delegation

type AuditEvent struct {
	Operation      string // "create_or_confirm", "confirm", "revoke", "revoke_by_labels", "expire", "reconcile"
	RunIDHash      string
	EnclaveEntryID string
	InvocationID   string
	RepositoryHash string
	HandleHash     string
	PolicyGen      uint64
	Outcome        string // "admitted", "confirmed", "denied", "revoked", "mismatch", "expired"
	Reason         string // coarse, non-identifying reason code only
}

type ControlCapability struct {
	// contains filtered or unexported fields
}

type CreateOrConfirmRequest struct {
	// RunID must equal the envelope's bound workflow run.
	RunID string `json:"run_id"`
	// EnclaveBackend must equal the envelope's single AWF enclave backend.
	EnclaveBackend string `json:"enclave_backend"`
	// EnclaveEntryID identifies the enclave entry (frontmatter block) this
	// invocation belongs to.
	EnclaveEntryID string `json:"enclave_entry_id"`
	// InvocationID identifies one bounded enclave invocation.
	InvocationID string `json:"invocation_id"`
	// Repository is the canonical, exact-byte owner/repo selector chosen
	// for this invocation. It must already be canonical: the Store performs
	// no trimming, case folding, Unicode normalization, or URL decoding.
	Repository string `json:"repository"`
	// ToolPolicy must equal ToolPolicyGitHubRepositoryReadV1.
	ToolPolicy string `json:"tool_policy"`
	// SchemaHash is the finite response schema hash approved for this
	// invocation; it must be a member of the envelope's allowed set.
	SchemaHash string `json:"schema_hash"`
	// AdmittedDefaultBranchSHA is the default-branch SHA AWF resolved
	// during live-read admission, when known at request time.
	AdmittedDefaultBranchSHA string `json:"admitted_default_branch_sha,omitempty"`
	// RequestedTTL bounds how long the identity should live; it is capped
	// by (and must not exceed) the envelope's MaxIdentityTTL.
	RequestedTTL time.Duration `json:"requested_ttl"`
	// InvocationExpiresAt is the absolute deadline of the invocation, when
	// one is supplied by AWF. An identity can never outlive this deadline.
	InvocationExpiresAt time.Time `json:"invocation_expires_at,omitempty"`
	// IdempotencyKey deduplicates retried create/confirm calls for the same
	// (RunID, EnclaveEntryID, InvocationID, Repository) tuple.
	IdempotencyKey string `json:"idempotency_key"`
}

type Envelope struct {
	// RunID is the workflow run this envelope, and every identity minted
	// from it, is bound to.
	RunID string `json:"run_id"`
	// EnclaveBackend is the single AWF enclave backend identities may be
	// bound to.
	EnclaveBackend string `json:"enclave_backend"`
	// AllowedRepositories is the closed set of canonical owner/repo
	// selectors the compiler admitted for this run. Selectors are compared
	// as exact ASCII byte sequences; no normalization is performed.
	AllowedRepositories []string `json:"allowed_repositories"`
	// ToolPolicy is the single delegated tool policy this envelope allows.
	// Only ToolPolicyGitHubRepositoryReadV1 is currently supported.
	ToolPolicy string `json:"tool_policy"`
	// AllowedSchemaHashes is the closed set of finite response schema
	// hashes the compiler approved for this run.
	AllowedSchemaHashes []string `json:"allowed_schema_hashes"`
	// MaxIdentityTTL bounds how long any single delegated identity may
	// live, and therefore how long an executor bearer remains valid.
	MaxIdentityTTL time.Duration `json:"max_identity_ttl"`
	// ExpiresAt is the envelope's own absolute expiry, no later than the
	// workflow job lifetime. No identity may be created once the envelope
	// itself has expired.
	ExpiresAt time.Time `json:"expires_at"`
}

type Identity struct {
	Handle                   string    `json:"handle"`
	ExecutorBearer           string    `json:"executor_bearer"`
	RunID                    string    `json:"run_id"`
	EnclaveBackend           string    `json:"enclave_backend"`
	EnclaveEntryID           string    `json:"enclave_entry_id"`
	InvocationID             string    `json:"invocation_id"`
	Repository               string    `json:"repository"`
	ToolPolicy               string    `json:"tool_policy"`
	SchemaHash               string    `json:"schema_hash"`
	AdmittedDefaultBranchSHA string    `json:"admitted_default_branch_sha,omitempty"`
	ExpiresAt                time.Time `json:"expires_at"`
	InvocationExpiresAt      time.Time `json:"invocation_expires_at,omitempty"`
	PolicyGeneration         uint64    `json:"policy_generation"`
	IdempotencyKey           string    `json:"idempotency_key"`
	CreatedAt                time.Time `json:"created_at"`
	Revoked                  bool      `json:"revoked"`
}

type IdentityResult struct {
	Handle                   string    `json:"handle"`
	ExecutorBearer           string    `json:"executor_bearer"`
	Repository               string    `json:"repository"`
	ToolPolicy               string    `json:"tool_policy"`
	Tools                    []string  `json:"tools"`
	AdmittedDefaultBranchSHA string    `json:"admitted_default_branch_sha,omitempty"`
	ExpiresAt                time.Time `json:"expires_at"`
}

type Store struct {
	// contains filtered or unexported fields
}