policy

type Axis string

type Credential struct {
	Env    string `yaml:"env,omitempty" json:"env,omitempty"`
	File   string `yaml:"file,omitempty" json:"file,omitempty"`
	Scheme string `yaml:"scheme,omitempty" json:"scheme,omitempty"`
}

type Egress struct {
	// AllowedDomains is the only egress permitted from managed environments (firewall + harness sandbox).
	AllowedDomains []string `yaml:"allowedDomains,omitempty" json:"allowedDomains,omitempty"`
}

type Experiment struct {
	Meta   `yaml:",inline"`
	Type   ExperimentType `yaml:"type" json:"type"`
	Axis   Axis           `yaml:"axis" json:"axis"`
	Status string         `yaml:"status,omitempty" json:"status,omitempty"` // draft | running | paused | concluded
	// Rings the experiment draws users from.
	Rings    []string  `yaml:"rings" json:"rings"`
	Variants []Variant `yaml:"variants" json:"variants"`
	// Shadow only: fraction of eligible requests mirrored (0-1).
	SampleRate float64  `yaml:"sampleRate,omitempty" json:"sampleRate,omitempty"`
	Metrics    Metrics  `yaml:"metrics" json:"metrics"`
	Stopping   Stopping `yaml:"stopping" json:"stopping"`
	// Salt keeps assignment independent across experiments; defaults to Name.
	Salt string `yaml:"salt,omitempty" json:"salt,omitempty"`
}

type ExperimentType string

type Gateway struct {
	Meta `yaml:",inline"`
	// BaseURL is what clients are pointed at (Kong's public listener).
	BaseURL string `yaml:"baseURL" json:"baseURL"`
	// Protocol per harness: anthropic-messages | bedrock-invoke | openai-responses | gemini.
	Protocols map[string]string `yaml:"protocols,omitempty" json:"protocols,omitempty"`
	// Auth: how clients obtain a credential for the auth gateway.
	Auth GatewayAuth `yaml:"auth" json:"auth"`
	// Models maps a stable alias (what clients request) to upstream targets.
	Models map[string]ModelRoute `yaml:"models" json:"models"`
	// Upstreams are named backends (e.g. the orchestrator, direct Anthropic).
	Upstreams map[string]Upstream `yaml:"upstreams" json:"upstreams"`
	// Engine is the data plane that enforces this policy: halo-proxy (default)
	// or kong. Multi-target routes (weights, failover) are halo-proxy-only; Kong
	// uses each route's first target.
	Engine string `yaml:"engine,omitempty" json:"engine,omitempty"`
}

type GatewayAuth struct {
	// HelperCommand prints a short-lived token (used as Claude apiKeyHelper, Codex env_key source, ...).
	HelperCommand string `yaml:"helperCommand,omitempty" json:"helperCommand,omitempty"`
	TTLSeconds    int    `yaml:"ttlSeconds,omitempty" json:"ttlSeconds,omitempty"`
	// IdentityHeader is the header the auth gateway sets with the verified user id.
	IdentityHeader string `yaml:"identityHeader,omitempty" json:"identityHeader,omitempty"`
}

type Guardrail func(*Org) []Issue

type HarnessSpec struct {
	// Version is an exact CLI version pin (e.g. "2.1.280"). Required for rings.
	Version string `yaml:"version" json:"version"`
	// Model is this harness's default model alias, replacing models.default
	// for it (e.g. codex-default, so codex does not ask for a Claude alias).
	// Must be a gateway.models alias, and in models.allowed when enforced.
	Model string `yaml:"model,omitempty" json:"model,omitempty"`
	// Overrides are raw, harness-native keys merged last. Escape hatch; the Go guardrails still check them (ADR-0007).
	Overrides map[string]any `yaml:"overrides,omitempty" json:"overrides,omitempty"`
}

