methods

const (
	// MethodStart asks the Runtime to spawn a new task / foreground run.
	// Maps onto tasks.TaskRegistry.Spawn.
	MethodStart Method = "start"
	// MethodCancel cancels a run (soft by default; `hard: true` in the
	// payload propagates a cancellation context). Maps onto the CANCEL
	// steering control.
	MethodCancel Method = "cancel"
	// MethodPause pauses a run at the next planner-step boundary. Maps
	// onto the PAUSE steering control; the run loop routes it through
	// the unified pauseresume.Coordinator.
	MethodPause Method = "pause"
	// MethodResume resumes a paused run. Maps onto the RESUME steering
	// control; the run loop routes it through pauseresume.Coordinator.
	MethodResume Method = "resume"
	// MethodRedirect rewrites a run's goal. Maps onto the REDIRECT
	// steering control; the new goal is the payload's `goal` string.
	MethodRedirect Method = "redirect"
	// MethodInjectContext appends operator-supplied context to a run's
	// trajectory, visible on the planner's next step. Maps onto the
	// INJECT_CONTEXT steering control.
	MethodInjectContext Method = "inject_context"
	// MethodApprove approves a HITL-gated step. Maps onto the APPROVE
	// steering control; the run loop advances the pause via
	// pauseresume.Coordinator.
	MethodApprove Method = "approve"
	// MethodReject rejects a HITL-gated step. Maps onto the REJECT
	// steering control; the run loop advances the pause and the run
	// terminates with Finish{ConstraintsConflict}.
	MethodReject Method = "reject"
	// MethodPrioritize changes a run's task priority. Maps onto the
	// PRIORITIZE steering control; the new priority is the payload's
	// `priority` number.
	MethodPrioritize Method = "prioritize"
	// MethodUserMessage injects a user-authored message into a run,
	// visible on the planner's next step. Maps onto the USER_MESSAGE
	// steering control; the message is the payload's `message` string.
	MethodUserMessage Method = "user_message"

	// MethodEventsSubscribe opens a server-filtered event subscription.
	// The wire-transport route is `GET /v1/events`
	// SSE; the canonical method name is the contract a
	// third-party Console branches on. Identity-mandatory; a request
	// with `?admin=1` (cross-tenant fan-in) requires the verified
	// `auth.ScopeAdmin` or `auth.ScopeConsoleFleet` scope claim.
	// The reject path returns the canonical
	// `errors.CodeIdentityScopeRequired` Code (HTTP 403). NOT a
	// task-control method — IsControlMethod returns false; the
	// control nine stays exclusive.
	MethodEventsSubscribe Method = "events.subscribe"

	// MethodEventsAggregate returns time-bucketed event-type counts
	// over a window. Powers the per-event-type
	// stacked-area sparkline on the Console Events page.
	// The wire-transport route is `POST /v1/events/aggregate`.
	// Identity-mandatory + cross-tenant scope rules apply (same
	// posture as MethodEventsSubscribe).
	//
	// NOT a control method: `IsControlMethod(MethodEventsAggregate)`
	// returns false.
	MethodEventsAggregate Method = "events.aggregate"

	// MethodSearchQuery — the Console palette
	// dispatcher. Pure aggregator: fans out concurrently to the
	// runtime-side per-index search methods, merges + paginates the
	// union. Carries no index of its own.
	MethodSearchQuery Method = "search.query"
	// MethodSearchSessions — Server-enforced session-index
	// search scoped to the caller's identity triple; cross-tenant
	// requires the `auth.ScopeAdmin` claim.
	MethodSearchSessions Method = "search.sessions"
	// MethodSearchTasks — Server-enforced task-index search;
	// same identity-scope contract as MethodSearchSessions.
	MethodSearchTasks Method = "search.tasks"
	// MethodSearchEvents — Server-enforced events-index
	// search (filters by event type + header fields + time window).
	// Reuses the EventFilter predicate. Substring search over
	// event payload contents is post-V1.
	MethodSearchEvents Method = "search.events"
	// MethodSearchArtifacts — Server-enforced artifact-index
	// search; rows always carry a `ref` (artifacts are by-reference by
	// construction).
	MethodSearchArtifacts Method = "search.artifacts"

