types

type ADOEntraConfig struct {
	// TenantID is the Entra tenant every sign-in for this row goes to (GUID); a well-known alias ("common", "organizations") is refused.
	TenantID string `json:"tenant_id"`
	ClientID string `json:"client_id"` // app registration the sign-in names, as a GUID
	// CapabilityCeiling is the widest capability set a run on this row may
	// ever hold; required and non-empty when the block is present.
	CapabilityCeiling []adoscope.Capability `json:"capability_ceiling,omitempty"`
	DefaultProfile    []adoscope.Capability `json:"default_profile,omitempty"` // what a run gets by default; empty reads as adoscope.ProfileDefault
	TokenMode         ADOTokenMode          `json:"token_mode,omitempty"`      // empty reads as ADOTokenModeBearer
	// PATMaxHours is the longest a minted_pat run's token lives (1-168). 0
	// reads as 8; read via PATHours, never directly.
	PATMaxHours int `json:"pat_max_hours,omitempty"`
	// PATMaxDays is the furthest expiry an own_pat token may carry (1-90). 0
	// reads as 30; read via PATDays, never directly. A Server row has no entra
	// block, so it cannot set this and always reads the default, 30.
	PATMaxDays int `json:"pat_max_days,omitempty"`
	// RESTAPI: brokered REST calls, or only git traffic. Default true; read
	// via RESTAPIEnabled, never directly.
	RESTAPI *bool `json:"rest_api,omitempty"`
	// RunnerResident opts this connection's minted tokens in to runner_resident
	// delivery: held in a self-hosted runner's OS keystore for the run and
	// injected by the runner's own proxy, where the class's delivery policy and
	// posture requirement allow it. Off by default.
	RunnerResident bool `json:"runner_resident,omitempty"`
	// RunnerResidentSandbox also hands that token into the sandbox, where the
	// agent can use it past the REST gate and capability holds. Requires
	// RunnerResident.
	RunnerResidentSandbox bool `json:"runner_resident_sandbox,omitempty"`
}

type ADOTokenMode string

type APIToken struct {
	ID              uuid.UUID  `json:"id"`
	Principal       string     `json:"principal"`
	Email           string     `json:"email,omitempty"`
	Role            string     `json:"role"`
	UserType        string     `json:"user_type"`
	Groups          []string   `json:"groups,omitempty"`
	GroupsTruncated *bool      `json:"groups_truncated,omitempty"`
	Name            string     `json:"name"`
	CreatedAt       time.Time  `json:"created_at"`
	LastUsedAt      *time.Time `json:"last_used_at,omitempty"`
	RevokedAt       *time.Time `json:"revoked_at,omitempty"`
	ExpiresAt       *time.Time `json:"expires_at,omitempty"` // nil = never expires; an expired token authenticates nothing
	MintedBy        string     `json:"minted_by,omitempty"`  // admin who minted this for its owner; empty when the owner minted it
	// Disposition is where an admin-minted token stands, derived at read (#1508); empty on any other token.
	Disposition TokenDisposition `json:"disposition,omitempty"`
	// ServiceIdentity names the service identity an admin linked this token to, set with Disposition on
	// a token that has a move row (#1508); empty on any other token.
	ServiceIdentity string `json:"service_identity,omitempty"`
	Token           string `json:"token,omitempty"` // plaintext, create response ONLY
	// IdentityStampedAt is when Role and Groups were last stamped: at mint, then at each sign-in of
	// the owner. Nil reads as stale under WARDYN_ROLE_STAMP_TTL. Never on the wire.
	IdentityStampedAt *time.Time `json:"-"`
	// RevSeq is the revocation sequence read when the token was minted; migration 0176 gave the tokens
	// that existed their order once. 0 only for a token written by a replica that predates it, which a
	// revocation cutoff orders on CreatedAt. Never on the wire.
	RevSeq int64 `json:"-"`
}

type ActorType string

type AgentProvider struct {
	// ID is the --agent value this row governs: a harness-catalog id OR a
	// WARDYN_AGENT_IMAGES key. The image-map half is deliberate: harnessByID
	// documents an image-map-only custom agent as supported, so a block that
	// refuses agents without a row must let the admin write one for their own.
	ID string `json:"id"`
	// Disabled turns the row off without deleting it — negative-sense, so the
	// zero value is ENABLED. Its runs are refused and the console renders it
	// unavailable, never hidden.
	Disabled bool `json:"disabled,omitempty"`
	// DefaultProvider names the model provider a new run of this agent uses
	// unless the person chooses another; must be enabled for this agent. If
	// later disabled, the default becomes a sentinel whose runs are refused,
	// never silently moved to another provider.
	DefaultProvider string `json:"default_provider,omitempty"`
}

type AgentProviders struct {
	// Agents are the per-agent rows; an agent with NO row is not offered at
	// all once the block exists.
	Agents []AgentProvider `json:"agents,omitempty"`
}

type AgentRun struct {
	ID        uuid.UUID `json:"id"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
	CreatedBy string    `json:"created_by"` // human principal (token `sub`)
	Agent     string    `json:"agent"`      // e.g. "claude-code", "codex-cli"
	Repo      string    `json:"repo"`       // e.g. "org/name"
	Task      string    `json:"task"`       // human task description
	// Title groups runs in the console's list; empty for legacy/system runs, which fall back to Task.
	Title string `json:"title,omitempty"`
	// Description is optional free-text context; display-only, never interpreted.
	Description      string           `json:"description,omitempty"`
	PolicyID         *uuid.UUID       `json:"policy_id,omitempty"`
	ConfinementClass ConfinementClass `json:"confinement_class"`
	State            RunState         `json:"state"`
	SPIFFEID         string           `json:"spiffe_id"`     // spiffe://<trust-domain>/agent-run/<id>; empty while QUEUED, written when the run starts
	RunnerTarget     string           `json:"runner_target"` // "docker"
	// Placement is where the sandbox lives (OD-8): remote (the organisation's own
	// executor), local (a runner the person registered), or empty for a run from
	// before 0.9 and for one whose placement nothing has recorded yet. ALWAYS on
	// the wire — a run has a placement even when the value is the empty one.
	Placement Placement `json:"placement"`
	// PlacementFilled records that a placement was RESOLVED for this run rather
	// than asked for by name, so an incident review can tell "the person chose
	// local" from "local was the only eligible placement".
	PlacementFilled bool `json:"placement_filled,omitempty"`
	// RunnerID names the runner a local run landed on. NULL for a remote run and
	// for every run from before 0.9; omitted on the wire when NULL, never "".
	RunnerID *uuid.UUID `json:"runner_id,omitempty"`
	// RunnerName, RunnerOnline and RunnerLastSeenAt are read-side facts about that runner, projected on
	// the run routes and never stored. They are absent for a remote run and when the runner could not be
	// read. The name is the runner's current one, which equals the name at create: a runner is never
	// renamed and a claimed row is never deleted, so a revoked runner's run keeps it. RunnerOnline is
	// this process's live view, so a pointer: absent is unknown. false is a fact on a single replica (also
	// when the hub cannot be asked); under WARDYN_HA it is never sent, because a replica that does not hold
	// the runner's session cannot tell offline from connected elsewhere.
	RunnerName       string     `json:"runner_name,omitempty"`
	RunnerOnline     *bool      `json:"runner_online,omitempty"`
	RunnerLastSeenAt *time.Time `json:"runner_last_seen_at,omitempty"`
	// EvidenceSource says who can attest this run's evidence (OD-8): substrate or
	// runner_asserted, empty for a legacy or unresolved record. Not
	// `confinement_source`, which says who CHOSE the class.
	EvidenceSource RunEvidenceSource `json:"evidence_source,omitempty"`
	// RunnerPoolID is the runner pool the run was admitted into, and the next three fields say how
	// (all written once at create). A pool is a label for a choice and never admission: the run
	// goes to the exact runner recorded in RunnerID (a self-hosted runner) or RunnerPoolExecutor (a
	// remote-hosted runner's id), whatever the pool or anyone's defaults say later. Nil for a run from
	// before pools and for a server-originated run that names none; RunnerPoolSelection is then empty.
	RunnerPoolID        *uuid.UUID          `json:"runner_pool_id,omitempty"`
	RunnerPoolRevision  int64               `json:"runner_pool_revision,omitempty"`
	RunnerPoolSelection RunnerPoolSelection `json:"runner_pool_selection,omitempty"`
	RunnerPoolExecutor  string              `json:"remote_runner_id,omitempty"`
	// Reserved is what the run holds on its runner while it holds a sandbox there (0174): the CPU and
	// memory it was given and its main drive, written once at insert and summed as the runner's In use.
	Reserved   RunnerAmounts `json:"-"`
	SandboxRef string        `json:"sandbox_ref,omitempty"`
	Image      string        `json:"image,omitempty"` // resolved sandbox image, kept for provenance; empty for legacy rows
	// Interactive marks a human-driven run: sandbox comes up RUNNING, no task exec'd, no completion watcher.
	Interactive bool `json:"interactive"`
	// Experience is the canonical run mode chosen at launch (0.9 New Run), frozen at create and never re-derived. Empty for a run from an older client or before 0.9;
	// BackgroundOnly is the one predicate every interactive door reads. It is not Interactive, which is the legacy execution flag.
	Experience RunExperience `json:"experience,omitempty"`
	// WorkspacePath is the run's primary host directory, denormalized so the control plane can warn (never block) a second run on it.
	WorkspacePath string `json:"workspace_path,omitempty"`
	// WorkspaceID marks a governed scan run: the driver runs wardyn-scan instead of the agent, trusted (not sandbox input) to persist the profile.
	WorkspaceID *uuid.UUID `json:"workspace_id,omitempty"`
	// WorkspaceIDs is the onboarded workspaces this run's policy referenced at create; grants nothing, only tells an `always` egress decision what to persist to.
	WorkspaceIDs []uuid.UUID `json:"workspace_ids,omitempty"`
	SourceID     *uuid.UUID  `json:"source_id,omitempty"` // trusted run→library-source linkage for a per-source scan run; never set by user runs
	// AutoStopAfterSec is the run's idle auto-stop cap, frozen at create so the reaper works with no policy_id to JOIN. 0 = never; <0 = explicit never.
	AutoStopAfterSec int    `json:"auto_stop_after_sec,omitempty"`
	AgentExecID      string `json:"agent_exec_id,omitempty"` // docker exec id, so the crash reconciler can check agent liveness across a wardynd restart
	FailureHint      string `json:"failure_hint,omitempty"`  // operator-facing reason a run FAILED before the agent started; display-only
	// StatusDetail is what the substrate says this run awaits while STARTING, and a lifetime end reason ("lifetime: end_reached", "lifetime: max_lifetime_reached") on a run KILLED at its end or its maximum; blanked on leaving STARTING except a TERMINAL failure reason or a lifetime end reason (kept for postmortem).
	StatusDetail string `json:"status_detail,omitempty"`
	StatusReason string `json:"status_reason,omitempty"` // reason token parsed out of StatusDetail, derived at read, never stored
	// AutonomyLevel freezes the level resolved at create, not the profile/posture that produced it (that's on the audit row).
	AutonomyLevel AutonomyLevel `json:"autonomy_level,omitempty"`
	// AdmittedAt is when a queued run was promoted out of the queue; written by promotion only, so nil for a run that never waited.
	AdmittedAt *time.Time `json:"admitted_at,omitempty"`
	// Queue is a waiting run's place in its pool's queue, derived at read from the queue row and never stored on the run; absent once the run leaves QUEUED.
	Queue  *RunQueue  `json:"queue,omitempty"`
	EndsAt *time.Time `json:"ends_at"` // run's lease end, captured once at create from RunLimits, never re-resolved
	// LifetimeCapAt is the latest end the pool and the deployment allow, measured from launch (created_at plus the lowest of their maximums); absent when neither bounds the lifetime or for a run from before this column. LifetimeCapSource names which one bound it (pool or deployment) and stays off the wire.
	LifetimeCapAt     *time.Time  `json:"lifetime_cap_at,omitempty"`
	LifetimeCapSource LimitSource `json:"-"`
	WaitBudgetSec     int         `json:"wait_budget_sec,omitempty"` // how long an approval this run raises stays open; 0 = deployment default alone applies
	// RunLimits are the owner's profile limits as they stood at create; later clamps use these captured bounds, never the profile's current ones.
	RunLimits           RunLimits  `json:"run_limits"`
	GovernanceProfileID *uuid.UUID `json:"governance_profile_id,omitempty"`
	// LostAt/LostReason mark a run that lost its sandbox but is kept (no proxy/network, files stay); stays RUNNING until a kill or the ended-run grace.
	LostAt     *time.Time `json:"lost_at,omitempty"`
	LostReason LostReason `json:"lost_reason,omitempty"`
	// ContainmentError/At: latest/first stop-confirm failure for a kept run; the lease sweep retries and clears both once it lands.
	ContainmentError   string     `json:"containment_error,omitempty"`
	ContainmentErrorAt *time.Time `json:"containment_error_at,omitempty"`
	// EndedAt stamps the transition into a terminal RunState; a lease-ended run stays RUNNING until the ended-run grace, so its end time is LostAt, not EndedAt.
	EndedAt        *time.Time `json:"ended_at,omitempty"`
	EndTightenedAt *time.Time `json:"end_tightened_at,omitempty"` // profile re-clamp shortened the end
	// PausedAt/PausedReason mark a run frozen with nobody present; keeps state/memory/files/proxy until activity or resume. Not contained — kill still works.
	PausedAt     *time.Time  `json:"paused_at,omitempty"`
	PausedReason PauseReason `json:"paused_reason,omitempty"`
	ActiveAt     *time.Time  `json:"active_at,omitempty"` // presence clock: last human input/egress decision/proxied bytes, or a resume; keepalives never move it; nil reads as CreatedAt
	// ModelProviderID freezes the provider id at create; the kind is deliberately NOT frozen (can change later) and lives only on the run.create audit snapshot.
	ModelProviderID string `json:"model_provider_id,omitempty"`
	UserType        string `json:"user_type,omitempty"` // creator's resolved user type, frozen at create
	Preset          string `json:"preset,omitempty"`    // launch preset this run was expanded from; empty for an explicit-spec run
	PresetVersion   int    `json:"preset_version,omitempty"`
	OperatorOwned   bool   `json:"operator_owned,omitempty"` // mirrors identity.Claims.OperatorOwned so dispatch/revive re-mint read what create decided; the console reads it for the no-personal-owner entry carve-out
	// CreatedVia is the registered portal this run was launched through on the person's behalf; nil when self-launched. The owner is still the person.
	CreatedVia *uuid.UUID `json:"created_via,omitempty"`
	// HasRecording/RecordingBytes/RecordingDurationSec are derived, never stored, projected only with ?include=recording_meta; HasRecording is the only "no recording" signal.
	HasRecording         bool          `json:"has_recording"`
	RecordingBytes       int64         `json:"recording_bytes,omitempty"`
	RecordingDurationSec float64       `json:"recording_duration_sec,omitempty"`
	DiskMiB              int           `json:"disk_mib,omitempty"`  // effective ephemeral disk cap MiB; 0 = no cap resolved
	Attention            *RunAttention `json:"attention,omitempty"` // what this live run awaits and who can clear it; derived, only on view-opted-in read paths

