v1alpha1

const (
	ToolSessionLogOff        = "off"
	ToolSessionLogHighSignal = "highSignal"
	ToolSessionLogFull       = "full"
)

const (
	// FactSourceStateGated is a producer every call of which is gated; GatedBy
	// names the types.
	FactSourceStateGated = "gated"
	// FactSourceStateUngated is a producer no permission check gates.
	FactSourceStateUngated = "ungated"
	// FactSourceStateUnresolved is a real producer whose gate could not be
	// determined. Distinct from ungated, and never treated as blocked.
	FactSourceStateUnresolved = "unresolved"
	// FactSourceStateAbsent is an observed fact nothing on this class records.
	FactSourceStateAbsent = "absent"
	// FactSourceStateEnvelope is an envelope fact, which no tool ever records.
	FactSourceStateEnvelope = "envelope"
)

const (
	ArtifactVisibilitySession      = "session"
	ArtifactVisibilityOrganization = "organization"
)

const (
	// MetaagentTriggerMention is the default: the ambient path is off entirely.
	// The metaagent runs only when addressed explicitly, plus at session start.
	// This is today's behavior.
	MetaagentTriggerMention = "mention"

	// MetaagentTriggerShadow classifies every inbound turn and APPLIES NOTHING.
	//
	// The measurement mode, and the reason it exists is that the alternative is
	// measuring in production. The prefilter is a keyword heuristic that trades
	// recall for cost and whose miss rate is unmeasured; the classifier behind
	// it is an LLM reading untrusted text. Shadow runs both for real and records
	// what WOULD have happened — prefiltered-out versus extractor-invoked, and
	// which decision came back — while changing nothing about the session.
	//
	// So a cluster can turn this on for a few agents, read the numbers, and
	// decide whether inline is worth it. That is the same discipline the plan
	// gate's logging mode follows, for the same reason.
	MetaagentTriggerShadow = "shadow"

	// MetaagentTriggerInline classifies every inbound turn AND acts on it.
	//
	// Everything downstream still applies: a widening needs approval, standing
	// still gates the surface, and the admin ceiling still clamps. What changes
	// is only how often the classifier runs.
	MetaagentTriggerInline = "inline"
)

const (
	AgentIdentityConditionValid   = "Valid"
	AgentIdentityConditionRefresh = "Refresh"

	// AgentIdentityConditionPlatformLinked reports whether this identity is
	// linked to the singleton SpiceDB platform object
	// (agentidentity:<ns>/<name>#platform@platform:platform).
	//
	// That ONE relationship is the only live arm of
	// agentidentity#update_credential — the permission gating "a human replaces
	// this agent's own dead shared credential" — so while it is absent every
	// such check fails closed, otherwise SILENTLY: the schema compiles, the card
	// publishes, the button renders, the click is refused.
	//
	// Deliberately NOT folded into Valid: an identity whose credentials all
	// resolve is usable by every session, and Valid=False over a SpiceDB-side
	// problem would stop agents that work fine. What is broken is only the
	// operator's ability to REPAIR it later.
	AgentIdentityConditionPlatformLinked = "PlatformLinked"
)

const (
	LabelAttendedParentNamespace = "agentprimitives.authzed.com/attended-parent-namespace"
	LabelAttendedParentName      = "agentprimitives.authzed.com/attended-parent-name"
)

const (
	// PendingRestartModeRestart (the empty-string default) is
	// restart-from-here: turns 0..CutTurnIndex are copied and the edited
	// message becomes turn CutTurnIndex+1 in the child.
	PendingRestartModeRestart = ""
	// PendingRestartModeInherit is continuation-inherit: the FULL parent
	// transcript is copied (the reconciler recomputes the cut as the
	// parent's last turn index) and the new message is appended after it.
	// Written by channelsd when a new inbound arrives for a terminal
	// session that a fresh clean retry can continue from.
	PendingRestartModeInherit = "inherit"
	// PendingRestartModeTakeover is a DIFFERENT-user continuation: someone who
	// is not the parent's started_by continues a terminal predecessor in the
	// same thread and becomes the child's owner. InheritHistory selects whether
	// the parent transcript carries over (ordinary terminal) or the child
	// starts fresh (policy/security halt). Authorization is the channelsd choke
	// point — the requester sent a legitimate app-mention into the thread, the
	// same basis on which they could start their own session — so
	// ReconcileRestart does NOT run the agentsession#fork gate for this mode.
	// The inherit and restart modes keep it.
	PendingRestartModeTakeover = "takeover"
)

const (
	ChannelRoleInput      = "input"
	ChannelRoleOutput     = "output"
	ChannelRoleBoth       = "both"
	ChannelRoleMonitoring = "monitoring"
)

const (
	// ConditionIdPValid is the readiness condition identityd consults
	// before serving IdP login.
	ConditionIdPValid = "Valid"

	ReasonIdPReady           = "Ready"
	ReasonIdPSecretMissing   = "SecretMissing"
	ReasonIdPDiscoveryFailed = "DiscoveryFailed"
	ReasonIdPConfigInvalid   = "ConfigInvalid"
)

const (
	ReasonClassValid                 = "Valid"
	ReasonClassInvalidImage          = "InvalidImage"
	ReasonClassInvalidTool           = "InvalidTool"
	ReasonClassInvalidResource       = "InvalidResource"
	ReasonClassInvalidEnvDefaults    = "InvalidEnvDefaults"
	ReasonClassInvalidPrivateVolumes = "InvalidPrivateVolumes"
	ReasonToolspecCoverageMissing    = "ToolspecCoverageMissing"
	// ReasonClassInvalidSandbox marks a class whose spec.sandbox names an
	// unregistered backend, or a backend that cannot satisfy what the class asks.
	ReasonClassInvalidSandbox = "InvalidSandbox"
	// ReasonClassInvalidSandboxWarmPool marks a class that requests non-zero
	// spec.sandbox.warmPool.replicas on a backend whose Runtime does not
	// implement sandboxkinds.Prewarmer. Distinct from ReasonClassInvalidSandbox
	// so an operator can tell "the backend itself is wrong" apart from "the
	// backend is fine, but it cannot pre-warm."
	ReasonClassInvalidSandboxWarmPool = "InvalidSandboxWarmPool"
	// ReasonSandboxKindNotPermitted marks a resource whose resolved sandbox
	// backend exists but is excluded by an allowedSandboxKinds ceiling. Distinct
	// from ReasonClassInvalidSandbox, which means the named backend is not
	// registered at all � the two need different operator responses.
	ReasonSandboxKindNotPermitted = "SandboxKindNotPermitted"
	// ReasonSandboxConfigIgnored marks a resource where a sandbox config value
	// was not a JSON object and was skipped. Non-fatal: the resolved backend is
	// still usable. Distinct from ReasonSandboxKindNotPermitted, which means the
	// backend itself is forbidden here.
	ReasonSandboxConfigIgnored = "SandboxConfigIgnored"
)

const (
	ReasonToolkitMissing    = "ToolkitMissing"
	ReasonCELCompileError   = "CELCompileError"
	ReasonUnknownSubcommand = "UnknownSubcommand"
	ReasonSpecLoadFailed    = "SpecLoadFailed"
)

const (
	SpiceboxSessionConditionReady       = "Ready"
	SpiceboxSessionConditionProgressing = "Progressing"
	SpiceboxSessionConditionFailed      = "Failed"
	SpiceboxSessionConditionTerminated  = "Terminated"
)

const (
	ReasonPodReady     = "PodReady"
	ReasonPodNotReady  = "PodNotReady"
	ReasonPodMissing   = "PodMissing"
	ReasonCreating     = "Creating"
	ReasonDraining     = "Draining"
	ReasonPodOOMKilled = "PodOOMKilled"
	ReasonPodCrashed   = "PodCrashed"
	// ReasonPodStartFailed marks a bundle pod wedged in a terminal container
	// "Waiting" state it will not recover from on its own � an unpullable image
	// (ImagePullBackOff), an unsatisfiable config (CreateContainerConfigError), a
	// crash loop, etc. The specific kubelet reason is carried in the condition
	// message. Distinct from ReasonPodCrashed (PodFailed phase), since these pods
	// never reach PodFailed � they retry forever � so without this the bundle (and
	// its waiting AgentSession) would hang silently.
	ReasonPodStartFailed = "PodStartFailed"
	// ReasonWorkspaceProvisioningFailed marks a session whose workspace (or
	// snapshot-store) PVC could not be provisioned by its StorageClass — an
	// undersized request the backend rejects (Filestore's minimum share size),
	// a disabled cloud API, quota, or a missing class. The provider's actual
	// event message is carried in the condition message. Distinct from
	// BundleFailed (a pod that scheduled but never became Ready): here no pod can
	// ever schedule because its volume never binds, so we fail fast with the
	// storage reason instead of waiting out bundleReadyDeadline behind the
	// generic "did not become Ready" text.
	ReasonWorkspaceProvisioningFailed = "WorkspaceProvisioningFailed"
	ReasonNodeEvicted                 = "NodeEvicted"
	ReasonClassMissing                = "ClassMissing"
	ReasonClassInvalid                = "ClassInvalid"
	ReasonIdleTTL                     = "IdleTTL"
	ReasonMaxDuration                 = "MaxDuration"
	ReasonUserDelete                  = "UserDelete"
	ReasonToolspecNotInClass          = "ToolspecNotInClass"
)

const (
	ToolCallConditionValidated = "Validated"
	ToolCallConditionRunning   = "Running"
	ToolCallConditionSucceeded = "Succeeded"
	ToolCallConditionFailed    = "Failed"
	ToolCallConditionTimeout   = "Timeout"
	ToolCallConditionCanceled  = "Canceled"
	// ToolCallConditionSnapshotAuditRecorded indicates the workspace
	// snapshot audit entry (tool_dispatch_snapshot memory kind) has
	// been recorded for this ToolCall. Used by the toolcall reconciler
	// to skip redundant Record calls on re-entry for streaming ToolCalls.
	ToolCallConditionSnapshotAuditRecorded = "SnapshotAuditRecorded"
	// ToolCallConditionReconcileRetrying is True while the reconciler is
	// failing on this ToolCall and being requeued. Its message carries the
	// last error and its LastTransitionTime marks when the current streak
	// began — which is what bounds how long the call may keep failing before
	// it is finished outright (ReasonToolCallReconcileFailed). It exists so a
	// stuck call is legible on the object from the FIRST failure, rather than
	// only in an operator log nobody is watching while a person waits.
	ToolCallConditionReconcileRetrying = "ReconcileRetrying"
)

const (
	ReasonToolCallValid             = "Valid"
	ReasonSessionNotActive          = "SessionNotActive"
	ReasonToolUnknown               = "ToolUnknown"
	ReasonInputArtifactMissing      = "InputArtifactMissing"
	ReasonExecStarted               = "ExecStarted"
	ReasonExecClosed                = "ExecClosed"
	ReasonProcessExited             = "ProcessExited"
	ReasonNonZeroExit               = "NonZeroExit"
	ReasonSessionGone               = "SessionGone"
	ReasonOperatorRestart           = "OperatorRestart"
	ReasonHydrateFailed             = "HydrateFailed"
	ReasonDeadlineExceeded          = "DeadlineExceeded"
	ReasonSpiceboxSessionTerminated = "SpiceboxSessionTerminated"
	ReasonToolspecDenied            = "ToolspecDenied"
	ReasonStreamTokenHashMissing    = "StreamTokenHashMissing"
	// ReasonSessionBindingMismatch: the ToolCall's spec.session names a bundle
	// belonging to a different AgentSession than the one that owns the call.
	// Both fields are creator-written, and everything privileged downstream
	// keys on spec.session — the sandbox to exec into and the session whose
	// use_token grant is consulted — so they must agree.
	ReasonSessionBindingMismatch = "SessionBindingMismatch"
	// ReasonSandboxUnresolved: the session has no sandbox handle yet, or its
	// kind has no runtime linked into this binary. Never a fallback to a
	// default backend � running in the wrong sandbox is worse than refusing.
	ReasonSandboxUnresolved = "SandboxUnresolved"
	// Interactive-mode terminal reasons. ReasonToolCallMaxDuration is named
	// to avoid colliding with SpiceboxSession's ReasonMaxDuration above; both
	// share the same value string but Go const names must be unique.
	ReasonIdleExit            = "IdleExit"
	ReasonToolCallMaxDuration = "ToolCallMaxDuration"
	// Reconcile-failure surfacing. ReasonToolCallReconcileError marks the
	// ReconcileRetrying condition while attempts continue;
	// ReasonToolCallReconcileRecovered clears it after one succeeds; and
	// ReasonToolCallReconcileFailed is the TERMINAL Failed reason for a call
	// that kept failing past the budget, carrying the last error so the
	// runner can hand the agent — and the agent the user — a reason.
	ReasonToolCallReconcileError     = "ReconcileError"
	ReasonToolCallReconcileRecovered = "ReconcileRecovered"
	ReasonToolCallReconcileFailed    = "ReconcileFailed"
)

const (
	ReasonAllReferencesResolve    = "AllReferencesResolve"
	ReasonSpecInvalid             = "SpecInvalid"
	ReasonSecretMissing           = "SecretMissing"
	ReasonSecretKeyMissing        = "SecretKeyMissing"
	ReasonOAuthSecretIncomplete   = "OAuthSecretIncomplete"
	ReasonBindingPrefixMixed      = "BindingPrefixMixed"
	ReasonBindingModeMismatch     = "BindingModeMismatch"
	ReasonBindingMatchUnparseable = "BindingMatchUnparseable"
	ReasonAgentCredentialExpired  = "AgentCredentialExpired"
	ReasonCredentialEmpty         = "CredentialEmpty"

