protocol

var (
	// ErrAuthRequired — the attacher signals the MCP server needs
	// authorization. The service parks on the unified pause/resume primitive.
	// Concrete attachers wrap this so the service reaches it via errors.Is.
	ErrAuthRequired = errors.New("agentcfg/protocol: mcp connection requires authorization")
	// ErrConnectionAttachUnavailable — add_mcp_connection was called but no
	// ConnectionAttacher is wired on this runtime (→ 501).
	ErrConnectionAttachUnavailable = errors.New("agentcfg/protocol: mcp connection attach not wired on this runtime")
	// ErrStdioNotAllowed — a stdio add named a command absent from the
	// fail-closed allowlist (→ 403). Adding a stdio server is the most
	// privileged action; the allowlist is the §7 RCE gate.
	ErrStdioNotAllowed = errors.New("agentcfg/protocol: stdio mcp connection command is not allowlisted")
	// ErrInvalidConnection — the connection descriptor failed validation
	// (empty name, unknown transport, missing/incoherent command/URL) (→ 400).
	ErrInvalidConnection = errors.New("agentcfg/protocol: invalid mcp connection descriptor")
	// ErrCoordinatorUnavailable — an auth-required attach fired but no
	// pause/resume Coordinator is wired (→ 500). Fail loud rather than drop
	// the auth requirement silently (CLAUDE.md §13).
	ErrCoordinatorUnavailable = errors.New("agentcfg/protocol: pause/resume coordinator not wired for the mcp oauth path")
)

var (
	// ErrConnectionNotFound — remove_mcp_connection named a connection that is
	// not in the agent's active revision (never runtime-added, or already
	// removed). No revision recorded, no event emitted (→ 404).
	ErrConnectionNotFound = errors.New("agentcfg/protocol: mcp connection not found in the agent's active revision")
	// ErrBootDeclaredConnection — remove_mcp_connection named a server that is
	// declared in the boot yaml (`tools.mcp_servers`). Distinct from
	// ErrConnectionNotFound: the verb governs revisioned state only; a
	// boot-declared server is edited in yaml + restart, not removed through
	// the control plane. No revision recorded, no event emitted (→ 400).
	ErrBootDeclaredConnection = errors.New("agentcfg/protocol: connection is boot-declared (yaml) — edit tools.mcp_servers and restart; the control plane governs runtime-added connections only")
)

var (
	// ErrIdentityRequired — the request carried an incomplete identity
	// triple or an empty agent id. Fails closed.
	ErrIdentityRequired = errors.New("agentcfg/protocol: identity scope incomplete")
	// ErrMisconfigured — NewService was called with a nil registry.
	ErrMisconfigured = errors.New("agentcfg/protocol: NewService missing a mandatory dependency")
	// ErrSkillsUnavailable — a skills method was called but no SkillStore
	// was wired into the Service.
	ErrSkillsUnavailable = errors.New("agentcfg/protocol: skills control not wired on this runtime")
	// ErrUnknownModel — a set_llm_params (or a set_revision carrying an
	// LLMParams.Model) named a model with no configured ModelProfile. The
	// per-agent model is validated at set time (parity with the tenant
	// model-swap), so an invalid model can never be persisted — fail loud,
	// never a silent fallback (CLAUDE.md §13).
	ErrUnknownModel = errors.New("agentcfg/protocol: unknown model (no configured ModelProfile)")
	// ErrInvalidLLMParams — a set_llm_params (or a set_revision carrying an
	// LLMParams section) supplied an out-of-range sampling value (temperature
	// outside [0,2], non-positive max-tokens, or an unknown reasoning-effort).
	// Validated at set time so an invalid value never reaches a run (parity
	// with runs.set_overrides), fail loud (CLAUDE.md §13).
	ErrInvalidLLMParams = errors.New("agentcfg/protocol: invalid LLM parameters")
	// ErrInvalidHooks — a set_revision carrying a hooks section supplied an
	// invalid run-completion hook (a negative timeout_ms). Validated at set
	// time so an invalid value is rejected loud BEFORE any registry write —
	// parity with the yaml validator's negative-timeout rejection; the
	// normalizer's negative→0 coercion is defence-in-depth behind this gate,
	// never the primary posture (CLAUDE.md §13).
	ErrInvalidHooks = errors.New("agentcfg/protocol: invalid hooks section")
	// ErrInvalidToolExposureLoading — a set_tool_exposure (or a set_revision
	// carrying a ToolExposure section) supplied a server_loading_modes /
	// tool_loading_modes entry with an empty key or a value outside
	// "always"|"deferred". Validated at set time BEFORE any registry write
	// so an invalid override can never be persisted — no revision, no
	// event — fail loud, never a silent drop (CLAUDE.md §13).
	ErrInvalidToolExposureLoading = errors.New("agentcfg/protocol: invalid tool-loading-mode override")
	// ErrInvalidNaming — a set_revision carrying a naming section supplied an
	// invalid session auto-naming policy: a negative after_turns / repeat_every
	// / max_repetitions, a max_title_len outside [8,200], a repeat_every > 0
	// with max_repetitions < 1 (no unlimited value exists), or an unknown
	// model. Validated at set time BEFORE any registry write so an invalid
	// policy can never be persisted — fail loud, never a silent clamp
	// (CLAUDE.md §13). The model is validated via the same validateModel path
	// as set_llm_params.
	ErrInvalidNaming = errors.New("agentcfg/protocol: invalid naming section")
)

