types

type ADOEntraConfig struct {
	// TenantID is the Entra tenant every sign-in for this row goes to (GUID); a well-known alias ("common", "organizations") is refused.
	TenantID string `json:"tenant_id"`
	ClientID string `json:"client_id"` // app registration the sign-in names, as a GUID
	// CapabilityCeiling is the widest capability set a run on this row may
	// ever hold; required and non-empty when the block is present.
	CapabilityCeiling []adoscope.Capability `json:"capability_ceiling,omitempty"`
	DefaultProfile    []adoscope.Capability `json:"default_profile,omitempty"` // what a run gets by default; empty reads as adoscope.ProfileDefault
	TokenMode         ADOTokenMode          `json:"token_mode,omitempty"`      // empty reads as ADOTokenModeBearer
	// PATMaxHours is the longest a minted_pat run's token lives (1-168). 0
	// reads as 8; read via PATHours, never directly.
	PATMaxHours int `json:"pat_max_hours,omitempty"`
	// PATMaxDays is the furthest expiry an own_pat token may carry (1-90). 0
	// reads as 30; read via PATDays, never directly. A Server row has no entra
	// block, so it cannot set this and always reads the default, 30.
	PATMaxDays int `json:"pat_max_days,omitempty"`
	// RESTAPI: brokered REST calls, or only git traffic. Default true; read
	// via RESTAPIEnabled, never directly.
	RESTAPI *bool `json:"rest_api,omitempty"`
}

type ADOTokenMode string

type APIToken struct {
	ID              uuid.UUID  `json:"id"`
	Principal       string     `json:"principal"`
	Email           string     `json:"email,omitempty"`
	Role            string     `json:"role"`
	UserType        string     `json:"user_type"`
	Groups          []string   `json:"groups,omitempty"`
	GroupsTruncated *bool      `json:"groups_truncated,omitempty"`
	Name            string     `json:"name"`
	CreatedAt       time.Time  `json:"created_at"`
	LastUsedAt      *time.Time `json:"last_used_at,omitempty"`
	RevokedAt       *time.Time `json:"revoked_at,omitempty"`
	MintedBy        string     `json:"minted_by,omitempty"` // admin who minted this for its owner; empty when the owner minted it
	Token           string     `json:"token,omitempty"`     // plaintext, create response ONLY
}

type ActorType string

type AgentProvider struct {
	// ID is the --agent value this row governs: a harness-catalog id OR a
	// WARDYN_AGENT_IMAGES key. The image-map half is deliberate: harnessByID
	// documents an image-map-only custom agent as supported, so a block that
	// refuses agents without a row must let the admin write one for their own.
	ID string `json:"id"`
	// Disabled turns the row off without deleting it — negative-sense, so the
	// zero value is ENABLED. Its runs are refused and the console renders it
	// unavailable, never hidden.
	Disabled bool `json:"disabled,omitempty"`
	// DefaultProvider names the model provider a new run of this agent uses
	// unless the person chooses another; must be enabled for this agent. If
	// later disabled, the default becomes a sentinel whose runs are refused,
	// never silently moved to another provider.
	DefaultProvider string `json:"default_provider,omitempty"`
}

type AgentProviders struct {
	// Agents are the per-agent rows; an agent with NO row is not offered at
	// all once the block exists.
	Agents []AgentProvider `json:"agents,omitempty"`
}

type AgentRun struct {
	ID        uuid.UUID `json:"id"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
	CreatedBy string    `json:"created_by"` // human principal (token `sub`)
	Agent     string    `json:"agent"`      // e.g. "claude-code", "codex-cli"
	Repo      string    `json:"repo"`       // e.g. "org/name"
	Task      string    `json:"task"`       // human task description
	// Title groups runs in the console's list; empty for legacy/system runs, which fall back to Task.
	Title string `json:"title,omitempty"`
	// Description is optional free-text context; display-only, never interpreted.
	Description      string           `json:"description,omitempty"`
	PolicyID         *uuid.UUID       `json:"policy_id,omitempty"`
	ConfinementClass ConfinementClass `json:"confinement_class"`
	State            RunState         `json:"state"`
	SPIFFEID         string           `json:"spiffe_id"`     // spiffe://<trust-domain>/agent-run/<id>
	RunnerTarget     string           `json:"runner_target"` // "docker"
	SandboxRef       string           `json:"sandbox_ref,omitempty"`
	Image            string           `json:"image,omitempty"` // resolved sandbox image, kept for provenance; empty for legacy rows
	// Interactive marks a human-driven run: sandbox comes up RUNNING, no task exec'd, no completion watcher.
	Interactive bool `json:"interactive"`
	// WorkspacePath is the run's primary host directory, denormalized so the control plane can warn (never block) a second run on it.
	WorkspacePath string `json:"workspace_path,omitempty"`
	// WorkspaceID marks a governed scan run: the driver runs wardyn-scan instead of the agent, trusted (not sandbox input) to persist the profile.
	WorkspaceID *uuid.UUID `json:"workspace_id,omitempty"`
	// WorkspaceIDs is the onboarded workspaces this run's policy referenced at create; grants nothing, only tells an `always` egress decision what to persist to.
	WorkspaceIDs []uuid.UUID `json:"workspace_ids,omitempty"`
	SourceID     *uuid.UUID  `json:"source_id,omitempty"` // trusted run→library-source linkage for a per-source scan run; never set by user runs
	// AutoStopAfterSec is the run's idle auto-stop cap, frozen at create so the reaper works with no policy_id to JOIN. 0 = never; <0 = explicit never.
	AutoStopAfterSec int    `json:"auto_stop_after_sec,omitempty"`
	AgentExecID      string `json:"agent_exec_id,omitempty"` // docker exec id, so the crash reconciler can check agent liveness across a wardynd restart
	FailureHint      string `json:"failure_hint,omitempty"`  // operator-facing reason a run FAILED before the agent started; display-only
	// StatusDetail is what the substrate says this run awaits while STARTING; blanked on leaving STARTING except a TERMINAL failure reason (kept for postmortem).
	StatusDetail string `json:"status_detail,omitempty"`
	StatusReason string `json:"status_reason,omitempty"` // reason token parsed out of StatusDetail, derived at read, never stored
	// AutonomyLevel freezes the level resolved at create, not the profile/posture that produced it (that's on the audit row).
	AutonomyLevel AutonomyLevel `json:"autonomy_level,omitempty"`
	EndsAt        *time.Time    `json:"ends_at"`                   // run's lease end, captured once at create from RunLimits, never re-resolved
	WaitBudgetSec int           `json:"wait_budget_sec,omitempty"` // how long an approval this run raises stays open; 0 = deployment default alone applies
	// RunLimits are the owner's profile limits as they stood at create; later clamps use these captured bounds, never the profile's current ones.
	RunLimits           RunLimits  `json:"run_limits"`
	GovernanceProfileID *uuid.UUID `json:"governance_profile_id,omitempty"`
	// LostAt/LostReason mark a run that lost its sandbox but is kept (no proxy/network, files stay); stays RUNNING until a kill or the ended-run grace.
	LostAt     *time.Time `json:"lost_at,omitempty"`
	LostReason LostReason `json:"lost_reason,omitempty"`
	// ContainmentError/At: latest/first stop-confirm failure for a kept run; the lease sweep retries and clears both once it lands.
	ContainmentError   string     `json:"containment_error,omitempty"`
	ContainmentErrorAt *time.Time `json:"containment_error_at,omitempty"`
	// EndedAt stamps the transition into a terminal RunState; a lease-ended run stays RUNNING until the ended-run grace, so its end time is LostAt, not EndedAt.
	EndedAt        *time.Time `json:"ended_at,omitempty"`
	EndTightenedAt *time.Time `json:"end_tightened_at,omitempty"` // profile re-clamp shortened the end
	// PausedAt/PausedReason mark a run frozen with nobody present; keeps state/memory/files/proxy until activity or resume. Not contained — kill still works.
	PausedAt     *time.Time  `json:"paused_at,omitempty"`
	PausedReason PauseReason `json:"paused_reason,omitempty"`
	ActiveAt     *time.Time  `json:"active_at,omitempty"` // presence clock: last human input/egress decision/proxied bytes; keepalives never move it; nil reads as CreatedAt
	// ModelProviderID freezes the provider id at create; the kind is deliberately NOT frozen (can change later) and lives only on the run.create audit snapshot.
	ModelProviderID string `json:"model_provider_id,omitempty"`
	UserType        string `json:"user_type,omitempty"` // creator's resolved user type, frozen at create
	Preset          string `json:"preset,omitempty"`    // launch preset this run was expanded from; empty for an explicit-spec run
	PresetVersion   int    `json:"preset_version,omitempty"`
	OperatorOwned   bool   `json:"-"` // mirrors identity.Claims.OperatorOwned so dispatch/revive re-mint read what create decided
	// CreatedVia is the registered portal this run was launched through on the person's behalf; nil when self-launched. The owner is still the person.
	CreatedVia *uuid.UUID `json:"created_via,omitempty"`
	// HasRecording/RecordingBytes/RecordingDurationSec are derived, never stored, projected only with ?include=recording_meta; HasRecording is the only "no recording" signal.
	HasRecording         bool          `json:"has_recording"`
	RecordingBytes       int64         `json:"recording_bytes,omitempty"`
	RecordingDurationSec float64       `json:"recording_duration_sec,omitempty"`
	DiskMiB              int           `json:"disk_mib,omitempty"`  // effective ephemeral disk cap MiB; 0 = no cap resolved
	Attention            *RunAttention `json:"attention,omitempty"` // what this live run awaits and who can clear it; derived, only on view-opted-in read paths
}

type ApprovalDecision struct {
	State     ApprovalState
	DecidedBy string
	Reason    string
	Scope     ApprovalScope // meaningful only for an egress_domain approval; others leave the zero value
	ExpiresAt *time.Time
}