	// HumanAuthor is the principal accountable for the run at create, written once: the service identity's sponsor
	// at launch for a service identity's run, unchanged by a later sponsor change, and CreatedBy for any other run. A
	// record of accountability, not proof that a person was present. Empty for a run from before it was recorded.
	// Read by the second-human rules only.
	HumanAuthor string `json:"-"`
	// LaunchIntent is the setup kept for Run again (a kind Run document), written in the run row's own
	// transaction when set. Never on the wire and never read back onto a listed run: the creator reads it by
	// run id. On a created run it is set only when the store kept it.
	LaunchIntent json.RawMessage `json:"-"`
}

type ApprovalDecision struct {
	State     ApprovalState
	DecidedBy string
	Reason    string
	Scope     ApprovalScope // meaningful only for an egress_domain approval; others leave the zero value
	ExpiresAt *time.Time
}

type ApprovalEscalation struct {
	Tier   int16
	NextAt *time.Time
}

type ApprovalKind string

type ApprovalNotifyChannelStat struct {
	Channel        string
	LastSentAt     *time.Time
	LastError      string
	LastErrorAt    *time.Time
	FailedLastHour int
}

type ApprovalNotifyState string

type ApprovalRequest struct {
	ID             uuid.UUID       `json:"id"`
	RunID          uuid.UUID       `json:"run_id"`
	GrantID        *uuid.UUID      `json:"grant_id,omitempty"`
	Kind           ApprovalKind    `json:"kind"`
	RequestedScope json.RawMessage `json:"requested_scope"`
	State          ApprovalState   `json:"state"`
	RequestedAt    time.Time       `json:"requested_at"`
	DecidedAt      *time.Time      `json:"decided_at,omitempty"`
	DecidedBy      string          `json:"decided_by,omitempty"`
	MintedJTI      string          `json:"minted_jti,omitempty"`
	Reason         string          `json:"reason,omitempty"`
	// DecisionScope is how far the decision reaches (see ApprovalScope); empty on a PENDING row. Named
	// decision_scope to avoid clashing with RequestedScope (the unrelated host JSON).
	DecisionScope ApprovalScope `json:"decision_scope,omitempty"`
	// DecisionExpiresAt is set only when DecisionScope is until — a different clock than the EXPIRED-state sweeper, which ages out stale PENDING requests.
	DecisionExpiresAt *time.Time `json:"decision_expires_at,omitempty"`
	// ExpiresAt is when a PENDING request stops waiting: min(requested_at+WaitBudgetSec, EndsAt); computed on read, never stored.
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
	Held      bool       `json:"held,omitempty"` // Held/HeldUntil project approval.Hold(this, now) at response time, never stored; both zero on a DECIDED row
	HeldUntil *time.Time `json:"held_until,omitempty"`
	// EscalationTier is the highest notification tier whose due time has passed, and SLADueAt is the
	// next tier's due time. Both are projected from approval_notifications at response time on PENDING
	// rows only, never stored; tier 0 (the first notice) and "no later tier" leave them zero.
	EscalationTier int16      `json:"escalation_tier,omitempty"`
	SLADueAt       *time.Time `json:"sla_due_at,omitempty"`
}

type ApprovalScope string

type ApprovalState string

type AttentionBy string

type AttentionKind string

type AuditEvent struct {
	ID        uuid.UUID       `json:"id"`
	Time      time.Time       `json:"time"`
	RunID     *uuid.UUID      `json:"run_id,omitempty"`
	ActorType ActorType       `json:"actor_type"`
	Actor     string          `json:"actor"`  // human sub, agent SPIFFE ID, or component name
	Action    string          `json:"action"` // dotted verb, e.g. "credential.mint", "egress.deny", "kernel.process.exec"
	Target    string          `json:"target,omitempty"`
	Outcome   string          `json:"outcome"` // "success" | "failure" | "denied"
	SourceIP  string          `json:"source_ip,omitempty"`
	Data      json.RawMessage `json:"data,omitempty"`

	// DeviceID names the enrolled device that forwarded this row; derived on read, never taken from a caller.
	DeviceID *uuid.UUID `json:"device_id,omitempty"`