	// MethodRuntimeInfo — Read-only posture method:
	// returns the Runtime's build identity (version / commit / Go
	// toolchain / build date), Protocol version, advertised
	// capabilities, uptime, instance ID, and operator-configured
	// display name. NOT a control method; dispatched by PostureSurface.
	MethodRuntimeInfo Method = "runtime.info"
	// MethodRuntimeHealth — Read-only posture method:
	// returns the per-subsystem readiness rollup (`ready` / `degraded`
	// / `unavailable`) across the runtime's registered subsystems.
	MethodRuntimeHealth Method = "runtime.health"
	// MethodRuntimeCounters — Read-only posture method:
	// returns the low-cardinality live counters the Console footer /
	// sidebar chips render (events/sec, tasks running, background jobs,
	// MCP connections, sessions active). Identity-scoped; the response
	// is the roll-up, never a per-run / per-task breakdown.
	MethodRuntimeCounters Method = "runtime.counters"
	// MethodRuntimeDrivers — Read-only posture method:
	// returns the configured driver names per persistence-shaped
	// subsystem (`state`, `artifacts`, `memory`, `eventlog`). Returns
	// the driver name + optional posture mode — never the DSN.
	MethodRuntimeDrivers Method = "runtime.drivers"
	// MethodMetricsSnapshot — Read-only posture method:
	// returns a Protocol-shaped projection over the
	// MetricsRegistry — counters, histograms, gauges as flat wire
	// values. NOT an OpenTelemetry SDK re-export.
	MethodMetricsSnapshot Method = "metrics.snapshot"

	// MethodGovernancePosture — Returns the
	// runtime's read-only governance configuration: the consolidated
	// `IdentityTiers` map (per-tier `BudgetCeilingUSD` + token-bucket
	// `RateLimit` + `MaxTokens`) plus the `DefaultTier` selector and the
	// caller-resolved tier. Identity-mandatory; cross-tenant reads
	// require the `auth.ScopeAdmin` claim. NOT a control method
	// and NOT a search method — it is a posture method (read-only
	// runtime-config projection). `IsControlMethod` / `IsSearchMethod`
	// both return false; `IsPostureMethod` returns true. See
	MethodGovernancePosture Method = "governance.posture"

	// MethodLLMPosture — Returns the
	// runtime's read-only LLM provider posture: provider name, model id,
	// region/endpoint, and a `MockMode` boolean — `true` iff the runtime
	// booted with `HARBOR_DEV_ALLOW_MOCK=1`. Identity-mandatory;
	// cross-tenant reads require the `auth.ScopeAdmin` claim. A
	// posture method, same posture as MethodGovernancePosture.
	MethodLLMPosture Method = "llm.posture"

	// MethodGovernanceSetTenantOverrides — admin verb: sets (or clears) a
	// tenant's default LLM-parameter overrides (model, additive
	// extra-instructions, temperature, max-tokens, reasoning-effort) live,
	// with no redeploy. The change is a desired-state REPLACE and lands on
	// every session in the tenant on its next run (the RFC §6.15
	// `ModelOverride` governance seam). Identity-mandatory; requires the
	// `auth.ScopeAdmin` claim (a non-admin caller is rejected with
	// CodeScopeMismatch). NOT a control / search / posture method —
	// `IsGovernanceAdminMethod` is its own O(1) predicate. The
	// wire-transport route is `POST /v1/governance/set_tenant_overrides`.
	MethodGovernanceSetTenantOverrides Method = "governance.set_tenant_overrides"

	// MethodGovernanceGetTenantOverrides — admin verb: reads a tenant's
	// current default LLM-parameter override record (the read-back the
	// Console renders before editing). Identity-mandatory; requires the
	// `auth.ScopeAdmin` claim. The wire-transport route is
	// `POST /v1/governance/get_tenant_overrides`.
	MethodGovernanceGetTenantOverrides Method = "governance.get_tenant_overrides"