type ApprovalKind string

type ApprovalRequest struct {
	ID             uuid.UUID       `json:"id"`
	RunID          uuid.UUID       `json:"run_id"`
	GrantID        *uuid.UUID      `json:"grant_id,omitempty"`
	Kind           ApprovalKind    `json:"kind"`
	RequestedScope json.RawMessage `json:"requested_scope"`
	State          ApprovalState   `json:"state"`
	RequestedAt    time.Time       `json:"requested_at"`
	DecidedAt      *time.Time      `json:"decided_at,omitempty"`
	DecidedBy      string          `json:"decided_by,omitempty"`
	MintedJTI      string          `json:"minted_jti,omitempty"`
	Reason         string          `json:"reason,omitempty"`
	// DecisionScope is how far the decision reaches (see ApprovalScope); empty on a PENDING row. Named
	// decision_scope to avoid clashing with RequestedScope (the unrelated host JSON).
	DecisionScope ApprovalScope `json:"decision_scope,omitempty"`
	// DecisionExpiresAt is set only when DecisionScope is until — a different clock than the EXPIRED-state sweeper, which ages out stale PENDING requests.
	DecisionExpiresAt *time.Time `json:"decision_expires_at,omitempty"`
	// ExpiresAt is when a PENDING request stops waiting: min(requested_at+WaitBudgetSec, EndsAt); computed on read, never stored.
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
	Held      bool       `json:"held,omitempty"` // Held/HeldUntil project approval.Hold(this, now) at response time, never stored; both zero on a DECIDED row
	HeldUntil *time.Time `json:"held_until,omitempty"`
}

type ApprovalScope string

type ApprovalState string

type AttentionBy string

type AttentionKind string

type AuditEvent struct {
	ID        uuid.UUID       `json:"id"`
	Time      time.Time       `json:"time"`
	RunID     *uuid.UUID      `json:"run_id,omitempty"`
	ActorType ActorType       `json:"actor_type"`
	Actor     string          `json:"actor"`  // human sub, agent SPIFFE ID, or component name
	Action    string          `json:"action"` // dotted verb, e.g. "credential.mint", "egress.deny", "kernel.process.exec"
	Target    string          `json:"target,omitempty"`
	Outcome   string          `json:"outcome"` // "success" | "failure" | "denied"
	SourceIP  string          `json:"source_ip,omitempty"`
	Data      json.RawMessage `json:"data,omitempty"`

	// DeviceID names the enrolled device that forwarded this row; derived on read, never taken from a caller.
	DeviceID *uuid.UUID `json:"device_id,omitempty"`

	// PrevHash/RowHash form the tamper-evidence chain: RowHash = SHA-256(PrevHash || canonical serialization
	// of the fields above), computed BY POSTGRES in a BEFORE INSERT trigger, never by the caller; sinks use
	// the head hash to detect truncation. Verified via GET /api/v1/audit/chain/verify.
	PrevHash string `json:"prev_hash,omitempty"`
	RowHash  string `json:"row_hash,omitempty"`
}

type AutonomyEgressPosture string

type AutonomyLevel string

type AutonomyPosture struct {
	Egress      AutonomyEgressPosture  `json:"egress"`
	Secrets     AutonomySecretsPosture `json:"secrets"`
	Confinement ConfinementClass       `json:"confinement"`
}

type AutonomyResolution struct {
	Level   AutonomyLevel   `json:"level"`
	Posture AutonomyPosture `json:"posture"`
	BoundBy []string        `json:"bound_by,omitempty"`
}

type AutonomyRubric struct {
	// EgressOpen caps the level when egress is OPEN: allow-all, or any allowlisted host beyond baseline.
	EgressOpen AutonomyLevel `json:"egress_open,omitempty"`
	// EgressReviewed caps the level when egress is REVIEWED: first-use approval raises approvals, nothing wide open.
	EgressReviewed AutonomyLevel `json:"egress_reviewed,omitempty"`
	// EgressSealed caps the level when egress is SEALED: neither of the above.
	EgressSealed AutonomyLevel `json:"egress_sealed,omitempty"`
	// SecretsPowerful caps the level when the run holds a POWERFUL secret: a write-capable grant, an
	// api_key to a non-baseline host, or a git_pat/ssh_key/env_secret grant.
	SecretsPowerful AutonomyLevel `json:"secrets_powerful,omitempty"`
	// SecretsBaseline caps the level when the run holds any grant, none of them powerful.
	SecretsBaseline AutonomyLevel `json:"secrets_baseline,omitempty"`
	// SecretsNone caps the level when the run holds no grant at all.
	SecretsNone AutonomyLevel `json:"secrets_none,omitempty"`
	// ConfinementCC1/CC2/CC3 cap the level by the run's ENFORCED confinement
	// class (an empty enforced class reads as CC1 — see AutonomyPosture).
	ConfinementCC1 AutonomyLevel `json:"confinement_cc1,omitempty"`
	ConfinementCC2 AutonomyLevel `json:"confinement_cc2,omitempty"`
	ConfinementCC3 AutonomyLevel `json:"confinement_cc3,omitempty"`
}

type AutonomySecretsPosture string

type BaseImageEntry struct {
	ID    uuid.UUID `json:"id"`
	Kind  string    `json:"kind"` // "registry" | "custom" | "byo"
	Name  string    `json:"name"`
	Image string    `json:"image"` // the ref: the image itself (registry/byo) or the FROM (custom)
	// Steps are Dockerfile lines on a "custom" Image; not applied at build
	// time (host-side build RCE — see WorkspaceBaseImage.Steps), stored only
	// so the row round-trips.
	Steps     []string  `json:"steps,omitempty"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type BedrockSettings struct {
	Region       string `json:"region,omitempty"`
	BaseURL      string `json:"base_url,omitempty"`
	SSOStartURL  string `json:"sso_start_url,omitempty"`
	SSOAccountID string `json:"sso_account_id,omitempty"`
	SSORoleName  string `json:"sso_role_name,omitempty"`
}

type Branding struct {
	OrgName         string
	NameFormat      string
	Primary         string
	PrimaryText     string
	DarkPrimary     string
	DarkPrimaryText string
	SupportURL      string
	Logo            []byte
	LogoType        string
	LogoFromFile    bool // the logo is the site config's branding.logo_path file (0105_branding_logo_from_file)
	UpdatedAt       time.Time
	UpdatedBy       string
}

type CapabilityEffect string

type CapabilityGrant struct {
	ID          uuid.UUID             `json:"id"`
	SubjectType CapabilitySubjectType `json:"subject_type"`
	Subject     string                `json:"subject"`
	Capability  string                `json:"capability"`
	Value       string                `json:"value"`
	Effect      CapabilityEffect      `json:"effect"`
	CreatedAt   time.Time             `json:"created_at"`
	CreatedBy   string                `json:"created_by,omitempty"`
}

type CapabilitySubjectType string

type ConfinementClass string

type CredentialGrant struct {
	ID        uuid.UUID `json:"id"`
	RunID     uuid.UUID `json:"run_id"`
	CreatedAt time.Time `json:"created_at"`
	Spec      GrantSpec `json:"spec"`
}

type CredentialSource string

type Delegate struct {
	ID          uuid.UUID `json:"id"`
	Name        string    `json:"name"`
	IdPClientID string    `json:"idp_client_id"`
	Group       string    `json:"group"`
	// Never serialized: a credential hash has no business leaving the process.
	CredentialSHA256 string     `json:"-"`
	RegisteredBy     string     `json:"registered_by"`
	CreatedAt        time.Time  `json:"created_at"`
	LastUsedAt       *time.Time `json:"last_used_at,omitempty"`
	RevokedAt        *time.Time `json:"revoked_at,omitempty"`
	// Credential is the plaintext portal credential, on the register
	// response ONLY; the row stores its hash.
	Credential string `json:"credential,omitempty"`
}

type DelegatedToken struct {
	ID              uuid.UUID `json:"id"`
	DelegateID      uuid.UUID `json:"delegate_id"`
	Principal       string    `json:"principal"`
	Email           string    `json:"email,omitempty"`
	UserType        string    `json:"user_type"`
	Groups          []string  `json:"groups"`
	GroupsTruncated bool      `json:"groups_truncated"`
	CreatedAt       time.Time `json:"created_at"`
	ExpiresAt       time.Time `json:"expires_at"`
}

type DelegationVia struct {
	Delegate uuid.UUID `json:"delegate"`
	Grant    uuid.UUID `json:"grant"`
}

type Device struct {
	ID   uuid.UUID `json:"id"`
	Name string    `json:"name"`
	// Never serialized: a credential hash has no business leaving the process.
	CredentialSHA256 string     `json:"-"`
	EnrolledBy       string     `json:"enrolled_by"`
	CreatedAt        time.Time  `json:"created_at"`
	LastSeenAt       *time.Time `json:"last_seen_at,omitempty"`
	RevokedAt        *time.Time `json:"revoked_at,omitempty"`
	LastSeq          int64      `json:"last_seq"`
	LastRowHash      string     `json:"last_row_hash,omitempty"`
}

type DeviceAck struct {
	AckedSeq int64 `json:"acked_seq"`
}

type DeviceEnrolRequest struct {
	Token string `json:"token"`
}

type DeviceEnrolResponse struct {
	DeviceID uuid.UUID `json:"device_id"`
	Name     string    `json:"name"`
	Token    string    `json:"token"`
}

type DeviceEnrolmentToken struct {
	ID          uuid.UUID  `json:"id"`
	TokenSHA256 string     `json:"-"`
	DeviceName  string     `json:"device_name"`
	MintedBy    string     `json:"minted_by"`
	CreatedAt   time.Time  `json:"created_at"`
	ExpiresAt   time.Time  `json:"expires_at"`
	ConsumedAt  *time.Time `json:"consumed_at,omitempty"`
	Token       string     `json:"token,omitempty"` // plaintext, mint response ONLY
}

