agentsessionsv1

type ApprovalRef struct {
	ExecutionId string `protobuf:"bytes,1,opt,name=execution_id,json=executionId,proto3" json:"execution_id,omitempty"`
	ToolCallId  string `protobuf:"bytes,2,opt,name=tool_call_id,json=toolCallId,proto3" json:"tool_call_id,omitempty"`
	RequestSeq  int64  `protobuf:"varint,3,opt,name=request_seq,json=requestSeq,proto3" json:"request_seq,omitempty"`
	// contains filtered or unexported fields
}

type ApprovalRequest struct {
	ToolCallId string `protobuf:"bytes,1,opt,name=tool_call_id,json=toolCallId,proto3" json:"tool_call_id,omitempty"`
	Reason     string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type ApprovalResult struct {
	ToolCallId string `protobuf:"bytes,1,opt,name=tool_call_id,json=toolCallId,proto3" json:"tool_call_id,omitempty"`
	Approved   bool   `protobuf:"varint,2,opt,name=approved,proto3" json:"approved,omitempty"` // non-optional durable value; request-level decision presence is in ApproveRequest
	Reason     string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
	// Positive sequence of the resolved APPROVAL_REQUEST. Zero is retained for legacy decisions;
	// it cannot identify a new durable approval request.
	RequestSeq int64 `protobuf:"varint,4,opt,name=request_seq,json=requestSeq,proto3" json:"request_seq,omitempty"`
	// contains filtered or unexported fields
}

type ApproveRequest struct {
	Session     string `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
	ExecutionId string `protobuf:"bytes,2,opt,name=execution_id,json=executionId,proto3" json:"execution_id,omitempty"`
	ToolCallId  string `protobuf:"bytes,3,opt,name=tool_call_id,json=toolCallId,proto3" json:"tool_call_id,omitempty"`
	RequestSeq  int64  `protobuf:"varint,4,opt,name=request_seq,json=requestSeq,proto3" json:"request_seq,omitempty"`
	// Required presence: false means deny; absent is INVALID_ARGUMENT. Unlike this request, the
	// journal's ApprovalResult.approved remains a non-optional bool for compatibility.
	Approved *bool        `protobuf:"varint,5,opt,name=approved,proto3,oneof" json:"approved,omitempty"`
	Reason   string       `protobuf:"bytes,6,opt,name=reason,proto3" json:"reason,omitempty"`
	Identity *IdentityRef `protobuf:"bytes,7,opt,name=identity,proto3" json:"identity,omitempty"`
	// contains filtered or unexported fields
}

type ApproveResponse struct {
	Session  *Session   `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
	Decision *LogRecord `protobuf:"bytes,2,opt,name=decision,proto3" json:"decision,omitempty"`
	// contains filtered or unexported fields
}

type Cancel struct {
	Reason string `protobuf:"bytes,1,opt,name=reason,proto3" json:"reason,omitempty"` // USER | TIMEOUT | INTERNAL
	// contains filtered or unexported fields
}

type CancelRequest struct {
	Session     string `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
	ExecutionId string `protobuf:"bytes,2,opt,name=execution_id,json=executionId,proto3" json:"execution_id,omitempty"`
	Reason      string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"` // USER | TIMEOUT | INTERNAL
	// contains filtered or unexported fields
}

type Capabilities struct {
	Resumability Resumability `protobuf:"varint,1,opt,name=resumability,proto3,enum=agentsessions.v1.Resumability" json:"resumability,omitempty"`
	ForkSafe     bool         `protobuf:"varint,2,opt,name=fork_safe,json=forkSafe,proto3" json:"fork_safe,omitempty"` // no un-replayable side effects mid-turn
	RequiresGpu  bool         `protobuf:"varint,3,opt,name=requires_gpu,json=requiresGpu,proto3" json:"requires_gpu,omitempty"`
	Streaming    bool         `protobuf:"varint,4,opt,name=streaming,proto3" json:"streaming,omitempty"`
	// reasoning_replay: harness replays opaque reasoning parts verbatim via the provider
	// stateless path; keeps reasoning on STATELESS_REPLAY (no memory-snapshot edge).
	ReasoningReplay bool `protobuf:"varint,5,opt,name=reasoning_replay,json=reasoningReplay,proto3" json:"reasoning_replay,omitempty"`
	// contains filtered or unexported fields
}