	// ReasonCredentialShapeMismatch: the stored value does not match the token
	// format its provider declares (provider.TokenShape). It is a Valid=False
	// reason rather than a warning because the alternative is what it replaces:
	// every readiness gate reporting healthy and the credential failing as an
	// opaque 401 inside a tool's own output, minutes later. The message names
	// both the expected shape and the one the value actually has.
	ReasonCredentialShapeMismatch = "CredentialShapeMismatch"

	// PlatformLinked reasons. ReasonPlatformLinkFailed is TRANSIENT (SpiceDB
	// unreachable, schema not composed yet) and keeps being retried. The two
	// Unrepresentable* reasons are PERMANENT: a Kubernetes name may contain
	// '.', a SpiceDB object id may not, so the link can never be written and
	// the reconciler stops retrying and says so. For a class that means it can
	// never appear in the browser's agent picker.
	ReasonPlatformLinked              = "PlatformLinked"
	ReasonPlatformLinkFailed          = "PlatformLinkFailed"
	ReasonUnrepresentableIdentityName = "UnrepresentableIdentityName"
	ReasonUnrepresentableClassName    = "UnrepresentableClassName"

	// AgentIdentity Refresh-condition reasons, set by the OAuth refresh controller.
	ReasonNoOAuthCredentials     = "NoOAuthCredentials"
	ReasonAllOAuthFresh          = "AllOAuthFresh"
	ReasonRefreshSucceeded       = "RefreshSucceeded"
	ReasonNoRefreshToken         = "NoRefreshToken"
	ReasonTokenEndpointError     = "TokenEndpointError"
	ReasonRefreshResponseInvalid = "RefreshResponseInvalid"
)

const (
	ToolCallConditionEnvHighEntropy = "EnvHighEntropy"

	ReasonToolCallEnvSecretLike     = "ToolCallEnvSecretLike"
	ReasonToolCallEnvShadowsAgent   = "ToolCallEnvShadowsAgent"
	ReasonCredentialSourceForbidden = "CredentialSourceForbidden"
	ReasonAgentNotFound             = "AgentNotFound"
	ReasonAgentBindingMissing       = "AgentBindingMissing"
	ReasonAgentCredentialUnresolved = "AgentCredentialUnresolved"
	ReasonAgentSecretMissing        = "AgentSecretMissing"
	ReasonAgentSecretKeyMissing     = "AgentSecretKeyMissing"

	// ReasonAgentCredentialRevoked is set on the ToolCall Failed condition
	// when the sandbox-exec pre-dispatch use_token check gets a definitive
	// deny from SpiceDB (CheckUseToken returns false, nil) � the credential
	// resolved fine (ReasonAgentCredentialUnresolved does not apply) but the
	// operator's authorized_token grant for it no longer matches (revoked,
	// rotated, or never granted). Distinct from
	// ReasonAgentSessionTokenAuthzUnavailable, which is the indeterminate
	// case (the check itself couldn't be confirmed) and fails the parent
	// AgentSession, not just this ToolCall. A definitive deny is surgical:
	// only this ToolCall fails; the session continues.
	ReasonAgentCredentialRevoked = "AgentCredentialRevoked"
)

const (
	FinalizerSpiceboxSession  = "spiceboxsession.agentprimitives.authzed.com/finalizer"
	FinalizerToolCall         = "toolcall.agentprimitives.authzed.com/finalizer"
	FinalizerAgentSession     = "agentsession.agentprimitives.authzed.com/finalizer"
	FinalizerArtifactRender   = "artifactrender.agentprimitives.authzed.com/finalizer"
	FinalizerSpiceDBBootstrap = "spicedbbootstrap.agentprimitives.authzed.com/finalizer"
	FinalizerSidecarToolbox   = "sidecartoolbox.agentprimitives.authzed.com/finalizer"
	FinalizerPublicEndpoint   = "publicendpoint.agentprimitives.authzed.com/finalizer"
	FinalizerUserIdentity     = "useridentity.agentprimitives.authzed.com/finalizer"
	FinalizerWorkshop         = "workshop.agentprimitives.authzed.com/finalizer"
	// FinalizerSubagentRequest is added ONLY to an `attended`-mode
	// SubagentRequest, giving the controller a chance to notify a live
	// attended child's watching parent (a fixed inbound line + a forced wake)
	// before an early delete (a "stop") cascades the child away — the
	// GC-cascade would otherwise remove both objects with nothing left to
	// read. Every other mode never carries it.
	FinalizerSubagentRequest = "subagentrequest.agentprimitives.authzed.com/finalizer"
)

const (
	AgentClassConditionValid = "Valid"
	// AgentClassConditionPlatformLinked is True once the controller has written
	// agentclass:<ns>/<name>#platform@platform:platform � the tuple that makes
	// agentclass#start_session satisfiable, and so the only reason this class
	// can appear in the browser's agent picker at all. A condition rather than
	// a silent write because its absence is otherwise invisible: the schema
	// compiles, the dashboard renders, and the picker is simply empty. Reasons
	// are shared with AgentIdentity's platform link, plus
	// ReasonUnrepresentableClassName for the permanent case.
	AgentClassConditionPlatformLinked = "PlatformLinked"
	// AgentClassConditionStartersLinked is True once agentclass#starter holds
	// exactly spec.authz.session.allowedStarters (reason StartersLinked), or
	// when the class declares none and the relation was cleared (reason
	// NoAllowedStarters). False with StartersLinkFailed on a transient write
	// error (requeued), or ReasonUnrepresentableClassName (permanent).
	AgentClassConditionStartersLinked = "StartersLinked"
	// AgentClassConditionSettingsAccepted is True when the 4-tier settings
	// chain resolves without any fatal violation for this class.
	AgentClassConditionSettingsAccepted = "SettingsAccepted"
	// AgentClassConditionSchemaValidated is True when the operator has verified
	// every referenced tool's permission_check against the live SpiceDB schema.
	// Lazy: only re-runs on an AgentClass or referenced-tool Generation bump.
	AgentClassConditionSchemaValidated = "SchemaValidated"
	// AgentClassConditionAgentSessionGrantsWritten is True when the controller
	// has reconciled the owned "<className>-grants" AgentSessionGrants CR from
	// the union of resolved tool Permission.Check pairs. False with reason
	// AgentSessionGrantsWriteFailed when the write errored � surfaced without
	// failing the overall reconcile, so an API-server hiccup does not flap Valid.
	AgentClassConditionAgentSessionGrantsWritten = "AgentSessionGrantsWritten"
	// AgentClassConditionToolAuthDisabled is True when spec.authz.toolCalls.mode is
	// "disabled" � the operator-visible signal that per-tool authz is bypassed
	// for every session of this class. Reason is always ReasonToolAuthBypassed;
	// absent or False on enforcing/permissive classes.
	AgentClassConditionToolAuthDisabled = "ToolAuthDisabled"
	// AgentClassConditionInformationLeakageReady is True when every bound
	// Channel's kind satisfies the capability level required by
	// spec.authz.informationLeakage.mode. False (with a specific reason)
	// when mode=enforcing and a bound channel's kind either has no
	// AudienceResolver or is SingleUser with singleUserBypass=false.
	// Always True when mode=disabled or mode=logging.
	AgentClassConditionInformationLeakageReady = "InformationLeakageReady"
	// AgentClassConditionCapabilitiesValid is True when every key in
	// spec.capabilities names a registered capability and its config parses
	// (both the common {enabled} envelope and the capability-specific
	// ParseConfig). False (with a message) does NOT block readiness � an
	// unrecognized or malformed grant is dropped gracefully at assembly
	// time (see pkg/agent/tool/meta/capability), so this condition is purely
	// diagnostic. Absent capabilities map � vacuously True.
	AgentClassConditionCapabilitiesValid = "CapabilitiesValid"
	// AgentClassConditionSubagentsCapabilityGranted is True when
	// spec.subagents is empty (nothing to delegate to, so the question does
	// not apply) OR spec.capabilities carries a "subagents" entry. False when
	// spec.subagents names one or more classes but spec.capabilities has no
	// "subagents" key at all: the roster then has nowhere to send a delegate
	// call, since the subagents capability (DefaultOn() == false) is what
	// offers the delegate/reply_to_subagent tools in the first place — a
	// class in this state is fully valid and reconciles cleanly, but can
	// never actually hand work to anyone on its own roster. Purely
	// diagnostic, same as CapabilitiesValid: does NOT block readiness, since
	// nothing about this is a spec error, only an easy-to-miss omission.
	AgentClassConditionSubagentsCapabilityGranted = "SubagentsCapabilityGranted"
)

const (
	ReasonConfigMapMissing            = "ConfigMapMissing"
	ReasonConfigMapKeyMissing         = "ConfigMapKeyMissing"
	ReasonToolspecMissing             = "ToolspecMissing"
	ReasonAgentIdentityMissing        = "AgentIdentityMissing"
	ReasonAgentIdentityBindingMissing = "AgentIdentityBindingMissing"
	// ReasonAgentIdentityInvalid fires when the AgentClass's bound
	// AgentIdentity exists but is itself not Valid=True (e.g. an empty-
	// value Secret backing one of its credentials). Propagating the
	// identity's invalidity into the class completes the start-gate
	// chain: the AgentSession reconciler parks any session whose
	// AgentClass is not Valid (ReasonAgentClassNotValid).
	ReasonAgentIdentityInvalid    = "AgentIdentityInvalid"
	ReasonBundleToolNameCollision = "BundleToolNameCollision"
	ReasonTestProviderNotAllowed  = "TestProviderNotAllowed"

	// StartersLinked reasons. ReasonStartersLinked is the AgentClassConditionStartersLinked
	// True reason when a non-empty allowedStarters was written; ReasonNoAllowedStarters
	// is the True reason when the class declares none and the relation was cleared.
	// ReasonStartersLinkFailed is the transient False reason (requeued); the permanent
	// False reason reuses ReasonUnrepresentableClassName, shared with PlatformLinked.
	ReasonStartersLinked     = "StartersLinked"
	ReasonNoAllowedStarters  = "NoAllowedStarters"
	ReasonStartersLinkFailed = "StartersLinkFailed"
)

const (
	ReasonToolPermissionMissing = "ToolPermissionMissing"
	// ReasonPlanGateRequiresToolCallEnforcing: planGate.mode=enforcing with
	// toolCalls.mode not enforcing. The plan gate enforces the CLASS axis
	// itself, but the INSTANCE axis rides on tool_call_authz � so with that
	// hook permissive or unregistered, per-resource gating would silently stop
	// while the class axis kept refusing, which reads as "the gate is working".
	ReasonPlanGateRequiresToolCallEnforcing = "PlanGateRequiresToolCallEnforcing"
	// ReasonPlanExampleInvalid: an authored planGate.examples entry names a
	// handle or slot type this class cannot declare. Refused rather than
	// dropped: the prompt tells agents an undeclarable handle is silently
	// removed from their phase, and planners transcribe these examples closely,
	// so admitting one would teach that failure into every plan the agent
	// writes — surfacing much later as calls denied for no visible reason.
	ReasonPlanExampleInvalid = "PlanExampleInvalid"
	// ReasonTrifectaCeilingContradicted: the class declares
	// authz.trifecta.neverConsequential yet holds a readwrite or external tool
	// permission. A declared ceiling checked against the derived surface, so a
	// contradiction is surfaced at apply time rather than as an untraceable
	// refusal during a later delegation.
	ReasonTrifectaCeilingContradicted = "TrifectaCeilingContradicted"
	// ReasonBoundEntitiesRenamed: spec.boundEntities still set after the
	// rename. Rejected rather than ignored � silently dropping an authz field
	// would leave the agent less constrained than its author wrote.
	ReasonBoundEntitiesRenamed = "BoundEntitiesRenamed"
	// ReasonSlotDeclarationInvalid: an authz.slots entry is internally
	// inconsistent � an unknown enum value, a duplicate resourceType, or a
	// trust policy declared where it cannot take effect. Rejected rather than
	// ignored: a policy field that never runs is worse than an absent one,
	// because its presence in the YAML reads as protection.
	ReasonSlotDeclarationInvalid = "SlotDeclarationInvalid"
	// ReasonSlotPreconditionUnsatisfiable: a slot precondition reads an
	// observed fact whose every declared producer is a tool gated by that same
	// slot. Nothing can ever satisfy it — the agent is handed a hint naming a
	// call it will be denied, and burns its budget retrying. Refused at
	// admission for the same reason a subagent cycle is: a bound that only
	// holds at runtime does not hold.
	//
	// Its OWN reason rather than ReasonSlotDeclarationInvalid because this is
	// not an internal-consistency claim about the declaration — it is a claim
	// about the declaration against the class's resolved tools, and it can only
	// be judged once those are resolved.
	ReasonSlotPreconditionUnsatisfiable = "SlotPreconditionUnsatisfiable"
	// ReasonSlotPreconditionUnroutable: a slot precondition's waiver has no one
	// to route to. A Refused verdict raises a human waiver card whose approver
	// pool is the precondition's own approvers[] when SET (authoritative), or the
	// slot type's resolved standing when UNSET. Two shapes leave that pool empty
	// by SHAPE: a SET approvers[] that names no subject (a list of blanks, which
	// overrides the standing default with a route to no one), or an UNSET
	// approvers[] whose slot type resolves to no standing at all.
	//
	// Refused at admission, and only for the structurally-empty case: this
	// cannot and does not claim SpiceDB currently holds zero approver subjects
	// for a declared standing (that is a runtime fact, not a shape). Its OWN
	// reason rather than ReasonSlotPreconditionUnsatisfiable because the defect
	// is the absent APPROVER route, not an unsatisfiable predicate, and rather
	// than ReasonSlotDeclarationInvalid because it is a claim about the
	// precondition's own approver routing, judged against the resolved standings.
	ReasonSlotPreconditionUnroutable = "SlotPreconditionUnroutable"
	// ReasonRosterInvalid marks an AgentClass whose delegation roster does not
	// hold together: a spec.subagents graph with a cycle, one that exceeds the
	// depth ceiling, or one naming a class that does not exist — plus a
	// spec.subagentModes entry keyed on a name absent from spec.subagents, or
	// carrying a value that is not a delegation mode.
	ReasonRosterInvalid = "RosterInvalid"
	// ReasonConfigInvalid: spec.config violates spec.configSchema, or a bound
	// toolspec constraint references a config key not declared in configSchema.
	ReasonConfigInvalid = "ConfigInvalid"
	// ReasonUserPreferencesInvalid: spec.userPreferences is self-inconsistent
	// (duplicate key, default violating its own type/enum/pattern, …).
	ReasonUserPreferencesInvalid        = "UserPreferencesInvalid"
	ReasonPermissionSpecInvalid         = "PermissionSpecInvalid"
	ReasonPermissionTemplateUnresolved  = "PermissionTemplateUnresolved"
	ReasonPermissionTransformUnknown    = "PermissionTransformUnknown"
	ReasonPermissionSchemaMismatch      = "PermissionSchemaMismatch"
	ReasonSpiceDBUnreachable            = "SpiceDBUnreachable"
	ReasonAgentSessionGrantsWritten     = "AgentSessionGrantsWritten"
	ReasonAgentSessionGrantsWriteFailed = "AgentSessionGrantsWriteFailed"
	// ReasonToolAuthBypassed is the Reason on AgentClassConditionToolAuthDisabled
	// when status=True. Message includes a fixed operator-readable note that
	// tool calls run without SpiceDB validation.
	ReasonToolAuthBypassed = "ToolAuthBypassed"