type DriveBackend string

type DriveKind string

type DriveMount struct {
	// DriveID is the user_drives row this mount came from; labels and reclaim
	// sweeps group by it.
	DriveID    uuid.UUID    `json:"drive_id"`
	Backend    DriveBackend `json:"backend"`
	ObjectName string       `json:"object_name"` // what the substrate is asked for — volume name, PVC name, or absolute host path
	// HostRoot is THIS drive's own share root, carried on a host_path mount
	// so the driver can assert the bind stays inside it. Does NOT replace the
	// deployment's WARDYN_USER_DRIVE_HOST_ROOTS ceiling (that bounds EVERY
	// drive at once; this refuses a link into a different drive's tree). The
	// driver asserts BOTH.
	HostRoot string `json:"host_root,omitempty"`
	// DriveName is the drive's human name, carried for the AUDIT row alone so
	// a member learns which drive without the operator's absolute host path.
	DriveName    string `json:"drive_name,omitempty"`
	StorageClass string `json:"storage_class,omitempty"` // provisioner a managed k8s_pvc claim asks for; carried since a substrate never reads the database
	HomeName     string `json:"home_name"`               // per-user segment ObjectName was built from
	// SubjectHash is the non-PII fingerprint of the principal this mount was
	// resolved for. DEFENCE IN DEPTH over the managed-backend collision the
	// write boundary refuses: a stored row predating that refusal can still
	// resolve two principals onto one volume, so the driver stamps this and
	// refuses the second. A digest, never the claim — a label is echoed by
	// `docker volume inspect` to anybody who can reach the daemon.
	SubjectHash string
	Target      string             `json:"target"` // reserved in-container path (runner.DriveTarget), carried so a runner never hard-codes it
	ReadOnly    bool               `json:"read_only,omitempty"`
	SizeMiB     int                `json:"size_mib,omitempty"`
	Enforcement StorageEnforcement `json:"enforcement"`
}

type DriveObjectScheme string

type DriveReclaim string

type EgressRedirect struct {
	// From is the public/upstream URL or host being redirected away from.
	From string `json:"from"`
	// To is the corporate-internal URL or host every matching run's egress
	// substitutes to; for an Ecosystem row it's also emitted into that
	// ecosystem's config file (the old ArtifactOverride.BaseURL).
	To string `json:"to"`
	// TokenSecretRef optionally names a secret injected proxy-side as a
	// Bearer token for To's host (the sandbox never holds it). Mutually
	// exclusive with TokenIntegrationRef.
	TokenSecretRef string `json:"token_secret_ref,omitempty"`
	// TokenIntegrationRef optionally names an Integration
	// (SiteConfig.Integrations[i].ID) to take this redirect's token FROM
	// instead of a bare secret. The redirect points AT the integration
	// rather than restating its secret, inheriting its Header/Format so a
	// feed authenticating with something other than "Authorization: Bearer"
	// finally can. Naming nothing, a disabled row, or one with no header
	// credential degrades to redirect-without-token.
	TokenIntegrationRef string `json:"token_integration_ref,omitempty"`
	// Ecosystem, when set, is one of six package-manager ecosystems
	// ("npm"|"pip"|"cargo"|"maven"|"go"|"nuget") this redirect ALSO emits a
	// config file for. Empty means NETWORK-ONLY: no config file is emitted.
	Ecosystem string `json:"ecosystem,omitempty"`
}

type EphemeralProvider struct {
	DefaultDiskMiB int `json:"default_disk_mib,omitempty"` // 0 = unset
	// MaxDiskMiB: ceiling a larger request is clamped to (0 = unlimited); a
	// DefaultDiskMiB above it is refused at the write boundary.
	MaxDiskMiB int `json:"max_disk_mib,omitempty"`
}

type FederatedAuditEvent struct {
	AuditEvent
	Seq int64 `json:"seq"`
}

type FirstUseMode string

type GitLane string

type GitProvider struct {
	ID   string          `json:"id"`   // operator-chosen stable slug, unique within Git, held to integrationRefRE; a capability grant names a provider by this id
	Kind GitProviderKind `json:"kind"` // which forge's bespoke behaviour this row carries
	// Disabled turns the row off without deleting it (zero value enabled); a
	// disabled row still claims its hosts rather than falling through to ScmHosts.
	Disabled bool `json:"disabled,omitempty"`
	// BaseURLs are the https addresses this row admits: a repo is admitted
	// when its clone URL's scheme/host match one of these and its path equals
	// or extends that base URL's path at a "/" boundary. 1-8 entries; no
	// port, credentials, query or fragment; at most two path segments.
	BaseURLs []string `json:"base_urls"`
	// Lanes are the credential lanes usable for this provider; empty means
	// every legacy lane (LegacyGitLanes) — the field narrows, never widens.
	Lanes            []GitLane        `json:"lanes,omitempty"`
	CredentialSource CredentialSource `json:"credential_source,omitempty"` // whose credential the lanes use; empty = CredentialSourceShared, CredentialSourcePerUser requires GitLaneEntra, or GitLanePAT on an Azure DevOps row (a Server row, which has no Entra sign-in)
	Entra            *ADOEntraConfig  `json:"entra,omitempty"`             // present only on, and required by, a row whose Lanes name GitLaneEntra
}

type GitProviderKind string

type GovernanceAssignment struct {
	ID          uuid.UUID             `json:"id"`
	SubjectType CapabilitySubjectType `json:"subject_type"`
	Subject     string                `json:"subject"`
	ProfileID   uuid.UUID             `json:"profile_id"`
	Priority    int                   `json:"priority"`
	CreatedAt   time.Time             `json:"created_at"`
	CreatedBy   string                `json:"created_by,omitempty"`
}

type GovernanceLimits struct {
	// DenyTaskModeExec refuses task_mode=exec for a member under this profile.
	DenyTaskModeExec bool `json:"deny_task_mode_exec,omitempty"`
	// DenyInteractive refuses an interactive run under this profile.
	// Evaluated against POST-COERCION interactivity, since omitting the
	// task coerces to interactive later — a raw "did the caller ask" check
	// would be evaded by leaving the field out. It also refuses the terminal
	// attach and SSH into a run created under this profile, since a task or
	// exec run still has a sandbox to open a shell in (#1392).
	DenyInteractive bool `json:"deny_interactive,omitempty"`
	// DenyUIApps strips ui_apps from a run under this profile at create, and
	// the UI gateway refuses a session into a run created under it. A limit
	// rather than an empty ceiling ui_apps, which stays "no opinion" so
	// existing profiles keep their behaviour (#1391).
	DenyUIApps bool `json:"deny_ui_apps,omitempty"`
	// MaxConcurrentRuns caps how many NON-TERMINAL runs a member under this
	// profile may hold at once. 0 is unlimited.
	MaxConcurrentRuns int `json:"max_concurrent_runs,omitempty"`
	// DenyUserDrive refuses a USER DRIVE mount under this profile, whatever
	// an admin allocated. A DOOR, NOT A QUOTA: a drive outlives the run, so
	// "may this principal persist anything at all" is the question (403 +
	// authz.denied), not "how big".
	DenyUserDrive bool `json:"deny_user_drive,omitempty"`
	// MaxEphemeralDiskMiB caps the EPHEMERAL scratch (the writable layer when no drive is
	// mounted) a run under this profile may be given. 0 is unlimited. A CLAMP, NOT A DOOR: no
	// authz.denied at the bound. Enforced at dispatch only (runs_dispatch.go), folded with the
	// deployment's own storage.ephemeral.max_disk_mib; assigned members only, operators exempt.
	// Whether it actually binds depends on the substrate (Docker's overlay2 doesn't enforce
	// size at all) — render through StorageEnforcement, never claim a cap the substrate doesn't keep.
	MaxEphemeralDiskMiB int `json:"max_ephemeral_disk_mib,omitempty"`
	// MaxDriveSizeMiB caps how large a USER DRIVE may be under this profile. 0 is unlimited —
	// DenyUserDrive's twin ("may persist" vs "how much"). PER PRINCIPAL: a drive is one tree
	// belonging to one subject; a team-shared drive's ceiling is not the sum of its members'
	// and can't be derived from one, so sharing (0.8) adds a scope axis instead. Clamped in
	// newResolvedDrive, the one place holding both facts — never at grant write, where the
	// subject is claims-resolved and unreadable from the row. Folds with
	// storage.user_drive.max_size_mib in one min(), so launch, /me and preview can't disagree.
	MaxDriveSizeMiB int `json:"max_drive_size_mib,omitempty"`
	// AutonomyRubric maps a run's posture to a permitted AutonomyLevel
	// (0.8, #77). A POINTER so an unset rubric doesn't put
	// `"autonomy_rubric":{}` on every profile's wire body. Nil means "no
	// rubric" (resolveRunAutonomy, #97, treats it like no assigned profile).
	AutonomyRubric *AutonomyRubric `json:"autonomy_rubric,omitempty"`
	// RunLimits is embedded, so its seven fields sit flat on the limits wire
	// object beside the ones above — the same field set a run captures at
	// create (AgentRun.RunLimits).
	RunLimits
}

type GovernanceProfile struct {
	ID        uuid.UUID        `json:"id"`
	Name      string           `json:"name"`
	Ceiling   RunPolicySpec    `json:"ceiling"`
	Limits    GovernanceLimits `json:"limits"`
	CreatedAt time.Time        `json:"created_at"`
	UpdatedAt time.Time        `json:"updated_at"`
	CreatedBy string           `json:"created_by,omitempty"`
}

type GrantKind string

type GrantSpec struct {
	Kind GrantKind `json:"kind"`
	// Scope is kind-specific: {repos,permissions} for github_token; {host,header} for api_key;
	// {host,secret_name,username?} for git_pat; {host,key_secret_ref,username?,known_hosts_secret_ref?} for ssh_key.
	Scope json.RawMessage `json:"scope"`
	// TTL of the minted credential. Max (and default) 1h.
	TTLSeconds int `json:"ttl_seconds,omitempty"`
	// RequiresApproval forces a human approval to mint (vs auto-mint on policy).
	RequiresApproval bool `json:"requires_approval"`
	OwnerOnly        bool `json:"owner_only,omitempty"` // stored secret from the run owner's own row only, never the operator's
}