type ComputeRef struct {
	Runtime      string               `protobuf:"bytes,1,opt,name=runtime,proto3" json:"runtime,omitempty"` // "pod" | "kata" | "clh" | "substrate"
	Worker       string               `protobuf:"bytes,2,opt,name=worker,proto3" json:"worker,omitempty"`   // pod/worker id when live/warm; empty when cold
	Snapshot     *SnapshotRef         `protobuf:"bytes,3,opt,name=snapshot,proto3" json:"snapshot,omitempty"`
	Capabilities *RuntimeCapabilities `protobuf:"bytes,4,opt,name=capabilities,proto3" json:"capabilities,omitempty"`
	Attributes   map[string]string    `` // backend-specific, e.g. substrate actor/atespace
	/* 147-byte string literal not displayed */
	FenceToken int64 `protobuf:"varint,6,opt,name=fence_token,json=fenceToken,proto3" json:"fence_token,omitempty"` // monotonic; log rejects appends from a superseded incarnation
	// contains filtered or unexported fields
}

type ComputeState int32

type ControllerFrame struct {
	Session     string `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
	ExecutionId string `protobuf:"bytes,2,opt,name=execution_id,json=executionId,proto3" json:"execution_id,omitempty"`
	// Types that are valid to be assigned to Frame:
	//
	//	*ControllerFrame_Start
	//	*ControllerFrame_Cancel
	//	*ControllerFrame_Approval
	//	*ControllerFrame_Tool
	//	*ControllerFrame_Model
	//	*ControllerFrame_Park
	Frame isControllerFrame_Frame `protobuf_oneof:"frame"`
	// contains filtered or unexported fields
}

type ControllerFrame_Approval struct {
	Approval *ApprovalResult `protobuf:"bytes,5,opt,name=approval,proto3,oneof"` // host-owned committed decision, before the correlated tool receipt
}

type ControllerFrame_Cancel struct {
	Cancel *Cancel `protobuf:"bytes,4,opt,name=cancel,proto3,oneof"`
}

type ControllerFrame_Model struct {
	Model *ModelResult `protobuf:"bytes,7,opt,name=model,proto3,oneof"` // served completion for a mediated/replayed model call
}

type ControllerFrame_Park struct {
	Park *ApprovalRef `protobuf:"bytes,8,opt,name=park,proto3,oneof"` // host-owned unresolved request; requires correlated EVENT_PARKED
}

type ControllerFrame_Start struct {
	Start *Start `protobuf:"bytes,3,opt,name=start,proto3,oneof"`
}

type ControllerFrame_Tool struct {
	Tool *ToolResult `protobuf:"bytes,6,opt,name=tool,proto3,oneof"` // result for a CONTROLLER_MEDIATED or decided REQUIRES_APPROVAL call
}

type CreateSessionRequest struct {
	Session *Session `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
	// contains filtered or unexported fields
}

type DataPart struct {
	Data *structpb.Struct `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
	// contains filtered or unexported fields
}

type DeleteSessionRequest struct {
	Uid string `protobuf:"bytes,1,opt,name=uid,proto3" json:"uid,omitempty"`
	// contains filtered or unexported fields
}

type DeletionState int32

type Delta struct {
	ExecutionId string `protobuf:"bytes,1,opt,name=execution_id,json=executionId,proto3" json:"execution_id,omitempty"`
	PartIndex   int32  `protobuf:"varint,2,opt,name=part_index,json=partIndex,proto3" json:"part_index,omitempty"` // which content part it accumulates into
	Chunk       string `protobuf:"bytes,3,opt,name=chunk,proto3" json:"chunk,omitempty"`                           // text chunk; binary/media deltas are a later addition
	Done        bool   `protobuf:"varint,4,opt,name=done,proto3" json:"done,omitempty"`                            // last delta for this part
	// contains filtered or unexported fields
}

type DescribeRequest struct {
	// contains filtered or unexported fields
}

type Error struct {
	Code        int32  `protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"` // grpc status code
	Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
	// contains filtered or unexported fields
}

type Event struct {
	ExecutionId   string                 `protobuf:"bytes,2,opt,name=execution_id,json=executionId,proto3" json:"execution_id,omitempty"` // which execution/turn produced this event
	Ts            *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=ts,proto3" json:"ts,omitempty"`
	SchemaVersion int32                  `protobuf:"varint,4,opt,name=schema_version,json=schemaVersion,proto3" json:"schema_version,omitempty"` // §7: versions the body; replay survives schema skew
	Kind          EventKind              `protobuf:"varint,7,opt,name=kind,proto3,enum=agentsessions.v1.EventKind" json:"kind,omitempty"`
	// Types that are valid to be assigned to Body:
	//
	//	*Event_Message
	//	*Event_Model
	//	*Event_Tool
	//	*Event_Result
	//	*Event_Approval
	//	*Event_ApprovalResult
	//	*Event_Usage
	//	*Event_Lifecycle
	//	*Event_End
	//	*Event_Error
	//	*Event_ExecutionStart
	//	*Event_Parked
	Body  isEvent_Body `protobuf_oneof:"body"`
	Actor *IdentityRef `protobuf:"bytes,18,opt,name=actor,proto3" json:"actor,omitempty"` // emitter principal -> provenance
	// contains filtered or unexported fields
}