var (
	// ErrInvalidLLMProvider — the descriptor failed validation (empty name /
	// provider, empty/non-remote credential_source, empty inference_broker)
	// (→ 400).
	ErrInvalidLLMProvider = errors.New("agentcfg/protocol: invalid llm provider descriptor")
	// ErrLLMProviderBrokerUnknown — the descriptor's inference_broker resolves
	// to no boot-declared broker (→ 400). No admin-writable field determines a
	// sink, so an unknown broker is a loud client error, never a silent accept.
	ErrLLMProviderBrokerUnknown = errors.New("agentcfg/protocol: inference_broker resolves to no boot-declared broker")
	// ErrLLMProviderInstallUnavailable — set_llm_provider was called but no
	// LLMProviderInstaller is wired on this runtime (→ 501).
	ErrLLMProviderInstallUnavailable = errors.New("agentcfg/protocol: llm provider install not wired on this runtime")
)

var (
	// ErrInvalidProvider — the provider descriptor failed validation (empty
	// name, wrong driver, empty/wrong credential_source, empty credential_broker)
	// (→ 400).
	ErrInvalidProvider = errors.New("agentcfg/protocol: invalid oauth provider descriptor")
	// ErrBootDeclaredProvider — set/remove_oauth_provider named a boot-declared
	// (yaml) provider — a DISTINCT loud error (boot wins; edit yaml + restart)
	// (→ 400).
	ErrBootDeclaredProvider = errors.New("agentcfg/protocol: oauth provider is boot-declared (edit yaml + restart, not the control plane)")
	// ErrProviderNotFound — remove_oauth_provider named a provider absent from
	// the agent's revisioned installed-provider set (→ 404).
	ErrProviderNotFound = errors.New("agentcfg/protocol: oauth provider not found in the agent's installed set")
	// ErrProviderInstallUnavailable — set/remove_oauth_provider was called but
	// no ProviderInstaller is wired on this runtime (→ 501).
	ErrProviderInstallUnavailable = errors.New("agentcfg/protocol: oauth provider install not wired on this runtime")
	// ErrProviderBrokerUnknown — the descriptor's credential_broker resolves to
	// no boot-declared broker (→ 400). The installer wraps its own broker error;
	// this sentinel lets the wire handler classify it as a client error.
	ErrProviderBrokerUnknown = errors.New("agentcfg/protocol: credential_broker resolves to no boot-declared broker")
	// ErrWireDescriptorNotAllowed — a provider descriptor (set_oauth_provider or
	// an add_mcp_connection inline binding) carried a credential-sink field
	// (token_url / audience / remote) while the fail-closed
	// tools.allow_wire_oauth_descriptor opt-in was OFF (→ 400). The default
	// zero-URL name-only posture is unchanged; the reject names the offending
	// field + the opt-in key.
	ErrWireDescriptorNotAllowed = errors.New("agentcfg/protocol: wire-carried oauth-provider descriptor is not allowed (the fail-closed tools.allow_wire_oauth_descriptor opt-in is off)")
)

var ErrDiscoveryOriginsNotHTTP = errors.New("agentcfg/protocol: connection is a stdio transport — OAuth-discovery origins apply only to http connections")

var ErrDiscoveryTargetNotLive = errors.New("agentcfg/protocol: connection not attached in the live MCP registry — allowance recorded in the revision, applied on next reconcile")

var ErrSessionOverlayUnavailable = errors.New("agentcfg/protocol: session safe-subset control not wired on this runtime")