host

type AgentConfig struct {
	Namespace, HTTPRegistry, CredentialsFile string
	Repositories                             []string
	// Trusted in-process boundary injectors, never CLI or resource input.
	Source            agentcontroller.Source `json:"-"`
	RegistryTransport http.RoundTripper      `json:"-"`
}

type Config struct {
	Addr, HealthAddr, Journal string
	Mode                      authn.Mode
	TLSCert, TLSKey           string
	Identity                  entraauth.Config
	Approvers                 []api.CallerIdentity
	Harnesses                 map[string]string
	Substrate                 *SubstrateConfig
	Agents                    AgentConfig
	ToolExecutors             string
	// HarnessService is an explicit exact in-cluster Service FQDN:port exception.
	// It does not relax the loopback Sessions or health listeners.
	HarnessService string
	// HarnessServices adds exact exceptions; HarnessService remains the first/legacy entry.
	HarnessServices                       []string
	PeerNodeFile, NodeName                string
	ModelPolicy                           string
	ModelEndpoint, Deployment, ModelScope string
	// ModelTransport and ModelCredential are trusted in-process host settings,
	// never CLI, environment, or auth-config input. Nil credential preserves
	// the production workload-identity-only behavior.
	ModelTransport  *http.Transport
	ModelCredential azcore.TokenCredential `json:"-"`
}

type SubstrateConfig struct {
	Harness, ActorAtespace, TemplateAtespace, Template            string
	ControlAddr, ControlServerName, CAFile, TokenFile, RouterAddr string
	PlacementFile                                                 string
}