	// ReasonInfoLeakageReady is the Reason on
	// AgentClassConditionInformationLeakageReady when status=True.
	ReasonInfoLeakageReady = "CapabilitySatisfied"
	// ReasonChannelKindLacksAudienceResolver is set when a bound Channel's
	// kind has no AudienceResolver and
	// informationLeakage.onUnsupportedChannel=blockBinding.
	ReasonChannelKindLacksAudienceResolver = "ChannelKindLacksAudienceResolver"
	// ReasonSingleUserBypassDisabled is set when a bound Channel's kind
	// reports CapabilitySingleUser but informationLeakage.singleUserBypass
	// is false.
	ReasonSingleUserBypassDisabled = "SingleUserBypassDisabled"

	// ReasonCapabilitiesValid is the Reason on
	// AgentClassConditionCapabilitiesValid when status=True.
	ReasonCapabilitiesValid = "CapabilitiesValid"
	// ReasonUnknownCapability is set when spec.capabilities has a key that
	// names no registered capability.
	ReasonUnknownCapability = "UnknownCapability"
	// ReasonInvalidCapabilityConfig is set when spec.capabilities has a
	// known key whose value fails to parse (the common {enabled} envelope
	// or the capability-specific config).
	ReasonInvalidCapabilityConfig = "InvalidCapabilityConfig"

	// ReasonSubagentsCapabilityGranted is the Reason on
	// AgentClassConditionSubagentsCapabilityGranted when status=True (either
	// no roster, or the capability is present).
	ReasonSubagentsCapabilityGranted = "SubagentsCapabilityGranted"
	// ReasonSubagentsCapabilityMissing is set when spec.subagents is
	// non-empty but spec.capabilities has no "subagents" entry: the roster
	// exists but nothing offers the delegate tool that would use it.
	ReasonSubagentsCapabilityMissing = "SubagentsCapabilityMissing"
)

const (
	AgentSessionConditionClassResolved = "ClassResolved"
	AgentSessionConditionBundlesReady  = "BundlesReady"
	AgentSessionConditionRunnerReady   = "RunnerReady"
	AgentSessionConditionSucceeded     = "Succeeded"
	AgentSessionConditionFailed        = "Failed"
	// AgentSessionConditionSettingsAccepted is True when the 4-tier settings
	// chain resolves without any fatal violation for this session.
	AgentSessionConditionSettingsAccepted = "SettingsAccepted"
	// AgentSessionConditionSkillBundlesIntegrity is False when a staged skill
	// bundle's store-returned bytes did not hash to its SkillBundleRef digest �
	// a corrupt or poisoned cache. The skill still runs instruction-only, but
	// the failure is surfaced here so `kubectl describe` distinguishes it from
	// the benign not-cached case, which produces no condition at all. Absent
	// when every bundle the store served verified cleanly.
	AgentSessionConditionSkillBundlesIntegrity = "SkillBundlesIntegrity"
	// AgentSessionConditionSandboxScheduling is the durable, channelsd-visible
	// twin of the one-shot "capacity" monitoring event: False
	// (ReasonSandboxUnschedulable) when a bundle or content-guard detector pod
	// has been stuck Pending on a scheduler failure (insufficient cpu/memory,
	// taints, �) past the grace window, with the scheduler's real reason in
	// Message; True (ReasonSandboxScheduled) once nothing is stalled, so a
	// resolved capacity problem is reflected as promptly as the stall was.
	// Absent until the first wait observes a scheduling result.
	//
	// Unlike the monitoring event it is set regardless of whether
	// MonitoringPublish is configured: it is the primary signal channelsd
	// reacts to, and must work on clusters with no NATS wiring.
	AgentSessionConditionSandboxScheduling = "SandboxScheduling"
)

const (
	ReasonSettingsResolved         = "SettingsResolved" // accepted, no warnings
	ReasonSettingsClamped          = "SettingsClamped"  // accepted, budget clamped
	ReasonSettingsSelfInconsistent = "SelfInconsistent" // a Settings default violates its own ceiling
	ReasonSettingsNotSingleton     = "NotSingleton"     // a Settings CR has a non-well-known name
	ReasonSettingsConsistent       = "Consistent"       // Settings CR SelfConsistent=True
	ReasonClassPreferencesValid    = "ClassPreferencesValid"
	ReasonClassPreferencesInvalid  = "ClassPreferencesInvalid"
)

const (
	SettingsConditionSelfConsistent = "SelfConsistent"

	// SettingsConditionClassPreferencesValid reports whether every
	// classUserPreferences global matches an installed class's declared
	// userPreferences schema. Unknown class names are tolerated (install
	// order); unknown keys and type mismatches against an INSTALLED class
	// are violations.
	SettingsConditionClassPreferencesValid = "ClassPreferencesValid"
)

const (
	AgentSessionPhasePending   = "Pending"
	AgentSessionPhaseRunning   = "Running"
	AgentSessionPhaseSucceeded = "Succeeded"
	AgentSessionPhaseFailed    = "Failed"
	// AgentSessionPhaseAwaitingApproval is the legacy phase name; see
	// AgentSessionPhaseAwaitingDecision. Kept for back-compat with
	// in-flight CRs written before the unified state machine.
	AgentSessionPhaseAwaitingApproval = "AwaitingApproval"
	// AgentSessionPhaseAwaitingDecision is the canonical phase entered
	// when one or more tool dispatches are paused waiting for a human
	// decision (tool_call, leakage_share, content_inspect, scope_review).
	// Restored to the pre-decision phase when all pending decisions resolve.
	AgentSessionPhaseAwaitingDecision = "AwaitingDecision"
	// AgentSessionPhaseHeld is a forensic hold: the session is parked with its
	// workspace preserved, pending a human decision to release it. Byte-identical
	// to lifecycle.PhaseHeld, which projects onto status.phase.
	AgentSessionPhaseHeld = "Held"
	// AgentSessionPhaseAwaitingRetry is entered when the LLM provider
	// returned an error on a channel-attached session. Pod exits clean;
	// channelsd posts a Retry button on the channel. Click sets the
	// wake annotation; the controller transitions back to Pending and
	// respawns the runner. Non-terminal.
	AgentSessionPhaseAwaitingRetry = "AwaitingRetry"
)

const (
	ReasonAgentClassMissing  = "AgentClassMissing"
	ReasonAgentClassNotValid = "AgentClassNotValid"
	ReasonRunnerCreating     = "RunnerCreating"
	ReasonRunnerReady        = "RunnerReady"
	// ReasonRunnerPodRefused is set on RunnerReady=False when creating the
	// runner workload was REFUSED — an admission verdict (a quota, a policy, a
	// webhook), as opposed to ReasonSandboxUnschedulable, where it was created
	// and could not be placed. The condition message carries the refusal's own
	// words, and it is a positive readiness gate
	// (pkg/controllers/agentstatus.notReadyGates), so a person watching the
	// session is told why instead of watching it sit.
	ReasonRunnerPodRefused = "RunnerPodRefused"
	// ReasonRunnerStartError is set on RunnerReady=False when the runner
	// workload could not be created for any reason OTHER than an admission
	// refusal (a transient apiserver error, a client-side pod-build failure).
	// It deliberately does not carry ReasonRunnerPodRefused's "not allowed the
	// resources it needs" phrasing (pkg/controllers/agentstatus/friendly.go) —
	// that wording is reserved for a genuine refusal, and applying it to an
	// unrelated error would misattribute the cause to a quota or policy that
	// was never involved.
	ReasonRunnerStartError    = "RunnerStartError"
	ReasonAgentSessionStalled = "Stalled"
	ReasonAgentSessionBudget  = "BudgetExceeded"
	// ReasonAgentSessionExpired is set on the Failed condition when a session
	// exceeds its wall-clock budget.sessionExpiration (measured from
	// status.startedAt). Distinct from ReasonAgentSessionBudget (turns/tokens/
	// active run-time). Its string value "SessionExpired" is mirrored by the
	// lifecycle Expired event's FailureReason.
	ReasonAgentSessionExpired     = "SessionExpired"
	ReasonAgentSessionRunnerCrash = "RunnerCrashed"
	ReasonAgentSessionBundleFail  = "BundleFailed" // a tool bundle's sandbox failed terminally
	ReasonAgentSessionMemoryDown  = "MemoryUnavailable"
	ReasonAgentSessionProviderErr = "ProviderError"
	// ReasonAgentSessionRefusal: the provider returned stop_reason=refusal
	// (content-policy block). Channel-attached sessions park in AwaitingRetry
	// under this reason (recoverable, Retry button); local sessions fail.
	ReasonAgentSessionRefusal = "Refusal"
	// ReasonAgentSessionScopeReviewFailed is set on the Failed condition when
	// the runner's cold-start scope review could not complete (publish error,
	// timeout, or authzd error). The session fails closed: the agent is never
	// run unscoped when scope review is unavailable.
	ReasonAgentSessionScopeReviewFailed = "ScopeReviewFailed"
	// ReasonAgentSessionColdStartDenied is set on the Failed condition when
	// cold-start scope review COMPLETED and left the session no turn-0 to run:
	// the approver denied the prompt, or the cleaned remainder was empty.
	// Distinct from ReasonAgentSessionScopeReviewFailed, which means review
	// could not complete at all (publish error, timeout, authzd error).
	//
	// Only a DELEGATED child terminalizes on this arm. A session with a person
	// on the other end parks Idle instead (the conversation stays alive for a
	// follow-up) and a kubectl-driven one completes with an empty result;
	// neither ever carries this reason. A delegated child has no person and no
	// exit code, so its refusal has to reach the waiting parent, and this
	// string is what the parent's delegate / reply_to_subagent call reads back
	// out of the SubagentRequest.
	ReasonAgentSessionColdStartDenied = "ColdStartDenied"
	// ReasonAgentSessionToolGuardHalt is set on the Failed condition when a
	// tool-guard rule with action=halt fires (circuit breaker or rate limit).
	ReasonAgentSessionToolGuardHalt = "ToolGuardHalt"
	// ReasonAgentSessionFederatedIdPSecretMissing is set when a synthesized
	// type=federated credential references an IdP-identity Secret that does not
	// exist � fail-closed and loud, never a silent runner hang.
	ReasonAgentSessionFederatedIdPSecretMissing = "FederatedIdPSecretMissing"
	// ReasonAgentSessionContentGuardHalt is set on the Failed condition when a
	// content-inspector plugin is misconfigured at session start (unregistered ID
	// or invalid plugin config). The session fails closed rather than running with
	// a broken content-guard policy.
	ReasonAgentSessionContentGuardHalt = "ContentGuardHalt"
	// ReasonAgentSessionAwaitingDetector is set while one or more content-guard
	// detector pods have been created but have not yet reported a Ready PodIP.
	// Runner-pod creation is held until every detector IP is reflected; this
	// reason makes the wait visible rather than leaving the session in a blank
	// phase (no-silent-hang policy).
	ReasonAgentSessionAwaitingDetector = "AwaitingDetector"
	// ReasonAgentSessionComplete is set on the Succeeded condition when the
	// agent_work_complete tool fires for a kubectl-driven session (no
	// spec.channel). The string deliberately does not match the tool name:
	// monitoring and alerting filter on it, so it is frozen for compatibility.
	ReasonAgentSessionComplete = "AgentComplete"
	// ReasonAgentSessionAwaitingToolApproval is the Reason set on the
	// Working / AwaitingDecision phase transition.
	ReasonAgentSessionAwaitingToolApproval   = "AwaitingToolApproval"
	ReasonAgentSessionAwaitingEntityApproval = "AwaitingEntityApproval"
	// ReasonAgentSessionSkillBundleDigestMismatch is the reason on
	// SkillBundlesIntegrity=False. The digest is the bundle's content identity,
	// so a mismatch is a tamper signal: the skill falls back to
	// instruction-only and the mismatched bytes are never mounted.
	ReasonAgentSessionSkillBundleDigestMismatch = "SkillBundleDigestMismatch"
)