type Hook struct {
	// Event: PreToolUse | PostToolUse | SessionStart | Stop | UserPromptSubmit
	Event   string `yaml:"event" json:"event"`
	Matcher string `yaml:"matcher,omitempty" json:"matcher,omitempty"`
	Command string `yaml:"command" json:"command"`
}

type Hooks struct {
	ManagedOnly bool   `yaml:"managedOnly,omitempty" json:"managedOnly,omitempty"`
	Hooks       []Hook `yaml:"items,omitempty" json:"items,omitempty"`
}

type Identity struct {
	Issuer   string `yaml:"issuer,omitempty" json:"issuer,omitempty"`
	ClientID string `yaml:"clientID,omitempty" json:"clientID,omitempty"`
	// Audience expected in gateway bearer tokens; defaults to ClientID.
	Audience string `yaml:"audience,omitempty" json:"audience,omitempty"`
	// UserClaim / GroupsClaim name the JWT claims for subject id and groups.
	UserClaim   string `yaml:"userClaim,omitempty" json:"userClaim,omitempty"`     // default "email"
	GroupsClaim string `yaml:"groupsClaim,omitempty" json:"groupsClaim,omitempty"` // default "groups"
	// AdminGroups may approve requests and manage experiments in the portal.
	AdminGroups []string `yaml:"adminGroups,omitempty" json:"adminGroups,omitempty"`
}

type Issue struct {
	Severity Severity
	Path     string
	Message  string
}

type Kind string

type MCP struct {
	// ManagedOnly blocks every server not listed here.
	ManagedOnly bool        `yaml:"managedOnly,omitempty" json:"managedOnly,omitempty"`
	Servers     []MCPServer `yaml:"servers,omitempty" json:"servers,omitempty"`
	Denied      []string    `yaml:"denied,omitempty" json:"denied,omitempty"`
}

type MCPServer struct {
	Name    string            `yaml:"name" json:"name"`
	URL     string            `yaml:"url,omitempty" json:"url,omitempty"`
	Command []string          `yaml:"command,omitempty" json:"command,omitempty"`
	Headers map[string]string `yaml:"headers,omitempty" json:"headers,omitempty"`
}

type Membership struct {
	// Users are explicit user ids always in this ring (checked before Groups).
	Users []string `yaml:"users,omitempty" json:"users,omitempty"`
	// Groups are IdP groups always in this ring.
	Groups []string `yaml:"groups,omitempty" json:"groups,omitempty"`
	// Percent of remaining users hashed into this ring (0-100, basis points precision).
	Percent float64 `yaml:"percent,omitempty" json:"percent,omitempty"`
	// Default marks the catch-all ring (GA).
	Default bool `yaml:"default,omitempty" json:"default,omitempty"`
	// OptIn lets developers join this ring themselves from the portal
	// (recorded as a group membership request; admins may auto-approve).
	OptIn bool `yaml:"optIn,omitempty" json:"optIn,omitempty"`
}

type Meta struct {
	APIVersion string            `yaml:"apiVersion" json:"apiVersion"`
	Kind       Kind              `yaml:"kind" json:"kind"`
	Name       string            `yaml:"name" json:"name"`
	Labels     map[string]string `yaml:"labels,omitempty" json:"labels,omitempty"`
}

type MetricDef struct {
	Name        string
	Unit        string // unit of the value, e.g. ratio, ms, usd
	Description string
	Sources     map[string]string
	// Source lists where values come from. When a metric has both online
	// sources, internal/promote prefers the gateway for an experiment that has
	// gateway data (exact cohort attribution), else the CLI events.
	Source []SignalSource
	// PerUnit defines one analysis sample: experiments compare the per-unit
	// values of the two arms. CLI unit = user.id (Codex: user.account_id, else
	// conversation.id; Gemini: installation.id); gateway unit = salted hash
	// of the session id (else of the verified subject).
	PerUnit string
	// Better is the direction of improvement ("increase" | "decrease"); when
	// set, goals on this metric must use it. Empty = not enforced.
	Better string
}