	// PrevHash/RowHash form the tamper-evidence chain: RowHash = SHA-256(PrevHash || canonical serialization
	// of the fields above), computed BY POSTGRES in a BEFORE INSERT trigger, never by the caller; sinks use
	// the head hash to detect truncation. Verified via GET /api/v1/audit/chain/verify.
	PrevHash string `json:"prev_hash,omitempty"`
	RowHash  string `json:"row_hash,omitempty"`
}

type AuditRetentionDrop struct {
	Partition string `json:"partition"`
	Rows      int64  `json:"rows"`
	SeqLo     int64  `json:"seq_lo"`
	SeqHi     int64  `json:"seq_hi"`
	Digest    string `json:"digest"`
	// EventSeq is the seq of the chained audit.retention.partition_dropped event.
	EventSeq int64 `json:"event_seq"`
}

type AuditRetentionPartition struct {
	Name string `json:"name"`
	// Lo is absent for the legacy partition (it starts at MINVALUE).
	Lo    *time.Time `json:"lo,omitempty"`
	Hi    *time.Time `json:"hi,omitempty"`
	Rows  int64      `json:"rows"`
	State string     `json:"state"` // closed | open | future
	// Eligible is true when audit_retention_drop would take this partition now; otherwise Refusal is the
	// reason it would refuse with.
	Eligible bool   `json:"eligible"`
	Refusal  string `json:"refusal,omitempty"`
}

type AuditRetentionPolicy struct {
	// Days is the stored policy; EffectiveDays is what the drop function applies now (the pending value
	// once its date has passed).
	Days          int `json:"days"`
	EffectiveDays int `json:"effective_days"`
	// PendingDays and PendingEffectiveAt are set together, for a decrease that has not taken effect.
	PendingDays        *int       `json:"pending_days,omitempty"`
	PendingEffectiveAt *time.Time `json:"pending_effective_at,omitempty"`
}

type AuditRetentionPolicyChange struct {
	Outcome string `json:"outcome"`
	AuditRetentionPolicy
}

type AuditRetentionStatus struct {
	Policy AuditRetentionPolicy `json:"policy"`
	// Cutover is when the log was converted to partitions; everything before it is in the legacy partition.
	Cutover    time.Time                 `json:"cutover"`
	Partitions []AuditRetentionPartition `json:"partitions"`
	// MonthsAhead is how many months past the current one already have a partition.
	MonthsAhead int `json:"months_ahead"`
}

type AutonomyEgressPosture string

type AutonomyLevel string

type AutonomyPosture struct {
	Egress      AutonomyEgressPosture  `json:"egress"`
	Secrets     AutonomySecretsPosture `json:"secrets"`
	Confinement ConfinementClass       `json:"confinement"`
}

type AutonomyResolution struct {
	Level   AutonomyLevel   `json:"level"`
	Posture AutonomyPosture `json:"posture"`
	BoundBy []string        `json:"bound_by,omitempty"`
}

type AutonomyRubric struct {
	// EgressOpen caps the level when egress is OPEN: allow-all, or any allowlisted host beyond baseline.
	EgressOpen AutonomyLevel `json:"egress_open,omitempty"`
	// EgressReviewed caps the level when egress is REVIEWED: first-use approval raises approvals, nothing wide open.
	EgressReviewed AutonomyLevel `json:"egress_reviewed,omitempty"`
	// EgressSealed caps the level when egress is SEALED: neither of the above.
	EgressSealed AutonomyLevel `json:"egress_sealed,omitempty"`
	// SecretsPowerful caps the level when the run holds a POWERFUL secret: a write-capable grant, an
	// api_key to a non-baseline host, or a git_pat/ssh_key/env_secret grant.
	SecretsPowerful AutonomyLevel `json:"secrets_powerful,omitempty"`
	// SecretsBaseline caps the level when the run holds any grant, none of them powerful.
	SecretsBaseline AutonomyLevel `json:"secrets_baseline,omitempty"`
	// SecretsNone caps the level when the run holds no grant at all.
	SecretsNone AutonomyLevel `json:"secrets_none,omitempty"`
	// ConfinementCC1/CC2/CC3 cap the level by the run's ENFORCED confinement
	// class (an empty enforced class reads as CC1 — see AutonomyPosture).
	ConfinementCC1 AutonomyLevel `json:"confinement_cc1,omitempty"`
	ConfinementCC2 AutonomyLevel `json:"confinement_cc2,omitempty"`
	ConfinementCC3 AutonomyLevel `json:"confinement_cc3,omitempty"`
	// AgentGuardrailLocks selects the locked L2 managed-settings document for a run that resolves to L2:
	// repository hooks and permission rules cannot override the agent-side guardrails. It caps no level
	// and changes nothing at any other rung.
	AgentGuardrailLocks bool `json:"agent_guardrail_locks,omitempty"`
}

type AutonomySecretsPosture string

type AzureSettings struct {
	Endpoint string `json:"endpoint,omitempty"`
	Route    string `json:"route,omitempty"`
}

type BaseImageEntry struct {
	ID    uuid.UUID `json:"id"`
	Kind  string    `json:"kind"` // "registry" | "custom" | "byo"
	Name  string    `json:"name"`
	Image string    `json:"image"` // the ref: the image itself (registry/byo) or the FROM (custom)
	// Steps are Dockerfile lines on a "custom" Image; not applied at build
	// time (host-side build RCE — see WorkspaceBaseImage.Steps), stored only
	// so the row round-trips.
	Steps     []string  `json:"steps,omitempty"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type BedrockSettings struct {
	Region       string `json:"region,omitempty"`
	BaseURL      string `json:"base_url,omitempty"`
	SSOStartURL  string `json:"sso_start_url,omitempty"`
	SSOAccountID string `json:"sso_account_id,omitempty"`
	SSORoleName  string `json:"sso_role_name,omitempty"`
}

type Branding struct {
	OrgName         string
	NameFormat      string
	Primary         string
	PrimaryText     string
	DarkPrimary     string
	DarkPrimaryText string
	SupportURL      string
	Logo            []byte
	LogoType        string
	LogoFromFile    bool // the logo is the site config's branding.logo_path file (0105_branding_logo_from_file)
	UpdatedAt       time.Time
	UpdatedBy       string
}

type CLIAWS struct {
	StartURL  string `json:"start_url"`  // the access portal, https
	SSORegion string `json:"sso_region"` // where the portal lives
	AccountID string `json:"account_id"` // 12 digits
	RoleName  string `json:"role_name"`  // the permission set name
	Region    string `json:"region"`     // the CLI's default region
}

type CLIAzure struct {
	Subscriptions []string `json:"subscriptions"` // 1..MaxCLIAzureSubscriptions GUIDs
	Access        string   `json:"access"`        // read (GET and HEAD only) | write
}

type CLIGitHub struct {
	Capabilities []ghscope.Capability `json:"capabilities"`
}

type CapabilityEffect string

type CapabilityGrant struct {
	ID          uuid.UUID             `json:"id"`
	SubjectType CapabilitySubjectType `json:"subject_type"`
	Subject     string                `json:"subject"`
	Capability  string                `json:"capability"`
	Value       string                `json:"value"`
	Effect      CapabilityEffect      `json:"effect"`
	CreatedAt   time.Time             `json:"created_at"`
	CreatedBy   string                `json:"created_by,omitempty"`
}

type CapabilitySubjectType string

type CeilingOverlay struct {
	AllowedDomains          *[]string              `json:"allowed_domains,omitempty"`
	DeniedDomains           *[]string              `json:"denied_domains,omitempty"`
	AllowAllEgress          *bool                  `json:"allow_all_egress,omitempty"`
	FirstUseApproval        *FirstUseMode          `json:"first_use_approval,omitempty"`
	FirstUseHoldSeconds     *int                   `json:"first_use_hold_seconds,omitempty"`
	MaxHolds                *int                   `json:"max_holds,omitempty"`
	AllowedMethods          *[]string              `json:"allowed_methods,omitempty"`
	MinConfinementClass     *ConfinementClass      `json:"min_confinement_class,omitempty"`
	EligibleGrants          *[]GrantSpec           `json:"eligible_grants,omitempty"`
	AutoStopAfterSec        *int                   `json:"auto_stop_after_sec,omitempty"`
	WorkspaceMounts         *[]WorkspaceMount      `json:"workspace_mounts,omitempty"`
	WorkspaceRepos          *[]WorkspaceRepo       `json:"workspace_repos,omitempty"`
	LLMInspection           *LLMInspectionSpec     `json:"llm_inspection,omitempty"`
	UIApps                  *[]UIApp               `json:"ui_apps,omitempty"`
	Resources               *ResourcesOverlay      `json:"resources,omitempty"`
	ToolRules               *[]ToolRule            `json:"tool_rules,omitempty"`
	GitPushAnyBranch        *bool                  `json:"git_push_any_branch,omitempty"`
	PushRules               *PushRulesOverlay      `json:"push_rules,omitempty"`
	AzureDevOpsCapabilities *[]adoscope.Capability `json:"azure_devops_capabilities,omitempty"`
	GitHubCapabilities      *[]ghscope.Capability  `json:"github_capabilities,omitempty"`
}

type Component struct {
	ID         uuid.UUID           `json:"id"`
	Owner      string              `json:"owner,omitempty"`
	Name       string              `json:"name"`
	Definition ComponentDefinition `json:"definition"`
	// Version starts at 1 and moves by one on every update.
	Version   int       `json:"version"`
	CreatedBy string    `json:"created_by,omitempty"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type ComponentCLI struct {
	Kind   string     `json:"kind"` // azure | aws | github
	Azure  *CLIAzure  `json:"azure,omitempty"`
	AWS    *CLIAWS    `json:"aws,omitempty"`
	GitHub *CLIGitHub `json:"github,omitempty"`
}

type ComponentConfigSchema struct {
	SchemaVersion int           `json:"schema_version"`
	Groups        []ConfigGroup `json:"groups,omitempty"`
	Fields        []ConfigField `json:"fields"`
}

type ComponentConfigValues map[string]json.RawMessage

type ComponentDefinition struct {
	Hosts   []string          `json:"hosts"`
	Secrets []ComponentSecret `json:"secrets,omitempty"`
	Config  map[string]string `json:"config,omitempty"`
	// CLI marks an org row as a CLI credential card (azure, aws or github).
	CLI *ComponentCLI `json:"cli,omitempty"`
	// MCP makes the component a remote MCP server, which a run's harnesses
	// reach only through the proxy's broker route (component_mcp.go).
	MCP *ComponentMCP `json:"mcp,omitempty"`
}

type ComponentDelivery struct {
	Mode string `json:"mode"` // header | env | file
	// Host, Header and Format apply to header: Host is a bare host — no
	// port, never a wildcard — that one of the definition's hosts names bare
	// or with :443; an empty Header or Format takes the caller's default.
	Host   string `json:"host,omitempty"`
	Header string `json:"header,omitempty"`
	Format string `json:"format,omitempty"`
	// PlainHTTP lets a header credential travel without TLS. That it appears
	// on an org row only is the caller's check.
	PlainHTTP bool `json:"plain_http,omitempty"`
	// Var applies to env: the environment variable name.
	Var string `json:"var,omitempty"`
	// File applies to file: a single name, never a path. The directory is
	// fixed by the runner.
	File string `json:"file,omitempty"`
}

type ComponentKind string

type ComponentMCP struct {
	// URL is the server's streamable HTTP address: https, no userinfo, its
	// host one of the component's hosts.
	URL       string `json:"url"`
	Transport string `json:"transport"` // http
}