type EventKind int32

type Event_Approval struct {
	Approval *ApprovalRequest `protobuf:"bytes,12,opt,name=approval,proto3,oneof"`
}

type Event_ApprovalResult struct {
	ApprovalResult *ApprovalResult `protobuf:"bytes,13,opt,name=approval_result,json=approvalResult,proto3,oneof"`
}

type Event_End struct {
	End *HarnessEnd `protobuf:"bytes,16,opt,name=end,proto3,oneof"`
}

type Event_Error struct {
	Error *Error `protobuf:"bytes,17,opt,name=error,proto3,oneof"`
}

type Event_ExecutionStart struct {
	ExecutionStart *ExecutionStart `protobuf:"bytes,19,opt,name=execution_start,json=executionStart,proto3,oneof"`
}

type Event_Lifecycle struct {
	Lifecycle *Lifecycle `protobuf:"bytes,15,opt,name=lifecycle,proto3,oneof"`
}

type Event_Message struct {
	Message *Message `protobuf:"bytes,8,opt,name=message,proto3,oneof"`
}

type Event_Model struct {
	Model *ModelCall `protobuf:"bytes,9,opt,name=model,proto3,oneof"`
}

type Event_Parked struct {
	// EVENT_PARKED echoes the park reference; Event.execution_id must match its execution_id.
	Parked *ApprovalRef `protobuf:"bytes,20,opt,name=parked,proto3,oneof"`
}

type Event_Result struct {
	Result *ToolResult `protobuf:"bytes,11,opt,name=result,proto3,oneof"`
}

type Event_Tool struct {
	Tool *ToolCall `protobuf:"bytes,10,opt,name=tool,proto3,oneof"`
}

type Event_Usage struct {
	Usage *Usage `protobuf:"bytes,14,opt,name=usage,proto3,oneof"`
}

type ExecRequest struct {

	// The session to run against. Empty creates one first, using the server defaults and the harness
	// below, and returns it as the stream's first frame. A caller that wants to set a project, name,
	// or model still calls CreateSession; this exists so the common case is one call rather than
	// three (create, read the cursor, exec).
	Session string `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
	// Input messages for a new turn. While this session owns an unreceipted approval call,
	// new inputs are FAILED_PRECONDITION, including after a decision but before its receipt.
	// For an existing current approval-bearing, non-terminal execution, empty inputs recover
	// that recorded invocation via Resume, without a new EXECUTION_START. Recorded inputs,
	// config, harness, version and resume cursor win over this request's invocation overrides.
	// Pending requests return a paused Session without runtime IO; a call-only crash cut repairs
	// the request first. expected_last_seq is checked under the session guard before runtime IO
	// or repair, and deadline_unix bounds recovery. Other inputless Exec calls retain their
	// ordinary new-turn behavior; use Resume for general interrupted-turn recovery.
	Inputs []*Message `protobuf:"bytes,2,rep,name=inputs,proto3" json:"inputs,omitempty"`
	// Cursor handed to the harness as Start.resume_from_seq. The host does not interpret it; only a
	// harness knows what resuming from a sequence means for its own state. To re-read committed
	// records after a disconnect, use Replay, which is the read path for exactly that. Non-zero cursors
	// are journaled in EXECUTION_START and restored during controller replay/interrupted resume.
	ResumeFromSeq int64 `protobuf:"varint,3,opt,name=resume_from_seq,json=resumeFromSeq,proto3" json:"resume_from_seq,omitempty"`
	// Empty = the session's harness. A different harness runs this turn only, unless either one is
	// a registered harness (see HarnessRegistry): then the session is pinned and the call is
	// FAILED_PRECONDITION. A stored REQUIRES_MEMORY_SNAPSHOT harness also refuses a
	// STATELESS_REPLAY override before any fence or journal write: parking only the override
	// cannot checkpoint the stored harness's live memory.
	Harness string `protobuf:"bytes,4,opt,name=harness,proto3" json:"harness,omitempty"`
	// Opaque per-execution config, passed through to Start.config. Non-empty bytes are journaled
	// verbatim in EXECUTION_START before the harness runs, and restored for controller replay/resume.
	// Do not put credentials here: config is durable journal content exposed by Replay.
	Config []byte `protobuf:"bytes,5,opt,name=config,proto3" json:"config,omitempty"`
	// Single-writer CAS: the host commits this execution's first event only if the log head equals
	// expected_last_seq. A mismatch is ABORTED, meaning another writer advanced the log.
	// A deleted session returns FAILED_PRECONDITION regardless of this cursor's value.
	//
	// It is optional because the guarantee should be opt-in rather than the price of a simple call.
	// Unset means "append at whatever the head is now", which is what a caller with a single writer
	// wants. Set means the strict check, and 0 is a real value there: it asserts the session has no
	// events yet. That distinction is why this carries explicit presence instead of treating 0 as
	// "unset" -- a caller could not otherwise say "this must be the first turn".
	ExpectedLastSeq *int64 `protobuf:"varint,6,opt,name=expected_last_seq,json=expectedLastSeq,proto3,oneof" json:"expected_last_seq,omitempty"`
	DeadlineUnix    int64  `protobuf:"varint,7,opt,name=deadline_unix,json=deadlineUnix,proto3" json:"deadline_unix,omitempty"` // optional execution deadline (unix seconds); host cancels past it
	// contains filtered or unexported fields
}

