auditaction

const (

	// ActionTaskUpsert records a task whose audited fields changed.
	ActionTaskUpsert Action = "task.upsert"
	// ActionTaskDelete records a task leaving the plan.
	ActionTaskDelete Action = "task.delete"
	// ActionTaskStatus records a hand-made status change.
	ActionTaskStatus Action = "task.status"
	// ActionTaskDispatch records a task being handed to an executor.
	ActionTaskDispatch Action = "task.dispatch"
	// ActionTaskFinish records a dispatched task reaching a terminal outcome.
	ActionTaskFinish Action = "task.finish"

	// ActionRunCapPaused records a run parked by a Claude Code subscription
	// cap, together with when the window reopens.
	ActionRunCapPaused Action = "run.cap_paused"
	// ActionRunCapResumed records the hub restarting such a run once the
	// window rolled over, with no human involved.
	ActionRunCapResumed Action = "run.cap_resumed"

	// ActionStepAppend records one execution step's transcript.
	ActionStepAppend Action = "step.append"

	// ActionStateSave records a plan-level state write.
	ActionStateSave Action = "state.save"
	// ActionConfigSet records a configuration write.
	ActionConfigSet Action = "config.set"

	// ActionExecutorEnroll records an agent joining the fleet.
	ActionExecutorEnroll Action = "executor.enroll"
	// ActionExecutorRevoke records an agent's credential being revoked.
	ActionExecutorRevoke Action = "executor.revoke"
	// ActionExecutorCordon records an executor being closed to new work.
	ActionExecutorCordon Action = "executor.cordon"
	// ActionExecutorUncordon records a cordoned executor returning to service.
	ActionExecutorUncordon Action = "executor.uncordon"
	// ActionExecutorDrain records an executor being told to shed work.
	ActionExecutorDrain Action = "executor.drain"
	// ActionExecutorBind records a project being pinned to one executor.
	ActionExecutorBind Action = "executor.bind"
	// ActionExecutorUnbind records a project's executor pin being cleared.
	ActionExecutorUnbind Action = "executor.unbind"
	// ActionExecutorStateChange records a health-state transition nobody asked for.
	ActionExecutorStateChange Action = "executor.state_change"
	// ActionExecutorFailover records a session moving off a failed executor.
	ActionExecutorFailover Action = "executor.failover"

	// ActionWorkspaceProvisionStart records the beginning of source provisioning.
	ActionWorkspaceProvisionStart Action = "workspace.provision_start"
	// ActionWorkspaceProvisionEnd records provisioning finishing, with or without an error.
	ActionWorkspaceProvisionEnd Action = "workspace.provision_end"

	// ActionSandboxImageDenied records an image refused by trust policy.
	ActionSandboxImageDenied Action = "sandbox.image_denied"

	// ActionSandboxAttachOpen records a shell being opened inside a running sandbox.
	ActionSandboxAttachOpen Action = "sandbox.attach.open"
	// ActionSandboxAttachClose records an attached session ending.
	ActionSandboxAttachClose Action = "sandbox.attach.close"
	// ActionSandboxAttachDenied records an attach request being refused.
	ActionSandboxAttachDenied Action = "sandbox.attach.denied"

	// ActionSecretMint records a credential being sealed into a new secret.
	ActionSecretMint Action = "secret.mint"
	// ActionSecretDelete records a secret being destroyed.
	ActionSecretDelete Action = "secret.delete"
	// ActionSecretGrant records authority to lease a secret being written.
	ActionSecretGrant Action = "secret.grant"
	// ActionSecretRevoke records a grant being marked unusable.
	ActionSecretRevoke Action = "secret.revoke"
	// ActionSecretLease records a lease being issued or refused.
	ActionSecretLease Action = "secret.lease"
	// ActionSecretRenew records a live lease being re-issued.
	ActionSecretRenew Action = "secret.renew"
	// ActionSecretRelease records a lease ending in the ordinary way.
	ActionSecretRelease Action = "secret.release"
	// ActionSecretAccessCheck records an access decision against a grant's constraints.
	ActionSecretAccessCheck Action = "secret.access_check"
	// ActionSecretRequest records a self-service access request being filed.
	ActionSecretRequest Action = "secret.request"
	// ActionSecretRequestApprove records a request being approved.
	ActionSecretRequestApprove Action = "secret.request_approve"
	// ActionSecretRequestDeny records a request being refused.
	ActionSecretRequestDeny Action = "secret.request_deny"
	// ActionSecretRequestWithdraw records a requester withdrawing their request.
	ActionSecretRequestWithdraw Action = "secret.request_withdraw"
	// ActionSecretRequestExpire records a request lapsing undecided.
	ActionSecretRequestExpire Action = "secret.request_expire"
	// ActionSecretLeaseSweep records one run of the expired-lease sweeper.
	ActionSecretLeaseSweep Action = "secret.lease.sweep"