type HomeTemplate string

type Integration struct {
	// ID is an operator-chosen stable slug, unique within
	// SiteConfig.Integrations (no generated uuid — egress redirects'
	// token_integration_ref and workspace requirements point at it).
	ID   string `json:"id"`
	Name string `json:"name"`
	// Kind is the ONE field saying what this connects to: a closed-set kind
	// (ClosedIntegrationKinds) with bespoke behavior, or any other slug (generic).
	Kind string `json:"kind"`
	// Disabled turns the integration off without deleting its configuration.
	Disabled bool `json:"disabled,omitempty"`
	// Secrets are the required secrets, each with its delivery; refs/names only.
	Secrets []IntegrationSecret `json:"secrets,omitempty"`
	// Egress is WHERE THE SYSTEM LIVES: hosts this integration may reach
	// (proxy.ValidDomainEntry syntax: exact host or leading-"*." wildcard,
	// optionally ":port"). TRUST BOUNDARY: a wildcard opens the path but
	// never carries the credential — proxy-side injection needs an exact
	// entry, so a proxy_header secret is rejected at write time if any
	// egress entry is a wildcard or has a port.
	Egress []string `json:"egress,omitempty"`
	// Config is non-secret, kind-validated configuration; closed kinds accept
	// only known keys (unknown 400s by name at write), generic kinds take any
	// string keys.
	Config map[string]any `json:"config,omitempty"`
	Docs   string         `json:"docs,omitempty"`
	// DisabledCapabilities lists capability names this integration does NOT support.
	DisabledCapabilities []string  `json:"disabled_capabilities,omitempty"`
	CreatedAt            time.Time `json:"created_at"`
	UpdatedAt            time.Time `json:"updated_at"`
	// contains filtered or unexported fields
}

type IntegrationDelivery struct {
	Mode string `json:"mode"` // proxy_header | resident_file | resident_env
	// Header/Format apply to proxy_header: field name and value template (one
	// %s; empty means the raw secret IS the value).
	Header string `json:"header,omitempty"`
	Format string `json:"format,omitempty"`
	// Path applies to resident_file: the in-sandbox path the secret lands at.
	Path string `json:"path,omitempty"`
	// Var applies to resident_env: the environment variable name.
	Var string `json:"var,omitempty"`
}

type IntegrationList []Integration

type IntegrationSecret struct {
	Role       string               `json:"role"`
	SecretName string               `json:"secret_name"`
	Delivery   *IntegrationDelivery `json:"delivery,omitempty"`
}

type InternalHost struct {
	// HostSuffix matches a request host by label suffix: itself, or any host
	// ending in "."+HostSuffix (never a mid-label substring match).
	HostSuffix string `json:"host_suffix"`
	// CIDRs scopes the lift to these ranges only, each inside RFC1918,
	// fc00::/7, or 100.64.0.0/10 (ipguard.Liftable) — never loopback/
	// link-local/metadata/multicast/NAT64. Empty lifts the full Liftable set.
	CIDRs []string `json:"cidrs,omitempty"`
}

type LLMInspectionSpec struct {
	// Mode is "off" (default), "alert" (scan + audit, forward unchanged), or
	// "block" (a qualifying finding refuses the request). "" == "off".
	Mode string `json:"mode"`
	// WorkspaceSecretNames are operator-declared secret NAMES, resolved against the at-rest secret
	// store — the field an operator/admin actually AUTHORS. A name is not sensitive the way a value
	// is, so it may freely appear in a stored policy row. Resolved to WorkspaceSecretValues ONLY at
	// dispatch, in memory, on the per-dispatch policy copy handed to the proxy.
	WorkspaceSecretNames []string `json:"workspace_secret_names,omitempty"`
	// WorkspaceSecretValues are the RESOLVED secret VALUES the run must not leak into a prompt — the
	// v1 detection corpus the proxy actually matches against. NOT an authoring field:
	// validatePolicySpec refuses a non-empty value here on every policy write. Populated ONLY by
	// dispatch, in memory; every other copy carries names only, values redacted to a count. NEVER
	// logged. Values shorter than the masking floor are ignored.
	WorkspaceSecretValues []string `json:"workspace_secret_values,omitempty"`
	// DetectSecrets enables the known-secret detector (exact match against WorkspaceSecretValues).
	// At least one Detect* must be true when Mode != off.
	DetectSecrets bool `json:"detect_secrets,omitempty"`
	// DetectSecretPatterns enables the regex catalog of well-known secret formats (AWS/GitHub/Slack/
	// Google keys, PEM keys, JWTs, Stripe) — higher precision than entropy but can false-positive on
	// example/test keys in code.
	DetectSecretPatterns bool `json:"detect_secret_patterns,omitempty"`
	// DetectEntropy enables the Shannon-entropy detector (high FP in code; medium
	// severity so a strict block_min_severity can exclude it). Off by default.
	DetectEntropy bool `json:"detect_entropy,omitempty"`
	// DetectPII enables the regex/Luhn PII detector (best-effort, high false-negative recall — a
	// visibility signal, never a control). Off by default.
	DetectPII bool `json:"detect_pii,omitempty"`
	// DetectorSidecarURL, when set, adds an out-of-process detection sidecar the proxy POSTs each
	// span to. Trusted operator config. A sidecar error/timeout/non-200 respects on_scanner_error
	// like any other scanner error: fail-OPEN by default, fail-CLOSED when on_scanner_error=block —
	// so block mode with the sidecar as the SOLE detector DOES guarantee a block on sidecar failure.
	DetectorSidecarURL string `json:"detector_sidecar_url,omitempty"`
	// ClassifiedMarkers are operator-defined literal markers (e.g. "INTERNAL ONLY",
	// "CONFIDENTIAL//NOFORN") whose presence in outbound content flags a
	// classified-content leak. Case-insensitive substring match; category "classified".
	ClassifiedMarkers []string `json:"classified_markers,omitempty"`
	// ScanAttachments opts into decoding+scanning base64 image/document attachment
	// bytes in a prompt (off by default — binary, large, high-FP).
	ScanAttachments bool `json:"scan_attachments,omitempty"`
	// InspectForwardEgress extends inspection from the LLM routes to the GENERIC plaintext-HTTP
	// forward path, so a custom (non-LLM) HTTP connector's POST/PUT body is scanned too. Off by
	// default. (HTTPS connectors tunnel via opaque CONNECT and remain uninspected unless MITM'd.)
	InspectForwardEgress bool `json:"inspect_forward_egress,omitempty"`
	// MaxScanBytes caps the size of a single extracted span scanned; 0 => a
	// built-in default. A larger span is skipped (fail-open) and recorded.
	MaxScanBytes int `json:"max_scan_bytes,omitempty"`
	// OnScannerError selects behavior when the scanner ERRORS (e.g. an
	// unparseable body): "pass" (default, fail-open) or "block".
	OnScannerError string `json:"on_scanner_error,omitempty"`
	// RequireInspectableLLM, when true, refuses to schedule a run whose resolved LLM transport is
	// opaque (subscription-OAuth/Bedrock CONNECT) and therefore cannot be inspected — fail-closed,
	// like MinConfinementClass. Default false only WARNS (the common subscription user isn't punished).
	RequireInspectableLLM bool `json:"require_inspectable_llm,omitempty"`
	// InterceptTLS opts the run into TLS-MITM of opaque CONNECT tunnels to known LLM hosts
	// (Anthropic/OpenAI), making the subscription-OAuth path inspectable. TRUST BOUNDARY: the
	// control plane provisions a per-run CA — the PRIVATE key goes only to the proxy sidecar; the
	// sandbox trusts only the CA's PUBLIC cert. Adds a CA trust dependency inside the sandbox. Off by default.
	InterceptTLS bool `json:"intercept_tls,omitempty"`
	// BlockMinSeverity is the minimum finding severity that triggers a block in
	// "block" mode ("low"|"medium"|"high"|"critical"; "" => low).
	BlockMinSeverity string `json:"block_min_severity,omitempty"`
}

type LaunchPreset struct {
	Name        string          `json:"name"`
	Version     int             `json:"version"`
	Description string          `json:"description,omitempty"`
	UserTypes   []string        `json:"user_types"`
	Request     json.RawMessage `json:"request"`
	CreatedAt   time.Time       `json:"created_at"`
	UpdatedAt   time.Time       `json:"updated_at"`
	CreatedBy   string          `json:"created_by,omitempty"`
	UpdatedBy   string          `json:"updated_by,omitempty"`
}

type LostReason string

type ModelProvider struct {
	ID string `json:"id"` // admin's slug ("corp-gateway"); unique within the block
	// UID is SERVER-OWNED: minted on first write, never reissued once deleted. Every person's credential is
	// keyed by it, so a submitted value is ignored rather than trusted.
	UID  string            `json:"uid,omitempty"`
	Name string            `json:"name,omitempty"` // shown when people choose it ("Corp gateway")
	Kind ModelProviderKind `json:"kind"`
	// Disabled is negative-sense so the zero value is ENABLED. A disabled provider may remain an agent's
	// default: that default becomes a refused sentinel, never a fall-through to another provider.
	Disabled bool `json:"disabled,omitempty"`
	// BaseURL: required for custom_endpoint, an optional gateway override for Anthropic/OpenAI, never set
	// on Bedrock (its address is Bedrock.BaseURL).
	BaseURL string           `json:"base_url,omitempty"`
	Auth    *ProviderAuth    `json:"auth,omitempty"`    // how each person's token is sent; custom_endpoint only
	Bedrock *BedrockSettings `json:"bedrock,omitempty"` // region, address and sign-in setup for a Bedrock kind
	// Harnesses are the harnesses this provider serves, with per-pairing settings.
	Harnesses []ProviderHarness `json:"harnesses,omitempty"`
}

type ModelProviderKind string

type ModelProviders struct {
	Providers []ModelProvider `json:"providers,omitempty"`
}