const (
	// ReasonSandboxUnschedulable is the Reason on SandboxScheduling=False.
	ReasonSandboxUnschedulable = "Unschedulable"
	// ReasonSandboxScheduled is the Reason on SandboxScheduling=True.
	ReasonSandboxScheduled = "Scheduled"
)

const (
	ChannelConditionValid     = "Valid"
	ChannelConditionConnected = "Connected"
	// ChannelConditionDeliverable records the outcome of the most recent
	// outbound delivery attempt through this Channel. Owned by channelsd's
	// outbound relay: False (DeliveryFailed) when a Sender's Send errored —
	// the bot evicted from or never invited to its Slack channel, a deleted
	// destination, a revoked token — and True (DeliverySucceeded) as soon as
	// a send lands again. Distinct from Connected, which reports
	// listener/socket health: a Slack channel whose bot token connects fine
	// still cannot deliver into a channel the bot is not a member of, and
	// that fact is observable only at send time. Absent until the first
	// outbound send is attempted; monitored by pkg/controllers/monitoring so
	// a channel that silently swallows agent replies alerts instead of
	// looking healthy.
	ChannelConditionDeliverable = "Deliverable"
	// ChannelConditionScopesValid is True when the runtime credential carries
	// every scope the listener needs. Owned by channelsd's listener, not the
	// operator. On False the message names the exact missing scopes, so an
	// operator can reinstall the app with the right grants without grepping
	// channelsd logs after the first failed message.
	ChannelConditionScopesValid = "ScopesValid"
	// ChannelConditionInformationLeakageReady mirrors the AgentClass-side
	// InformationLeakageReady check from the Channel's perspective. True
	// when this Channel's kind satisfies the capability level required by
	// the bound AgentClass's informationLeakage policy. Set by the channel
	// controller; absent on monitoring-role channels (no AgentClass).
	ChannelConditionInformationLeakageReady = "InformationLeakageReady"

	// ChannelConditionWebhookURLDrift is True when a Channel's inbound
	// webhook, as currently registered with its third-party provider (a
	// GitHub App's hook_attributes.url), no longer matches where this
	// cluster actually serves deliveries
	// (channelevents.WebhookPathFor under the cluster's external base URL).
	// Status=Unknown means the provider could not be reached/read — that is
	// NOT the same fact as "no drift" and is reported distinctly, never
	// folded into False. Set by the channel controller for whichever kind
	// implements channelkinds.WebhookURLDriftChecker (github today);
	// absent for every other kind, and absent when the check has nothing to
	// run against yet (no ExternalBaseURL configured, no credentials
	// Secret).
	//
	// Whether the controller CORRECTS a mismatch, rather than only reporting
	// it, turns on one fact: whether this tool registered the application in
	// the first place, recorded by the provenance marker a wizard stamps on
	// the Channel (channelkinds.AnnotationAppProvisionedBy).
	//
	//   - MARKED — the application is this tool's own. The controller
	//     repoints it to where the cluster now serves and reports the result
	//     here: False/URLRepointed when the write lands, True/RepointFailed,
	//     carrying the provider's error, when it does not.
	//   - UNMARKED — a human registered it. Silently changing an
	//     outward-facing setting on a resource the cluster does not own needs
	//     a human, not an automatic fix, so the mismatch is reported
	//     (True/URLDrifted) and never written back. A human corrects it on
	//     the provider's own settings page; the next reconcile clears the
	//     condition once the registered URL matches again.
	ChannelConditionWebhookURLDrift = "WebhookURLDrift"
)

const (
	ChannelConditionMetaagentChannelMembership = "MetaagentChannelMembership"

	ChannelReasonMetaagentInvited            = "Invited"
	ChannelReasonMetaagentInsufficientScopes = "InsufficientScopes"
	ChannelReasonMetaagentDMNotSupported     = "DMNotSupported"
	ChannelReasonMetaagentAppNotInstalled    = "MetaagentAppNotInstalled"
)

const (
	ReasonChannelAllReferencesResolve    = "AllReferencesResolve"
	ReasonChannelSpecInvalid             = "SpecInvalid"
	ReasonChannelSecretMissing           = "SecretMissing"
	ReasonChannelSecretKeyMissing        = "SecretKeyMissing"
	ReasonChannelAgentClassMissing       = "AgentClassMissing"
	ReasonChannelAgentClassNotValid      = "AgentClassNotValid"
	ReasonChannelAgentIdentityMissing    = "AgentIdentityMissing"
	ReasonChannelSocketAttached          = "SocketAttached"          // set by channelsd on Connected=True
	ReasonChannelSocketDetached          = "SocketDetached"          // set by channelsd on Connected=False
	ReasonChannelDependenciesUnavailable = "DependenciesUnavailable" // memory or SpiceDB unreachable
	ReasonChannelListenerStartFailed     = "ListenerStartFailed"     // set by channelsd when listener.Start fails
	ReasonChannelScopesGranted           = "ScopesGranted"           // set by channelsd on ScopesValid=True
	ReasonChannelMissingScopes           = "MissingScopes"           // set by channelsd on ScopesValid=False; message lists the missing scopes
	ReasonChannelDeliverySucceeded       = "DeliverySucceeded"       // set by channelsd's relay on Deliverable=True
	ReasonChannelDeliveryFailed          = "DeliveryFailed"          // set by channelsd's relay on Deliverable=False; message carries the send error

	// ReasonChannelOutputBindingUnresolvable is set on a role=input Channel
	// whose reply target cannot be resolved: its AgentClass has zero or more
	// than one role=output Channel, or the resolved Channel's kind provides no
	// outbound anchor. Reported at apply time so the misconfiguration does not
	// first surface when the cron fires.
	ReasonChannelOutputBindingUnresolvable = "OutputBindingUnresolvable"

	// ReasonChannelOutputDestinationMissing is set on a role=output Channel
	// bound to an AgentClass whose status.userlessInput is true: the class's
	// input carries no human, so no inbound message supplies a destination and
	// this Channel has to configure its own. It is refused at apply time
	// because the alternative is a Channel that reports Valid=True with nowhere
	// to post: the failure would then wait to surface until the agent finished
	// its work and the reply went nowhere.
	//
	// Distinct from ReasonChannelOutputBindingUnresolvable, which is reported
	// on the role=input Channel about ITS target; this one is reported on the
	// output Channel itself, which is the object a human has to edit.
	ReasonChannelOutputDestinationMissing = "OutputDestinationMissing"

	// WebhookURLDrift reasons. ReasonChannelWebhookURLDrifted is Status=True
	// (a mismatch was found); ReasonChannelWebhookURLMatches is Status=False
	// (registered and expected agree); ReasonChannelWebhookProviderUnreachable
	// is Status=Unknown (the provider could not be reached/read — distinct
	// from both, never conflated with "matches").
	ReasonChannelWebhookURLDrifted          = "URLDrifted"
	ReasonChannelWebhookURLMatches          = "URLMatches"
	ReasonChannelWebhookProviderUnreachable = "ProviderUnreachable"

	// Repoint reasons, set only on a Channel whose application this tool
	// registered. ReasonChannelWebhookURLRepointed is Status=False — the
	// registration now matches because this controller just wrote it, which
	// is a different fact from URLMatches ("it already agreed") and is worth
	// telling apart when reading a Channel's history.
	// ReasonChannelWebhookRepointFailed is Status=True: the write was refused,
	// so deliveries still go somewhere wrong, and the condition's message
	// carries the provider's error.
	ReasonChannelWebhookURLRepointed  = "URLRepointed"
	ReasonChannelWebhookRepointFailed = "RepointFailed"
)

const (
	AgentSessionPhaseIdle     = "Idle"
	AgentSessionConditionIdle = "Idle"
	// AgentSessionConditionAwaitingRetry is True while the runner has
	// exited for a provider error and channelsd is waiting on the user
	// to click Retry. Set by the runner's WriteAwaitingRetry; cleared
	// by the controller on wake (AwaitingRetry � Pending).
	AgentSessionConditionAwaitingRetry = "AwaitingRetry"
	ReasonAgentSessionAwaitingUserMsg  = "AwaitingUserMessage"
	ReasonAgentSessionWakeRequested    = "WakeRequested"
	ReasonAgentSessionAuthzWriteFail   = "AuthzWriteFailed" // SpiceDB write failure on new-session creation

	// AgentSessionConditionStarterAllowed records the start-gate verdict for a
	// class that declares spec.authz.session.allowedStarters. True (reason
	// StarterAllowed) is set ONCE and never re-asked, so an operator restart
	// cannot re-decide a running session; False with NotAnAllowedStarter is
	// the refusal (the session is Failed); False with StartAuthzUnavailable is
	// indeterminate (requeued, never a refusal).
	AgentSessionConditionStarterAllowed     = "StarterAllowed"
	ReasonAgentSessionStarterAllowed        = "StarterAllowed"
	ReasonAgentSessionNotAnAllowedStarter   = "NotAnAllowedStarter"
	ReasonAgentSessionStartAuthzUnavailable = "StartAuthzUnavailable"

	// ReasonAgentSessionRetryBudgetExhausted is set on the AwaitingRetry
	// condition (cleared) and the Failed condition when the runner has hit
	// the maxRetry cap � no more automatic AwaitingRetry cycles are allowed.
	ReasonAgentSessionRetryBudgetExhausted = "RetryBudgetExhausted"
	// ReasonAgentSessionRetryTimeout is set on the Failed condition when the
	// operator's AwaitingRetry TTL elapses without the user clicking Retry.
	ReasonAgentSessionRetryTimeout = "RetryTimeout"
)

const (
	// AgentSessionConditionInteractPolicyApplied is stamped after the
	// AgentClass.spec.sessionInteractPermission snapshot step at session
	// creation. True when the snapshot was captured (or the field was
	// empty); False when the snapshot was captured but the SpiceDB write
	// failed.
	AgentSessionConditionInteractPolicyApplied = "InteractPolicyApplied"
	// AgentSessionConditionPermissionRequestPending is True when
	// len(Status.PendingRequesters) > 0.
	AgentSessionConditionPermissionRequestPending = "PermissionRequestPending"
	// AgentSessionConditionStartApprovalPending is True while a session an
	// org non-member started sits parked awaiting a platform admin's
	// start_approval decision. Written by channelsd alongside the
	// PendingRequesters entry it refers to; the operator reads the sibling
	// annotation (AnnotationStartApprovalRequestRef), not this condition, to
	// withhold the runner.
	AgentSessionConditionStartApprovalPending = "StartApprovalPending"
	// The three *ApprovalPending conditions are channelsd-owned observable
	// surfaces for an outstanding decision of each category. All are written by
	// the generic park handler (registry-driven via
	// channelinteractions.Category.PendingCondition) alongside the
	// PendingInteractions list; none of them derives phase �
	// phase=AwaitingDecision comes from the runner's signed lifecycle
	// projection.
	AgentSessionConditionToolApprovalPending              = "ToolApprovalPending"
	AgentSessionConditionInfoLeakageApprovalPending       = "InfoLeakageApprovalPending"
	AgentSessionConditionContentInspectionApprovalPending = "ContentInspectionApprovalPending"
	// AgentSessionConditionPreconditionWaiverPending is True while a
	// precondition_waiver decision is outstanding: a human is being asked to
	// waive a slot precondition whose CEL predicate over signed facts Refused.
	// Same generic-park-handler machinery and same observable-only status as the
	// three above — approving it binds a slot grant, which IS the waiver, but the
	// phase stays derived from the runner's signed lifecycle projection.
	AgentSessionConditionPreconditionWaiverPending = "PreconditionWaiverPending"
	// AgentSessionConditionPreferenceConfirmPending is True while a user_preference_confirm
	// decision is outstanding: the addressee is being asked to confirm a preference update.
	AgentSessionConditionPreferenceConfirmPending = "PreferenceConfirmPending"
	// AgentSessionConditionScopeReviewPending is True while a cold-start scope_review
	// decision is outstanding and turn-0 execution is blocked. Written by the operator
	// from the folded lifecycle projection; cleared when the decision resolves.
	AgentSessionConditionScopeReviewPending = "ScopeReviewPending"
	// AgentSessionConditionToolCallGated is True when one or more tool calls were
	// denied by a hook (toolguard, revocation, content-guard) but not surfaced to a
	// human approver. The operator writes this from the folded lifecycle projection so
	// the count is readable from CR status without grepping logs (no-silent-errors).
	AgentSessionConditionToolCallGated = "ToolCallGated"

	// ReasonInteractPolicyApplied marks that the AgentSession received
	// the AgentClass snapshot at creation.
	ReasonInteractPolicyApplied = "AppliedFromAgentClass"
	// ReasonInteractPolicyNotConfigured marks that AgentClass had no
	// sessionInteractPermission set.
	ReasonInteractPolicyNotConfigured = "NotConfigured"
	// ReasonInteractPolicySpiceDBWriteFailed marks that the snapshot was
	// captured but the SpiceDB participant write failed.
	ReasonInteractPolicySpiceDBWriteFailed = "SpiceDBWriteFailed"