type ExecState int32

type ExecUpdate struct {

	// Types that are valid to be assigned to Update:
	//
	//	*ExecUpdate_Record
	//	*ExecUpdate_Delta
	//	*ExecUpdate_Session
	Update isExecUpdate_Update `protobuf_oneof:"update"`
	// contains filtered or unexported fields
}

type ExecUpdate_Delta struct {
	Delta *Delta `protobuf:"bytes,2,opt,name=delta,proto3,oneof"`
}

type ExecUpdate_Record struct {
	Record *LogRecord `protobuf:"bytes,1,opt,name=record,proto3,oneof"`
}

type ExecUpdate_Session struct {
	// The session this execution runs against, sent as the FIRST frame of every Exec stream. It is
	// how a caller learns the uid of a session Exec created for it, and it reports the cursor
	// the turn started from. A successful approval park or approval-bearing no-input recovery
	// also sends a FINAL current Session before OK stream closure. That frame carries the latest
	// cursor and pending approval, when present; use the latest Session and committed record
	// cursors for the next CAS, not the initial frame alone. A pause is not a terminal END/ERROR,
	// and a pending query alone is not proof that compute has been made cold.
	//
	// It is sent before the turn runs, so a failed execution still tells the caller which session
	// it was against. A caller therefore sees this frame BEFORE any error, and must read the
	// stream to completion rather than treating the first receive as the result.
	Session *Session `protobuf:"bytes,3,opt,name=session,proto3,oneof"`
}

type ExecutionStart struct {
	Config        []byte `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
	ResumeFromSeq int64  `protobuf:"varint,2,opt,name=resume_from_seq,json=resumeFromSeq,proto3" json:"resume_from_seq,omitempty"` // harness cursor, distinct from the append CAS cursor
	// Expected number of INPUT events for this invocation, always set by new writers (including zero).
	// Replay/resume reject a completed or selected invocation with a missing/negative count or a
	// different committed INPUT count before running the harness. An incomplete trailing invocation
	// is skipped by completed replay. Count-less experimental start markers fail closed; truly
	// markerless legacy executions retain their existing reconstruction behavior.
	InputCount *int64 `protobuf:"varint,3,opt,name=input_count,json=inputCount,proto3,oneof" json:"input_count,omitempty"`
	// Host-resolved registry name used for this execution, not necessarily HarnessDescriptor.id.
	// Interrupted Resume resolves this exact name; absent legacy names use the session harness.
	Harness string `protobuf:"bytes,4,opt,name=harness,proto3" json:"harness,omitempty"`
	// Advertised, opaque harness replay-compatibility version. Empty means unknown/unversioned.
	// When nonempty, controller replay and interrupted resume require an exact served-version
	// match (including rejection of an empty served version) before running the harness.
	// Empty recorded versions retain existing behavior; this field is opt-in, not required.
	HarnessVersion string `protobuf:"bytes,5,opt,name=harness_version,json=harnessVersion,proto3" json:"harness_version,omitempty"`
	// contains filtered or unexported fields
}

type FilePart struct {
	Mime string `protobuf:"bytes,1,opt,name=mime,proto3" json:"mime,omitempty"`
	// Types that are valid to be assigned to Source:
	//
	//	*FilePart_Bytes
	//	*FilePart_Uri
	Source isFilePart_Source `protobuf_oneof:"source"`
	Name   string            `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`     // optional display name
	Digest string            `protobuf:"bytes,5,opt,name=digest,proto3" json:"digest,omitempty"` // content digest of the uri target (chain covers externalized bytes)
	// contains filtered or unexported fields
}

type FilePart_Bytes struct {
	Bytes []byte `protobuf:"bytes,2,opt,name=bytes,proto3,oneof"`
}

type FilePart_Uri struct {
	Uri string `protobuf:"bytes,3,opt,name=uri,proto3,oneof"`
}

