS.ProcessEnv) => boolean;
/** Does the LIVE session prove a completed flow / docs-only change right now?
 *  Shared by the commit boundary (block decision) and the attest boundary (record
 *  decision) so the two can never diverge. Null = not allowed. */
export declare function commitAllowedNow(sid: string | null, files: string[], env?: NodeJS.ProcessEnv): Promise<{
    allowed: true;
    reason: 'docs_only' | 'flow_complete' | 'human';
} | null>;
/** The gate decision. Returns the process exit code (0 allow, 2 block). */
export declare function runGate(boundary: 'commit' | 'push', cwd: string, env?: NodeJS.ProcessEnv): Promise<number>;
/** PGB.2 — the attest boundary (post-commit hook + `opensquid gate attest` CLI):
 *  record provenance for HEAD when the live session can prove it RIGHT NOW. Never
 *  blocks, never throws — recording is best-effort; an unattested commit simply
 *  falls back to the session check at push time (fail-closed preserved). */
export declare function runAttest(cwd: string, env?: NodeJS.ProcessEnv): Promise<number>;
/** Resolve the git work-tree root for `cwd`, or null if not in a repo. */
export declare function gitRoot(cwd: string): Promise<string | null>;
export declare function registerGate(program: Command): void;
//# sourceMappingURL=gate.d.ts.map