	// Restart-from-here condition types and reasons. Set by the
	// AgentSession controller's restart reconciler and the toolcall
	// controller's JIT-snapshot path, respectively.
	// AgentSessionConditionSupersededByRestart indicates the session was
	// archived because the user triggered Restart-from-here, producing a
	// child AgentSession (status.supersededBy). The child carries the
	// continuation; this session is read-only.
	AgentSessionConditionSupersededByRestart = "SupersededByRestart"

	// AgentSessionConditionWorkspaceSnapshotFailed indicates a JIT
	// workspace snapshot Job failed. While True, the runner refuses to
	// dispatch further stateImpact={readwrite,external} tool calls � the
	// next would lose the recoverable cut point for fork-at-this-turn.
	AgentSessionConditionWorkspaceSnapshotFailed = "WorkspaceSnapshotFailed"

	// ReasonReplacedByForkedSession is the reason for
	// SupersededByRestart=True. The condition Message names the child.
	ReasonReplacedByForkedSession = "ReplacedByForkedSession"

	// ReasonSnapshotJobFailed is the reason for
	// WorkspaceSnapshotFailed=True. The condition Message names the
	// failed Job and its terminating phase.
	ReasonSnapshotJobFailed = "SnapshotJobFailed"

	// AgentSessionConditionRestartDenied indicates a restart-from-here (fork)
	// was denied by the SessionFork authz gate � the forker is not the session
	// owner. The PendingRestart marker is cleared; no child is created.
	//
	// It reports the CURRENT attempt's verdict, not "a denial happened once":
	// the operator sets it False (ReasonRestartAttemptPending) whenever it
	// picks up a new PendingRestart, so a session whose later continuation
	// succeeds stops reading as denied, and a repeat denial is a genuine
	// False�True transition � which is what lets anything keying off
	// LastTransitionTime see the user's retry at all.
	AgentSessionConditionRestartDenied = "RestartDenied"

	// ReasonForkNotAuthorized is the reason for AgentSessionConditionRestartDenied.
	ReasonForkNotAuthorized = "ForkNotAuthorized"

	// ReasonRestartAttemptPending is the reason for
	// AgentSessionConditionRestartDenied=False: the operator has picked up a new
	// PendingRestart and cleared the previous attempt's verdict before running
	// the fork gate. It is what makes the condition report current state � and
	// what makes a repeat denial a real False�True transition, so consumers that
	// key off LastTransitionTime see the retry.
	ReasonRestartAttemptPending = "RestartAttemptPending"

	// ReasonRestartMarkerUnverified is the reason for RestartDenied=True when
	// status.pendingRestart could not be authenticated as connector-authored:
	// an unregistered signing key, or a digest mismatch. A marker carrying no
	// attestation envelope at all gets RestartMarkerUnsigned instead � that is
	// what a pre-upgrade connector writes, so it must not read as a forgery.
	// Distinct from ForkNotAuthorized, where a KNOWN requester failed the
	// SpiceDB fork check; here the requester on the marker cannot be believed
	// at all.
	ReasonRestartMarkerUnverified = "RestartMarkerUnverified"
)

const (
	AgentSessionConditionStorageReclaimed = "StorageReclaimed"
	ReasonAgentSessionStorageReclaimed    = "RetentionElapsed"
)

const (
	ReasonAgentSessionAgentWorkComplete = "AgentWorkComplete" // agent_work_complete tool was called
	ReasonAgentSessionArchived          = "Archived"          // operator archive sweep transitioned Idle � Succeeded
)

const (
	AnnotationWakeRequestedAt = "agentprimitives.authzed.com/wake-requested-at"

	// AnnotationUIServeRequestedAt asks the operator to spawn a SERVE-ONLY
	// runner: one that answers a browser's agent-UI requests and runs no agent
	// loop. Written by webd when a data binding finds no runner subscribed.
	//
	// A SECOND key rather than a second meaning for the one above, and the
	// distinction is the point: AnnotationWakeRequestedAt resumes the
	// CONVERSATION, so the runner it spawns replays memory, claims the live
	// region and takes an LLM turn. Reusing it made a dashboard load put
	// content in the agent's context that no human asked for, and on a live
	// cluster left the session Failed. A pod spawned via THIS key must not move
	// phase or write a terminal status; internal/cmd/runner enforces that structurally
	// by never calling Loop.Run, the sole writer of both.
	//
	// Both keys carry an RFC3339Nano timestamp the reconciler compares against
	// what it has already acted on, so re-stamping while a spawn is in flight
	// coalesces rather than duplicating.
	AnnotationUIServeRequestedAt = "agentprimitives.authzed.com/ui-serve-requested-at"

	// AnnotationSidecarFailureReported carries, as a JSON object, the
	// sidecar-name � failure-fingerprint map the runner has already reported to
	// the user � the durable half of its once-per-failure contract, since a
	// process-local record alone re-reports the same failure on every restart.
	// Written by the runner, which already patches session annotations, and
	// deliberately not status: status here is the operator's observation of the
	// pods.
	//
	// It lives beside AnnotationWakeRequestedAt because those two are the whole
	// of what a session runner may write on the main resource �
	// pkg/controllers/webhooks/agentsession's runnerWritableAnnotations refuses
	// every other key. internal/cmd/runner still defines its own copy
	// (sidecarFailureReportedAnnotation); it should be collapsed onto this one.
	AnnotationSidecarFailureReported = "agentprimitives.authzed.com/sidecar-failure-reported"

	// AnnotationAwaitingRetrySince records when the operator first observed
	// the session in phase=AwaitingRetry. Used by the retry-TTL mechanism:
	// the operator stamps this once on entry and requeueAfter the remainder;
	// when the TTL elapses the operator emits RetryTTLExpired � Failed[RetryTimeout].
	// Cleared when the session wakes (RetryRequested � Pending).
	AnnotationAwaitingRetrySince = "agentprimitives.authzed.com/awaiting-retry-since"

	// AnnotationStartedByExternalID records the kind-specific external identity
	// (a Slack user_id, say) of the inbound that created the AgentSession.
	// Stamped and consumed by the channelsd pipeline as a fast-path "same
	// external user" check, bypassing the canonical_id round-trip � which is
	// fragile when upstream identity resolution flickers across inbounds and
	// yields different canonical_ids for the same human.
	AnnotationStartedByExternalID = "agentprimitives.authzed.com/started-by-external-id"

	// AnnotationStartedByEmail records the VERIFIED email of the human who
	// originally created the AgentSession, when the originating channel kind
	// vouches for one (webchat/idp always; Slack when a users.info lookup
	// resolved it) � the same email fed into identity.FromExternal(...).Email
	// when the session's started-by canonical was computed (see
	// AnnotationStartedByCanonicalID). Stamped alongside
	// AnnotationStartedByExternalID at session-creation time.
	//
	// Consumed by IdentityChoiceGate.requester() so the ask|dynamic prompt's
	// Audience.Requester carries the SAME verified email the deciding click's
	// payload does; both sides then canonicalize to the identical SpiceDB
	// subject. Without it, Canonical() rejects the email-less requester with
	// ErrSyntheticSubject and DecideRequester fails every decision closed.
	//
	// Empty when the channel kind has no verified email for the starter
	// (kubectl-driven sessions, or a channel-native id with no email lookup).
	// The gate's requester then has no Email either and fails closed like any
	// guest identity � intended: such an initiator cannot decide their own
	// identity_choice prompt, just as they could never pass through as
	// themselves.
	AnnotationStartedByEmail = "agentprimitives.authzed.com/started-by-email"

	// AnnotationBackfilledFromTS records the kind-opaque cursor of the
	// OLDEST message seeded into memory at thread adoption. The
	// read_thread_history tool defaults its BeforeTS to this value so
	// the agent pages strictly older than what is already in memory.
	AnnotationBackfilledFromTS = "agentprimitives.authzed.com/backfilled-from-ts"

	// AnnotationBackfilledThroughTS records the kind-opaque cursor of the
	// NEWEST message seeded into memory. The pipeline advances it on
	// every catch-up so the next catch-up only seeds messages newer
	// than this.
	AnnotationBackfilledThroughTS = "agentprimitives.authzed.com/backfilled-through-ts"
)

const (
	LabelChannelName = "channel.agentprimitives.authzed.com/name"
	LabelChannelKind = "channel.agentprimitives.authzed.com/kind"
	LabelChannelKey  = "channel.agentprimitives.authzed.com/key" // sha256-hex of channelKey

	// LabelOutputChannelKey is the sha256 of the session's
	// spec.outputChannel.Key, patched by channelsd's outbound relay once a
	// cron-spawned session's thread anchor is captured on the first send. The
	// pipeline's session lookup matches it as a union alongside
	// LabelChannelKey, so an inbound reply to a cron-spawned thread resolves
	// the right AgentSession.
	LabelOutputChannelKey = "channel.agentprimitives.authzed.com/output-key"
)

const (
	ReasonPinDrifted      = "PinDrifted"      // live identity != baseline
	ReasonPinMatch        = "PinMatch"        // live identity == baseline
	ReasonPinVerifyFailed = "PinVerifyFailed" // could not compute live identity
)

const (
	ReasonMCPServerAllowlistResolved      = "AllowlistResolved"
	ReasonMCPServerProbeOK                = "ProbeOK"
	ReasonMCPServerProbeFailed            = "ProbeFailed"
	ReasonMCPServerAllowlistDrift         = "AllowlistDrift"
	ReasonMCPServerConstraintCompileError = "ConstraintCompileError"
	ReasonMCPServerAuthResolutionFailed   = "AuthResolutionFailed"
	// ReasonMCPServerSpicedbSchemaMissing fires when one or more
	// `tools[*].permission.check.resourceType` or
	// `tools[*].permissionVariants[*].check.resourceType` references a
	// resource that is not declared in this MCPServer's
	// `spec.spiceDBSchema.resources[*].name` (the implicit `user` type
	// is always allowed). The condition message lists every offending
	// reference so operators can fix the spec without source-diving.
	ReasonMCPServerSpicedbSchemaMissing = "SpicedbSchemaMissing"

	// ReasonMCPServerWildcardLeafNotRouted is the converse of
	// ReasonMCPServerRouteViaSessionGrantMissingLeaf, and the fail-OPEN
	// half of the same invariant: a tool's Permission.Check targets a
	// permission that a `wildcard: true` relation can satisfy, but the
	// check does NOT set routeViaSessionGrant. The direct
	// `<resourceType>:<id>#<permission>@user:<subject>` check then
	// succeeds for every user, so the gate never denies and the approval
	// flow it exists to trigger never fires � silently. The condition
	// message names each offending (tool spec path, resourceType,
	// permission, wildcard relation) and both ways to resolve it.
	ReasonMCPServerWildcardLeafNotRouted = "WildcardLeafNotRouted"

	// ReasonMCPServerAuthCredentialMissing fires when spec.auth.provider is
	// set but spec.auth.credential is empty. Credential names must be
	// declared explicitly � there is no metadata.name fallback � so both
	// setup-identity and the runner descriptor agree on what credential to
	// look up. The condition message names the missing field.
	ReasonMCPServerAuthCredentialMissing = "AuthCredentialMissing"

	// ReasonMCPServerLabelsCompileError fires when a tool's `labels` block has
	// a malformed CEL expression (when / forEach / label.*). The condition
	// message lists each offending (tool, block-index, field, err) tuple so
	// authors can fix the spec without source-diving.
	ReasonMCPServerLabelsCompileError = "LabelsCompileError"

	// ReasonMCPServerRelationshipsCompileError fires when a tool's
	// `writesRelationships` block has a malformed CEL expression (when /
	// forEach / tuple.resource / tuple.relation / tuple.subject). The message
	// names the offending (tool, block-index, field, err) so authors can fix
	// the spec without source-diving.
	//
	// Validation compiles through the SAME relwrites env that executes these
	// expressions, so "validated" and "will run" cannot drift. Compiling them
	// first at dispatch time instead would let a server carrying an
	// uncompilable expression report Valid=True and fail mid-turn, as an error
	// the agent cannot act on.
	ReasonMCPServerRelationshipsCompileError = "RelationshipsCompileError"
)

const (
	ReasonAgentSessionMCPServerMissing          = "MCPServerMissing"
	ReasonAgentSessionMCPServerInvalid          = "MCPServerInvalid"
	ReasonAgentSessionMCPAuthResolutionFailed   = "MCPAuthResolutionFailed"
	ReasonAgentSessionMCPServerUnreachable      = "MCPServerUnreachable"
	ReasonAgentSessionMCPAllowlistDrift         = "MCPAllowlistDrift"
	ReasonAgentSessionMCPConstraintCompileError = "MCPConstraintCompileError"
)

const (
	ReasonAgentClassMCPServerMissing = "AgentClassMCPServerMissing"
	ReasonAgentClassMCPServerInvalid = "AgentClassMCPServerInvalid"
	// ReasonAgentClassSkillMissing fires when the AgentClass opts into a
	// skill (spec.skills, a canonical name) for which no Skill or
	// ClusterSkill has materialized yet � so the class is parked
	// (Valid=False) rather than silently dropping the skill at session
	// start. ReasonAgentClassSkillInvalid fires when such a Skill exists
	// but is not itself Valid=True (e.g. its SKILL.md was rejected).
	ReasonAgentClassSkillMissing = "AgentClassSkillMissing"
	ReasonAgentClassSkillInvalid = "AgentClassSkillInvalid"
	// ReasonAgentClassSpicedbSchemaConflict fires when two or more
	// MCPServers referenced by the AgentClass declare the same SpiceDB
	// resource (by name) with non-identical definitions � the
	// guardian/schema composer cannot merge them into a single coherent
	// SpiceDB schema. The condition message names the conflicting
	// resource(s). The cross-MCPServer mirror of
	// ReasonMCPServerSpicedbSchemaMissing's intra-fragment check.
	ReasonAgentClassSpicedbSchemaConflict = "SpicedbSchemaConflict"