type PauseReason string

type Person struct {
	Principal       string     `json:"principal"`
	Email           string     `json:"email,omitempty"`
	Issuer          string     `json:"issuer,omitempty"`
	TenantID        string     `json:"tenant_id,omitempty"`
	ObjectID        string     `json:"object_id,omitempty"`
	CreatedBy       string     `json:"created_by"`
	CreatedAt       time.Time  `json:"created_at"`
	FirstSignedInAt *time.Time `json:"first_signed_in_at,omitempty"`
}

type ProviderAuth struct {
	Header string `json:"header,omitempty"`
	Format string `json:"format,omitempty"`
}

type ProviderHarness struct {
	Harness string `json:"harness"` // harness-catalog id ("claude-code", "codex-cli")
	// Model: model id this harness uses on this provider; admin-set, no member override. Required
	// (an inference profile) on a Bedrock kind.
	Model string `json:"model,omitempty"`
	Path  string `json:"path,omitempty"` // where a custom endpoint serves this harness's API dialect, under BaseURL; may not change the host
	// AuthHeader and AuthFormat override the provider's Auth for this harness alone (custom_endpoint only).
	AuthHeader string `json:"auth_header,omitempty"`
	AuthFormat string `json:"auth_format,omitempty"`
}

type PushContentScope struct {
	// Repo is the repository as the run's grant names it: "github.com/<owner>/<repo>"
	// on the GitHub App lane, "<host>/<path>" on the git_pat lane (Azure DevOps:
	// "dev.azure.com/<org>/<project>/_git/<repo>").
	Repo string `json:"repo"`
	// Branch is the ref the push updates, "refs/heads/…"; several names join
	// sorted by ", ".
	Branch string `json:"branch"`
	// ActsAs is the credential the forwarded push authenticates with, as
	// "<grant kind>:<grant id>" — "github_token:<uuid>" or "git_pat:<uuid>".
	ActsAs string `json:"acts_as"`
	// Paths are the first PushContentMaxPaths review-matched paths, sorted,
	// each git-quoted (core.quotePath on, the sidecar's quotePath) so every
	// path is valid UTF-8 on the wire. A path ending in "/" is a directory the
	// push does not carry.
	Paths []string `json:"paths"`
	// PathsTotal is how many paths matched a review pattern in all.
	PathsTotal int `json:"paths_total"`
	// Commits are the object ids the push sets its refs to, sorted.
	Commits []string `json:"commits"`
	// Updates pairs each ref the push updates with the object id it sets it
	// to — all zeros for a delete — sorted by ref. Branch and Commits name the
	// same refs and ids for the card; Updates is what binds one to the other,
	// so the same commits sent to the same refs in a different assignment are
	// a different scope. A row raised before it existed has none and matches
	// no new raise.
	Updates []PushRefUpdate `json:"updates"`
	// PathsDigest is the lower-case hex SHA-256 over every review-matched path,
	// sorted, each followed by a NUL byte (a git path cannot contain one).
	PathsDigest string `json:"paths_digest"`

	// ActsAsKind and ActsAsLabel are SERVER-SET: the control plane resolves
	// ActsAs against the run's own grants and stamps them before the row is
	// stored, refusing a raise that carries either — a sidecar's word on who a
	// push acts as is not taken. ActsAsKind is one of the PushActsAs*
	// constants; ActsAsLabel is the principal the console names.
	ActsAsKind  string `json:"acts_as_kind,omitempty"`
	ActsAsLabel string `json:"acts_as_label,omitempty"`
}

type PushPathList struct {
	Paths     []string `json:"paths"`
	Truncated bool     `json:"truncated"`
}

type PushRefUpdate struct {
	Ref string `json:"ref"`
	New string `json:"new"`
}

type PushRulesSpec struct {
	// DenyPaths are path patterns (e.g. ".github/workflows/**") the broker
	// refuses in a push: "**" crosses path segments, "*" and "?" do not, and
	// the pattern is anchored at the repository root. A trailing "/" means
	// everything beneath the directory (DenyPathSegments).
	DenyPaths []string `json:"deny_paths,omitempty"`
	// MaxInspectPackMiB caps how much of an incoming push the broker buffers
	// before refusing it as too large. 0/absent takes the broker's own default,
	// below the authored maximum so raising this is a real remedy; bounded
	// 0..64 by validatePolicySpec.
	MaxInspectPackMiB int `json:"max_inspect_pack_mib,omitempty"`
	// RequireReviewPaths are patterns in DenyPaths' language whose match HOLDS
	// a push for an admin's decision instead of refusing it. A deny match wins
	// over a review match; an unattended run refuses rather than holding.
	RequireReviewPaths []string `json:"require_review_paths,omitempty"`
	// HoldSeconds is how long a held push waits for that decision before it
	// is refused. 0/absent means 120; bounded 0..600 by validatePolicySpec.
	HoldSeconds int `json:"hold_seconds,omitempty"`
	// DenyNewExecutables is reserved: the broker cannot yet tell a newly added executable from an
	// edit to an existing one, so validation refuses it when true rather than store a rule nothing
	// enforces, and IsSet does not count it, so a stored true never makes the broker inspect for
	// a rule it cannot apply.
	DenyNewExecutables bool `json:"deny_new_executables,omitempty"`
	// MaxFileSizeMiB refuses a push that introduces a file larger than this many MiB, or one whose
	// size the pack does not carry and the forge cannot show unchanged. 0/absent is off; bounded
	// 0..1024 by validatePolicySpec.
	MaxFileSizeMiB int `json:"max_file_size_mib,omitempty"`
}

type ResolvedDrive struct {
	Drive    UserDrive
	Grant    UserDriveGrant
	Tier     CapabilitySubjectType
	HomeName string // per-user segment: the subdirectory of a share, or the suffix of a managed object's name
	// SubjectHash fingerprints the principal HomeName was derived FROM
	// (DriveSubjectHash), carried so the runner can stamp it and refuse one
	// stamped for somebody else.
	SubjectHash string `json:"subject_hash,omitempty"`
	ObjectName  string // what the runner asks the substrate for — a volume name, a PVC name, or an absolute host path
	SizeMiB     int
	Writable    bool
	Enforcement StorageEnforcement
	// Paused is set when the grant that WON is disabled: nothing is derived
	// and nothing may be mounted, but the row still wins its tier (DESIGN
	// §2.2) rather than falling through.
	Paused bool
}

type ResolvedInjection struct {
	Host      string `json:"host"`
	Header    string `json:"header"`
	Value     string `json:"value"`
	JTI       string `json:"jti"`
	ExpiresAt int64  `json:"expires_at,omitempty"`
	// Organisation is the ADO org a per-person credential was dispatched for — informational only;
	// the proxy's REST gate pins the org from its own dispatch-time config, never from a resolve.
	Organisation string `json:"organisation,omitempty"`
	// Capabilities is the same lane's granted capability set, read once to confirm an asked-for
	// capability came back granted. Empty on other lanes.
	Capabilities []string `json:"capabilities,omitempty"`
}

type ResourceLimits struct {
	CPUMillis int `json:"cpu_millis,omitempty"` // milli-CPU; 2000 = 2 vCPU
	MemoryMiB int `json:"memory_mib,omitempty"` // hard memory cap in MiB
	PidsLimit int `json:"pids_limit,omitempty"` // max processes/threads (fork-bomb guard)
	DiskMiB   int `json:"disk_mib,omitempty"`   // writable storage cap in MiB (best-effort)
}

type RoleMapping struct {
	ID                 uuid.UUID `json:"id"`
	Value              string    `json:"value"`
	Role               string    `json:"role"`
	UserType           string    `json:"user_type,omitempty"`
	MigratedFromMember bool      `json:"migrated_from_member,omitempty"`
	CreatedAt          time.Time `json:"created_at"`
	CreatedBy          string    `json:"created_by,omitempty"`
}

type RunAttention struct {
	Kind    AttentionKind `json:"kind"`
	By      AttentionBy   `json:"by"`
	Pending int           `json:"pending"`
}

type RunLayout struct {
	Preset    string            `json:"preset"`
	Layout    []RunLayoutWidget `json:"layout"`
	UpdatedAt time.Time         `json:"updated_at"`
}

type RunLayoutWidget struct {
	Widget string `json:"widget"`
	X      int    `json:"x"`
	Y      int    `json:"y"`
	W      int    `json:"w"`
	H      int    `json:"h"`
}

type RunLimits struct {
	// MaxEndAheadSec: furthest ahead of NOW a run's end may be set (0 = no limit).
	// Extending within it never needs UserChangesLimits — extending is the lease.
	MaxEndAheadSec int `json:"max_end_ahead_sec,omitempty"`
	// DefaultEndSec is a new run's end, from create; 0 means MaxEndAheadSec, and
	// a run has no end when both are 0.
	DefaultEndSec int `json:"default_end_sec,omitempty"`
	// AllowNoEnd offers "No end" to a user who may change limits.
	AllowNoEnd bool `json:"allow_no_end,omitempty"`
	// MaxWaitSec/DefaultWaitSec: longest and default wait for a decision; 0 =
	// the deployment's approval expiry, which also caps both.
	MaxWaitSec     int `json:"max_wait_sec,omitempty"`
	DefaultWaitSec int `json:"default_wait_sec,omitempty"`
	// UserChangesLimits is the one gate: the user may shorten the end, set No
	// end, or change the wait.
	UserChangesLimits bool `json:"user_changes_limits,omitempty"`
	// PauseIdleAfterSec pauses an unused run after this long (0 pauses only
	// runs waiting for a decision).
	PauseIdleAfterSec int `json:"pause_idle_after_sec,omitempty"`
}

type RunPolicy struct {
	ID        uuid.UUID     `json:"id"`
	Name      string        `json:"name"`
	CreatedAt time.Time     `json:"created_at"`
	UpdatedAt time.Time     `json:"updated_at"`
	Spec      RunPolicySpec `json:"spec"`
}