type ComponentRef struct {
	ID     *uuid.UUID           `json:"id,omitempty"`
	Inline *ComponentDefinition `json:"inline,omitempty"`
	Name   string               `json:"name,omitempty"`
	// Builtin names a built-in Git provider component, github or azure_devops:
	// API and git-over-HTTPS access to the listed repositories without a
	// workspace, the agent cloning for itself. Org and Repos scope it, Access
	// narrows it.
	Builtin string `json:"builtin,omitempty"`
	// Org is the GitHub owner or the Azure DevOps organisation. Required with Builtin.
	Org string `json:"org,omitempty"`
	// Repos are owner/name (GitHub) or project/repository (Azure DevOps). GitHub
	// requires at least one; an Azure DevOps ref without any reaches every
	// repository the person can reach in Org.
	Repos []string `json:"repos,omitempty"`
	// Access is read or write; empty reads as read.
	Access string `json:"access,omitempty"`
	// MCPHarnesses are the included harnesses (tools[].id) an MCP component's
	// server is turned on for. Absent means every harness that can take it.
	MCPHarnesses []string `json:"mcp_harnesses,omitempty"`
}

type ComponentSecret struct {
	SecretName string `json:"secret_name"`
	// Shared marks an org component's secret as the operator's value rather
	// than the launching person's own. Header delivery only (Validate); that
	// it appears on an org row only is the caller's check, since a definition
	// does not know its owner.
	Shared   bool              `json:"shared,omitempty"`
	Delivery ComponentDelivery `json:"delivery"`
}

type ComponentSettings struct {
	// RequireVaultForCredentials restores the CC3 confinement floor for a
	// component's header credential to a non-baseline host, org and person rows
	// alike. False (default) lifts the floor for component-authored grants only.
	RequireVaultForCredentials bool `json:"require_vault_for_credentials,omitempty"`
	// DenyResidentDelivery refuses env-var and file delivery DEPLOYMENT-WIDE,
	// for org and person rows alike; header delivery keeps working.
	DenyResidentDelivery bool `json:"deny_resident_delivery,omitempty"`
	// AutonomyCap caps a run carrying a SELF-DEFINED component, with or without
	// a governance profile: "" no cap (default), "L1" holds tool calls, "L0"
	// refuses unattended runs. No other value is accepted: the cap only tightens.
	AutonomyCap AutonomyLevel `json:"autonomy_cap,omitempty"`
}

type ConcurrencyBound struct {
	Source LimitSource `json:"source"`
	Max    int         `json:"max"`
}

type ConfigBindTarget string

type ConfigBinding struct {
	Target ConfigBindTarget `json:"target"`
	// Key is the environment variable name: the config key, or the variable
	// the secret is delivered in. It follows the component env-name rules,
	// including the reserved names.
	Key string `json:"key"`
}

type ConfigCondition struct {
	Field  string          `json:"field"`
	Equals json.RawMessage `json:"equals"`
}

type ConfigField struct {
	// ID is the field's structural name: lowercase letters, digits and
	// underscores. Values are keyed by it.
	ID          string          `json:"id"`
	Kind        ConfigFieldKind `json:"kind"`
	Label       string          `json:"label"`
	Description string          `json:"description,omitempty"`
	Group       string          `json:"group,omitempty"`
	// Required asks for a value whenever the field is visible and has no default.
	Required bool `json:"required,omitempty"`
	// ReadOnly shows a managed value. It needs a Default, and a value that
	// differs from it is refused.
	ReadOnly bool `json:"read_only,omitempty"`
	// Default is the value an untouched field takes, typed by Kind.
	Default json.RawMessage `json:"default,omitempty"`
	// Min and Max bound an integer or number.
	Min *float64 `json:"min,omitempty"`
	Max *float64 `json:"max,omitempty"`
	// MaxLen bounds a string or each string_list entry, in bytes.
	MaxLen int `json:"max_len,omitempty"`
	// MaxItems bounds a string_list.
	MaxItems int `json:"max_items,omitempty"`
	// Options are an enum's choices.
	Options []ConfigOption `json:"options,omitempty"`
	// VisibleWhen shows the field only while another field holds one value.
	VisibleWhen *ConfigCondition `json:"visible_when,omitempty"`
	Bind        ConfigBinding    `json:"bind"`
}

type ConfigFieldKind string

type ConfigGroup struct {
	ID          string `json:"id"`
	Label       string `json:"label"`
	Description string `json:"description,omitempty"`
}

type ConfigIssue struct {
	Path    string `json:"path"`
	Message string `json:"message"`
}

type ConfigOption struct {
	Value string `json:"value"`
	Label string `json:"label"`
}

type ConfinementClass string

type CredentialDeliveryPolicyDoc struct {
	Policy    json.RawMessage `json:"policy"`
	UpdatedAt time.Time       `json:"updated_at"`
	UpdatedBy string          `json:"updated_by"`
}

type CredentialGrant struct {
	ID        uuid.UUID `json:"id"`
	RunID     uuid.UUID `json:"run_id"`
	CreatedAt time.Time `json:"created_at"`
	Spec      GrantSpec `json:"spec"`
	// Delivery is how the grant reached a local run; empty for a remote run and for one from before 0.9.
	Delivery GrantDelivery `json:"delivery,omitempty"`
}

type CredentialSource string

type Delegate struct {
	ID          uuid.UUID `json:"id"`
	Name        string    `json:"name"`
	IdPClientID string    `json:"idp_client_id"`
	Group       string    `json:"group"`
	// Never serialized: a credential hash has no business leaving the process.
	CredentialSHA256 string     `json:"-"`
	RegisteredBy     string     `json:"registered_by"`
	CreatedAt        time.Time  `json:"created_at"`
	LastUsedAt       *time.Time `json:"last_used_at,omitempty"`
	RevokedAt        *time.Time `json:"revoked_at,omitempty"`
	// Credential is the plaintext portal credential, on the register
	// response ONLY; the row stores its hash.
	Credential string `json:"credential,omitempty"`
}

type DelegatedToken struct {
	ID              uuid.UUID `json:"id"`
	DelegateID      uuid.UUID `json:"delegate_id"`
	Principal       string    `json:"principal"`
	Email           string    `json:"email,omitempty"`
	UserType        string    `json:"user_type"`
	Groups          []string  `json:"groups"`
	GroupsTruncated bool      `json:"groups_truncated"`
	CreatedAt       time.Time `json:"created_at"`
	ExpiresAt       time.Time `json:"expires_at"`
	// RevSeq is the revocation sequence read when the token was minted; 0 for a token minted before it
	// existed, which a revocation cutoff orders on CreatedAt. Never on the wire.
	RevSeq int64 `json:"-"`
}

type DelegationVia struct {
	Delegate uuid.UUID `json:"delegate"`
	Grant    uuid.UUID `json:"grant"`
}

type Destination struct {
	// Host is lower case with no trailing dot; an IP literal is in its
	// canonical spelling. For a wildcard it is the suffix after "*.".
	Host     string
	Wildcard bool
	// Port 0 means any port, as a bare entry does at the proxy.
	Port int
}

type Device struct {
	ID   uuid.UUID `json:"id"`
	Name string    `json:"name"`
	// Never serialized: a credential hash has no business leaving the process.
	CredentialSHA256 string     `json:"-"`
	EnrolledBy       string     `json:"enrolled_by"`
	CreatedAt        time.Time  `json:"created_at"`
	LastSeenAt       *time.Time `json:"last_seen_at,omitempty"`
	RevokedAt        *time.Time `json:"revoked_at,omitempty"`
	LastSeq          int64      `json:"last_seq"`
	LastRowHash      string     `json:"last_row_hash,omitempty"`
}

type DeviceAck struct {
	AckedSeq int64 `json:"acked_seq"`
}

type DeviceEnrolRequest struct {
	Token string `json:"token"`
}

type DeviceEnrolResponse struct {
	DeviceID uuid.UUID `json:"device_id"`
	Name     string    `json:"name"`
	Token    string    `json:"token"`
}

type DeviceEnrolmentToken struct {
	ID          uuid.UUID  `json:"id"`
	TokenSHA256 string     `json:"-"`
	DeviceName  string     `json:"device_name"`
	MintedBy    string     `json:"minted_by"`
	CreatedAt   time.Time  `json:"created_at"`
	ExpiresAt   time.Time  `json:"expires_at"`
	ConsumedAt  *time.Time `json:"consumed_at,omitempty"`
	Token       string     `json:"token,omitempty"` // plaintext, mint response ONLY
}

type DriveBackend string

type DriveKind string

type DriveMount struct {
	// DriveID is the user_drives row this mount came from; labels and reclaim
	// sweeps group by it.
	DriveID    uuid.UUID    `json:"drive_id"`
	Backend    DriveBackend `json:"backend"`
	ObjectName string       `json:"object_name"` // what the substrate is asked for — volume name, PVC name, or absolute host path
	// HostRoot is THIS drive's own share root, carried on a host_path mount
	// so the driver can assert the bind stays inside it. Does NOT replace the
	// deployment's WARDYN_USER_DRIVE_HOST_ROOTS ceiling (that bounds EVERY
	// drive at once; this refuses a link into a different drive's tree). The
	// driver asserts BOTH.
	HostRoot string `json:"host_root,omitempty"`
	// DriveName is the drive's human name, carried for the AUDIT row alone so
	// a member learns which drive without the operator's absolute host path.
	DriveName    string `json:"drive_name,omitempty"`
	StorageClass string `json:"storage_class,omitempty"` // provisioner a managed k8s_pvc claim asks for; carried since a substrate never reads the database
	HomeName     string `json:"home_name"`               // per-user segment ObjectName was built from
	// SubjectHash is the non-PII fingerprint of the principal this mount was
	// resolved for. DEFENCE IN DEPTH over the managed-backend collision the
	// write boundary refuses: a stored row predating that refusal can still
	// resolve two principals onto one volume, so the driver stamps this and
	// refuses the second. A digest, never the claim — a label is echoed by
	// `docker volume inspect` to anybody who can reach the daemon.
	SubjectHash string
	Target      string             `json:"target"` // reserved in-container path (runner.DriveTarget), carried so a runner never hard-codes it
	ReadOnly    bool               `json:"read_only,omitempty"`
	SizeMiB     int                `json:"size_mib,omitempty"`
	Enforcement StorageEnforcement `json:"enforcement"`
}

