delegation

type AuditEvent struct {
	Operation      string // "create_or_confirm", "confirm", "revoke", "revoke_by_labels", "expire", "reconcile"
	RunIDHash      string
	EnclaveEntryID string
	InvocationID   string
	RepositoryHash string
	HandleHash     string
	PolicyGen      uint64
	Outcome        string // "admitted", "confirmed", "denied", "revoked", "mismatch", "expired"
	Reason         string // coarse, non-identifying reason code only
}

type ControlCapability struct {
	// contains filtered or unexported fields
}

type CreateOrConfirmRequest struct {
	// RunID must equal the envelope's bound workflow run.
	RunID string `json:"run_id"`
	// EnclaveBackend must equal the envelope's single AWF enclave backend.
	EnclaveBackend string `json:"enclave_backend"`
	// EnclaveEntryID identifies the enclave entry (frontmatter block) this
	// invocation belongs to.
	EnclaveEntryID string `json:"enclave_entry_id"`
	// InvocationID identifies one bounded enclave invocation.
	InvocationID string `json:"invocation_id"`
	// Repository is the canonical, exact-byte owner/repo selector chosen
	// for this invocation. It must already be canonical: the Store performs
	// no trimming, case folding, Unicode normalization, or URL decoding.
	Repository string `json:"repository"`
	// ToolPolicy must equal ToolPolicyGitHubRepositoryReadV1.
	ToolPolicy string `json:"tool_policy"`
	// SchemaHash is the finite response schema hash approved for this
	// invocation; it must be a member of the envelope's allowed set.
	SchemaHash string `json:"schema_hash"`
	// AdmittedDefaultBranchSHA is the default-branch SHA AWF resolved
	// during live-read admission, when known at request time.
	AdmittedDefaultBranchSHA string `json:"admitted_default_branch_sha,omitempty"`
	// RequestedTTL bounds how long the identity should live; it is capped
	// by (and must not exceed) the envelope's MaxIdentityTTL.
	RequestedTTL time.Duration `json:"requested_ttl"`
	// InvocationExpiresAt is the absolute deadline of the invocation, when
	// one is supplied by AWF. An identity can never outlive this deadline.
	InvocationExpiresAt time.Time `json:"invocation_expires_at,omitempty"`
	// IdempotencyKey deduplicates retried create/confirm calls for the same
	// (RunID, EnclaveEntryID, InvocationID, Repository) tuple.
	IdempotencyKey string `json:"idempotency_key"`
}

type Envelope struct {
	// RunID is the workflow run this envelope, and every identity minted
	// from it, is bound to.
	RunID string `json:"run_id"`
	// EnclaveBackend is the single AWF enclave backend identities may be
	// bound to.
	EnclaveBackend string `json:"enclave_backend"`
	// AllowedRepositories is the closed set of canonical owner/repo
	// selectors the compiler admitted for this run. Selectors are compared
	// as exact ASCII byte sequences; no normalization is performed.
	AllowedRepositories []string `json:"allowed_repositories"`
	// AllowedOwners is the closed set of canonical repository owners the
	// compiler admitted for this run's dynamic enclaves. When set, AWF may
	// select any exact repository under an allowed owner at invocation
	// time without the compiler enumerating every repository in advance.
	// A repository is admitted if it is a member of AllowedRepositories or
	// its owner segment is a member of AllowedOwners; one identity remains
	// bound to exactly one repository either way. Owners are compared as
	// exact ASCII byte sequences; no normalization is performed.
	AllowedOwners []string `json:"allowed_owners,omitempty"`
	// ToolPolicy is the single delegated tool policy this envelope allows.
	// Only ToolPolicyGitHubRepositoryReadV1 is currently supported.
	ToolPolicy string `json:"tool_policy"`
	// AllowedSchemaHashes is the closed set of finite response schema
	// hashes the compiler approved for this run. It may be left empty to
	// use MaxDynamicSchemaHashes' bounded runtime admission instead.
	AllowedSchemaHashes []string `json:"allowed_schema_hashes"`
	// MaxDynamicSchemaHashes bounds how many distinct invocation-supplied
	// schema hashes may be admitted at runtime when AllowedSchemaHashes is
	// empty, so a dynamic enclave can be authorized against a bounded
	// finite-schema policy without every hash being enumerated at compile
	// time. It has no effect when AllowedSchemaHashes is non-empty: in
	// that case only the exact compiled hashes are ever admitted.
	MaxDynamicSchemaHashes int `json:"max_dynamic_schema_hashes,omitempty"`
	// MaxIdentityTTL bounds how long any single delegated identity may
	// live, and therefore how long an executor bearer remains valid.
	MaxIdentityTTL time.Duration `json:"max_identity_ttl"`
	// ExpiresAt is the envelope's own absolute expiry, no later than the
	// workflow job lifetime. No identity may be created once the envelope
	// itself has expired.
	ExpiresAt time.Time `json:"expires_at"`
}

type Identity struct {
	Handle                   string        `json:"handle"`
	ExecutorBearer           string        `json:"executor_bearer"`
	RunID                    string        `json:"run_id"`
	EnclaveBackend           string        `json:"enclave_backend"`
	EnclaveEntryID           string        `json:"enclave_entry_id"`
	InvocationID             string        `json:"invocation_id"`
	Repository               string        `json:"repository"`
	ToolPolicy               string        `json:"tool_policy"`
	SchemaHash               string        `json:"schema_hash"`
	AdmittedDefaultBranchSHA string        `json:"admitted_default_branch_sha,omitempty"`
	RequestedTTL             time.Duration `json:"requested_ttl,omitempty"`
	ExpiresAt                time.Time     `json:"expires_at"`
	InvocationExpiresAt      time.Time     `json:"invocation_expires_at,omitempty"`
	PolicyGeneration         uint64        `json:"policy_generation"`
	IdempotencyKey           string        `json:"idempotency_key"`
	CreatedAt                time.Time     `json:"created_at"`
	Revoked                  bool          `json:"revoked"`
}

type IdentityResult struct {
	Handle                   string    `json:"handle"`
	ExecutorBearer           string    `json:"executor_bearer"`
	Repository               string    `json:"repository"`
	ToolPolicy               string    `json:"tool_policy"`
	Tools                    []string  `json:"tools"`
	AdmittedDefaultBranchSHA string    `json:"admitted_default_branch_sha,omitempty"`
	ExpiresAt                time.Time `json:"expires_at"`
}

type Store struct {
	// contains filtered or unexported fields
}

type StoreStatus struct {
	// RecoveryIncomplete reports whether restart reconstruction left this
	// Store unable to vouch for prior state. New dynamic admissions are
	// refused while this is true.
	RecoveryIncomplete bool `json:"recovery_incomplete"`
	// Generation is the compiler-supplied policy generation bound to this
	// Store.
	Generation uint64 `json:"generation"`
	// LiveIdentityCount is the number of currently live (non-expired,
	// non-revoked) identities.
	LiveIdentityCount int `json:"live_identity_count"`
}