type RunPolicySpec struct {
	// AllowedDomains is the L2 egress allowlist (exact hosts or "*." wildcards).
	AllowedDomains []string `json:"allowed_domains"`
	// DeniedDomains always wins over AllowedDomains.
	DeniedDomains []string `json:"denied_domains,omitempty"`
	// AllowAllEgress switches L2 egress from default-deny to "allow all (deny-list only)" mode: the
	// proxy allows ANY non-denied PUBLIC host, AllowedDomains may be empty. SECURITY: denied_domains
	// STILL wins, the SSRF/private-IP guard is unaffected, and credential injection STILL requires
	// an EXACT allowlist entry, so allow-all never widens where a secret may be injected.
	AllowAllEgress bool `json:"allow_all_egress,omitempty"`
	// FirstUseApproval controls how an unknown domain is handled: always_deny,
	// deny_with_review, or wait_for_review. Accepts the legacy boolean on the
	// wire. Inert under allow-all.
	FirstUseApproval FirstUseMode `json:"first_use_approval"`
	// FirstUseHoldSeconds bounds how long a wait_for_review connection is HELD
	// open awaiting a decision before the proxy refuses it. 0/absent keeps the
	// built-in 30s default; a positive value overrides it. Only wait_for_review
	// holds. See internal/egress/proxy configureHold.
	FirstUseHoldSeconds int `json:"first_use_hold_seconds,omitempty"`
	// MaxHolds caps concurrent wait_for_review holds. 0/absent keeps the
	// built-in 16 default. The (N+1)th concurrent held connection fails fast
	// rather than consuming an unbounded goroutine.
	MaxHolds int `json:"max_holds,omitempty"`
	// AllowedMethods optionally restricts HTTP methods (empty = all).
	AllowedMethods []string `json:"allowed_methods,omitempty"`
	// MinConfinementClass refuses to launch below this class.
	MinConfinementClass ConfinementClass `json:"min_confinement_class"`
	// EligibleGrants is the ceiling of credential scopes a run may request.
	EligibleGrants []GrantSpec `json:"eligible_grants,omitempty"`
	// AutoStopAfter stops idle sandboxes after this many seconds. 0/absent
	// means never reaped, same as an explicit negative (the reaper skips <=
	// 0); negative exists only to state never-reap intent explicitly.
	AutoStopAfterSec int `json:"auto_stop_after_sec,omitempty"`
	// WorkspaceMounts are host bind mounts injected into the sandbox. TRUST BOUNDARY: authored only
	// on a stored policy or inline create-run request by an admin/SSO-gated operator, never chosen
	// by the in-sandbox agent. validatePolicySpec runs runner.ValidateMount (the same deny-list the
	// docker driver enforces) at write time and again, defense-in-depth, at sandbox-create.
	WorkspaceMounts []WorkspaceMount `json:"workspace_mounts,omitempty"`
	// WorkspaceRepos are additional git repos attached to a run, paralleling WorkspaceMounts for
	// git-cloned (rather than bind-mounted) sources. Same admin/inline authoring surface and trust
	// boundary as WorkspaceMounts: never agent-chosen. validatePolicySpec enforces a unique-target
	// invariant across ALL WorkspaceMounts + WorkspaceRepos dests, so a clone can never land on a
	// bind target or shadow another repo's checkout.
	WorkspaceRepos []WorkspaceRepo `json:"workspace_repos,omitempty"`
	// LLMInspection optionally enables OUTBOUND content inspection at the proxy for brokered LLM
	// routes. Nil/omitted => OFF (the safe default). A guardrail + visibility layer, NOT
	// exfiltration prevention (see internal/contentscan + threatmodel §5.1).
	LLMInspection *LLMInspectionSpec `json:"llm_inspection,omitempty"`
	// UIApps declares the in-sandbox loopback HTTP apps the UI gateway may relay to a browser.
	// OPERATOR-AUTHORED, same trust boundary as WorkspaceMounts: an app is a NAME, a loopback PORT
	// and a PATH — never a command string. The gateway serves ONLY a declared port; `ssh -L` stays
	// the undeclared-port escape hatch.
	UIApps []UIApp `json:"ui_apps,omitempty"`
	// Resources caps sandbox CPU/memory/PIDs/disk. Nil, or a zero field, means "use the platform
	// default" — dispatch fills conservative defaults so EVERY run is capped, the multi-tenant
	// safety control that keeps one runaway/prompt-injected agent from OOM-killing the host,
	// fork-bombing it, or filling storage and taking down sibling runs.
	Resources *ResourceLimits `json:"resources,omitempty"`
	// ToolRules narrows an autonomous run's tool use from a BINARY (`tool_approvals`'s `auto`/`hold`)
	// to a policy: naming a TOOL and an effect (allow/hold/deny) lets "read freely, ask before shell,
	// never fetch the web" become expressible. Operator-authored and evaluated outside the sandbox
	// (proxy-side), so a compromised agent can't rewrite its own rules; it only narrows, and applies
	// only to a run already in `hold`, so a bad rule at worst asks more or refuses a call. Empty
	// preserves today's behaviour.
	ToolRules []ToolRule `json:"tool_rules,omitempty"`
	// GitPushAnyBranch turns OFF branch-namespace confinement for THIS run's brokered pushes (GitHub
	// App, opted-in git_pat and Azure DevOps Entra lanes). By default the broker forwards a push only
	// under refs/heads/wardyn/<run-id>/, so an agent can't rewrite main — right for an autonomous run,
	// wrong for a human-driven sandbox using an external tool with its own branch names. true =
	// forward to any branch the granted token may write, audited per push; the grant's own GitHub
	// ruleset still bounds what the token can touch. Operator-authored, never agent-settable.
	//
	// ponytail: whole-namespace off, not a per-run allowed-prefix list — add a
	// prefix list when someone needs an external tool AND confinement at once.
	GitPushAnyBranch bool `json:"git_push_any_branch,omitempty"`
	// PushRules declares CONTENT rules for this run's brokered git pushes — WHAT a push may touch,
	// alongside GitPushAnyBranch's WHERE. Nil (every pre-existing policy) means no content rules,
	// byte-identical to that prior wire shape, since every reader keys off IsSet. A policy that sets
	// PushRules while this run's only git-capable grant is ssh_key is legal but UNENFORCEABLE (SSH
	// has no broker seam) — composer.Grade surfaces that as a medium-risk WARNING, never a refusal.
	PushRules *PushRulesSpec `json:"push_rules,omitempty"`
	// AzureDevOpsCapabilities chooses THIS run's capabilities on the per-person Azure DevOps lane,
	// in place of the provider row's default_profile — which is what lets a saved policy act as a
	// saved access profile. It chooses only WITHIN the row's capability_ceiling: dispatch refuses a
	// run naming anything outside it, and the resolver re-checks the live ceiling on every request.
	// Empty/absent keeps the row's default_profile. Inert for a run not on that lane.
	AzureDevOpsCapabilities []adoscope.Capability `json:"azure_devops_capabilities,omitempty"`
}

type RunState string

type SSHPublicKey struct {
	Fingerprint   string     `json:"fingerprint"`
	Principal     string     `json:"principal"`
	Name          string     `json:"name"`
	PublicKey     string     `json:"public_key"` // authorized_keys line; never a secret
	Role          string     `json:"role"`
	RoleCheckedAt *time.Time `json:"role_checked_at,omitempty"`
	Capped        bool       `json:"capped"`
	CreatedAt     time.Time  `json:"created_at"`
}