	// MethodGovernanceRotateKey — admin verb: rotates the LLM provider
	// API key live, with no redeploy. The new key swaps atomically behind
	// the provider account so the next call uses it and the old key is
	// invalidated immediately. The key VALUE is a secret carried only on
	// the request leg — never logged, audited, or echoed; the response +
	// the `governance.key_rotated` event carry only a non-reversible
	// fingerprint. Identity-mandatory; requires the `auth.ScopeAdmin`
	// claim (a non-admin caller is rejected with CodeScopeMismatch). The
	// wire-transport route is `POST /v1/governance/rotate_key`.
	MethodGovernanceRotateKey Method = "governance.rotate_key"

	// MethodGovernanceSetPosture — admin verb: writes the identity-tier
	// policy table (per tier: budget-ceiling USD / max-tokens cap /
	// rate-limit capacity, plus the default-tier assignment) live, with no
	// redeploy. The write is a FULL REPLACE through the shared validator the
	// `governance.posture` read projects (never a partial merge) — a
	// submitted table that OMITS or zeroes a ceiling the current effective
	// policy enforces is rejected fail-closed with CodeInvalidRequest before
	// any state mutation, never budget-widening. The tier policy graduates
	// from hot-reloadable boot config to a StateStore-backed record layered
	// over the config-declared defaults; it round-trips with the read (what
	// you set is what the next `governance.posture` returns).
	// Identity-mandatory; requires the `auth.ScopeAdmin` claim ONLY —
	// explicitly NOT the two-scope (`admin` OR `console:fleet`) set that
	// gates the read, so a leaked read-only fleet token cannot widen a
	// budget. A non-admin caller is rejected with CodeScopeMismatch. NOT a
	// control / search / posture method — `IsGovernanceAdminMethod` is its
	// own O(1) predicate. The wire-transport route is
	// `POST /v1/governance/set_posture`.
	MethodGovernanceSetPosture Method = "governance.set_posture"