type DriveObjectScheme string

type DriveReclaim string

type EffectiveLimit struct {
	Default       LimitAmount `json:"default"`
	Cap           LimitAmount `json:"cap"`
	DefaultSource LimitSource `json:"default_source,omitempty"`
	CapSource     LimitSource `json:"cap_source,omitempty"`
}

type EffectiveRunLimits struct {
	RunType   RunnerPoolRunType `json:"run_type"`
	CPUMillis EffectiveLimit    `json:"cpu_millis"`
	MemoryMiB EffectiveLimit    `json:"memory_mib"`
	// DiskMiB is the main drive's size in MiB. An unlimited Default means an untouched
	// run gets no size (its scratch is unbounded); with no default but a cap, an
	// untouched run gets the cap (foldField's rule).
	DiskMiB       EffectiveLimit     `json:"disk_mib"`
	Lifetime      EffectiveLimit     `json:"lifetime_sec"`
	LifetimeSpan  EffectiveLimit     `json:"lifetime_span_sec"`
	LifetimeLease EffectiveLimit     `json:"lifetime_lease_sec"`
	NoEndAllowed  bool               `json:"no_end_allowed"`
	Idle          *EffectiveLimit    `json:"idle_sec,omitempty"`
	Concurrency   []ConcurrencyBound `json:"concurrency"`
}

type EgressRedirect struct {
	// From is the public/upstream URL or host being redirected away from.
	From string `json:"from"`
	// To is the corporate-internal URL or host every matching run's egress
	// substitutes to; for an Ecosystem row it's also emitted into that
	// ecosystem's config file (the old ArtifactOverride.BaseURL).
	To string `json:"to"`
	// TokenSecretRef optionally names a secret injected proxy-side as a
	// Bearer token for To's host (the sandbox never holds it). Mutually
	// exclusive with TokenIntegrationRef.
	TokenSecretRef string `json:"token_secret_ref,omitempty"`
	// TokenIntegrationRef optionally names an Integration
	// (SiteConfig.Integrations[i].ID) to take this redirect's token FROM
	// instead of a bare secret. The redirect points AT the integration
	// rather than restating its secret, inheriting its Header/Format so a
	// feed authenticating with something other than "Authorization: Bearer"
	// finally can. Naming nothing, a disabled row, or one with no header
	// credential degrades to redirect-without-token.
	TokenIntegrationRef string `json:"token_integration_ref,omitempty"`
	// Ecosystem, when set, is one of six package-manager ecosystems
	// ("npm"|"pip"|"cargo"|"maven"|"go"|"nuget") this redirect ALSO emits a
	// config file for. Empty means NETWORK-ONLY: no config file is emitted.
	Ecosystem string `json:"ecosystem,omitempty"`
}

type EphemeralProvider struct {
	DefaultDiskMiB int `json:"default_disk_mib,omitempty"` // 0 = unset
	// MaxDiskMiB: ceiling a larger request is clamped to (0 = unlimited); a
	// DefaultDiskMiB above it is refused at the write boundary.
	MaxDiskMiB int `json:"max_disk_mib,omitempty"`
}

type FederatedAuditEvent struct {
	AuditEvent
	Seq int64 `json:"seq"`
}

type FirstUseMode string

type GitLane string

type GitPATScope struct {
	Host       string    `json:"host"`
	SecretName string    `json:"secret_name"`
	Username   string    `json:"username,omitempty"`
	Repos      *[]string `json:"repos,omitempty"`
	Access     string    `json:"access,omitempty"`
	API        bool      `json:"api,omitempty"`
	Forge      string    `json:"forge,omitempty"`
}

type GitProvider struct {
	ID   string          `json:"id"`   // operator-chosen stable slug, unique within Git, held to integrationRefRE; a capability grant names a provider by this id
	Kind GitProviderKind `json:"kind"` // which forge's bespoke behaviour this row carries
	// Disabled turns the row off without deleting it (zero value enabled); a
	// disabled row still claims its hosts rather than falling through to ScmHosts.
	Disabled bool `json:"disabled,omitempty"`
	// BaseURLs are the https addresses this row admits: a repo is admitted
	// when its clone URL's scheme/host match one of these and its path equals
	// or extends that base URL's path at a "/" boundary. 1-8 entries; no
	// port, credentials, query or fragment; at most two path segments.
	BaseURLs []string `json:"base_urls"`
	// Lanes are the credential lanes usable for this provider; empty means
	// every legacy lane (LegacyGitLanes) — the field narrows, never widens.
	Lanes []GitLane `json:"lanes,omitempty"`
	// GitHubAppInstallURL is operator-configured, nonsecret installation
	// metadata for this row's App lane. It grants no access and is disclosed
	// by run facts only to operators, never ordinary members.
	GitHubAppInstallURL string           `json:"github_app_install_url,omitempty"`
	CredentialSource    CredentialSource `json:"credential_source,omitempty"` // whose credential the lanes use; empty = CredentialSourceShared, CredentialSourcePerUser requires GitLaneEntra, or GitLanePAT on an Azure DevOps row (a Server row, which has no Entra sign-in)
	Entra               *ADOEntraConfig  `json:"entra,omitempty"`             // present only on, and required by, a row whose Lanes name GitLaneEntra
}

type GitProviderKind string

type GovernanceAssignment struct {
	ID          uuid.UUID             `json:"id"`
	SubjectType CapabilitySubjectType `json:"subject_type"`
	Subject     string                `json:"subject"`
	ProfileID   uuid.UUID             `json:"profile_id"`
	Priority    int                   `json:"priority"`
	CreatedAt   time.Time             `json:"created_at"`
	CreatedBy   string                `json:"created_by,omitempty"`
}

type GovernanceChange struct {
	ID         uuid.UUID       `json:"id"`
	TargetKind string          `json:"target_kind"`
	Op         string          `json:"op"`
	TargetKey  string          `json:"target_key"`
	State      string          `json:"state"`
	ProposedBy string          `json:"proposed_by"`
	ProposedAt time.Time       `json:"proposed_at"`
	ExpiresAt  time.Time       `json:"expires_at"`
	Diff       json.RawMessage `json:"diff"`
	DecidedBy  string          `json:"decided_by,omitempty"`
	DecidedAt  *time.Time      `json:"decided_at,omitempty"`
	// Reason is a rejection's optional explanation.
	Reason string `json:"reason,omitempty"`

	// Payload, hashes and emails stay server-side.
	Payload         json.RawMessage `json:"-"`
	BaseHash        string          `json:"-"`
	DeploymentHash  string          `json:"-"`
	ProposedByEmail string          `json:"-"`
	DecidedByEmail  string          `json:"-"`
}

type GovernanceLimits struct {
	// LocalSelfDefinedComponents permits a local run to carry a component its launcher defined.
	// Omitted or false refuses it; runner-reported confinement is not platform attestation.
	LocalSelfDefinedComponents bool `json:"local_self_defined_components,omitempty"`
	// DenyTaskModeExec refuses task_mode=exec for a member under this profile.
	DenyTaskModeExec bool `json:"deny_task_mode_exec,omitempty"`
	// DenyInteractive refuses an interactive run under this profile.
	// Evaluated against POST-COERCION interactivity, since omitting the
	// task coerces to interactive later — a raw "did the caller ask" check
	// would be evaded by leaving the field out. It also refuses the terminal
	// attach and SSH into a run created under this profile, since a task or
	// exec run still has a sandbox to open a shell in (#1392).
	DenyInteractive bool `json:"deny_interactive,omitempty"`
	// DenyUIApps strips ui_apps from a run under this profile at create, and
	// the UI gateway refuses a session into a run created under it. A limit
	// rather than an empty ceiling ui_apps, which stays "no opinion" so
	// existing profiles keep their behaviour (#1391).
	DenyUIApps bool `json:"deny_ui_apps,omitempty"`
	// MaxConcurrentRuns caps how many NON-TERMINAL runs a member under this
	// profile may hold at once. 0 is unlimited.
	MaxConcurrentRuns int `json:"max_concurrent_runs,omitempty"`
	// DenyUserDrive refuses a USER DRIVE mount under this profile, whatever
	// an admin allocated. A DOOR, NOT A QUOTA: a drive outlives the run, so
	// "may this principal persist anything at all" is the question (403 +
	// authz.denied), not "how big".
	DenyUserDrive bool `json:"deny_user_drive,omitempty"`
	// DenyMemberDrives refuses CREATING a member drive under this profile, on top of
	// storage.user_drive.member_create (the org switch). A DOOR with no zero-value
	// opinion: false inherits the switch, so an unset profile changes nothing. DenyUserDrive
	// also blocks creation (a person who may mount no drive may not make one); this door
	// narrows only the creating. Operators are exempt from both doors.
	DenyMemberDrives bool `json:"deny_member_drives,omitempty"`
	// DenyPlacements refuses a run whose resolved placement is listed (403 placement_denied +
	// authz.denied). A DENY LIST: absent means every placement is permitted, including for a
	// member with no assigned profile. Values are `remote` and `local`; a profile denying both is
	// refused at write, since the people it binds could run nothing.
	DenyPlacements []Placement `json:"deny_placements,omitempty"`
	// MaxCPUMillis and MaxMemoryMiB cap the sandbox's CPU (millicores) and memory a run under this
	// profile may be given, whatever its ceiling's own resources or a member's request say. 0 is
	// unlimited. A CLAMP, NOT A DOOR, like MaxEphemeralDiskMiB. Folded into composer.Clamp at
	// create and preflight and re-applied at dispatch; assigned members only, operators exempt.
	MaxCPUMillis int `json:"max_cpu_millis,omitempty"`
	MaxMemoryMiB int `json:"max_memory_mib,omitempty"`
	// MaxEphemeralDiskMiB caps the EPHEMERAL scratch (the writable layer when no drive is
	// mounted) a run under this profile may be given. 0 is unlimited. A CLAMP, NOT A DOOR: no
	// authz.denied at the bound. Enforced at dispatch only (runs_dispatch.go), folded with the
	// deployment's own storage.ephemeral.max_disk_mib; assigned members only, operators exempt.
	// Whether it actually binds depends on the substrate (Docker's overlay2 doesn't enforce
	// size at all) — render through StorageEnforcement, never claim a cap the substrate doesn't keep.
	MaxEphemeralDiskMiB int `json:"max_ephemeral_disk_mib,omitempty"`
	// MaxDriveSizeMiB caps how large a USER DRIVE may be under this profile. 0 is unlimited —
	// DenyUserDrive's twin ("may persist" vs "how much"). PER PRINCIPAL: a drive is one tree
	// belonging to one subject; a team-shared drive's ceiling is not the sum of its members'
	// and can't be derived from one, so sharing (0.8) adds a scope axis instead. Clamped in
	// newResolvedDrive, the one place holding both facts — never at grant write, where the
	// subject is claims-resolved and unreadable from the row. Folds with
	// storage.user_drive.max_size_mib in one min(), so launch, /me and preview can't disagree.
	MaxDriveSizeMiB int `json:"max_drive_size_mib,omitempty"`
	// AutonomyRubric maps a run's posture to a permitted AutonomyLevel
	// (0.8, #77). A POINTER so an unset rubric doesn't put
	// `"autonomy_rubric":{}` on every profile's wire body. Nil means "no
	// rubric" (resolveRunAutonomy, #97, treats it like no assigned profile).
	AutonomyRubric *AutonomyRubric `json:"autonomy_rubric,omitempty"`
	// RunLimits is embedded, so its seven fields sit flat on the limits wire
	// object beside the ones above — the same field set a run captures at
	// create (AgentRun.RunLimits).
	RunLimits
}