type SiteBranding struct {
	LogoPath string `json:"logo_path,omitempty"`
}

type SiteConfig struct {
	// UpstreamProxySecretRef names a secret holding the corporate upstream
	// proxy URL, or "" for none. UpstreamProxyURL wins if both are set (not
	// rejected, so an operator can migrate between the two).
	UpstreamProxySecretRef string `json:"upstream_proxy_secret_ref,omitempty"`
	// UpstreamProxyURL is the corporate upstream proxy URL written IN THE
	// CLEAR (http only) — topology, not a credential. MUST NOT embed
	// userinfo (validateSiteConfig rejects that).
	UpstreamProxyURL string `json:"upstream_proxy_url,omitempty"`
	// UpstreamProxyNoProxy is the upstream proxy's BYPASS list (like
	// NO_PROXY): destinations wardyn-proxy dials DIRECTLY, matched by
	// host/domain-suffix or CIDR. Exists because a corporate forward proxy
	// won't CONNECT to an internal address (breaks PrivateLink estates).
	//
	// SECURITY: a bypassed dial still hits the unconditional private/
	// reserved-IP SSRF guard (InternalHosts is the only lift) and grants no
	// policy allow. "*" is REFUSED at write time; empty (default) is
	// unchanged behavior.
	UpstreamProxyNoProxy []string `json:"upstream_proxy_no_proxy,omitempty"`
	// ArtifactOverrides maps an ecosystem ("npm"|"pip"|"cargo"|"maven"|"go"|
	// "nuget") to its corporate artifact-registry redirect.
	//
	// Deprecated: superseded by EgressRedirects; kept only so a
	// pre-EgressRedirects document still decodes. handlePutSiteConfig and
	// migration 0030 each fold a set value into EgressRedirects once.
	ArtifactOverrides map[string]ArtifactOverride `json:"artifact_overrides,omitempty"`
	// EgressRedirects is the operator's outbound redirect list: FROM a
	// public/upstream URL or host TO a corporate-internal replacement.
	// Ecosystem set gets the full behavior (config file + substitution +
	// token injection); Ecosystem "" is network-only (no config file).
	EgressRedirects []EgressRedirect `json:"egress_redirects,omitempty"`
	// ScmHosts are the operator's default SCM hosts (e.g. "dev.azure.com",
	// "github.example.com") the SCM Provider step / egress bundling consult.
	ScmHosts []string `json:"scm_hosts,omitempty"`
	// Integrations are the operator-configured external connections (AI
	// providers, SCM hosts, generic connections), the generalized
	// replacement the legacy fields above are migrating toward. Both are
	// read; nothing removes the legacy fields yet.
	Integrations IntegrationList `json:"integrations,omitempty"`
	// InternalHosts declares an internal hostname the proxy's unconditional
	// private/reserved-IP SSRF guard would otherwise refuse; each entry
	// LIFTS the guard for matching addresses.
	//
	// SECURITY: leave CIDRs empty unless you know the sandbox's actual
	// addresses — empty is the full liftable set, the safe default.
	// Loopback/link-local/metadata/multicast/NAT64 stay denied regardless.
	// This only lifts the SSRF builtin; policy still decides reachability.
	// Admin-only, validated against ipguard.Liftable. Empty => no lift.
	InternalHosts []InternalHost `json:"internal_hosts,omitempty"`
	// WorkspaceProviders is the org's workspace-provider POLICY: which git
	// hosts a run may clone from, with which credential lanes, plus storage
	// ceilings. A POINTER since a value struct's omitempty is a no-op
	// (would break the byte-identical-GET claim). Nil is legacy open mode;
	// PUT /site-config's absent-key/explicit-{} makes it MDM-deliverable.
	WorkspaceProviders *WorkspaceProviders `json:"workspace_providers,omitempty"`
	// AgentProviders is the org's agent-enablement POLICY: which coding
	// agents this deployment offers, each one's model-access lane, and
	// whether that credential is shared or per-person. A POINTER for the
	// same byte-identical-GET reason as WorkspaceProviders, with the same
	// absent-key/explicit-{} write terms. Nil is legacy open mode.
	AgentProviders *AgentProviders `json:"agent_providers,omitempty"`
	// ModelProviders is the org's model-provider configuration — a POINTER
	// for the same byte-identical-GET reason. Nil keeps today's
	// lane-resolution path.
	ModelProviders *ModelProviders `json:"model_providers,omitempty"`
	// SignInHelpText and SignInHelpURL are the admin's "what to do next",
	// shown on the sign-in page for refusals a person can't clear alone.
	//
	// SECURITY: PUBLIC — the anonymous /healthz publishes both, so they must
	// never name internal systems. Text <=1,000 chars, no control chars;
	// URL is http(s) only.
	SignInHelpText string `json:"sign_in_help_text,omitempty"`
	SignInHelpURL  string `json:"sign_in_help_url,omitempty"`
	// Branding is the part of the console branding (#1215) a site config can
	// carry: today only the logo, as a file wardynd reads when this document is
	// applied. A POINTER for the same byte-identical-GET reason as the provider
	// blocks; nil is "the site config says nothing about branding". Name and
	// colours stay with the Branding card (PUT /branding/settings).
	Branding *SiteBranding `json:"branding,omitempty"`
	// EffectiveScmHosts is READ-ONLY, SERVER-OWNED: ScmHosts minus hosts a
	// provider row claims, union enabled providers' hosts. A real field
	// (not a wrapper key) so a get|set round trip still decodes under
	// DisallowUnknownFields. PUT ignores a submitted value; never stored.
	EffectiveScmHosts []string `json:"effective_scm_hosts,omitempty"`
	// WithheldScmHosts is READ-ONLY, SERVER-OWNED, on the same terms as
	// EffectiveScmHosts: each host a DISABLED provider row claims that
	// EffectiveScmHosts therefore leaves out, with the row that withholds it, so
	// an admin is told why a host is missing rather than left to look for it.
	// Projected on read, ignored on PUT, never stored.
	WithheldScmHosts []WithheldScmHost `json:"withheld_scm_hosts,omitempty"`
	// OnboardingCompletedAt records when an operator finished (or left) the
	// Getting Started funnel on THIS INSTALL. Nil until then.
	//
	// Server-side because a localStorage flag outlived a wiped database and
	// was scoped per-origin (127.0.0.1 vs localhost disagreed).
	//
	// NOT settable via PUT /site-config — the handler ignores a submitted
	// value and carries the stored one forward; a dropped value is reported
	// as onboarding_completed_at_ignored.
	OnboardingCompletedAt *time.Time `json:"onboarding_completed_at,omitempty"`
}

type Source struct {
	ID   uuid.UUID  `json:"id"`
	Kind SourceKind `json:"kind"`
	// Locator is the identity: a host dir path (local_dir, trimmed) or
	// canonical repo slug/clone URL (repo, lowercased); with Ref, unique in the store.
	Locator string `json:"locator"`
	// Ref is an optional git ref (repo only); part of identity, so the same repo at two refs is two sources with two contracts.
	Ref          string                          `json:"ref,omitempty"`
	Name         string                          `json:"name"`
	Requirements map[string]WorkspaceRequirement `json:"requirements,omitempty"` // this source's own contract; see the type doc above
	// Profile is this source's scan result, opaque here (never interpreted, only
	// persisted/returned). json.RawMessage, not []byte: a bare []byte gets
	// base64-encoded by encoding/json (WIRE-2), shipping it to GET /sources as
	// an opaque string instead of real JSON.
	Profile     json.RawMessage `json:"profile,omitempty"`
	Status      WorkspaceStatus `json:"status"`                  // scan lifecycle: pending_scan | scanning | scanned | error
	ActiveRunID *uuid.UUID      `json:"active_run_id,omitempty"` // fences this source's in-flight scan run
	CreatedAt   time.Time       `json:"created_at"`
	UpdatedAt   time.Time       `json:"updated_at"`
}

type SourceKind string

type StorageEnforcement string

type StorageProviders struct {
	Ephemeral *EphemeralProvider `json:"ephemeral,omitempty"`  // bounds writable scratch when a run mounts no drive
	UserDrive *UserDriveProvider `json:"user_drive,omitempty"` // org switch and ceiling over user drives
}

type ToolEffect string

type ToolRule struct {
	Tool   string     `json:"tool"`
	Effect ToolEffect `json:"effect"`
}

type UIApp struct {
	Name string `json:"name"`
	Port int    `json:"port"`
	Path string `json:"path,omitempty"`
}

type UserDrive struct {
	ID      uuid.UUID    `json:"id"`
	Name    string       `json:"name"`
	Backend DriveBackend `json:"backend"`
	// HostRoot is the operator-mounted tree a host_path drive binds a
	// subdirectory of; empty for every other backend. Authored by an admin
	// and bound into OTHER PEOPLE's sandboxes, so the security ceiling is the
	// env allowlist (UserDriveHostRootCheck), never this column alone.
	HostRoot     string       `json:"host_root,omitempty"`
	StorageClass string       `json:"storage_class,omitempty"` // k8s_pvc provisioner to request; "" = cluster default
	HomeTemplate HomeTemplate `json:"home_template"`
	// ObjectScheme names which half of a minted object name carries the
	// drive — see DriveObjectScheme. NOT client-authored: on the wire only so
	// a GET and round-tripped PUT agree.
	ObjectScheme DriveObjectScheme `json:"object_scheme,omitempty"`
	// SizeMiB is the ALLOCATION, not a guarantee — see StorageEnforcement. 0
	// means "no allocation shown" except on k8s_pvc, where it IS
	// requests.storage.
	SizeMiB   int          `json:"size_mib,omitempty"`
	Writable  bool         `json:"writable,omitempty"`
	Reclaim   DriveReclaim `json:"reclaim"`
	CreatedAt time.Time    `json:"created_at"`
	UpdatedAt time.Time    `json:"updated_at"`
	CreatedBy string       `json:"created_by,omitempty"`
}

type UserDriveGrant struct {
	ID              uuid.UUID             `json:"id"`
	SubjectType     CapabilitySubjectType `json:"subject_type"`
	Subject         string                `json:"subject"`
	DriveID         uuid.UUID             `json:"drive_id"`
	Priority        int                   `json:"priority"`                    // breaks ties WITHIN a tier (higher wins); does NOT cross tiers
	SizeMiBOverride int                   `json:"size_mib_override,omitempty"` // 0 means "use the drive's"
	// WritableOverride is TRI-STATE: nil is "use the drive's posture",
	// explicit false is "read only even on a writable drive".
	WritableOverride *bool `json:"writable_override,omitempty"`
	// HomeOverride names this subject's directory verbatim. USER TIER ONLY:
	// on a group/all row it would give every member ONE home.
	HomeOverride string `json:"home_override,omitempty"`
	// Enabled is the admin's off switch. A disabled row still wins its tier:
	// the winner's bit folds to ResolvedDrive.Paused rather than silently
	// falling through to the wider row beneath it.
	Enabled   bool      `json:"enabled"`
	CreatedAt time.Time `json:"created_at"`
	CreatedBy string    `json:"created_by,omitempty"`
}

type UserDriveHostRootCheck func(hostRoot string) error

type UserDriveListItem struct {
	UserDrive
	GrantCount int `json:"grant_count"`
}

type UserDriveProvider struct {
	Disabled   bool `json:"disabled,omitempty"`     // turns drives off deployment-wide, negative-sense like GitProvider.Disabled, so zero value is today
	MaxSizeMiB int  `json:"max_size_mib,omitempty"` // largest drive allowed, refused at admin write boundary and clamped at resolve; 0 = no ceiling
}

type UserType struct {
	// ID is the immutable slug role-map values, grant subjects and token
	// stamps refer to.
	ID          string `json:"id"`
	Name        string `json:"name"`
	Description string `json:"description"`
	// Priority breaks a sign-in tie between two custom types (higher wins).
	// Always 0 on the built-in type, which never takes part in a tie.
	Priority  int       `json:"priority"`
	BuiltIn   bool      `json:"built_in"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
	CreatedBy string    `json:"created_by,omitempty"`
}

type WithheldScmHost struct {
	Host         string          `json:"host"`
	ProviderID   string          `json:"provider_id"`
	ProviderKind GitProviderKind `json:"provider_kind"`
}

type Workspace struct {
	ID   uuid.UUID `json:"id"`
	Name string    `json:"name"`
	// Sources is the composition: one-or-more local_dir/repo/ephemeral entries.
	Sources []WorkspaceSource `json:"sources"`
	// BaseImage is the base-image choice; nil means the platform default
	// convention image for the detected/scanned stack.
	BaseImage *WorkspaceBaseImage `json:"base_image,omitempty"`
	// Requirements is the declared requirements contract, keyed by a fixed
	// grammar of "<type>:<key>":
	//
	//	secret:NAME       a named secret must be resolvable, e.g. "secret:acme-anthropic-key"
	//	egress:host       the host must be reachable (bare host or "*."-wildcard), e.g. "egress:api.github.com"
	//	write:/host/path  the HOST path must be mounted writable, e.g. "write:/home/user/repo"
	//	integration:ID    the named Integration must be granted, e.g. "integration:git_host:github.com"
	//
	// Split on the FIRST colon only, since a write:/integration: key may itself
	// contain colons. An overlay on attached sources' own contracts;
	// EffectiveRequirements is the folded result a run consumes.
	Requirements map[string]WorkspaceRequirement `json:"requirements,omitempty"`