	// MethodAgentConfigGet — reads an agent's current active config
	// revision (the read-back the Console renders before editing).
	// Identity-mandatory; requires the verified `auth.ScopeAdmin` claim
	// (reading the agent-config control plane is a privileged action).
	// The wire-transport route is `POST /v1/agent_config/get`.
	MethodAgentConfigGet Method = "agent_config.get"
	// MethodAgentConfigSetRevision — admin verb: writes a NEW immutable,
	// content-addressed config revision for an agent and advances the
	// active pointer. An idempotent re-set of byte-identical canonical
	// content is a no-op returning the existing revision. The change lands
	// on the agent's NEXT run (next-turn projection — never mid-flight).
	// Identity-mandatory; requires the `auth.ScopeAdmin` claim (a
	// non-admin caller is rejected with CodeScopeMismatch). The
	// wire-transport route is `POST /v1/agent_config/set_revision`.
	MethodAgentConfigSetRevision Method = "agent_config.set_revision"
	// MethodAgentConfigListRevisions — reads an agent's revision chain,
	// newest-first. Identity-mandatory; requires the `auth.ScopeAdmin`
	// claim. The wire-transport route is
	// `POST /v1/agent_config/list_revisions`.
	MethodAgentConfigListRevisions Method = "agent_config.list_revisions"
	// MethodAgentConfigDiff — server-side compare of two existing config
	// revisions (a structured set-diff for the structured sections).
	// Identity-mandatory; requires the `auth.ScopeAdmin` claim. The
	// wire-transport route is `POST /v1/agent_config/diff`.
	MethodAgentConfigDiff Method = "agent_config.diff"
	// MethodAgentConfigRollback — admin verb: repoints the active pointer
	// to an existing revision WITHOUT mutating or deleting any revision.
	// The repoint lands on the agent's NEXT run. Identity-mandatory;
	// requires the `auth.ScopeAdmin` claim. The wire-transport route is
	// `POST /v1/agent_config/rollback`.
	MethodAgentConfigRollback Method = "agent_config.rollback"
	// MethodAgentConfigRetire terminally retires an agent configuration. It
	// remains a control-plane admin method; it is not a data-plane reach door.
	MethodAgentConfigRetire Method = "agent_config.retire"
	// MethodAgentConfigSkillsList — reads the agent's skills (metadata
	// only) — the first consumer of the config-revision registry.
	// Identity-mandatory; requires the `auth.ScopeAdmin` claim. The
	// wire-transport route is `POST /v1/agent_config/skills/list`.
	MethodAgentConfigSkillsList Method = "agent_config.skills.list"
	// MethodAgentConfigSkillsUpsert — admin verb: upserts a skill into the
	// agent's store and records the membership change as a config
	// revision. A pack-origin skill is never silently overwritten — the
	// refusal surfaces as a typed Protocol error. Identity-mandatory;
	// requires the `auth.ScopeAdmin` claim. The wire-transport route is
	// `POST /v1/agent_config/skills/upsert`.
	MethodAgentConfigSkillsUpsert Method = "agent_config.skills.upsert"
	// MethodAgentConfigSkillsDelete — admin verb: deletes a skill from the
	// agent's store and records the membership change as a config
	// revision. Identity-mandatory; requires the `auth.ScopeAdmin` claim.
	// The wire-transport route is `POST /v1/agent_config/skills/delete`.
	MethodAgentConfigSkillsDelete Method = "agent_config.skills.delete"
	// MethodAgentConfigAgentPacksList — admin verb: reads the agent's
	// operator-managed per-agent skill pack (full items, canonical order).
	// Identity-mandatory; requires the `auth.ScopeAdmin` claim. The
	// wire-transport route is `POST /v1/agent_config/agent_packs/list`.
	MethodAgentConfigAgentPacksList Method = "agent_config.agent_packs.list"
	// MethodAgentConfigAgentPacksUpsert — admin verb: DETERMINISTICALLY adds
	// or replaces ONE operator-managed pack item (body + membership atomically
	// in one content-addressed revision). Identity-mandatory; requires the
	// `auth.ScopeAdmin` claim. The wire-transport route is
	// `POST /v1/agent_config/agent_packs/upsert`.
	MethodAgentConfigAgentPacksUpsert Method = "agent_config.agent_packs.upsert"
	// MethodAgentConfigAgentPacksRemove — admin verb: DETERMINISTICALLY drops
	// ONE operator-managed pack item by name. Identity-mandatory; requires
	// the `auth.ScopeAdmin` claim. The wire-transport route is
	// `POST /v1/agent_config/agent_packs/remove`.
	MethodAgentConfigAgentPacksRemove Method = "agent_config.agent_packs.remove"
	// MethodAgentConfigAgentPacksPropose — admin verb: the GOVERNED first
	// phase of pack authoring — drafts a bounded skill body from an operator
	// intent via the agent's configured model under the versioned revision
	// policy, returning the canonical draft + content hash + warnings +
	// provenance stamp. NEVER writes. Identity-mandatory; requires the
	// `auth.ScopeAdmin` claim. The wire-transport route is
	// `POST /v1/agent_config/agent_packs/propose`.
	MethodAgentConfigAgentPacksPropose Method = "agent_config.agent_packs.propose"
	// MethodAgentConfigAgentPacksCommit — admin verb: the GOVERNED second
	// phase — CAS-binds the exact reviewed hash + proposal provenance +
	// expected-revision token, then atomically persists body + membership in
	// one revision. Identity-mandatory; requires the `auth.ScopeAdmin` claim.
	// The wire-transport route is `POST /v1/agent_config/agent_packs/commit`.
	MethodAgentConfigAgentPacksCommit Method = "agent_config.agent_packs.commit"