type MetricGoal struct {
	// Metric is a normalised halo.* metric name, e.g. halo.task.success, halo.cost.usd_per_session.
	Metric string `yaml:"metric" json:"metric"`
	// Direction: increase | decrease
	Direction string `yaml:"direction" json:"direction"`
	// MaxRegression (guardrails): relative worsening that aborts, e.g. 0.05 = 5%.
	MaxRegression float64 `yaml:"maxRegression,omitempty" json:"maxRegression,omitempty"`
}

type Metrics struct {
	Primary    MetricGoal   `yaml:"primary" json:"primary"`
	Guardrails []MetricGoal `yaml:"guardrails,omitempty" json:"guardrails,omitempty"`
}

type ModelChoice []string

type ModelRoute struct {
	Upstream string `yaml:"upstream,omitempty" json:"upstream,omitempty"`
	// Model is the provider model id / Bedrock inference profile ARN.
	Model   string        `yaml:"model,omitempty" json:"model,omitempty"`
	Targets []RouteTarget `yaml:"targets,omitempty" json:"targets,omitempty"`
}

type Models struct {
	Default string   `yaml:"default" json:"default"`
	Allowed []string `yaml:"allowed,omitempty" json:"allowed,omitempty"`
	// Enforce rejects models outside Allowed rather than just hiding them.
	Enforce bool `yaml:"enforce,omitempty" json:"enforce,omitempty"`
}

type Org struct {
	Name        string
	Identity    Identity
	SelfService SelfService
	Gateway     *Gateway
	Profiles    map[string]*Profile
	Rings       []*Ring // ordered, earliest ring first
	Experiments []*Experiment
	Toggles     []*Toggle `json:",omitempty"` // omitted when empty: existing snapshots keep their digest

	// Rollouts are omitted when empty, like Toggles.
	Rollouts []*Rollout `json:",omitempty"`

	// Deprecations are load-time warnings (one per file still on a deprecated
	// apiVersion) that Validate reports. Not part of the snapshot.
	Deprecations []Issue `json:"-"`
}

type Permissions struct {
	// Mode: default | acceptEdits | plan | auto
	Mode          string   `yaml:"mode,omitempty" json:"mode,omitempty"`
	Allow         []string `yaml:"allow,omitempty" json:"allow,omitempty"`
	Deny          []string `yaml:"deny,omitempty" json:"deny,omitempty"`
	Ask           []string `yaml:"ask,omitempty" json:"ask,omitempty"`
	DisableBypass bool     `yaml:"disableBypass,omitempty" json:"disableBypass,omitempty"`
	// Sandbox: harness sandbox policy — off | workspace-write | read-only
	Sandbox string `yaml:"sandbox,omitempty" json:"sandbox,omitempty"`
	// SandboxRequired fails closed: the harness must refuse to run (Claude:
	// sandbox.failIfUnavailable) rather than fall back to unsandboxed
	// execution when its sandbox dependencies are missing.
	SandboxRequired bool `yaml:"sandboxRequired,omitempty" json:"sandboxRequired,omitempty"`
}

type Profile struct {
	Meta    `yaml:",inline"`
	Extends string `yaml:"extends,omitempty" json:"extends,omitempty"`

	// Harnesses enabled by this profile, keyed by adapter name.
	Harnesses map[string]HarnessSpec `yaml:"harnesses" json:"harnesses"`