type ForkRequest struct {
	Session string `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
	// 0 = HEAD. A REQUIRES_MEMORY_SNAPSHOT harness forks by cloning a memory snapshot, which captures
	// RAM as of now, so it accepts only HEAD; a historical seq is FAILED_PRECONDITION.
	AtSeq int64 `protobuf:"varint,2,opt,name=at_seq,json=atSeq,proto3" json:"at_seq,omitempty"`
	Count int32 `protobuf:"varint,3,opt,name=count,proto3" json:"count,omitempty"` // fan-out N children; must be 1..128, else INVALID_ARGUMENT
	// Unsupported: per-child principals are not enforced. Any supplied identity, including an empty
	// message, is INVALID_ARGUMENT before placement or mutation. Leave unset to fork.
	Identity *IdentityRef `protobuf:"bytes,4,opt,name=identity,proto3" json:"identity,omitempty"`
	// Applied to every child instead of the parent's labels; never merged or inherited. Unset or
	// empty gives children an empty label map. The parent's annotations are inherited unchanged.
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// Display names for the children, in the order they are returned. Length must be 0 or exactly
	// count, else INVALID_ARGUMENT.
	//
	// Left unset, a child's name is empty rather than a copy of the parent's. A fork inherits the
	// parent's workload (project, harness, model) because that is what defines the run, but a name is
	// a caller-supplied label the server has no basis to invent. Copying it makes a listing report N+1
	// rows that claim to be the same session, and synthesizing one ("<parent> fork 2") would put a
	// presentation convention in the wire contract and be wrong the moment the same parent is forked
	// by two separate calls. Lineage is already on the child as parent_uid and fork_seq, so a caller
	// that wants a derived label can render one without the server denormalizing it into a string.
	ChildNames []string `protobuf:"bytes,6,rep,name=child_names,json=childNames,proto3" json:"child_names,omitempty"`
	// contains filtered or unexported fields
}

type ForkResponse struct {
	Children []*Session `protobuf:"bytes,1,rep,name=children,proto3" json:"children,omitempty"`
	// contains filtered or unexported fields
}

type GetHarnessRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Also ask the harness to Describe itself, bounded by a host timeout. The result is in observed
	// or observe_error; a failed Describe does not fail the call.
	Observe bool `protobuf:"varint,2,opt,name=observe,proto3" json:"observe,omitempty"`
	// contains filtered or unexported fields
}

type GetSessionRequest struct {
	Uid string `protobuf:"bytes,1,opt,name=uid,proto3" json:"uid,omitempty"`
	// contains filtered or unexported fields
}

type HarnessClient interface {
	// Describe returns the static contract; used to match the harness to a runtime.
	Describe(ctx context.Context, in *DescribeRequest, opts ...grpc.CallOption) (*HarnessDescriptor, error)
	// Connect drives ONE execution. The host sends Start (and optional control frames). Normally
	// the harness streams Events terminated by exactly one EVENT_END. An unresolved approval
	// instead follows park -> correlated EVENT_PARKED -> stream closure, with no EVENT_END.
	// Durable requests/decisions belong to the host; this protocol applies to STATELESS_REPLAY only.
	// After ACK and actual stream closure, the host closes the invocation connection, performs
	// an external snapshot and commits SUSPEND before reporting a successful live pause. Handoff
	// failures retain the durable request and their actual error; they are not park success.
	Connect(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ControllerFrame, Event], error)
}

type HarnessDescriptor struct {
	Id           string        `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Models       []string      `protobuf:"bytes,2,rep,name=models,proto3" json:"models,omitempty"` // model-agnostic: supported/required model ids
	Tools        []*ToolSpec   `protobuf:"bytes,3,rep,name=tools,proto3" json:"tools,omitempty"`
	Capabilities *Capabilities `protobuf:"bytes,4,opt,name=capabilities,proto3" json:"capabilities,omitempty"`
	// Stable, opaque implementation replay-compatibility version, owned by the harness author.
	// Change it when deterministic execution or config interpretation changes. Hosts record it
	// in ExecutionStart and compare known recorded versions exactly on replay/recovery.
	// Empty is supported for older/unversioned harnesses and records an unknown version.
	Version string `protobuf:"bytes,5,opt,name=version,proto3" json:"version,omitempty"`
	// contains filtered or unexported fields
}

type HarnessEnd struct {
	State string `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"` // COMPLETED | FAILED | CANCELED
	Error *Error `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type HarnessRegistration struct {