	// ActionLeaseRevokeSent records a revocation being queued for delivery.
	ActionLeaseRevokeSent Action = "lease.revoke_sent"
	// ActionLeaseRevokeAcked records an executor confirming it destroyed the material.
	ActionLeaseRevokeAcked Action = "lease.revoke_acked"
	// ActionLeaseRevokeFailed records a revocation that did not land.
	ActionLeaseRevokeFailed Action = "lease.revoke_failed"

	// ActionGitHubAppTokenDestroy records a GitHub App installation token deleted at GitHub.
	ActionGitHubAppTokenDestroy Action = "github_app.token_destroy"

	// ActionEgressGrant records authority to reach the network being written.
	ActionEgressGrant Action = "egress.grant"
	// ActionEgressRevoke records an egress authorisation being withdrawn.
	ActionEgressRevoke Action = "egress.revoke"
	// ActionEgressRedeem records a proxy session being minted against a grant.
	ActionEgressRedeem Action = "egress.redeem"
	// ActionEgressConnect records a connection attempt being evaluated.
	ActionEgressConnect Action = "egress.connect"
	// ActionEgressRequest records an HTTP request passing through the proxy.
	ActionEgressRequest Action = "egress.request"
	// ActionEgressClose records a proxy session closing with its byte counts.
	ActionEgressClose Action = "egress.close"

	// ActionGitProxySessionMinted records a git proxy session being created.
	ActionGitProxySessionMinted Action = "gitproxy.session_minted"
	// ActionGitProxySessionClosed records a git proxy session ending.
	ActionGitProxySessionClosed Action = "gitproxy.session_closed"
	// ActionGitProxyPushAllowed records a push admitted by branch policy.
	ActionGitProxyPushAllowed Action = "gitproxy.push_allowed"
	// ActionGitProxyPushDenied records a push refused by branch policy.
	ActionGitProxyPushDenied Action = "gitproxy.push_denied"
	// ActionGitProxyFetch records a read passing through the proxy.
	ActionGitProxyFetch Action = "gitproxy.fetch"
	// ActionGitProxyRejected records a request refused before policy evaluation.
	ActionGitProxyRejected Action = "gitproxy.rejected"

	// ActionKubeGuardSessionMinted records a Kubernetes proxy session being created.
	ActionKubeGuardSessionMinted Action = "kubeguard.session_minted"
	// ActionKubeGuardSessionClosed records a Kubernetes proxy session ending.
	ActionKubeGuardSessionClosed Action = "kubeguard.session_closed"
	// ActionKubeGuardRequestDenied records a Kubernetes request refused by policy.
	ActionKubeGuardRequestDenied Action = "kubeguard.request_denied"
	// ActionKubeGuardRequestAllowed records a Kubernetes request admitted by policy.
	ActionKubeGuardRequestAllowed Action = "kubeguard.request_allowed"
	// ActionKubeGuardRejected records a request refused before its session was identified.
	ActionKubeGuardRejected Action = "kubeguard.rejected"