	Models      Models      `yaml:"models" json:"models"`
	Permissions Permissions `yaml:"permissions" json:"permissions"`
	MCP         MCP         `yaml:"mcp" json:"mcp"`
	Hooks       Hooks       `yaml:"hooks" json:"hooks"`
	Telemetry   Telemetry   `yaml:"telemetry" json:"telemetry"`
	Egress      Egress      `yaml:"egress" json:"egress"`
	// Instructions is org-wide memory (managed CLAUDE.md / AGENTS.md / GEMINI.md).
	Instructions string `yaml:"instructions,omitempty" json:"instructions,omitempty"`
	// Env is extra environment applied to every harness.
	Env map[string]string `yaml:"env,omitempty" json:"env,omitempty"`
}

type Provider struct {
	Name    string `yaml:"name" json:"name"`
	Region  string `yaml:"region,omitempty" json:"region,omitempty"`
	Project string `yaml:"project,omitempty" json:"project,omitempty"`
	URL     string `yaml:"url,omitempty" json:"url,omitempty"`
}

type Ring struct {
	Meta    `yaml:",inline"`
	Order   int    `yaml:"order" json:"order"`
	Profile string `yaml:"profile" json:"profile"`
	// Release pins the ring to an immutable published release digest; empty = build from Profile.
	Release    string     `yaml:"release,omitempty" json:"release,omitempty"`
	Membership Membership `yaml:"membership" json:"membership"`
	// Posture gates gateway access on the device posture halod reports to
	// halo-server (fresh, drift-free, on this ring's release): off | warn | enforce.
	// Empty means warn. Takes effect only on gateways wired to halo-server.
	Posture string `yaml:"posture,omitempty" json:"posture,omitempty"`
	// VersionGate checks the CLI version in the User-Agent against the ring's
	// pinned harness version: off | warn | enforce. Empty means warn.
	VersionGate string `yaml:"versionGate,omitempty" json:"versionGate,omitempty"`
}

type Rollout struct {
	Meta `yaml:",inline"`
	Axis Axis `yaml:"axis" json:"axis"`
	// Status: draft | active | paused | aborted | completed ("" = draft).
	Status string `yaml:"status,omitempty" json:"status,omitempty"`
	// Step is the live step's name, set by merged advance PRs ("" = not started).
	Step string `yaml:"step,omitempty" json:"step,omitempty"`
	// Experiment is the backing two-arm experiment: exposure, evidence, kill
	// switch. Optional when every step is progressive or blue-green.
	Experiment string          `yaml:"experiment,omitempty" json:"experiment,omitempty"`
	Change     RolloutChange   `yaml:"change" json:"change"`
	Baseline   RolloutBaseline `yaml:"baseline,omitempty" json:"baseline,omitempty"`
	Steps      []RolloutStep   `yaml:"steps" json:"steps"`
}

type RolloutBaseline struct {
	// Release is the client-axis switch-back target (required with ring-wide steps).
	Release string `yaml:"release,omitempty" json:"release,omitempty"`
}

type RolloutChange struct {
	// Client axis: the release digest ring pointers move to, and its label.
	Release string `yaml:"release,omitempty" json:"release,omitempty"`
	Version string `yaml:"version,omitempty" json:"version,omitempty"`
	// Traffic axis: the gateway model alias whose route becomes the treatment
	// variant's route for it when the rollout completes.
	Alias string `yaml:"alias,omitempty" json:"alias,omitempty"`
}

type RolloutGates struct {
	// Guardrails compare the backing experiment's arms (internal/stats
	// sequential test). A breach triggers OnFailure at any time.
	Guardrails []MetricGoal `yaml:"guardrails,omitempty" json:"guardrails,omitempty"`
	// Scorecard reads a `halo eval run --output json` scorecard.
	Scorecard *ScorecardGate `yaml:"scorecard,omitempty" json:"scorecard,omitempty"`
	// Approval holds the step until a human advances it (`halo rollout advance`).
	Approval bool `yaml:"approval,omitempty" json:"approval,omitempty"`
}

type RolloutPreset struct {
	Name  string
	Rings []Ring
	// Canary is the treatment ramp on the backing experiment, in order.
	Canary []RolloutStep
	// TeamBake is the bake on ring0; RingBake on each later ring before GA.
	TeamBake, RingBake string
}