	// ReasonAgentClassSlotAutofillUnfillable marks a slot whose autoFillArgs
	// target a sandbox tool. Auto-fill writes a NAMED argument; a sandbox tool
	// takes argv, so the value would be ignored by both the tool and its
	// permission check � silently. Declaring autoFillArgs is an opt-in, and an
	// opt-in that cannot be honoured makes the class not-ready rather than
	// quietly binding nothing.
	ReasonAgentClassSlotAutofillUnfillable = "SlotAutofillUnfillable"
)

const (
	ReasonArtifactRenderRendered        = "Rendered"
	ReasonArtifactRenderRendererUnknown = "RendererUnknown"
	ReasonArtifactRenderPayloadTooLarge = "PayloadTooLarge"
	ReasonArtifactRenderRendererError   = "RendererError"
	ReasonArtifactRenderOutputTooLarge  = "OutputTooLarge"
	ReasonArtifactRenderTimeout         = "Timeout"
	ReasonArtifactRenderInternalError   = "InternalError"
	// ReasonArtifactRenderMalformedInput: the payload was structurally broken
	// before rendering (e.g. truncated mid-tag, or fully HTML-entity-encoded so
	// it would render as literal source). Distinct from RendererError so a bad
	// input is greppable separately from an internal renderer fault.
	ReasonArtifactRenderMalformedInput = "MalformedInput"
)

const (
	IdentityModeAgent           = "agent"
	IdentityModeUserPassthrough = "userPassthrough"
	IdentityModeAsk             = "ask"     // interactive: ask the initiating user
	IdentityModeDynamic         = "dynamic" // interactive: LLM recommends, user confirms
)

const (
	ReasonAgentSessionStartDenied          = "StartDenied"
	ReasonAgentSessionStartApprovalTimeout = "StartApprovalTimeout"
)

const (
	AgentSessionConditionCredentialsReady = "CredentialsReady"

	ReasonAwaitingUserCredentials = "AwaitingUserCredentials"
	ReasonCredentialLinkTimeout   = "CredentialLinkTimeout"
	ReasonUserIdentityResolved    = "UserIdentityResolved"
	ReasonNotPassthrough          = "NotPassthroughClass"
	ReasonMissingStarterSubject   = "MissingStarterSubject"

	ReasonIdentityChoiceTimeout   = "IdentityChoiceTimeout"
	ReasonIdentityChoiceCancelled = "IdentityChoiceCancelled"
	// ReasonIdentityChoiceFailed is the terminal Failed reason for an
	// identityMode=ask|dynamic session whose choice gate failed CLOSED for a
	// reason other than cancel or timeout: the interactive choice path was
	// unavailable (no channel), the choice envelope failed to build, the await
	// transport errored, or the channel returned an unknown action. Distinct from
	// ScopeReviewFailed � an identity halt is never mislabelled as a scope-review
	// failure. Cancel/timeout use their own reasons above so the runner's terminal
	// write agrees with the gate's IdentityChoiceCancelled fold and the operator's
	// IdentityChoiceTimeout backstop.
	ReasonIdentityChoiceFailed = "IdentityChoiceFailed"
)

const (
	UserIdentityConditionValid   = "Valid"
	UserIdentityConditionRefresh = "Refresh"
)

const (
	SessionUserIdentityConditionReady = "Ready"

	ReasonSessionUserIdentityResolved = "AllCredentialsBound"
	ReasonSessionUserIdentityMissing  = "CredentialsMissing"
)

const (
	WebdTrustedURLKey = "trusted-url"
	WebdSandboxURLKey = "sandbox-url"
)

const (
	ReasonAgentClassSidecarToolboxMissing = "AgentClassSidecarToolboxMissing"
	ReasonAgentClassSidecarToolboxInvalid = "AgentClassSidecarToolboxInvalid"
)

const (
	ReasonSidecarToolboxSpecOK                 = "SpecOK"
	ReasonSidecarToolboxClassMissing           = "ClassMissing"
	ReasonSidecarToolboxClassInvalid           = "ClassInvalid"
	ReasonSidecarToolboxProviderMissing        = "ProviderMissing"
	ReasonSidecarToolboxConstraintCompileError = "ConstraintCompileError"
	ReasonSidecarToolboxSourceInvalid          = "SourceInvalid"
	ReasonSidecarToolboxProbeFailed            = "ProbeFailed"
	ReasonSidecarToolboxAllowlistDrift         = "AllowlistDrift"
	ReasonSidecarToolboxProbeOK                = "ProbeOK"
	// ReasonSidecarToolboxDeferredToSession is set on Reachable=Unknown for
	// secret-gated (separate-pod) sidecars, which the operator does NOT probe at
	// admission time: the real sidecar exists only per-session, once its gating
	// secret is delivered, and runs in a namespace the operator's egress is
	// deliberately locked out of. The runner probes the live pod instead and the
	// result lands on AgentSession.status.resolvedSidecarToolboxes[]. NOT a
	// failure � the admin UI renders it as "Deferred", not red/ProbeFailed.
	ReasonSidecarToolboxDeferredToSession = "DeferredToSession"
	// ReasonSidecarToolboxDeletionBlocked is set when deletion is blocked
	// because one or more AgentClasses still reference this SidecarToolbox.
	// Operators must remove the reference from each AgentClass before the
	// finalizer can be released.
	ReasonSidecarToolboxDeletionBlocked = "DeletionBlocked"
)

const (
	ReasonAgentSessionSidecarToolboxMissing = "SidecarToolboxMissing"
	ReasonAgentSessionSidecarToolboxInvalid = "SidecarToolboxInvalid"
	ReasonAgentSessionSidecarBootFailed     = "SidecarBootFailed"
	// ReasonAgentSessionImagePinDrifted is set on AgentSessionConditionSettingsAccepted
	// (False) when a SidecarToolbox's image has drifted from its baseline digest
	// and the cluster/namespace pinning policy mode is "block". The session is
	// held in Pending until the operator updates or re-freezes the toolbox.
	ReasonAgentSessionImagePinDrifted = "ImagePinDrifted"
)

const (
	// SkillConditionValid is True when the skill's canonical name + frontmatter
	// + body pass validation. The admission webhook hard-denies invalid specs;
	// this condition is the controller-set mirror for already-stored objects.
	SkillConditionValid = "Valid"
	// SkillConditionPinned is advisory: True for frozen/named refs, False (with
	// ReasonSkillUnpinnedRolling) for an unpinned, rolling skill.
	SkillConditionPinned = "Pinned"
)

const (
	ReasonSkillValid           = "Valid"
	ReasonSkillInvalidSpec     = "InvalidSpec"
	ReasonSkillPinFrozen       = "Frozen"
	ReasonSkillPinNamed        = "NamedRef"
	ReasonSkillUnpinnedRolling = "UnpinnedRolling"
)

const (
	ReasonSkillSourceSynced            = "Synced"
	ReasonSkillSourceAuthResolveFailed = "AuthResolutionFailed"
	ReasonSkillSourceFetchFailed       = "FetchFailed"
	ReasonSkillSourceDiscoverFailed    = "DiscoverFailed"
	ReasonSkillSourceMaterializeFailed = "MaterializeFailed"
	// ReasonSkillSourceNoSkillsDiscovered is set when the fetch itself
	// succeeded but the pass materialized no skill at all — the tree held no
	// SKILL.md under spec.subpath, or every one it held was rejected. Ready is
	// False because a source that yields nothing satisfies no AgentClass
	// opting into it, and Synced would render it identically to a source that
	// yielded everything.
	ReasonSkillSourceNoSkillsDiscovered = "NoSkillsDiscovered"
)

const (
	ReasonToolchainValid         = "Valid"
	ReasonToolchainInvalidSpec   = "InvalidSpec"
	ReasonToolchainUnknownKind   = "UnknownSourceKind"
	ReasonToolchainInvalidSource = "InvalidSource"
)

const (
	ReasonToolchainMissing    = "ToolchainMissing"
	ReasonToolchainNotValid   = "ToolchainNotValid"
	ReasonToolchainResolveErr = "ToolchainResolveError"
)

const (
	ReasonWorkspaceSourceSpecOK            = "SpecOK"
	ReasonWorkspaceSourceSpecInvalid       = "SpecInvalid"
	ReasonWorkspaceSourceUnknownKind       = "UnknownDriverKind"
	ReasonWorkspaceSourceBaseUnconfigured  = "BaseStorageUnconfigured"
	ReasonWorkspaceSourceMaterializing     = "Materializing"
	ReasonWorkspaceSourceMaterialized      = "Materialized"
	ReasonWorkspaceSourceMaterializeFailed = "MaterializeFailed"
	// ReasonWorkspaceSourceRefreshing marks the Ready condition while a
	// scheduled base-refresh Job (spec.base.refresh) is in progress. The base
	// stays Ready=True/Refreshing rather than flipping unusable � the prior
	// checkout is still valid while the refresh Job runs.
	ReasonWorkspaceSourceRefreshing = "Refreshing"
	// ReasonWorkspaceSourceSpecChanged fires when the materialize Job already
	// succeeded for an older generation of the spec. The base checkout is
	// materialized exactly once (by stable Job name) and a spec edit does not
	// re-materialize it, so the controller reports the divergence honestly
	// instead of latching Ready=True for a generation it never materialized.
	ReasonWorkspaceSourceSpecChanged = "SpecChanged"
)

const (
	ReasonAgentClassWorkspaceSourceMissing     = "WorkspaceSourceMissing"
	ReasonAgentClassWorkspaceSourceInvalid     = "WorkspaceSourceInvalid"
	ReasonAgentSessionWorkspaceSourceNotReady  = "WorkspaceSourceNotReady"
	ReasonAgentSessionWorkspaceOverlayFailed   = "WorkspaceOverlayFailed"
	ReasonAgentSessionWorkspaceStorageRequired = "WorkspaceStorageRequired"
)

const (
	ReasonAgentClassAgentUIMissing = "AgentUIMissing"
	ReasonAgentClassAgentUIInvalid = "AgentUIInvalid"
)

const (
	// ReasonAgentUISpecOK marks the page — spec.view, or spec.slots compiled
	// — as having parsed and validated cleanly against the platform
	// vocabulary.
	ReasonAgentUISpecOK = "SpecOK"
	// ReasonAgentUIInvalidDefault marks a page — spec.view, or spec.slots
	// compiled — that failed either the strict wire parse (an unknown
	// structural key) or vocabulary validation (an unknown/duplicate/missing
	// hook name, an unknown component, an out-of-bounds tree, or a binding to
	// a tool outside the eligible-tools ceiling). The condition message
	// carries the *uicomponents.ValidationError's real Path and Reason, so the
	// failure is diagnosable without source-diving. A default that fails its
	// own parse is attributed to the CR's real index ("slots[1]"); everything
	// caught after compilation is attributed to the compiled tree
	// ("view.children[1]…"), which is where the node actually sits on the page
	// the runner serves.
	ReasonAgentUIInvalidDefault = "InvalidDefault"
	// ReasonAgentUIGrantUnresolved marks Valid=Unknown when the AgentClasses
	// in this namespace could not be listed to compute the deployment half
	// of the eligible-tools ceiling. Deliberately Unknown, not False: this
	// status is not itself an authorization decision, so persisting a
	// denial derived from an input this reconcile failed to read would be a
	// false diagnosis, not a safe default. status.eligibleTools is left
	// untouched (the last successfully-observed ceiling) rather than reset.
	ReasonAgentUIGrantUnresolved = "GrantUnresolved"
	// ReasonAgentUIActionToolNotRequested is the Valid=False reason for an
	// action naming a tool the UI never requested. Distinct from
	// ReasonAgentUIInvalidDefault because the fix is a different field
	// (spec.tools) than the declaration the author is looking at.
	ReasonAgentUIActionToolNotRequested = "ActionToolNotRequested"
)

const (
	// ReasonAgentUIToolsFullyGranted marks ToolsGranted=True: every
	// (deduplicated) tool in spec.tools made the eligible-tools ceiling.
	ReasonAgentUIToolsFullyGranted = "AllGranted"
	// ReasonAgentUIToolsPartiallyGranted marks ToolsGranted=False: at least
	// one requested tool did not make the ceiling. The condition message
	// carries uigrant.ExplainCeiling's per-tool diagnosis.
	ReasonAgentUIToolsPartiallyGranted = "PartiallyGranted"
)

const (
	WorkshopConditionNamespaceReady = "NamespaceReady"
	WorkshopConditionRBACReady      = "RBACReady"
	WorkshopConditionTupleWritten   = "TupleWritten"
	WorkshopConditionTokensReady    = "TokensReady"