	// Same-runtime organization skill-publication contract (HA-68). The
	// organization verbs require the verified admin scope; the available,
	// install, update, remove, and references.list verbs use the caller's
	// verified identity and signed effective-agent reach. Bodies are never
	// returned by these metadata/receipt methods.
	MethodSkillsPublicationsPublish        Method = "skills.publications.publish"
	MethodSkillsPublicationsList           Method = "skills.publications.list"
	MethodSkillsPublicationsGet            Method = "skills.publications.get"
	MethodSkillsPublicationsSuccessor      Method = "skills.publications.publish_successor"
	MethodSkillsPublicationsRetire         Method = "skills.publications.retire"
	MethodSkillsPublicationsAvailable      Method = "skills.publications.available"
	MethodSkillsPublicationsInstall        Method = "skills.publications.install"
	MethodSkillsPublicationsUpdate         Method = "skills.publications.update"
	MethodSkillsPublicationsRemove         Method = "skills.publications.remove"
	MethodSkillsPublicationsReferencesList Method = "skills.publications.references.list"
	// MethodAgentConfigSetToolExposure — admin verb: sets the agent's
	// MCP-exposure / per-tool policy (paused servers + disabled tools) as a
	// desired-state replace of the tool-exposure section and records the
	// change as a config revision. Pausing a server excludes its tools from
	// the next run (the live transport stays warm) and rejects its App
	// callbacks against current state; emits `mcp.connection.paused` /
	// `.resumed`. Identity-mandatory; requires the `auth.ScopeAdmin` claim.
	// The wire-transport route is `POST /v1/agent_config/set_tool_exposure`.
	MethodAgentConfigSetToolExposure Method = "agent_config.set_tool_exposure"
	// MethodAgentConfigSetPromptLayers — admin verb: sets the agent's
	// layered system prompt (operator base and/or user layer) as a
	// desired-state replace of the prompt-layer section and records the
	// change as a config revision. The base is the run's base system prompt;
	// the user layer composes above it in the lower-trust guidance position
	// (it can extend but never replace or weaken the operator base). The
	// skills + tool-exposure sections are preserved. Applies to the agent's
	// next run. Identity-mandatory; requires the `auth.ScopeAdmin` claim.
	// The wire-transport route is `POST /v1/agent_config/set_prompt_layers`.
	MethodAgentConfigSetPromptLayers Method = "agent_config.set_prompt_layers"
	// MethodAgentConfigSetExtraSystemBlocks — admin verb: sets the agent's
	// ORDERED list of named additive prompt blocks as a desired-state
	// replace of the blocks section and records the change as a config
	// revision. Every sibling section is preserved. The declared order IS
	// the render order — it is part of the content hash, so a re-ordering
	// is a real revision the diff reports. The bodies render VERBATIM,
	// each behind a plain-text `[name]` label, in the operator-trusted
	// additive guidance position, and they survive a session
	// system-prompt override. There are no per-block verbs: a second
	// contributor composes by read-modify-write, sending the read
	// revision's content hash as the expected-revision token. Applies to
	// the agent's next run. Identity-mandatory; requires the
	// `auth.ScopeAdmin` claim — that tier IS the trust boundary the
	// verbatim rendering rests on. The wire-transport route is
	// `POST /v1/agent_config/set_extra_system_blocks`.
	MethodAgentConfigSetExtraSystemBlocks Method = "agent_config.set_extra_system_blocks"
	// MethodAgentConfigSetLLMParams — admin verb: sets the agent's per-agent
	// LLM-parameter section (model / temperature / max-tokens /
	// reasoning-effort) as a desired-state replace of the LLM-params section
	// and records the change as a config revision. The per-agent params
	// override the tenant-wide baseline (resolution session › per-agent ›
	// tenant-wide baseline › config default) for the agent's next run. A set
	// model is validated against the configured ModelProfiles (an unknown
	// model is rejected). The prompt-layer + skills + tool-exposure +
	// connection sections are preserved. Identity-mandatory; requires the
	// `auth.ScopeAdmin` claim. The wire-transport route is
	// `POST /v1/agent_config/set_llm_params`.
	MethodAgentConfigSetLLMParams Method = "agent_config.set_llm_params"
	// MethodAgentConfigAddMCPConnection — admin verb: adds a NEW MCP server
	// connection (the separable async-dial path). The runtime drives the real
	// attach lifecycle (dial → initialize handshake → discover → register),
	// records the non-secret descriptor as a config revision (preserving the
	// skills + tool-exposure + prompt-layer sections), and emits the
	// `mcp.connection.pending` then a terminal `mcp.connection.added` /
	// `.failed` / `.auth_required` lifecycle event. A failure records no
	// revision and never registers a half-attached server (fail loud). Adding
	// a stdio server (an RCE surface) is gated beyond admin on an operator
	// allowlist (fail-closed; argv-form only). An auth-required server parks
	// on the unified pause/resume primitive (the resume continuation that
	// re-drives the attach to online is not yet implemented — issue #375).
	// Identity-mandatory; requires the `auth.ScopeAdmin` claim. The
	// wire-transport route is `POST /v1/agent_config/add_mcp_connection`.
	MethodAgentConfigAddMCPConnection Method = "agent_config.add_mcp_connection"