type RolloutStep struct {
	Name     string          `yaml:"name" json:"name"`
	Strategy RolloutStrategy `yaml:"strategy" json:"strategy"`
	// Ring is required for progressive/blue-green. Percent steps expose the
	// backing experiment's rings; Ring, if set, must be one of them.
	Ring string `yaml:"ring,omitempty" json:"ring,omitempty"`
	// Percent: canary = treatment share; holdout = share kept on control;
	// dark-launch = share of requests mirrored; progressive/blue-green = 100.
	Percent float64 `yaml:"percent,omitempty" json:"percent,omitempty"`
	// Bake is the minimum time at this step: Go duration or N"d" (e.g. "14d").
	Bake       string       `yaml:"bake,omitempty" json:"bake,omitempty"`
	MinSamples int          `yaml:"minSamples,omitempty" json:"minSamples,omitempty"`
	Gates      RolloutGates `yaml:"gates,omitempty" json:"gates,omitempty"`
	// OnFailure: rollback | pause (default rollback).
	OnFailure string `yaml:"onFailure,omitempty" json:"onFailure,omitempty"`
}

type RolloutStrategy string

type Root struct {
	APIVersion string `yaml:"apiVersion,omitempty" json:"apiVersion,omitempty"`
	Kind       string `yaml:"kind,omitempty" json:"kind,omitempty"`
	Org        string `yaml:"org" json:"org"`
	// Identity configures OIDC for the portal, halo-proxy and enrollment (any IdP).
	Identity Identity `yaml:"identity,omitempty" json:"identity,omitempty"`
	// SelfService configures the developer portal (kiosk).
	SelfService SelfService `yaml:"selfService,omitempty" json:"selfService,omitempty"`
	// Simple mode fields (tools, provider, models, ...): see simple.go.
	Simple `yaml:",inline"`
}

type RouteTarget struct {
	Upstream string  `yaml:"upstream" json:"upstream"`
	Model    string  `yaml:"model" json:"model"`
	Weight   float64 `yaml:"weight,omitempty" json:"weight,omitempty"`
	Priority int     `yaml:"priority,omitempty" json:"priority,omitempty"`
	// TimeoutSeconds bounds connect + wait for response headers (default: the
	// proxy's upstreamHeaderTimeout). Streams are not time-limited afterwards.
	TimeoutSeconds int `yaml:"timeoutSeconds,omitempty" json:"timeoutSeconds,omitempty"`
}

type ScorecardGate struct {
	// File is the scorecard JSON, relative to the policy dir.
	File    string `yaml:"file" json:"file"`
	Variant string `yaml:"variant" json:"variant"`
	// MinPass1 is the absolute pass@1 floor (0 = none).
	MinPass1 float64 `yaml:"minPass1,omitempty" json:"minPass1,omitempty"`
	// MaxRegression is the largest allowed pass-rate drop vs the scorecard's
	// control (0.02 = 2pp); a significantly worse comparison always fails.
	MaxRegression float64 `yaml:"maxRegression,omitempty" json:"maxRegression,omitempty"`
}

type SelfService struct {
	Enabled bool `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	// Launchers offered to developers: devcontainer | codespaces | coder | laptop.
	Launchers []string `yaml:"launchers,omitempty" json:"launchers,omitempty"`
	// Requestable items: kinds of access developers may request (approval opens a policy PR).
	Requestable []string `yaml:"requestable,omitempty" json:"requestable,omitempty"` // mcp-server | model | ring-opt-in | harness
	// Catalog lists MCP servers developers may request that aren't in their profile yet.
	Catalog []MCPServer `yaml:"catalog,omitempty" json:"catalog,omitempty"`
	// EnrollmentTTLSeconds bounds one-time laptop bootstrap tokens (default 900).
	EnrollmentTTLSeconds int `yaml:"enrollmentTTLSeconds,omitempty" json:"enrollmentTTLSeconds,omitempty"`
}