	ReasonWorkshopProvisioned     = "Provisioned"
	ReasonWorkshopProvisionFailed = "ProvisionFailed"
	ReasonWorkshopExpired         = "Expired"
	// ReasonWorkshopSessionFinished marks the workshop released because its
	// builder session reached a terminal phase (and any install it requested
	// was decided) — the standing reason for a teardown nobody asked for, the
	// way ReasonWorkshopExpired is for the max-age sweeper.
	ReasonWorkshopSessionFinished = "SessionFinished"
)

const (
	WorkshopProbePhasePending   = "Pending"
	WorkshopProbePhaseRunning   = "Running"
	WorkshopProbePhaseSucceeded = "Succeeded"
	WorkshopProbePhaseFailed    = "Failed"

	WorkshopProbeConditionProbed = "Probed"

	ReasonWorkshopProbeSucceeded = "ProbeSucceeded"
	ReasonWorkshopProbeFailed    = "ProbeFailed"
	ReasonWorkshopProbeDenied    = "ProbeDenied" // tuple absent
)

const (
	ReasonBuilderClassInvalid = "BuilderClassInvalid"
	// ReasonReferencesWorkshopTool marks a NON-workshop class that references
	// a workshop-labeled cluster-scoped toolspec/toolkit.
	ReasonReferencesWorkshopTool = "ReferencesWorkshopTool"
)

const (
	// RelationshipSourceConditionReady is True when the last pass enumerated
	// (fully or partially) and synced without a fatal error. Mirrors
	// SkillSourceConditionReady's single-condition shape; see the CRD's own
	// "Ready" printcolumn.
	RelationshipSourceConditionReady = "Ready"
	// RelationshipSourceConditionPartialFailure is True when the last
	// COMPLETED pass finished with per-scope errors, and False when that pass
	// finished clean. It is the second half of a two-condition split that
	// exists because Ready alone could not express partial success.
	//
	// Ready keeps its meaning exactly: a pass that enumerated and synced
	// without a fatal error is Ready=True/Synced, and per-scope failures stay
	// non-fatal (relsync.Pass's own doc: "one scope failing is not a pass
	// failure"). That is correct, and it is also why a whole arm of a sync can
	// fail invisibly — a GitHub source whose every per-repository team fetch
	// answered 403 reported Ready=True, Synced, scopesProcessed: 156, with the
	// 403s reaching only the operator log. Nothing downstream could tell
	// partial success from success. This condition is that missing signal:
	// True here and Ready=True together mean "ran, and some of it failed".
	//
	// It is set on the SAME status write status.sync.lastPass's counts ride,
	// from the same PassResult, so the condition and the counts can never
	// disagree. A pass that never completed (a fatal error, a total
	// enumeration failure, a parked source) leaves it untouched: it describes
	// the last pass that actually finished, and inventing a verdict for a pass
	// that did not run would be a false diagnosis. Ready=False is the signal
	// for those.
	RelationshipSourceConditionPartialFailure = "PartialFailure"
)

const (
	// ReasonRelationshipSourceSynced marks Ready=True after a pass completed
	// (fully or partially resumed) with no fatal error. Per-scope failures
	// (PassResult.ScopeErrors) are logged, not fatal — see relsync.Pass's own
	// doc on "one scope failing is not a pass failure". Whether this pass had
	// any is reported by RelationshipSourceConditionPartialFailure, not here.
	ReasonRelationshipSourceSynced = "Synced"
	// ReasonRelationshipSourceScopeErrors marks PartialFailure=True: the last
	// completed pass reported at least one PassResult.ScopeError. The
	// condition message carries the failure count and one sampled error; the
	// bounded sample set is on status.sync.lastPass.scopeErrorSamples.
	ReasonRelationshipSourceScopeErrors = "ScopeErrors"
	// ReasonRelationshipSourceAllScopesSynced marks PartialFailure=False: the
	// last completed pass reported no scope errors at all.
	ReasonRelationshipSourceAllScopesSynced = "AllScopesSynced"
	// ReasonRelationshipSourceKindUnregistered marks Ready=False when
	// spec.kind names no relsync.Kind registered in this binary.
	ReasonRelationshipSourceKindUnregistered = "KindUnregistered"
	// ReasonRelationshipSourceKindClaimed marks Ready=False when another
	// RelationshipSource already claims spec.kind — see the package doc on
	// why two CRs of the same kind must never both sync (the reap-vs-reap
	// annihilation case).
	ReasonRelationshipSourceKindClaimed = "KindClaimed"
	// ReasonRelationshipSourceAuthResolveFailed marks Ready=False when
	// spec.auth's AgentIdentity/credential/Secret cannot be resolved.
	ReasonRelationshipSourceAuthResolveFailed = "AuthResolutionFailed"
	// ReasonRelationshipSourcePassFailed marks Ready=False if relsync.Pass
	// itself ever returns a non-nil error — defensive, not reachable in the
	// current implementation. relsync.Pass's own doc says its error return
	// is reserved for a failure the algorithm cannot even attempt to
	// recover from, and today it always returns nil: every anticipated
	// failure (enumeration, a scope's fetch/write, the reap scan) folds
	// into PassResult.ScopeErrors instead — see
	// ReasonRelationshipSourceEnumerationFailed below for the "enumeration
	// produced nothing" case that reason exists to catch. Kept as the
	// defensive branch it is, not because it fires today.
	ReasonRelationshipSourcePassFailed = "PassFailed"
	// ReasonRelationshipSourceEnumerationFailed marks Ready=False when a pass
	// enumerated NOTHING and processed NOTHING — EnumComplete=false with zero
	// scopes visited. "One scope failing is not a pass failure" (Synced,
	// above) does not extend to a total enumeration failure (a revoked
	// token, missing_scope, a network outage): that pass wrote nothing, and
	// without this reason it folds into ScopeErrors while Ready still reads
	// True/Synced, so `kubectl get relationshipsources` shows a healthy
	// source that has never written a tuple. A pass that visited at least
	// one scope (a budget-truncated but otherwise productive cycle) still
	// reports Synced — see PassResult.Processed.
	ReasonRelationshipSourceEnumerationFailed = "EnumerationFailed"
)

const (
	// IdentityKindAgentIdentity is the AGENT's own shared credential.
	IdentityKindAgentIdentity = "AgentIdentity"
	// IdentityKindUserIdentity is a person's standing credential.
	IdentityKindUserIdentity = "UserIdentity"
	// IdentityKindSessionUserIdentity is the per-session projection of a
	// UserIdentity — same ownership (a person's), different CR.
	IdentityKindSessionUserIdentity = "SessionUserIdentity"
)

const (
	CredentialUpdateRequestPhasePending   = "Pending"
	CredentialUpdateRequestPhaseOpen      = "Open"
	CredentialUpdateRequestPhaseFulfilled = "Fulfilled"
	CredentialUpdateRequestPhaseRefused   = "Refused"
	CredentialUpdateRequestPhaseExpired   = "Expired"

	// CredentialUpdateRequestPhaseCollapsed is a request that resolved to a
	// credential another request already holds a live card for. It is
	// deliberately neither of the two phases anything downstream acts on:
	//
	//   - NOT Open, and Open is the ONLY phase channelsd's
	//     CredentialUpdateWatcher publishes on, so "no second card" is
	//     structural here rather than a second check bolted onto the publisher.
	//   - NOT terminal (IsCredentialUpdateRequestTerminal), so the blocked
	//     agent's request_credential_update call keeps waiting instead of
	//     being told its ask was settled when nothing has been decided yet.
	//
	// It is a named phase rather than leaving the request in Pending so that
	// `kubectl get credupdate` answers "why has nothing happened for my
	// session" directly, next to status.collapsedInto naming what it waits on.
	CredentialUpdateRequestPhaseCollapsed = "Collapsed"
)

const (
	// Opened a card.
	CredentialUpdateDeterminationRejectedVerified    = "RejectedVerified"
	CredentialUpdateDeterminationRejectedRefreshDead = "RejectedRefreshDead"
	// RejectedUnverified: opened on the platform's own observed auth failures
	// when the provider could not be reached to confirm.
	CredentialUpdateDeterminationRejectedUnverified = "RejectedUnverified"
	// Refused.
	CredentialUpdateDeterminationCredentialLive  = "CredentialLive"
	CredentialUpdateDeterminationUnverified      = "Unverified"
	CredentialUpdateDeterminationNotUpdatable    = "NotUpdatable"
	CredentialUpdateDeterminationSelfHealed      = "SelfHealed"
	CredentialUpdateDeterminationNoCredential    = "NoCredential"
	CredentialUpdateDeterminationAmbiguousCred   = "AmbiguousCredential"
	CredentialUpdateDeterminationBudgetExhausted = "BudgetExhausted"
	// CredentialUpdateDeterminationCollapsed is neither an open nor a refusal,
	// which is why it sits in its own group: nothing was asked of a human for
	// THIS request, and nothing was denied to the agent either. The identical
	// credential already has a card in front of a human, and this request is
	// waiting on that one. See CredentialUpdateRequestPhaseCollapsed.
	CredentialUpdateDeterminationCollapsed = "Collapsed"
)

const (
	StandingSessionOnly = "session-only"
	StandingRequired    = "required"
)

const (
	MCPServerConditionValid     = "Valid"
	MCPServerConditionReachable = "Reachable"
	// MCPServerConditionSpiceDBSchemaValid is guardian-owned, NOT the mcpserver
	// controller that owns Valid/Reachable above. False means this MCPServer's
	// fragment was excluded from the cluster-wide schema compose, either as
	// FragmentInvalid (bad on its own — a RawZed syntax error, a reserved
	// scaffold definition redeclared, an internal conflict) or FragmentConflict
	// (valid alone, but colliding with an already-accepted fragment; earlier
	// namespace/name wins and the later is marked here).
	//
	// Isolating the failure here rather than freezing the compose pass is what
	// stops one tenant's bad or hostile MCPServer from taking down
	// SchemaIncluded for every AgentSessionGrants in the cluster.
	MCPServerConditionSpiceDBSchemaValid = "SpiceDBSchemaValid"
)

const (
	PinModeBlock   = "block"
	PinModeApprove = "approve"
	PinModeWarn    = "warn"
	PinModeOff     = "off"
)

const (
	PublicEndpointPhasePending = "Pending"
	PublicEndpointPhaseReady   = "Ready"
	PublicEndpointPhaseFailed  = "Failed"
)

const (
	// ReasonPublicEndpointTunnelOpen — the tunnel is open and status.url is live.
	ReasonPublicEndpointTunnelOpen = "TunnelOpen"
	// ReasonPublicEndpointTunnelOpening — a concurrent reconcile of this same
	// endpoint is inside the provider's Start. This one declined to open a
	// second provider session and will re-check shortly.
	ReasonPublicEndpointTunnelOpening = "TunnelOpening"
	// ReasonPublicEndpointAuthTokenMissing — spec.authTokenRef does not resolve
	// to a non-empty Secret key. A prerequisite that has not arrived yet rather
	// than a failure, so the phase is Pending and the controller re-checks.
	ReasonPublicEndpointAuthTokenMissing = "AuthTokenSecretMissing"
	// ReasonPublicEndpointProviderUnknown — spec.provider names no registered
	// tunnel provider. Permanent until the spec is edited, so the phase is
	// Failed and the controller does not requeue.
	ReasonPublicEndpointProviderUnknown = "UnknownProvider"
	// ReasonPublicEndpointTunnelFailed — the provider refused to open the
	// tunnel (bad token, provider outage, session limit reached).
	ReasonPublicEndpointTunnelFailed = "TunnelStartFailed"
	// ReasonPublicEndpointLocalURLMissing — spec.localURL is empty. The CRD
	// marks the field required, so this is reachable only for a CR created
	// against an earlier version of the schema; refused rather than defaulted,
	// because a guessed local address 404s webd for every route.
	ReasonPublicEndpointLocalURLMissing = "LocalURLMissing"
	// ReasonPublicEndpointClusterKindRefusesTunnels — this cluster kind's
	// PublicEndpointPolicy is Never. Durable clusters have real ingress and
	// webd's external URL already names a genuine host; opening a tunnel would
	// overwrite it. Refused rather than quietly ignored so the CR says why.
	ReasonPublicEndpointClusterKindRefusesTunnels = "ClusterKindRefusesTunnels"
	// ReasonPublicEndpointReservedDomainUnsupported — spec.reservedDomain is
	// set but no registered provider honors it yet. Refused fail-closed rather
	// than accepted-and-ignored: silently handing back a per-session URL that
	// changes on every restart would leave the operator believing a promise
	// the system is not keeping.
	ReasonPublicEndpointReservedDomainUnsupported = "ReservedDomainUnsupported"
)

const (
	SessionHoldPhaseActive   = "Active"
	SessionHoldPhaseReleased = "Released"
)

const (
	ClusterAgentSettingsName = "cluster"
	AgentSettingsName        = "default"
)

const (
	SidecarToolboxConditionValid     = "Valid"
	SidecarToolboxConditionReachable = "Reachable"
	// SidecarToolboxConditionSpiceDBSchemaValid is the guardian-owned condition
	// reporting whether this toolbox's spec.spicedbSchema fragment was accepted
	// into the cluster-wide compose. False (with FragmentInvalid/FragmentConflict)
	// means the fragment was excluded so ONE bad or hostile toolbox cannot freeze
	// schema convergence for every session — the same isolation MCPServer gets.
	SidecarToolboxConditionSpiceDBSchemaValid = "SpiceDBSchemaValid"
)

const (
	SidecarToolboxReasonFragmentInvalid  = "FragmentInvalid"
	SidecarToolboxReasonFragmentConflict = "FragmentConflict"
	SidecarToolboxReasonFragmentValid    = "FragmentValid"
)