	// ActionCIRejected records a relay request refused before a session existed.
	ActionCIRejected Action = "ci.rejected"
	// ActionCISessionMinted records a relay session being issued to a pipeline.
	ActionCISessionMinted Action = "ci.session.minted"
	// ActionCISessionClosed records a relay session ending.
	ActionCISessionClosed Action = "ci.session.closed"
	// ActionCISessionRevoked records an operator revoking a live relay session.
	ActionCISessionRevoked Action = "ci.session.revoked"
	// ActionCIExchangeAccepted records a pipeline's OIDC token being exchanged.
	ActionCIExchangeAccepted Action = "ci.exchange.accepted"
	// ActionCIExchangeRejected records a token exchange being refused.
	ActionCIExchangeRejected Action = "ci.exchange.rejected"
	// ActionCIRelayAllowed records a relayed API call being forwarded.
	ActionCIRelayAllowed Action = "ci.relay.allowed"
	// ActionCIRelayDenied records a relayed API call being refused.
	ActionCIRelayDenied Action = "ci.relay.denied"
	// ActionCIRuleCreated records an allowlist rule being added.
	ActionCIRuleCreated Action = "ci.rule.created"
	// ActionCIRuleUpdated records an allowlist rule being edited.
	ActionCIRuleUpdated Action = "ci.rule.updated"
	// ActionCIRuleDeleted records an allowlist rule being removed.
	ActionCIRuleDeleted Action = "ci.rule.deleted"
	// ActionCIConfigUpdated records the relay's own settings changing.
	ActionCIConfigUpdated Action = "ci.config.updated"

	// ActionAuthzGranted records a privileged permission being exercised.
	ActionAuthzGranted Action = "authz.granted"
	// ActionAuthzDenied records a permission check refusing a caller.
	ActionAuthzDenied Action = "authz.denied"

	// ActionAPITokenCreated records a token or glasses link being minted.
	ActionAPITokenCreated Action = "api_token.created"
	// ActionAPITokenRevoked records a token or glasses link being revoked.
	ActionAPITokenRevoked Action = "api_token.revoked"
	// ActionAPITokenAuthFailed records a presented token failing to authenticate.
	ActionAPITokenAuthFailed Action = "api_token.auth_failed"
	// ActionAPITokenCreateDenied records a mint refused by the anti-escalation check.
	ActionAPITokenCreateDenied Action = "api_token.create_denied"

	// ActionSessionCreated records a sign-in completing.
	ActionSessionCreated Action = "session.created"
	// ActionSessionExpired records the janitor removing a deadline-expired session.
	ActionSessionExpired Action = "session.expired"
	// ActionSessionRevoked records a logout or an operator termination.
	ActionSessionRevoked Action = "session.revoked"
	// ActionSessionIdPRevoked records the IdP reporting the authorisation is gone.
	ActionSessionIdPRevoked Action = "session.idp_revoked"
	// ActionSessionRoleNarrowed records a re-assertion demoting a live session.
	ActionSessionRoleNarrowed Action = "session.role_narrowed"
	// ActionSessionClaimsUnverified records the hub failing to reach the IdP.
	ActionSessionClaimsUnverified Action = "session.claims_unverified"
	// ActionSessionClaimsRejected records the IdP refusing a re-assertion.
	ActionSessionClaimsRejected Action = "session.claims_rejected"
	// ActionSessionClaimsStale records a privileged operation blocked on claim age.
	ActionSessionClaimsStale Action = "session.claims_stale"

	// ActionRoleBindingGranted records a runtime binding granting a role.
	ActionRoleBindingGranted Action = "role_binding.granted"
	// ActionRoleBindingDenied records a runtime binding taking a role away.
	ActionRoleBindingDenied Action = "role_binding.denied"
	// ActionRoleBindingDeleted records a runtime binding being removed.
	ActionRoleBindingDeleted Action = "role_binding.deleted"

	// ActionQuotaDenied records admission control refusing an operation.
	ActionQuotaDenied Action = "quota.denied"
	// ActionQuotaOverrideSet records a per-identity quota override being written.
	ActionQuotaOverrideSet Action = "quota.override_set"
	// ActionQuotaOverrideCleared records an override being removed.
	ActionQuotaOverrideCleared Action = "quota.override_cleared"
	// ActionQuotaSpendRefused records a run stopped for exceeding a spend limit.
	ActionQuotaSpendRefused Action = "quota.spend_refused"

	// ActionResourceCeilingSet records a per-project resource ceiling being
	// written (Task 20301).
	//
	// Beside the quota overrides above, and for the same reason they are on the
	// trail: the authority to edit one is the authority to decide how much of
	// the machine a tenant gets. The fleet ceiling has no action of its own
	// because it is not editable at runtime — it comes from config.yaml, which
	// is reviewed and deployed rather than written through an API.
	ActionResourceCeilingSet Action = "resource_ceiling.set"
	// ActionResourceCeilingCleared records a per-project ceiling being removed,
	// after which the project is bounded by the fleet ceiling alone.
	ActionResourceCeilingCleared Action = "resource_ceiling.cleared"