type Severity string

type SignalSource string

type Simple struct {
	// Tools enables harnesses, each pinned to an exact CLI version: a bare
	// version, or {version, model} where model is one of the Models aliases
	// that tool starts on instead of "default" (e.g. codex on an OpenAI model).
	Tools map[string]ToolSpec `yaml:"tools,omitempty" json:"tools,omitempty"`
	// Provider is where models run: a name (anthropic | bedrock | vertex |
	// openai | gemini | multi) or {name, region, project, url}.
	Provider *Provider `yaml:"provider,omitempty" json:"provider,omitempty"`
	// Models maps an alias (what clients ask for; "default" is required) to a
	// provider model id, or to a list of ids tried in failover order. An id may
	// be prefixed "<provider>/" to pick another provider (required with multi).
	Models map[string]ModelChoice `yaml:"models,omitempty" json:"models,omitempty"`
	// Gateway is the base URL clients are pointed at (halo-proxy).
	Gateway string `yaml:"gateway,omitempty" json:"gateway,omitempty"`
	// Telemetry is the OTLP/HTTP endpoint (telemetry is always on).
	Telemetry string `yaml:"telemetry,omitempty" json:"telemetry,omitempty"`
	// Team is ring0: IdP groups, or user ids containing "@". Default:
	// identity.adminGroups, else "<org>-ai-platform".
	Team []string `yaml:"team,omitempty" json:"team,omitempty"`
	// Safety preset: strict | standard (default) | relaxed. None bypasses permissions.
	Safety string `yaml:"safety,omitempty" json:"safety,omitempty"`
	// Rollout preset: fast | standard (default) | careful. Sets the rings and
	// the step template `halo upgrade start` and `halo model switch --canary` use.
	Rollout string `yaml:"rollout,omitempty" json:"rollout,omitempty"`
}

type Stopping struct {
	// Method: msprt | fixed
	Method      string  `yaml:"method" json:"method"`
	Alpha       float64 `yaml:"alpha,omitempty" json:"alpha,omitempty"`
	MinSamples  int     `yaml:"minSamples,omitempty" json:"minSamples,omitempty"`
	MaxDays     int     `yaml:"maxDays,omitempty" json:"maxDays,omitempty"`
	MaxSpendUSD float64 `yaml:"maxSpendUSD,omitempty" json:"maxSpendUSD,omitempty"`
}

type Subject struct {
	ID     string
	Groups []string
}

type Telemetry struct {
	Enabled      bool              `yaml:"enabled" json:"enabled"`
	OTLPEndpoint string            `yaml:"otlpEndpoint,omitempty" json:"otlpEndpoint,omitempty"`
	Protocol     string            `yaml:"protocol,omitempty" json:"protocol,omitempty"` // grpc | http/protobuf
	LogPrompts   bool              `yaml:"logPrompts,omitempty" json:"logPrompts,omitempty"`
	Attributes   map[string]string `yaml:"attributes,omitempty" json:"attributes,omitempty"`
}

type Toggle struct {
	Meta        `yaml:",inline"`
	Description string `yaml:"description,omitempty" json:"description,omitempty"`
	// Owner is the team or person who answers for this toggle (required).
	Owner string `yaml:"owner" json:"owner"`
	// Expires (YYYY-MM-DD) is when the toggle should be removed; past it, validate warns.
	Expires string `yaml:"expires,omitempty" json:"expires,omitempty"`
	// Default is the state when no rule matches.
	Default bool `yaml:"default" json:"default"`
	// Axis: client = a settings fragment delivered in the signed release;
	// traffic = a model route switch applied by the gateway.
	Axis Axis `yaml:"axis" json:"axis"`
	// Rules are evaluated in order; the first rule that matches decides.
	Rules []ToggleRule `yaml:"rules,omitempty" json:"rules,omitempty"`
	// Client is the payload of a client-axis toggle.
	Client *ToggleClient `yaml:"client,omitempty" json:"client,omitempty"`
	// Traffic is the payload of a traffic-axis toggle.
	Traffic *ToggleTraffic `yaml:"traffic,omitempty" json:"traffic,omitempty"`
}