const (
	SpiceboxToolkitConditionValid = "Valid"
	// SpiceboxToolkitConditionSpiceDBSchemaValid is guardian-owned, NOT owned by
	// the spiceboxtoolkit controller that owns Valid above. False means this
	// toolkit's spec.spicedbSchema fragment was excluded from the cluster-wide
	// schema compose, either as FragmentInvalid (bad on its own — a RawZed
	// syntax error, a reserved scaffold definition redeclared, an internal
	// conflict) or FragmentConflict (valid alone, but colliding with an
	// already-accepted fragment; earlier namespace/name wins and the later is
	// marked here).
	//
	// A SpiceboxToolkit CR is installed, so it is tenant input like MCPServer
	// and SidecarToolbox — the //go:embed'ed built-in toolkits are a different,
	// compile-time set and are not gated by this condition. Isolating the
	// failure here rather than freezing the compose pass is what stops one
	// tenant's bad or hostile toolkit from taking down SchemaIncluded for every
	// AgentSessionGrants in the cluster.
	SpiceboxToolkitConditionSpiceDBSchemaValid = "SpiceDBSchemaValid"
)

const (
	SpiceDBBootstrapConditionValid                = "Valid"
	SpiceDBBootstrapConditionSchemaIncluded       = "SchemaIncluded"
	SpiceDBBootstrapConditionRelationshipsApplied = "RelationshipsApplied"
)

const (
	SpiceDBBootstrapReclaimDelete = "Delete"
	SpiceDBBootstrapReclaimRetain = "Retain"
)

const (
	ReasonCanonicalizeRequiresUserEmail = "CanonicalizeRequiresUserEmail"
	ReasonUserSubjectNotCanonical       = "UserSubjectNotCanonical"
	ReasonSubjectSetCannotCanonicalize  = "SubjectSetCannotCanonicalize"
	ReasonSubjectWildcardConflict       = "SubjectWildcardConflict"
	ReasonCannotRedeclareUser           = "CannotRedeclareUser"
	// ReasonRelationOwnedByAnotherSource marks a relationship whose
	// resourceType#relation is claimed by a different in-tree writer (see
	// pkg/authz/spicedb/relsource). The write-time guard
	// (spicedb.TouchBootstrapRelationshipVia) refuses the same relationship;
	// this reason surfaces that refusal on the CR itself instead of only in a
	// reconcile log.
	ReasonRelationOwnedByAnotherSource = "RelationOwnedByAnotherSource"
	// ReasonSpicedbSchemaFragmentInvalid is the SchemaIncluded=False reason
	// when this CR's own spec.spicedbSchema fragment is invalid ON ITS OWN
	// (guardianschema.ValidateFragment) — a RawZed syntax error, or it
	// redeclares a reserved scaffold definition. Distinct from
	// ReasonSpicedbSchemaConflict below, which is for a fragment that is
	// valid alone but collides with an already-accepted one.
	ReasonSpicedbSchemaFragmentInvalid = "SpicedbSchemaFragmentInvalid"
	// ReasonSpicedbSchemaConflict is the SchemaIncluded=False reason when
	// this CR's fragment is valid alone but collides with an already-accepted
	// fragment (guardianschema.PartitionCompatibleFragments) — see
	// ReasonSpicedbSchemaFragmentInvalid above for the invalid-alone case.
	ReasonSpicedbSchemaConflict = "SpicedbSchemaConflict"
	ReasonAllTouched            = "AllTouched"
	ReasonPartialApply          = "PartialApply"
	ReasonSpiceDBUnavailable    = "SpiceDBUnavailable"
	ReasonSpiceDBAuthFailed     = "SpiceDBAuthFailed"
	ReasonSpiceDBRejected       = "SpiceDBRejected"
	ReasonSchemaNotReady        = "SchemaNotReady"
	ReasonSchemaWriteFailed     = "SchemaWriteFailed"
)

const (
	// AgentClassPermissionStartSession = starter + platform->start_session.
	AgentClassPermissionStartSession = "start_session"
	// AgentClassPermissionStartExplicit = starter. The platform-admin arm is
	// absent by design: an explicit gate is one admins list themselves on.
	AgentClassPermissionStartExplicit = "start_explicit"
	// AgentClassRelationStarter is the relation AllowedStarters is written to.
	AgentClassRelationStarter = "starter"
)

const (
	SubagentRequestPhasePending = "Pending"
	SubagentRequestPhaseRunning = "Running"
	// SubagentRequestPhaseAwaitingParent is NON-terminal: the child asked its
	// parent a question and parked. IsTerminal deliberately excludes it, so a
	// reconcile still revisits the request and the child stays alive; what
	// bounds it is the controller's own per-exchange parent-reply timeout, not
	// a phase transition the child can reach on its own.
	SubagentRequestPhaseAwaitingParent = "AwaitingParent"
	// SubagentRequestPhaseAwaitingDisclosure is NON-terminal: a requested data
	// slot would disclose its datum to this child, so a human who can speak
	// for that datum is being asked.
	//
	// THE CHILD IS NOT CREATED WHILE THIS HOLDS. Starting it with the
	// undecided slot omitted would hand it a partial handoff, which it cannot
	// distinguish from a parent that chose to send less — so it would proceed
	// on the shorter set as though that were the task. The delegation waits
	// whole or fails whole.
	SubagentRequestPhaseAwaitingDisclosure = "AwaitingDisclosure"
	SubagentRequestPhaseSucceeded          = "Succeeded"
	SubagentRequestPhaseFailed             = "Failed"
	SubagentRequestPhaseDenied             = "Denied"
)

const (
	SubagentModeSingleTurn = "single_turn"
	SubagentModeTask       = "task"
	SubagentModeChat       = "chat"
	// SubagentModeAttended is a channel for a full back-and-forth with a HUMAN
	// rather than the parent agent. Registered here as a legal Mode value; the
	// routing, respond_to_user binding and provisioning that give it behavior
	// distinct from chat are added in a later change.
	SubagentModeAttended = "attended"
)

const (
	ToolGuardActionOff  = "off"
	ToolGuardActionWarn = "warn"
	ToolGuardActionDeny = "deny"
	ToolGuardActionHalt = "halt"
)

const (
	WorkshopPhaseProvisioning = "Provisioning"
	WorkshopPhaseReady        = "Ready"
	WorkshopPhaseExpired      = "Expired"
	WorkshopPhaseReleased     = "Released"
	WorkshopPhaseDeleting     = "Deleting"
)

const (
	WorkshopClosePhaseClosed   = "Closed"
	WorkshopClosePhaseRefused  = "Refused"
	WorkshopClosePhaseNotFound = "NotFound"
)

const (
	WorkshopInstallPhaseRequested = "Requested"
	WorkshopInstallPhaseApproved  = "Approved"
	WorkshopInstallPhaseInstalled = "Installed"
	WorkshopInstallPhaseDeclined  = "Declined"
	WorkshopInstallPhaseFailed    = "Failed"
)

const (
	LabelWorkshopSessionNamespace = "agentprimitives.authzed.com/workshop-session-namespace"
	LabelWorkshopSessionName      = "agentprimitives.authzed.com/workshop-session-name"
	LabelWorkshopNamespace        = "agentprimitives.authzed.com/workshop-namespace"
)

const (
	WorkspaceSourceConditionValid = "Valid"
	WorkspaceSourceConditionReady = "Ready"
)

const AgentSessionConditionCredentialRequestPublished = "CredentialRequestPublished"

const AgentSessionConditionCredentialUpdatePending = "CredentialUpdatePending"

const (
	// AgentSessionGrantsConditionSchemaIncluded reports whether every pair
	// in spec.pairs is present in the live SpiceDB agentsession definition.
	AgentSessionGrantsConditionSchemaIncluded = "SchemaIncluded"
)

const AgentSessionPhaseAwaitingCredentials = "AwaitingCredentials"

const AgentSessionPhaseAwaitingIdentityChoice = "AwaitingIdentityChoice"

const AgentSessionPhaseAwaitingStartApproval = "AwaitingStartApproval"

const AgentUIConditionToolsGranted = "ToolsGranted"

const AgentUIConditionValid = "Valid"

const AnnotationAuthzServiceSubject = "agentprimitives.authzed.com/authz-service-subject"

const AnnotationForkedFromThread = "agentprimitives.authzed.com/forked-from-thread"

const AnnotationInboundAttachmentCount = "agentprimitives.authzed.com/inbound-attachment-count"

const AnnotationPinRefreeze = "agentprimitives.authzed.com/pin-refreeze"

const AnnotationSessionOpening = "agentprimitives.authzed.com/session-opening"

const AnnotationSessionOpeningSent = "agentprimitives.authzed.com/session-opening-sent"

const AnnotationStandinSource = "agentprimitives.authzed.com/standin-source"

const AnnotationStartApprovalRequestRef = "agentprimitives.authzed.com/start-approval-request-ref"

const AnnotationStartedByCanonicalID = "agentprimitives.authzed.com/started-by-canonical-id"

const AnnotationTriggerOwnerSubject = "agentprimitives.authzed.com/trigger-owner-subject"

const (
	ArtifactRenderConditionReady = "Ready"
)

const AuthzSlotMembershipDefault = "frozen"

const ClusterIdentityProviderName = "default"

const CredentialUpdateRequestConditionCardDelivered = "CardDelivered"

const DefaultMaxWorkshopsPerStarter = int32(3)

const DefaultSandboxKind = "pod"

const GroupName = "agentprimitives.authzed.com"

const IdentitiesNamespace = "agentprimitives-identities"

const IdentitydExternalURLConfigMap = "spicebox-identityd-external-url"

const InboundAttachmentWriteBudget = 5 * time.Minute

const LabelCascadeOf = "agentprimitives.authzed.com/cascade-of"

const LabelDelegationRoot = "agentprimitives.authzed.com/delegation-root"

const LabelToolUseID = "agentprimitives.authzed.com/toolUseID"

const MCPServerReasonFragmentConflict = "FragmentConflict"

const MCPServerReasonFragmentInvalid = "FragmentInvalid"

const MCPServerReasonFragmentValid = "FragmentValid"

const MaxLineageWalk = 16

const MemoryTokenSecretSuffix = "-memory-token"

const PassthroughCredentialSecretSuffix = "-passthrough-creds"

const PassthroughLinkSigningKeySecret = "spicebox-passthrough-link-key"

const PinDriftCondition = "PinDrift"

const (
	// PublicEndpointConditionReady is True exactly while the operator holds an
	// open tunnel for this endpoint and status.url names it. False carries the
	// reason the tunnel is not up, in the reasons below.
	PublicEndpointConditionReady = "Ready"
)

const (
	// ReasonAgentClassUserLessMissingAuthz fires when an AgentClass binds
	// an input-role (or both-role) Channel whose kind reports
	// UserAttributable=false (e.g. bento) but the AgentClass has no
	// sessionInteractPermission AND/OR the Channel has no authzSubject �
	// leaving the spawned AgentSession with no SpiceDB subject to attribute
	// work to and no broad grant for humans to interact with the session.
	ReasonAgentClassUserLessMissingAuthz = "UserLessChannelMissingAuthz"
)

const ReasonAgentSessionSkillResolutionFailed = "SkillResolutionFailed"

const ReasonAgentSessionTokenAuthzUnavailable = "TokenAuthzUnavailable"

const ReasonAgentSessionTokenGrantFailed = "TokenGrantFailed"

const ReasonAgentSessionWorkshopLimitExceeded = "WorkshopLimitExceeded"

const (
	ReasonBuiltinCollision = "BuiltinCollision"
)

const (
	ReasonClassInvalidToolchains = "InvalidToolchains"
)

const ReasonCredentialRequestPublished = "CredentialRequestPublished"

const ReasonCredentialUpdateCardDelivered = "Published"

const ReasonCredentialUpdateNoRecipient = "NoRecipient"

const ReasonCredentialUpdateRequested = "CredentialUpdateRequested"

const ReasonCredentialUpdateResolved = "CredentialUpdateResolved"

const ReasonWebdExternalURLNotConfigured = "WebdExternalURLNotConfigured"

const SecretOutputSecretSuffix = "-secret-outputs"

const SessionUserIdentityConditionCredentialLinkAvailable = "CredentialLinkAvailable"

const (
	// SkillSourceConditionReady is True when the last sync cloned, discovered,
	// cached, and materialized Skills without a fatal error.
	SkillSourceConditionReady = "Ready"
)

const SlackOAuthSecret = "spicebox-slack-oauth"

const (
	SpiceboxClassConditionValid = "Valid"
)

const (
	SpiceboxToolchainConditionValid = "Valid"
)

const SpiceboxToolkitReasonFragmentConflict = "FragmentConflict"

const SpiceboxToolkitReasonFragmentInvalid = "FragmentInvalid"

const SpiceboxToolkitReasonFragmentValid = "FragmentValid"

const (
	SpiceboxToolspecConditionValid = "Valid"
)

const ToolchainCachePath = "/var/ap-cache"

const ToolchainRootPath = "/opt/ap-toolchains"

const UpstreamAuthProviderNone = "none"

const WebdExternalURLConfigMap = "spicebox-webd-external-url"

const WebdExternalURLFieldOwner = "publicendpoint-external-url"

const WorkshopCloseTargetAll = "*"

const WorkshopLimitBody = "You already have the maximum number of builder workshops open at once. Finish or close one before starting another."

const WorkshopTokenSecretSuffix = "-workshop-token"