	// Attachments is the tier-3 composition: ordered source refs and inline
	// ephemeral rows with per-attachment target/writable/overrides. Empty on
	// a pre-split row, falling back to Sources.
	Attachments []WorkspaceAttachment `json:"attachments,omitempty"`
	// BaseImageID references the shared base-image catalog (tier 2); nil means
	// "recommended" (per-workspace derived build) by design, not absence.
	BaseImageID *uuid.UUID `json:"base_image_id,omitempty"`
	// EffectiveRequirements is derived, read-only, never persisted: the
	// FoldWorkspaceContract result over attachments + source contracts + the
	// overlay above (equals Requirements on a pre-split row).
	EffectiveRequirements map[string]WorkspaceRequirement `json:"effective_requirements,omitempty"`

	// Kind mirrors Sources[0].Type (single-source only).
	Kind WorkspaceKind `json:"kind"`
	// Source mirrors Sources[0]'s host path (local_dir) or repo slug/URL (repo, single-source only).
	Source string `json:"source"`
	// Ref mirrors Sources[0].Ref (single-source repo only).
	Ref string `json:"ref,omitempty"`
	// DefaultTarget mirrors Sources[0].Target (single-source only).
	DefaultTarget string `json:"default_target,omitempty"`

	// Profile is internal/workspacescan's WorkspaceProfile, opaque here; nil/empty until scanned.
	Profile json.RawMessage `json:"profile,omitempty"`
	// ImageRef is the resolved/generated image for this workspace's profile; empty until scanned/built.
	ImageRef string `json:"image_ref,omitempty"`
	// BuiltProfileHash is the profile hash ImageRef was built from, the
	// build-once/reuse-many cache key (rebuild only when it changes).
	BuiltProfileHash string `json:"built_profile_hash,omitempty"`
	// ApprovedEgress is the operator-owned list of egress hosts explicitly
	// promoted, unioned into a run's allowlist. Never written by a scan;
	// cleared when the composition changes.
	ApprovedEgress []string `json:"approved_egress,omitempty"`
	// DeniedEgress mirrors ApprovedEgress: hosts explicitly blocked, folded
	// into denied_domains at create (deny beats allow/allow_all_egress/a
	// runtime approval alike). Unlike ApprovedEgress, not cleared on source
	// change (migration 0040) — a deny needs no re-review.
	DeniedEgress []string `json:"denied_egress,omitempty"`
	// EgressEditedAt is when an operator last REPLACED one of the two lists
	// above — read by the boot heal, which without it would let a decided
	// `always` approval re-widen a just-removed host every restart. Stamped
	// only by those two scoped setters.
	EgressEditedAt *time.Time `json:"egress_edited_at,omitempty"`
	// ActiveRunID is the in-flight scan/record run, so the import panel can
	// poll "is my step still running" without scanning all runs.
	ActiveRunID *uuid.UUID `json:"active_run_id,omitempty"`
	// RecordResults is the per-task Record Mode state; opaque
	// map[string]api-owned JSON. Written only via SetWorkspaceRecordResult;
	// cleared on composition change.
	RecordResults json.RawMessage `json:"record_results,omitempty"`
	// LLMCred is the model/harness credential binding a run inherits (see
	// WorkspaceLLMCred). Written only via the scoped SetWorkspaceLLMCred.
	LLMCred *WorkspaceLLMCred `json:"llm_cred,omitempty"`
	// OwnedBy is the member who created this workspace (lowercased OIDC sub or
	// email); empty means operator-owned. TRUST BOUNDARY: ownsWorkspaceOrAdmin
	// keys on non-empty — only that member or an admin may read/write it, else
	// the same 404 as a missing workspace. Set only by handleCreateWorkspace.
	OwnedBy   string          `json:"owned_by,omitempty"`
	Status    WorkspaceStatus `json:"status"`
	CreatedAt time.Time       `json:"created_at"`
	UpdatedAt time.Time       `json:"updated_at"`
	// AvailableToYou (#1267): per-caller bit — would the same decide path a
	// launch runs admit THIS workspace for this reader? Computed fresh per GET
	// (workspaceAvailableToCaller), never stored or accepted on write; always
	// true for an operator. Pointer with omitempty: only the two GET stampers
	// set it, so a plain bool would ship a false "unavailable" elsewhere — the
	// console's "absent means fall back" contract needs the omitted key.
	AvailableToYou *bool `json:"available_to_you,omitempty"`
}

type WorkspaceAttachment struct {
	SourceID  *uuid.UUID `json:"source_id,omitempty"`
	Ephemeral bool       `json:"ephemeral,omitempty"` // marks an inline scratch row (never a library entity)
	Target    string     `json:"target,omitempty"`    // in-sandbox mount/clone/scratch path for this attachment
	Writable  bool       `json:"writable,omitempty"`  // opts a local_dir attachment into read-write, per-attachment not per-source
	// Overrides is this workspace's stance on requirement keys the attached
	// source declares: reqKey -> off|optional|required. Never edits the
	// shared source; keys the source doesn't declare are ignored harmlessly.
	Overrides map[string]string `json:"overrides,omitempty"`
}

type WorkspaceBaseImage struct {
	// Kind is "recommended" (convention image for the detected stack),
	// "registry" (operator-picked, named by Image), "custom" (Image is a base,
	// see Steps), or "byo" (Image used verbatim).
	Kind string `json:"kind"`
	// Image is the base image reference. Meaning depends on Kind: the FROM for
	// "custom", the image itself for "registry"/"byo", unused for "recommended".
	Image string `json:"image,omitempty"`
	// Steps is CATALOG IDENTITY ONLY, never applied to an image. SECURITY:
	// running operator-authored RUN lines would be host-side RCE
	// (assertWrapSafeBase also refuses ONBUILD), so "custom" builds
	// identically to "byo". Must stay: part of base_images' UNIQUE(kind, image)
	// index; removing it mints duplicate rows.
	Steps []string `json:"steps,omitempty"`
}

type WorkspaceKind string

type WorkspaceLLMCred struct {
	// ProviderRef pins a run to one model provider (by id). A disallowed or
	// ineligible pin refuses the run rather than falling through to another
	// provider.
	ProviderRef string `json:"provider_ref,omitempty"`
	// ProviderUnavailable is set by the server on a READ only, in place of
	// ProviderRef, for a caller "Available to" does not admit to the pinned
	// provider: the workspace is pinned, to a provider they cannot use, and
	// its id is not theirs to learn (#1018). A write carrying it is refused.
	ProviderUnavailable bool `json:"provider_unavailable,omitempty"`
}

type WorkspaceMount struct {
	Source   string `json:"source"`
	Target   string `json:"target"`
	ReadOnly *bool  `json:"read_only,omitempty"`
}

type WorkspaceProviders struct {
	// Git rows: hosts a run may clone from and the credential lanes usable there.
	Git []GitProvider `json:"git,omitempty"`
	// Storage is the file-system half. A nil block is legacy behaviour.
	Storage *StorageProviders `json:"storage,omitempty"`
	// GitPatBrokerEnabled is read-only and server-owned: projected from
	// WARDYN_GIT_PAT_BROKER on every GET, never stored or accepted on a PUT.
	// A pointer since nil ("never projected") differs from a present false.
	GitPatBrokerEnabled *bool `json:"git_pat_broker_enabled,omitempty"`
}

type WorkspaceRepo struct {
	Repo   string `json:"repo"`
	Target string `json:"target,omitempty"`
	Ref    string `json:"ref,omitempty"`
}

type WorkspaceRequirement struct {
	// Level is "required" (a run cannot proceed without it) or "optional"
	// (a run may proceed without it, degraded).
	Level string `json:"level"`
	// Provenance is "scan_seeded" (the scanner detected the need) or
	// "operator_set" (an operator declared it directly).
	Provenance string `json:"provenance"`
}

type WorkspaceSource struct {
	Type WorkspaceSourceType `json:"type"`
	// Path is the host directory path (local_dir only).
	Path string `json:"path,omitempty"`
	// Source is the repo slug/URL (repo only).
	Source string `json:"source,omitempty"`
	// Ref is an optional git ref (branch/tag/sha, repo only).
	Ref string `json:"ref,omitempty"`
	// Target is the mount/clone/scratch-dir path inside the sandbox.
	Target string `json:"target,omitempty"`
	// Writable opts a local_dir source into read-write (default false =
	// read-only; a plain bool since false is already the safe default).
	Writable bool `json:"writable,omitempty"`
	// Overrides is this attachment's stance on requirement keys its source
	// declares: reqKey -> off|optional|required (workspace_contract.go's
	// AttachmentOverride* constants). nil means "say nothing" (server carries
	// forward the prior override); an explicit map REPLACES it outright.
	Overrides map[string]string `json:"overrides,omitempty"`
	// Admitted is a server-owned read projection, never persisted or from a
	// write body: does policy admit this clone URL today? A pointer so
	// "no answer" (absent, no provider row) differs from "not admitted".
	Admitted *bool `json:"admitted,omitempty"`
}

type WorkspaceSourceType string

type WorkspaceStatus string