type ToggleClient struct {
	Harnesses map[string]TogglePatch `yaml:"harnesses" json:"harnesses"`
}

type TogglePatch struct {
	MCPServers []MCPServer       `yaml:"mcpServers,omitempty" json:"mcpServers,omitempty"`
	Hooks      []Hook            `yaml:"hooks,omitempty" json:"hooks,omitempty"`
	Env        map[string]string `yaml:"env,omitempty" json:"env,omitempty"`
	// Overrides are harness-native keys, restricted to the same allowlist as profile overrides.
	Overrides map[string]any `yaml:"overrides,omitempty" json:"overrides,omitempty"`
}

type ToggleRule struct {
	Name   string   `yaml:"name,omitempty" json:"name,omitempty"`
	Rings  []string `yaml:"rings,omitempty" json:"rings,omitempty"`
	Groups []string `yaml:"groups,omitempty" json:"groups,omitempty"`
	Users  []string `yaml:"users,omitempty" json:"users,omitempty"`
	// Percent (0-100) of the matching subjects, hashed with the toggle's own
	// salt. Omitted = no percent condition; an explicit 0 matches nobody.
	Percent *float64 `yaml:"percent,omitempty" json:"percent,omitempty"`
	// Effect is the state when the rule matches: "on" (default) or "off".
	Effect string `yaml:"effect,omitempty" json:"effect,omitempty"`
}

type ToggleTraffic struct {
	Routes map[string]ModelRoute `yaml:"routes" json:"routes"`
}

type ToolSpec struct {
	Version string `yaml:"version" json:"version"`
	Model   string `yaml:"model,omitempty" json:"model,omitempty"`
}

type Upstream struct {
	// URL is the base URL. Optional for kind vertex (derived from region).
	URL string `yaml:"url,omitempty" json:"url,omitempty"`
	// Kind: orchestrator | anthropic | bedrock | vertex | openai | azure-openai | gemini
	Kind string `yaml:"kind" json:"kind"`
	// Project is the Google Cloud project id for kind vertex.
	Project string `yaml:"project,omitempty" json:"project,omitempty"`
	// APIVersion is the api-version query for kind azure-openai; empty uses the
	// versionless /openai/v1 surface.
	APIVersion string `yaml:"apiVersion,omitempty" json:"apiVersion,omitempty"`
	// Credential names where halo-proxy reads the provider key (kinds openai,
	// azure-openai, gemini). Policy never holds the secret itself.
	Credential *Credential `yaml:"credential,omitempty" json:"credential,omitempty"`
	// Region is the AWS SigV4 region for kind bedrock. halo-proxy signs a
	// bedrock upstream only if its host ends in an AWS suffix (.amazonaws.com,
	// .amazonaws.com.cn, .api.aws) or is listed in the proxy's signHosts; it
	// never signs for other hosts. The region is this value when set, else
	// parsed from the host (e.g. bedrock-runtime.<region>.amazonaws.com).
	Region string `yaml:"region,omitempty" json:"region,omitempty"`
	// Serves lists the client wires an orchestrator upstream answers
	// (anthropic-messages | bedrock-invoke | openai-responses | gemini). An
	// orchestrator may translate, so validate only trusts what is declared here;
	// other kinds' wires are known.
	Serves []string `yaml:"serves,omitempty" json:"serves,omitempty"`
}

type Variant struct {
	Name string `yaml:"name" json:"name"`
	// Weight is the share of the experiment's users (weights are normalised).
	Weight float64 `yaml:"weight" json:"weight"`
	// Traffic axis: model alias -> route override.
	Routes map[string]ModelRoute `yaml:"routes,omitempty" json:"routes,omitempty"`
	// Client axis: profile to apply.
	Profile string `yaml:"profile,omitempty" json:"profile,omitempty"`
	Control bool   `yaml:"control,omitempty" json:"control,omitempty"`
}

type WireFitness int