type GovernanceProfile struct {
	ID        uuid.UUID        `json:"id"`
	Name      string           `json:"name"`
	Ceiling   RunPolicySpec    `json:"ceiling"`
	Limits    GovernanceLimits `json:"limits"`
	CreatedAt time.Time        `json:"created_at"`
	UpdatedAt time.Time        `json:"updated_at"`
	CreatedBy string           `json:"created_by,omitempty"`
	// Contact is who owns the profile and how to ask for a change; nil is none.
	// Validated on write and re-validated on every read (internal/policyref).
	// Never inherited from a base: disclosing a base's contact would disclose the base.
	Contact *policyref.Contact `json:"contact,omitempty"`
	// ContactSet is a write instruction, never stored or serialized: true makes an
	// upsert write Contact (nil clears it), false keeps the stored value.
	ContactSet bool `json:"-"`
	// BaseProfileID is the profile this one composes on; nil with a non-nil Overlay means the
	// deployment default. Only a composed profile has one.
	BaseProfileID *uuid.UUID `json:"base_profile_id,omitempty"`
	// Overlay marks the profile composed. A non-nil pointer to an empty overlay is valid: it is the
	// base unchanged.
	Overlay *CeilingOverlay `json:"overlay,omitempty"`
	// OverlayLimits narrows the base's limits. Only with an Overlay; nil is no narrowing.
	OverlayLimits *LimitsOverlay `json:"overlay_limits,omitempty"`
}

type GrantDelivery string

type GrantKind string

type GrantSpec struct {
	Kind GrantKind `json:"kind"`
	// Scope is kind-specific: {repos,permissions} for github_token; {host,header} for api_key;
	// {host,secret_name,username?} for git_pat; {host,key_secret_ref,username?,known_hosts_secret_ref?} for ssh_key;
	// {name,secret_name} for env_secret; {file,secret_name} for file_secret.
	Scope json.RawMessage `json:"scope"`
	// TTL of the minted credential. Max (and default) 1h.
	TTLSeconds int `json:"ttl_seconds,omitempty"`
	// RequiresApproval forces a human approval to mint (vs auto-mint on policy).
	RequiresApproval bool `json:"requires_approval"`
	OwnerOnly        bool `json:"owner_only,omitempty"` // stored secret from the run owner's own row only, never the operator's
}

type HarnessCredential struct {
	Harness string `json:"harness"`
	// SHA256 is the lower-case hex digest of the credential.
	SHA256 string `json:"sha256"`
}

type HarnessToolRules struct {
	Harness string `json:"harness"`
	// Default is the effect for a tool no rule names. Empty means the harness
	// has no default, and an unmatched tool is held for a human.
	Default ToolEffect `json:"default,omitempty"`
	Rules   []ToolRule `json:"rules,omitempty"`
}

type HomeTemplate string

type ImageBuild struct {
	Schema        int              `json:"schema"`
	Lane          string           `json:"lane"`
	CacheKey      string           `json:"cache_key"`
	BuildID       string           `json:"build_id"`
	Reason        string           `json:"reason"`
	BuiltAt       time.Time        `json:"built_at"`
	WardynVersion string           `json:"wardyn_version"`
	Resolved      bool             `json:"resolved"`
	Inputs        ImageBuildInputs `json:"inputs"`
	Image         ImageBuildImage  `json:"image"`
}

type ImageBuildFeature struct {
	Ref     string         `json:"ref"`
	Digest  string         `json:"digest"`
	Options map[string]any `json:"options"`
}

type ImageBuildGenerator struct {
	Salt        string            `json:"salt"`
	FilesSHA256 map[string]string `json:"files_sha256"`
}

type ImageBuildImage struct {
	Ref string `json:"ref"`
	ID  string `json:"id"`
}

type ImageBuildInputs struct {
	Base       ImageBuildRef         `json:"base"`
	Features   []ImageBuildFeature   `json:"features,omitempty"`
	Installers []ImageBuildInstaller `json:"installers,omitempty"`
	Generator  *ImageBuildGenerator  `json:"generator,omitempty"`
	Repo       *ImageBuildRepo       `json:"repo,omitempty"`
}

type ImageBuildInstaller struct {
	Tool     string `json:"tool"`
	Channel  string `json:"channel"`
	Version  string `json:"version"`
	Platform string `json:"platform"`
	SHA256   string `json:"sha256"`
}

type ImageBuildRef struct {
	Ref    string `json:"ref"`
	Digest string `json:"digest"`
}

type ImageBuildRepo struct {
	URL string `json:"url"`
	Ref string `json:"ref"`
}

type Integration struct {
	// ID is an operator-chosen stable slug, unique within
	// SiteConfig.Integrations (no generated uuid — egress redirects'
	// token_integration_ref and workspace requirements point at it).
	ID   string `json:"id"`
	Name string `json:"name"`
	// Kind is the ONE field saying what this connects to: a closed-set kind
	// (ClosedIntegrationKinds) with bespoke behavior, or any other slug (generic).
	Kind string `json:"kind"`
	// Disabled turns the integration off without deleting its configuration.
	Disabled bool `json:"disabled,omitempty"`
	// Secrets are the required secrets, each with its delivery; refs/names only.
	Secrets []IntegrationSecret `json:"secrets,omitempty"`
	// Egress is WHERE THE SYSTEM LIVES: hosts this integration may reach
	// (proxy.ValidDomainEntry syntax: exact host or leading-"*." wildcard,
	// optionally ":port"). TRUST BOUNDARY: a wildcard opens the path but
	// never carries the credential — proxy-side injection needs an exact
	// entry, so a proxy_header secret is rejected at write time if any
	// egress entry is a wildcard or has a port.
	Egress []string `json:"egress,omitempty"`
	// Config is non-secret, kind-validated configuration; closed kinds accept
	// only known keys (unknown 400s by name at write), generic kinds take any
	// string keys.
	Config map[string]any `json:"config,omitempty"`
	Docs   string         `json:"docs,omitempty"`
	// DisabledCapabilities lists capability names this integration does NOT support.
	DisabledCapabilities []string  `json:"disabled_capabilities,omitempty"`
	CreatedAt            time.Time `json:"created_at"`
	UpdatedAt            time.Time `json:"updated_at"`
	// contains filtered or unexported fields
}

type IntegrationDelivery struct {
	Mode string `json:"mode"` // proxy_header | resident_file | resident_env
	// Header/Format apply to proxy_header: field name and value template (one
	// %s; empty means the raw secret IS the value).
	Header string `json:"header,omitempty"`
	Format string `json:"format,omitempty"`
	// Path applies to resident_file: the in-sandbox path the secret lands at.
	Path string `json:"path,omitempty"`
	// Var applies to resident_env: the environment variable name.
	Var string `json:"var,omitempty"`
}

type IntegrationList []Integration

type IntegrationSecret struct {
	Role       string               `json:"role"`
	SecretName string               `json:"secret_name"`
	Delivery   *IntegrationDelivery `json:"delivery,omitempty"`
}

type InternalHost struct {
	// HostSuffix matches a request host by label suffix: itself, or any host
	// ending in "."+HostSuffix (never a mid-label substring match).
	HostSuffix string `json:"host_suffix"`
	// CIDRs scopes the lift to these ranges only, each inside RFC1918,
	// fc00::/7, or 100.64.0.0/10 (ipguard.Liftable) — never loopback/
	// link-local/metadata/multicast/NAT64. Empty lifts the full Liftable set.
	CIDRs []string `json:"cidrs,omitempty"`
	// Baseline grades this host and EVERY subdomain as baseline egress, where
	// SiteEgress.BaselineHosts names exact hosts. Default false, so declaring an
	// internal host never changes a grade unless the operator says so. Set only
	// through PUT /governance/egress-baseline (or the boot seed on an empty
	// document): PUT /site-config refuses a changed set of marks.
	Baseline bool `json:"baseline,omitempty"`
}

type Invitation struct {
	ID              uuid.UUID       `json:"id"`
	Target          string          `json:"target"`
	CreatedBy       string          `json:"created_by"`
	CreatedAt       time.Time       `json:"created_at"`
	ExpiresAt       time.Time       `json:"expires_at"`
	TokenName       string          `json:"token_name,omitempty"`
	TokenTTLSeconds *int64          `json:"token_ttl_seconds,omitempty"` // nil = the deployment rule
	ReplacesTokenID *uuid.UUID      `json:"replaces_token_id,omitempty"`
	ClaimedAt       *time.Time      `json:"claimed_at,omitempty"`
	TokenID         *uuid.UUID      `json:"token_id,omitempty"`
	RevokedAt       *time.Time      `json:"revoked_at,omitempty"`
	RevokedBy       string          `json:"revoked_by,omitempty"`
	State           InvitationState `json:"state"`
	ConsolePath     string          `json:"console_path,omitempty"` // create response only
}