	// MethodAgentConfigRemoveMCPConnection — admin verb: removes a
	// runtime-added MCP server connection by name as a NEW revision. The
	// revision drops the named descriptor AND prunes that server's
	// tool-exposure residue (paused/disabled/loading entries), carrying every
	// sibling section (incl. hooks) forward. An unknown name and a
	// boot-declared (yaml) name each fail loud with a distinct typed error —
	// the verb governs revisioned state only (a boot-declared server is
	// edited in yaml + restart). The verb itself never tears anything down:
	// the physical teardown (deregister the server's tools + close its
	// transport) happens at the NEXT run-start reconcile. Exposure is
	// next-turn; teardown is process-global — an in-flight run whose next
	// step calls the detached server fails loudly (typed not-found / closed
	// transport), never a hang or a silent success. Identity-mandatory;
	// requires the `auth.ScopeAdmin` claim. The wire-transport route is
	// `POST /v1/agent_config/remove_mcp_connection`.
	MethodAgentConfigRemoveMCPConnection Method = "agent_config.remove_mcp_connection"

	// MethodAgentConfigSetMCPDiscoveryOrigins — admin verb: FULL-REPLACE writes
	// a runtime-added MCP connection's OAuth-discovery cross-origin allow-list.
	// It records a new revision (carrying every sibling section forward) AND
	// applies the allow-list to the live MCP registry so the very next discovery
	// uses it; a revoke also prunes the recorded requirement's now-unallowed
	// authorization-server entries, and a rollback past a grant revokes the
	// origin live via the owner-scoped run-start reconcile. Origins run the
	// shared discovery-origin validator (https origin, no path/IP-literal). An
	// unknown connection, a boot-declared (yaml) name, and a stdio connection
	// each fail loud with a distinct typed error. The allowance is never an SSRF
	// hole: a granted origin resolving private/loopback is still refused at dial.
	// Identity-mandatory; requires the `auth.ScopeAdmin` claim. The
	// wire-transport route is `POST /v1/agent_config/set_mcp_discovery_origins`.
	MethodAgentConfigSetMCPDiscoveryOrigins Method = "agent_config.set_mcp_discovery_origins"

	// MethodAgentConfigSetOAuthProvider — admin verb: installs (upserts) a
	// ZERO-URL, broker-pull OAuth provider onto the agent-config revision spine
	// AND into the live owner-tagged provider set so the next MCP attach bound to
	// it injects the exchanged bearer. The writable descriptor carries only
	// `{name, driver:"tokenexchange", credential_source:"remote",
	// credential_broker, scopes?}` — NO URL, NO env-var name, NO secret; every
	// credential sink is pinned at boot on the named credential broker (a write
	// carrying `token_url` / `auth_url` / `client_id_env` / `client_secret_env` /
	// `remote` is rejected BY NAME via DisallowUnknownFields). A name colliding
	// with a boot-declared provider is refused (boot wins). Identity-mandatory;
	// requires the `auth.ScopeAdmin` claim. The wire-transport route is
	// `POST /v1/agent_config/set_oauth_provider`.
	MethodAgentConfigSetOAuthProvider Method = "agent_config.set_oauth_provider"
	// MethodAgentConfigRegisterOAuthMCPCapability is the sole
	// production creator for one signed OAuth provider plus one MCP
	// connection. It is admin-only and cannot be composed from generic
	// provider/connection writes.
	MethodAgentConfigRegisterOAuthMCPCapability Method = "agent_config.register_oauth_mcp_capability"
	// MethodAgentConfigRemoveOAuthMCPCapability is the sole paired-removal
	// verb. It resumes the same frozen JTI receipt and is admin-only.
	MethodAgentConfigRemoveOAuthMCPCapability Method = "agent_config.remove_oauth_mcp_capability"

