harness

type Adapter interface {
	Name() string
	Capabilities() []Capability
	// Render returns the admin-enforced files for the profile. Unsupported
	// profile fields must be reported as warnings, never silently dropped.
	Render(p *policy.Profile, c Context) (files []File, warnings []string, err error)
	// InstallCommand returns the shell command that installs exactly version on os.
	InstallCommand(version string, os OS) string
}

type Capability string

type Context struct {
	Gateway *policy.Gateway
	Ring    string
	Release string // release digest or version label, stamped into headers/telemetry
	OS      OS
	// Experiment/Variant are set when rendering a client-axis variant release;
	// adapters stamp them into telemetry resource attributes (halo.experiment,
	// halo.variant) so CLI metrics are attributed to the variant. Never sent as
	// request headers: the gateway assigns and stamps x-halo-* itself.
	Experiment string
	Variant    string
}

type Describer interface {
	Meta() Meta
}

type File struct {
	// Path is absolute on the target OS.
	Path string
	Mode uint32
	Data []byte
	// Artifact and ArtifactPath are set on a file that is part of a
	// supply-chain artifact (ADR-0028): the artifact's name and the file's
	// path inside it, which halod checks against the artifact's pinned digest.
	Artifact, ArtifactPath string
}

type Finding struct {
	Problem string `json:"problem"`
	Fix     string `json:"fix"`
}

type Meta struct {
	Binary     string   // executable name, probed with `--version`
	Installer  string   // InstallerNPM | InstallerClaudeNative | "" (no verified installer)
	NPMPackage string   // npm package name when Installer is InstallerNPM
	UAPrefixes []string // lower-case User-Agent prefixes the CLI sends (none = never seen at the gateway)
	// ManagedDirs are the admin config directories (per OS) the adapter's
	// rendered files live under; halod refuses to write anywhere else.
	ManagedDirs map[OS][]string
	// ManagedFiles are single-file path.Match patterns outside ManagedDirs.
	ManagedFiles map[OS][]string
}

type OS string

type Posture struct {
	Harness  string    `json:"harness"`
	Sandbox  string    `json:"sandbox"` // human summary, e.g. "on (managed)", "not managed"
	Egress   string    `json:"egress"`
	Managed  bool      `json:"managed"` // the managed file turns the sandbox or egress rules on
	Findings []Finding `json:"findings,omitempty"`
}