type InvitationState string

type LLMInspectionSpec struct {
	// Mode is "off" (default), "alert" (scan + audit, forward unchanged), or
	// "block" (a qualifying finding refuses the request). "" == "off".
	Mode string `json:"mode"`
	// WorkspaceSecretNames are operator-declared secret NAMES, resolved against the at-rest secret
	// store — the field an operator/admin actually AUTHORS. A name is not sensitive the way a value
	// is, so it may freely appear in a stored policy row. Resolved to WorkspaceSecretValues ONLY at
	// dispatch, in memory, on the per-dispatch policy copy handed to the proxy.
	WorkspaceSecretNames []string `json:"workspace_secret_names,omitempty"`
	// WorkspaceSecretValues are the RESOLVED secret VALUES the run must not leak into a prompt — the
	// v1 detection corpus the proxy actually matches against. NOT an authoring field:
	// validatePolicySpec refuses a non-empty value here on every policy write. Populated ONLY by
	// dispatch, in memory; every other copy carries names only, values redacted to a count. NEVER
	// logged. Values shorter than the masking floor are ignored.
	WorkspaceSecretValues []string `json:"workspace_secret_values,omitempty"`
	// DetectSecrets enables the known-secret detector (exact match against WorkspaceSecretValues).
	// At least one Detect* must be true when Mode != off.
	DetectSecrets bool `json:"detect_secrets,omitempty"`
	// DetectSecretPatterns enables the regex catalog of well-known secret formats (AWS/GitHub/Slack/
	// Google keys, PEM keys, JWTs, Stripe) — higher precision than entropy but can false-positive on
	// example/test keys in code.
	DetectSecretPatterns bool `json:"detect_secret_patterns,omitempty"`
	// DetectEntropy enables the Shannon-entropy detector (high FP in code; medium
	// severity so a strict block_min_severity can exclude it). Off by default.
	DetectEntropy bool `json:"detect_entropy,omitempty"`
	// DetectPII enables the regex/Luhn PII detector (best-effort, high false-negative recall — a
	// visibility signal, never a control). Off by default.
	DetectPII bool `json:"detect_pii,omitempty"`
	// DetectorSidecarURL, when set, adds an out-of-process detection sidecar the proxy POSTs each
	// span to. Trusted operator config. A sidecar error/timeout/non-200 respects on_scanner_error
	// like any other scanner error: fail-OPEN by default, fail-CLOSED when on_scanner_error=block —
	// so block mode with the sidecar as the SOLE detector DOES guarantee a block on sidecar failure.
	DetectorSidecarURL string `json:"detector_sidecar_url,omitempty"`
	// ClassifiedMarkers are operator-defined literal markers (e.g. "INTERNAL ONLY",
	// "CONFIDENTIAL//NOFORN") whose presence in outbound content flags a
	// classified-content leak. Case-insensitive substring match; category "classified".
	ClassifiedMarkers []string `json:"classified_markers,omitempty"`
	// ScanAttachments opts into decoding+scanning base64 image/document attachment
	// bytes in a prompt (off by default — binary, large, high-FP).
	ScanAttachments bool `json:"scan_attachments,omitempty"`
	// InspectForwardEgress extends inspection from the LLM routes to the GENERIC plaintext-HTTP
	// forward path, so a custom (non-LLM) HTTP connector's POST/PUT body is scanned too. Off by
	// default. (HTTPS connectors tunnel via opaque CONNECT and remain uninspected unless MITM'd.)
	InspectForwardEgress bool `json:"inspect_forward_egress,omitempty"`
	// MaxScanBytes caps the size of a single extracted span scanned; 0 => a
	// built-in default. A larger span is skipped (fail-open) and recorded.
	MaxScanBytes int `json:"max_scan_bytes,omitempty"`
	// OnScannerError selects behavior when the scanner ERRORS (e.g. an
	// unparseable body): "pass" (default, fail-open) or "block".
	OnScannerError string `json:"on_scanner_error,omitempty"`
	// RequireInspectableLLM, when true, refuses to schedule a run whose resolved LLM transport is
	// opaque (subscription-OAuth/Bedrock CONNECT) and therefore cannot be inspected — fail-closed,
	// like MinConfinementClass. Default false only WARNS (the common subscription user isn't punished).
	RequireInspectableLLM bool `json:"require_inspectable_llm,omitempty"`
	// InterceptTLS opts the run into TLS-MITM of opaque CONNECT tunnels to known LLM hosts
	// (Anthropic/OpenAI), making the subscription-OAuth path inspectable. TRUST BOUNDARY: the
	// control plane provisions a per-run CA — the PRIVATE key goes only to the proxy sidecar; the
	// sandbox trusts only the CA's PUBLIC cert. Adds a CA trust dependency inside the sandbox. Off by default.
	InterceptTLS bool `json:"intercept_tls,omitempty"`
	// BlockMinSeverity is the minimum finding severity that triggers a block in
	// "block" mode ("low"|"medium"|"high"|"critical"; "" => low).
	BlockMinSeverity string `json:"block_min_severity,omitempty"`
}

type LaunchPreset struct {
	Name        string          `json:"name"`
	Version     int             `json:"version"`
	Description string          `json:"description,omitempty"`
	UserTypes   []string        `json:"user_types"`
	Request     json.RawMessage `json:"request"`
	CreatedAt   time.Time       `json:"created_at"`
	UpdatedAt   time.Time       `json:"updated_at"`
	CreatedBy   string          `json:"created_by,omitempty"`
	UpdatedBy   string          `json:"updated_by,omitempty"`
}

type LimitAmount struct {
	Value     int  `json:"value"`
	Unlimited bool `json:"unlimited,omitempty"`
}

type LimitSource string

type LimitsOverlay struct {
	LocalSelfDefinedComponents *bool           `json:"local_self_defined_components,omitempty"`
	DenyTaskModeExec           *bool           `json:"deny_task_mode_exec,omitempty"`
	DenyInteractive            *bool           `json:"deny_interactive,omitempty"`
	DenyUIApps                 *bool           `json:"deny_ui_apps,omitempty"`
	MaxConcurrentRuns          *int            `json:"max_concurrent_runs,omitempty"`
	DenyUserDrive              *bool           `json:"deny_user_drive,omitempty"`
	DenyMemberDrives           *bool           `json:"deny_member_drives,omitempty"`
	DenyPlacements             *[]Placement    `json:"deny_placements,omitempty"`
	MaxCPUMillis               *int            `json:"max_cpu_millis,omitempty"`
	MaxMemoryMiB               *int            `json:"max_memory_mib,omitempty"`
	MaxEphemeralDiskMiB        *int            `json:"max_ephemeral_disk_mib,omitempty"`
	MaxDriveSizeMiB            *int            `json:"max_drive_size_mib,omitempty"`
	AutonomyRubric             *AutonomyRubric `json:"autonomy_rubric,omitempty"`
	MaxEndAheadSec             *int            `json:"max_end_ahead_sec,omitempty"`
	DefaultEndSec              *int            `json:"default_end_sec,omitempty"`
	AllowNoEnd                 *bool           `json:"allow_no_end,omitempty"`
	MaxWaitSec                 *int            `json:"max_wait_sec,omitempty"`
	DefaultWaitSec             *int            `json:"default_wait_sec,omitempty"`
	UserChangesLimits          *bool           `json:"user_changes_limits,omitempty"`
	PauseIdleAfterSec          *int            `json:"pause_idle_after_sec,omitempty"`
}

type LostReason string

type MemberDrivePolicy struct {
	Enabled      bool `json:"enabled,omitempty"`
	MaxPerPerson int  `json:"max_per_person,omitempty"` // 1..MaxMemberDrivesPerPerson when Enabled
	// SizeMiB is the k8s claim request, required when Enabled and bounded by
	// UserDriveProvider.MaxSizeMiB. A Docker volume has no size limit, so it must be 0 there.
	SizeMiB      int    `json:"size_mib,omitempty"`
	StorageClass string `json:"storage_class,omitempty"` // k8s only; "" = the cluster default
}

type ModelProvider struct {
	ID string `json:"id"` // admin's slug ("corp-gateway"); unique within the block
	// UID is SERVER-OWNED: minted on first write, never reissued once deleted. Every person's credential is
	// keyed by it, so a submitted value is ignored rather than trusted.
	UID  string            `json:"uid,omitempty"`
	Name string            `json:"name,omitempty"` // shown when people choose it ("Corp gateway")
	Kind ModelProviderKind `json:"kind"`
	// Disabled is negative-sense so the zero value is ENABLED. A disabled provider may remain an agent's
	// default: that default becomes a refused sentinel, never a fall-through to another provider.
	Disabled bool `json:"disabled,omitempty"`
	// BaseURL: required for custom_endpoint, an optional gateway override for Anthropic/OpenAI, never set
	// on Bedrock (its address is Bedrock.BaseURL).
	BaseURL string           `json:"base_url,omitempty"`
	Auth    *ProviderAuth    `json:"auth,omitempty"`    // how each person's token is sent; custom_endpoint only
	Bedrock *BedrockSettings `json:"bedrock,omitempty"` // region, address and sign-in setup for a Bedrock kind
	Azure   *AzureSettings   `json:"azure,omitempty"`   // endpoint and route for azure_foundry
	// Harnesses are the harnesses this provider serves, with per-pairing settings.
	Harnesses []ProviderHarness `json:"harnesses,omitempty"`
}

type ModelProviderKind string

type ModelProviders struct {
	Providers []ModelProvider `json:"providers,omitempty"`
}

type ModelProvidersRead struct {
	ModelProviders
	ConnectedPeople      map[string]int      `json:"connected_people,omitempty"`
	EntraLoginConfigured bool                `json:"entra_login_configured"`
	KindsAvailable       []ModelProviderKind `json:"kinds_available"`
}

type OverrideDirection string

type OverrideKind string

type OverrideNarrowing struct {
	Kind      OverrideKind      `json:"kind"`
	Op        OverrideOp        `json:"op"`
	Direction OverrideDirection `json:"direction"`
	Rule      OverrideRule      `json:"rule"`
}

type OverrideOp string

type OverrideRule string

type PauseReason string

type Person struct {
	Principal       string     `json:"principal"`
	Email           string     `json:"email,omitempty"`
	Issuer          string     `json:"issuer,omitempty"`
	TenantID        string     `json:"tenant_id,omitempty"`
	ObjectID        string     `json:"object_id,omitempty"`
	CreatedBy       string     `json:"created_by"`
	CreatedAt       time.Time  `json:"created_at"`
	FirstSignedInAt *time.Time `json:"first_signed_in_at,omitempty"`
}