	// metadata.name is the key that Session.harness and ExecRequest.harness refer to. metadata.uid is
	// server-assigned and stays the same across UNCHANGED and REACTIVATED. metadata.project is
	// unused: a registration is host-scoped.
	Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Unset for a STATIC harness, or for a stored registration whose spec this host cannot decode
	// or validate. No partial spec is returned in the latter case; see unservable_reason.
	Spec *HarnessSpec `protobuf:"bytes,2,opt,name=spec,proto3" json:"spec,omitempty"`
	// "sha256:" followed by the lowercase hex SHA-256 of the RFC 8785 (JCS) form of the
	// originally stored spec's proto3-JSON mapping, with proto field names, enum names, and
	// unpopulated fields omitted. This is the same canonical form the journal hashes. Empty for a
	// STATIC harness. Preserved when spec is unset for an undecodable registration: this host
	// cannot recompute the original digest without understanding the complete spec.
	SpecDigest string        `protobuf:"bytes,3,opt,name=spec_digest,json=specDigest,proto3" json:"spec_digest,omitempty"`
	State      HarnessState  `protobuf:"varint,4,opt,name=state,proto3,enum=agentsessions.v1.HarnessState" json:"state,omitempty"`
	Source     HarnessSource `protobuf:"varint,5,opt,name=source,proto3,enum=agentsessions.v1.HarnessSource" json:"source,omitempty"`
	// Set while RETIRED: when the harness was first retired.
	RetireTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=retire_time,json=retireTime,proto3" json:"retire_time,omitempty"`
	// Set while RETIRED: the reason given when the harness was first retired.
	RetireReason string `protobuf:"bytes,7,opt,name=retire_reason,json=retireReason,proto3" json:"retire_reason,omitempty"`
	// Set only when GetHarnessRequest.observe is true and Describe succeeded: what the harness
	// reported just now. Never stored.
	Observed *HarnessDescriptor `protobuf:"bytes,8,opt,name=observed,proto3" json:"observed,omitempty"`
	// Set only when GetHarnessRequest.observe is true: why this host cannot serve the harness
	// (isolated or not loaded), or why Describe failed. Never stored.
	ObserveError string `protobuf:"bytes,9,opt,name=observe_error,json=observeError,proto3" json:"observe_error,omitempty"`
	// Nonempty if this host cannot serve a stored registration. The row remains visible and its
	// name reserved in the journal, ACTIVE or RETIRED. A registration isolated during this host's
	// startup load remains known locally; Sessions operations needing it fail FAILED_PRECONDITION.
	// A row added by another host after startup is visible here but unknown to this host's Sessions
	// routing until restart or a local RegisterHarness with the identical compatible spec; selecting
	// it for Create or auto-create Exec fails INVALID_ARGUMENT until loaded. For a RETIRED row,
	// restart this host to serve its existing sessions without reactivating it: RegisterHarness
	// reactivates the row for every host sharing the journal. A pending recorded Resume can still
	// fail FAILED_PRECONDITION under the existing recovery rule. Strict decoding
	// refuses unsupported stored fields and enum values, rather than accepting a partial spec.
	// This is a host-local status, never stored: another compatible host may serve the same row.
	// Do not match on this human-readable explanation.
	UnservableReason string `protobuf:"bytes,10,opt,name=unservable_reason,json=unservableReason,proto3" json:"unservable_reason,omitempty"`
	// contains filtered or unexported fields
}

type HarnessRegistryClient interface {
	// Returns CREATED, UNCHANGED or REACTIVATED. ALREADY_EXISTS when the name holds a different spec,
	// or is taken by or reserved for a STATIC harness. FAILED_PRECONDITION when the host cannot serve
	// a new placement. An identical repeat of a registration isolated during startup returns
	// UNCHANGED or REACTIVATED with unservable_reason set; it does not claim this host serves it.
	// An identical compatible repeat of a row added since startup can load it locally without restart.
	// Repeating a RETIRED registration reactivates it for every host sharing the journal; restart the
	// host instead to serve only its existing sessions without reactivation.
	RegisterHarness(ctx context.Context, in *RegisterHarnessRequest, opts ...grpc.CallOption) (*RegisterHarnessResponse, error)
	// NOT_FOUND for a name that is neither STATIC nor registered.
	GetHarness(ctx context.Context, in *GetHarnessRequest, opts ...grpc.CallOption) (*HarnessRegistration, error)
	ListHarnesses(ctx context.Context, in *ListHarnessesRequest, opts ...grpc.CallOption) (*ListHarnessesResponse, error)
	// Idempotent: retiring a RETIRED harness returns it unchanged. FAILED_PRECONDITION for a STATIC
	// harness; NOT_FOUND for an unknown name.
	RetireHarness(ctx context.Context, in *RetireHarnessRequest, opts ...grpc.CallOption) (*HarnessRegistration, error)
}

type HarnessRegistryServer interface {
	// Returns CREATED, UNCHANGED or REACTIVATED. ALREADY_EXISTS when the name holds a different spec,
	// or is taken by or reserved for a STATIC harness. FAILED_PRECONDITION when the host cannot serve
	// a new placement. An identical repeat of a registration isolated during startup returns
	// UNCHANGED or REACTIVATED with unservable_reason set; it does not claim this host serves it.
	// An identical compatible repeat of a row added since startup can load it locally without restart.
	// Repeating a RETIRED registration reactivates it for every host sharing the journal; restart the
	// host instead to serve only its existing sessions without reactivation.
	RegisterHarness(context.Context, *RegisterHarnessRequest) (*RegisterHarnessResponse, error)
	// NOT_FOUND for a name that is neither STATIC nor registered.
	GetHarness(context.Context, *GetHarnessRequest) (*HarnessRegistration, error)
	ListHarnesses(context.Context, *ListHarnessesRequest) (*ListHarnessesResponse, error)
	// Idempotent: retiring a RETIRED harness returns it unchanged. FAILED_PRECONDITION for a STATIC
	// harness; NOT_FOUND for an unknown name.
	RetireHarness(context.Context, *RetireHarnessRequest) (*HarnessRegistration, error)
	// contains filtered or unexported methods
}