	// ActionSealingKeyRotated records the secret store's sealing key being rotated.
	ActionSealingKeyRotated Action = "sealing_key.rotated"
	// ActionSealingKeyRetired records a superseded sealing key being retired.
	ActionSealingKeyRetired Action = "sealing_key.retired"

	// ActionSTTCredentialSet records the speech-to-text key being configured.
	ActionSTTCredentialSet Action = "stt.credential.set"
	// ActionSTTCredentialCleared records the speech-to-text key being removed.
	ActionSTTCredentialCleared Action = "stt.credential.cleared"

	// ActionUserOffboard is the offboarding summary row.
	ActionUserOffboard Action = "user.offboard"
	// ActionUserOffboardSession records sessions revoked during offboarding.
	ActionUserOffboardSession Action = "user.offboard_session"
	// ActionUserOffboardToken records API tokens revoked during offboarding.
	ActionUserOffboardToken Action = "user.offboard_token"
	// ActionUserOffboardGlasses records glasses links revoked during offboarding.
	ActionUserOffboardGlasses Action = "user.offboard_glasses"
	// ActionUserOffboardDeny records deny bindings written during offboarding.
	ActionUserOffboardDeny Action = "user.offboard_deny"
	// ActionUserOffboardMembership records project memberships dropped during offboarding.
	ActionUserOffboardMembership Action = "user.offboard_membership"
	// ActionUserOffboardLease records secret leases released during offboarding.
	ActionUserOffboardLease Action = "user.offboard_lease"
	// ActionUserOffboardTask records tasks stopped during offboarding.
	ActionUserOffboardTask Action = "user.offboard_task"
	// ActionUserOffboardProject records projects reported as needing a new owner.
	ActionUserOffboardProject Action = "user.offboard_project"

	// ActionProjectMemberGrant records an identity joining a project's roster.
	ActionProjectMemberGrant Action = "project.member.grant"
	// ActionProjectMemberRevoke records a maintainer removing a member.
	ActionProjectMemberRevoke Action = "project.member.revoke"
	// ActionProjectMemberLeave records a member removing themselves.
	ActionProjectMemberLeave Action = "project.member.leave"
)

const (
	// HomeControlPlane: the hub's own state.db. Facts about the fleet and the
	// hub as a whole — which executors exist, who holds a credential, who
	// logged in, what an operator administered. These outlive any one project
	// and several of them belong to no project at all, so a project's chain is
	// the wrong place for them even when a project is what triggered them.
	HomeControlPlane HomeDB = "control-plane"

	// HomeProject: the project's own .cloop/state.db. The plan's life — tasks
	// created, dispatched and finished, steps appended, the project's config
	// written. These travel with the project directory, which is what makes a
	// project's trail readable after it has been moved off the hub that ran it.
	HomeProject HomeDB = "project"

	// HomeEither: genuinely both, depending on the scope of the thing being
	// recorded — not "we did not decide".
	//
	// One family needs this honestly. An authorization decision is recorded
	// against whatever it was scoped to: a permission check on a project lands
	// in that project's chain, and a fleet-wide one lands in the hub's. Forcing
	// either answer would make the declaration a lie, and a lie here is worse
	// than the ambiguity it papers over, because the runtime assertion would
	// then fire on correct code and the next person would delete the assertion
	// rather than the lie.
	//
	// The gate keeps this from becoming a dumping ground: an entry declaring
	// HomeEither must carry a Note explaining what varies, or tests/arch fails.
	// An escape hatch that costs a sentence stays rare.
	HomeEither HomeDB = "either"
)

const (
	// StabilityStable: the name and the payload keys listed for it will not
	// change. Safe to key a detection rule on. New payload keys may still be
	// added — a consumer must tolerate that — but no listed key will be
	// removed or repurposed.
	StabilityStable Stability = "stable"

	// StabilityBeta: the action fires, and its rows are real, but its name or
	// payload may still change while the surface that emits it settles. Key a
	// dashboard on it; do not key a paging alert on it.
	StabilityBeta Stability = "beta"

	// StabilityDeprecated: still emitted for compatibility, replaced by
	// something else. The Note says by what. Kept in the registry rather than
	// deleted because stored rows still carry the name and a reader looking it
	// up deserves an answer better than silence.
	StabilityDeprecated Stability = "deprecated"
)