type PersonList struct {
	People     []PersonSummary `json:"people"`
	NextCursor string          `json:"next_cursor,omitempty"`
}

type PersonSummary struct {
	Principal       string     `json:"principal"`
	Email           string     `json:"email,omitempty"`
	IssuerKind      string     `json:"issuer_kind"`
	PreCreated      bool       `json:"pre_created"`
	FirstSignedInAt *time.Time `json:"first_signed_in_at,omitempty"`
	LastSignedInAt  *time.Time `json:"last_signed_in_at,omitempty"`
	DeactivatedAt   *time.Time `json:"deactivated_at,omitempty"`
	Role            string     `json:"role,omitempty"`
	ActiveSessions  int        `json:"active_sessions"`
	APITokens       int        `json:"api_tokens"`
	SSHKeys         int        `json:"ssh_keys"`
	Credentials     int        `json:"credentials"`
	ActiveRuns      int        `json:"active_runs"`
}

type Placement string

type ProviderAuth struct {
	Header string `json:"header,omitempty"`
	Format string `json:"format,omitempty"`
}

type ProviderHarness struct {
	Harness string `json:"harness"` // harness-catalog id ("claude-code", "codex-cli")
	// Model: model id this harness uses on this provider; admin-set, no member override. Required
	// (an inference profile) on a Bedrock kind.
	Model string `json:"model,omitempty"`
	// FastModel is the deployment the Messages harness uses for its small-model alias; azure_foundry only,
	// on that harness only. Unset means Model.
	FastModel string `json:"fast_model,omitempty"`
	Path      string `json:"path,omitempty"` // where a custom endpoint serves this harness's API dialect, under BaseURL; may not change the host
	// AuthHeader and AuthFormat override the provider's Auth for this harness alone (custom_endpoint only).
	AuthHeader string `json:"auth_header,omitempty"`
	AuthFormat string `json:"auth_format,omitempty"`
}

type PushContentScope struct {
	// Repo is the repository as the run's grant names it: "github.com/<owner>/<repo>"
	// on the GitHub App lane, "<host>/<path>" on the git_pat lane (Azure DevOps:
	// "dev.azure.com/<org>/<project>/_git/<repo>").
	Repo string `json:"repo"`
	// Branch is the ref the push updates, "refs/heads/…"; several names join
	// sorted by ", ".
	Branch string `json:"branch"`
	// ActsAs is the credential the forwarded push authenticates with, as
	// "<grant kind>:<grant id>" — "github_token:<uuid>" or "git_pat:<uuid>".
	ActsAs string `json:"acts_as"`
	// Paths are the first PushContentMaxPaths review-matched paths, sorted,
	// each git-quoted (core.quotePath on, the sidecar's quotePath) so every
	// path is valid UTF-8 on the wire. A path ending in "/" is a directory the
	// push does not carry.
	Paths []string `json:"paths"`
	// PathsTotal is how many paths matched a review pattern in all.
	PathsTotal int `json:"paths_total"`
	// Commits are the object ids the push sets its refs to, sorted.
	Commits []string `json:"commits"`
	// Updates pairs each ref the push updates with the object id it sets it
	// to — all zeros for a delete — sorted by ref. Branch and Commits name the
	// same refs and ids for the card; Updates is what binds one to the other,
	// so the same commits sent to the same refs in a different assignment are
	// a different scope. A row raised before it existed has none and matches
	// no new raise.
	Updates []PushRefUpdate `json:"updates"`
	// PathsDigest is the lower-case hex SHA-256 over every review-matched path,
	// sorted, each followed by a NUL byte (a git path cannot contain one).
	PathsDigest string `json:"paths_digest"`

	// ActsAsKind and ActsAsLabel are SERVER-SET: the control plane resolves
	// ActsAs against the run's own grants and stamps them before the row is
	// stored, refusing a raise that carries either — a sidecar's word on who a
	// push acts as is not taken. ActsAsKind is one of the PushActsAs*
	// constants; ActsAsLabel is the principal the console names.
	ActsAsKind  string `json:"acts_as_kind,omitempty"`
	ActsAsLabel string `json:"acts_as_label,omitempty"`
}

type PushPathList struct {
	Paths     []string `json:"paths"`
	Truncated bool     `json:"truncated"`
}

type PushRefUpdate struct {
	Ref string `json:"ref"`
	New string `json:"new"`
}

type PushRuleSet struct {
	Provider string `json:"provider"`
	Host     string `json:"host,omitempty"`
	Org      string `json:"org"`
	// BasePath is the path prefix of an Azure DevOps Server provider row (for
	// example "/tfs"), recorded from the row at dispatch. The git route derives
	// a remote's collection with it: without it a remote under a prefix is
	// ambiguous and its push is refused. Empty for every other entry.
	BasePath string        `json:"base_path,omitempty"`
	Rules    PushRulesSpec `json:"rules"`
}

type PushRulesOverlay struct {
	DenyPaths          *[]string `json:"deny_paths,omitempty"`
	MaxInspectPackMiB  *int      `json:"max_inspect_pack_mib,omitempty"`
	RequireReviewPaths *[]string `json:"require_review_paths,omitempty"`
	HoldSeconds        *int      `json:"hold_seconds,omitempty"`
	DenyNewExecutables *bool     `json:"deny_new_executables,omitempty"`
	MaxFileSizeMiB     *int      `json:"max_file_size_mib,omitempty"`
}

type PushRulesSpec struct {
	// DenyPaths are path patterns (e.g. ".github/workflows/**") the broker
	// refuses in a push: "**" crosses path segments, "*" and "?" do not, and
	// the pattern is anchored at the repository root. A trailing "/" means
	// everything beneath the directory (DenyPathSegments).
	DenyPaths []string `json:"deny_paths,omitempty"`
	// MaxInspectPackMiB caps how much of an incoming push the broker buffers
	// before refusing it as too large. 0/absent takes the broker's own default,
	// below the authored maximum so raising this is a real remedy; bounded
	// 0..64 by validatePolicySpec.
	MaxInspectPackMiB int `json:"max_inspect_pack_mib,omitempty"`
	// RequireReviewPaths are patterns in DenyPaths' language whose match HOLDS
	// a push for an admin's decision instead of refusing it. A deny match wins
	// over a review match; an unattended run refuses rather than holding.
	RequireReviewPaths []string `json:"require_review_paths,omitempty"`
	// HoldSeconds is how long a held push waits for that decision before it
	// is refused. 0/absent means 120; bounded 0..600 by validatePolicySpec.
	HoldSeconds int `json:"hold_seconds,omitempty"`
	// DenyNewExecutables is reserved: the broker cannot yet tell a newly added executable from an
	// edit to an existing one, so validation refuses it when true rather than store a rule nothing
	// enforces, and IsSet does not count it, so a stored true never makes the broker inspect for
	// a rule it cannot apply.
	DenyNewExecutables bool `json:"deny_new_executables,omitempty"`
	// MaxFileSizeMiB refuses a push that introduces a file larger than this many MiB, or one whose
	// size the pack does not carry and the forge cannot show unchanged. 0/absent is off; bounded
	// 0..1024 by validatePolicySpec.
	MaxFileSizeMiB int `json:"max_file_size_mib,omitempty"`
}

type RemoteRunner struct {
	ID   string     `json:"id"`
	Kind RunnerKind `json:"kind"`
	Name string     `json:"name"`
	// PeoplePools is who may add it to their own user pools; PeopleSubjects lists them when it is
	// listed. A listed policy whose people all left lists nobody and admits nobody.
	PeoplePools    RemoteRunnerPeoplePools `json:"people_pools"`
	PeopleSubjects []RunnerPoolSubject     `json:"people_subjects,omitempty"`
	// Limits is what an administrator declared (proposed once at boot from what the server measured);
	// nil while any of them is unset, and then the runner takes no run.
	Limits *RunnerLimits `json:"limits"`
	// Revision starts at 1 and rises on every change to the name or the people policy.
	Revision  int64     `json:"revision"`
	UpdatedBy string    `json:"updated_by,omitempty"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type RemoteRunnerPeoplePools string

type RemoteRunnerPoolRef struct {
	ID    uuid.UUID       `json:"id"`
	Name  string          `json:"name"`
	Scope RunnerPoolScope `json:"scope"`
	// Owner is a user pool's owner, set on the operators' reads only.
	Owner string `json:"owner,omitempty"`
}

type ResolvedDrive struct {
	Drive    UserDrive
	Grant    UserDriveGrant
	Tier     CapabilitySubjectType
	HomeName string // per-user segment: the subdirectory of a share, or the suffix of a managed object's name
	// SubjectHash fingerprints the principal HomeName was derived FROM
	// (DriveSubjectHash), carried so the runner can stamp it and refuse one
	// stamped for somebody else.
	SubjectHash string `json:"subject_hash,omitempty"`
	ObjectName  string // what the runner asks the substrate for — a volume name, a PVC name, or an absolute host path
	SizeMiB     int
	Writable    bool
	Enforcement StorageEnforcement
	// Paused is set when the grant that WON is disabled: nothing is derived
	// and nothing may be mounted, but the row still wins its tier (DESIGN
	// §2.2) rather than falling through.
	Paused bool
}

type ResolvedInjection struct {
	Host      string `json:"host"`
	Header    string `json:"header"`
	Value     string `json:"value"`
	JTI       string `json:"jti"`
	ExpiresAt int64  `json:"expires_at,omitempty"`
	// Organisation is the ADO org a per-person credential was dispatched for — informational only;
	// the proxy's REST gate pins the org from its own dispatch-time config, never from a resolve.
	Organisation string `json:"organisation,omitempty"`
	// Capabilities is the same lane's granted capability set, read once to confirm an asked-for
	// capability came back granted. Empty on other lanes.
	Capabilities []string `json:"capabilities,omitempty"`
}

type ResolvedRunnerPool struct {
	ID        uuid.UUID           `json:"id"`
	Name      string              `json:"name"`
	Scope     RunnerPoolScope     `json:"scope"`
	Revision  int64               `json:"revision"`
	Selection RunnerPoolSelection `json:"selection"`
}