type HarnessServer interface {
	// Describe returns the static contract; used to match the harness to a runtime.
	Describe(context.Context, *DescribeRequest) (*HarnessDescriptor, error)
	// Connect drives ONE execution. The host sends Start (and optional control frames). Normally
	// the harness streams Events terminated by exactly one EVENT_END. An unresolved approval
	// instead follows park -> correlated EVENT_PARKED -> stream closure, with no EVENT_END.
	// Durable requests/decisions belong to the host; this protocol applies to STATELESS_REPLAY only.
	// After ACK and actual stream closure, the host closes the invocation connection, performs
	// an external snapshot and commits SUSPEND before reporting a successful live pause. Handoff
	// failures retain the durable request and their actual error; they are not park success.
	Connect(grpc.BidiStreamingServer[ControllerFrame, Event]) error
	// contains filtered or unexported methods
}

type HarnessSource int32

type HarnessSpec struct {

	// Exactly one is required.
	//
	// Types that are valid to be assigned to Placement:
	//
	//	*HarnessSpec_Remote
	//	*HarnessSpec_Substrate
	Placement isHarnessSpec_Placement `protobuf_oneof:"placement"`
	// The contract the harness declares. resumability is required. Placement still gates every turn
	// on the capabilities the harness reports through Describe.
	Capabilities *Capabilities `protobuf:"bytes,3,opt,name=capabilities,proto3" json:"capabilities,omitempty"`
	// Expected HarnessDescriptor.id. When set, Exec, Resume and Fork are refused with
	// FAILED_PRECONDITION, before anything is journaled, if the harness's Describe reports a different
	// id. It is checked on every call, not at registration. Empty means not checked. The id is what
	// the harness reports about itself, so this catches an address that reaches the wrong harness; it
	// is not authentication.
	DescriptorId string `protobuf:"bytes,4,opt,name=descriptor_id,json=descriptorId,proto3" json:"descriptor_id,omitempty"`
	// contains filtered or unexported fields
}

type HarnessSpec_Remote struct {
	Remote *RemotePlacement `protobuf:"bytes,1,opt,name=remote,proto3,oneof"`
}

type HarnessSpec_Substrate struct {
	Substrate *SubstratePlacement `protobuf:"bytes,2,opt,name=substrate,proto3,oneof"`
}

type HarnessState int32

type Harness_ConnectClient = grpc.BidiStreamingClient[ControllerFrame, Event]

type Harness_ConnectServer = grpc.BidiStreamingServer[ControllerFrame, Event]

type IdentityContext struct {
	Principal     *IdentityRef `protobuf:"bytes,1,opt,name=principal,proto3" json:"principal,omitempty"`
	CanMintTokens bool         `protobuf:"varint,2,opt,name=can_mint_tokens,json=canMintTokens,proto3" json:"can_mint_tokens,omitempty"`
	// contains filtered or unexported fields
}

type IdentityRef struct {
	Principal string `protobuf:"bytes,1,opt,name=principal,proto3" json:"principal,omitempty"`
	Issuer    string `protobuf:"bytes,2,opt,name=issuer,proto3" json:"issuer,omitempty"`
	Subject   string `protobuf:"bytes,3,opt,name=subject,proto3" json:"subject,omitempty"` // session-scoped sub
	// contains filtered or unexported fields
}

type Lifecycle struct {
	Kind   Lifecycle_Kind `protobuf:"varint,1,opt,name=kind,proto3,enum=agentsessions.v1.Lifecycle_Kind" json:"kind,omitempty"`
	Detail string         `protobuf:"bytes,2,opt,name=detail,proto3" json:"detail,omitempty"` // e.g. "fork parent=<uid>@<seq>", baseline id
	// SnapshotRef captured on SUSPEND (§5.1), carried inline (mirroring the canonical api.SnapshotRef)
	// so it rides the tamper-evident chain with no side table and no cross-file message dependency.
	// This is distinct from the aspirational session-status message SnapshotRef in session.proto. A
	// filesystem-only backend sets only snapshot_local (the session handle to replay) with
	// snapshot_memory=false; a memory backend also sets snapshot_external_uri.
	SnapshotLocal       string `protobuf:"bytes,3,opt,name=snapshot_local,json=snapshotLocal,proto3" json:"snapshot_local,omitempty"`
	SnapshotExternalUri string `protobuf:"bytes,4,opt,name=snapshot_external_uri,json=snapshotExternalUri,proto3" json:"snapshot_external_uri,omitempty"`
	SnapshotMemory      bool   `protobuf:"varint,5,opt,name=snapshot_memory,json=snapshotMemory,proto3" json:"snapshot_memory,omitempty"`
	SnapshotSealed      bool   `protobuf:"varint,6,opt,name=snapshot_sealed,json=snapshotSealed,proto3" json:"snapshot_sealed,omitempty"`
	// contains filtered or unexported fields
}

type Lifecycle_Kind int32

type ListHarnessesRequest struct {

	// Maximum entries per page. 0 means 50; values above 500 are clamped to 500. Negative is
	// INVALID_ARGUMENT.
	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Opaque cursor from a prior ListHarnessesResponse.next_page_token. Empty means the first page.
	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// Include RETIRED entries. STATIC entries are always included.
	IncludeRetired bool `protobuf:"varint,3,opt,name=include_retired,json=includeRetired,proto3" json:"include_retired,omitempty"`
	// contains filtered or unexported fields
}

type ListHarnessesResponse struct {

	// In name order, STATIC and REGISTERED entries together.
	Harnesses []*HarnessRegistration `protobuf:"bytes,1,rep,name=harnesses,proto3" json:"harnesses,omitempty"`
	// Empty on the last page.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListSessionsRequest struct {
	Project string `protobuf:"bytes,1,opt,name=project,proto3" json:"project,omitempty"` // tenant / namespace; exact-match filter, not a prefix or wildcard
	// Maximum sessions to return. 0 = the server default; a value above the server maximum is
	// clamped rather than rejected.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Opaque cursor taken verbatim from a prior ListSessionsResponse.next_page_token. Empty = first
	// page. A token the server cannot parse is INVALID_ARGUMENT, never a silent restart from page 1.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListSessionsResponse struct {
	Sessions      []*Session `protobuf:"bytes,1,rep,name=sessions,proto3" json:"sessions,omitempty"`
	NextPageToken string     `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"` // empty on the last page
	// contains filtered or unexported fields
}

type LogRecord struct {
	Seq         int64  `protobuf:"varint,1,opt,name=seq,proto3" json:"seq,omitempty"`
	PrevHash    string `protobuf:"bytes,2,opt,name=prev_hash,json=prevHash,proto3" json:"prev_hash,omitempty"`
	ContentHash string `protobuf:"bytes,3,opt,name=content_hash,json=contentHash,proto3" json:"content_hash,omitempty"`
	Fence       int64  `protobuf:"varint,4,opt,name=fence,proto3" json:"fence,omitempty"`
	Event       *Event `protobuf:"bytes,5,opt,name=event,proto3" json:"event,omitempty"`
	// contains filtered or unexported fields
}

type Mediation int32

type Message struct {
	Role  string  `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"` // system, user, assistant, or tool
	Parts []*Part `protobuf:"bytes,2,rep,name=parts,proto3" json:"parts,omitempty"`
	// contains filtered or unexported fields
}

type ModelCall struct {
	Model     string            `protobuf:"bytes,1,opt,name=model,proto3" json:"model,omitempty"`
	Params    map[string]string ``                                                                                         /* 139-byte string literal not displayed */
	InputHash string            `protobuf:"bytes,3,opt,name=input_hash,json=inputHash,proto3" json:"input_hash,omitempty"` // §7/§9.1: required for STATELESS_REPLAY so the I0 check can run
	Id        string            `protobuf:"bytes,4,opt,name=id,proto3" json:"id,omitempty"`                                // correlation id for the served ModelResult
	// messages is the request context the host needs to INVOKE the model on the live path. It is
	// wire-only: the host records the call with input_hash alone (messages stripped), since the
	// recorded form only needs the hash to re-check I0 on replay.
	Messages []*Message `protobuf:"bytes,5,rep,name=messages,proto3" json:"messages,omitempty"`
	// tools are the definitions offered to the model on this call. Wire-only like messages: the
	// recorded form keeps input_hash, which covers them.
	Tools []*ToolDefinition `protobuf:"bytes,6,rep,name=tools,proto3" json:"tools,omitempty"`
	// tool_choice constrains whether and which tool the model calls. Wire-only like messages and
	// covered by input_hash. Unset means the provider default.
	ToolChoice *ToolChoice `protobuf:"bytes,7,opt,name=tool_choice,json=toolChoice,proto3" json:"tool_choice,omitempty"`
	// contains filtered or unexported fields
}

type ModelResult struct {
	Message     *Message `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
	Usage       *Usage   `protobuf:"bytes,2,opt,name=usage,proto3" json:"usage,omitempty"`
	ModelCallId string   `protobuf:"bytes,3,opt,name=model_call_id,json=modelCallId,proto3" json:"model_call_id,omitempty"` // correlates to the emitted ModelCall.id
	// contains filtered or unexported fields
}