	// MethodAgentConfigRemoveOAuthProvider — admin verb: uninstalls a
	// Protocol-installed OAuth provider by name as a NEW revision AND uninstalls
	// it live, which CLOSES the provider — so a still-bound connection's next
	// call fails LOUD rather than degrading to an unauthenticated dial
	// (deliberately breaking; the break is confined to the owning owner by the
	// owner-scoped run-start reconcile). An unknown name and a boot-declared name
	// each fail loud with a distinct typed error. Identity-mandatory; requires
	// the `auth.ScopeAdmin` claim. The wire-transport route is
	// `POST /v1/agent_config/remove_oauth_provider`.
	MethodAgentConfigRemoveOAuthProvider Method = "agent_config.remove_oauth_provider"

	// MethodAgentConfigSetLLMProvider — admin verb: installs (upserts) /
	// rotates a ZERO-URL, broker-pull INFERENCE provider binding onto the
	// owner-tagged provider set so the runtime's LLM key is sourced from the
	// named coordinator broker. The writable descriptor carries only
	// `{name, provider, credential_source:"remote", inference_broker,
	// model_allow?}` — NO URL, NO env-var name, NO secret; every credential
	// sink is pinned at boot on the named inference broker (a write carrying
	// `credential_url` / `token_url` / `*_env` / a secret is rejected BY NAME
	// via DisallowUnknownFields). A separate method from set_oauth_provider (a
	// distinct credential plane) — never a relaxation of its
	// tokenexchange-only allowlist. An unknown broker name is refused loud.
	// Identity-mandatory; requires the `auth.ScopeAdmin` claim ONLY (a control
	// write is a strictly more elevated tier than any read — NOT the admin OR
	// console:fleet set). The wire-transport route is
	// `POST /v1/agent_config/set_llm_provider`.
	MethodAgentConfigSetLLMProvider Method = "agent_config.set_llm_provider"

	// MethodAgentConfigSessionSetUserPrompt — session-safe verb (the
	// non-admin lower tier): a session-scoped end user sets a user
	// prompt layer that composes ABOVE the operator base (it can extend the
	// operator's guidance but never precede, replace, or weaken the base —
	// the base is unwritable by a session caller). Identity-mandatory; does
	// NOT require the admin scope (a valid identity is enough). The
	// wire-transport route is `POST /v1/agent_config/session/set_user_prompt`.
	MethodAgentConfigSessionSetUserPrompt Method = "agent_config.session.set_user_prompt"
	// MethodAgentConfigSessionSetSourceDisables — session-safe verb: a
	// session-scoped end user NARROWS (never widens) source/tool enablement
	// by naming servers/tools to DISABLE within the admin-allowed set. The
	// disable set is unioned into the admin exclusion set at run start, so it
	// can only narrow the admin-allowed exposure — there is no enable path.
	// Identity-mandatory; does NOT require the admin scope. The wire-transport
	// route is `POST /v1/agent_config/session/set_source_disables`.
	MethodAgentConfigSessionSetSourceDisables Method = "agent_config.session.set_source_disables"
	// MethodAgentConfigSessionSkillsList — session-safe verb: lists the
	// session's ephemeral personal skills (metadata only) under the caller's
	// real triple. Identity-mandatory; does NOT require the admin scope. The
	// wire-transport route is
	// `POST /v1/agent_config/session/skills/list`.
	MethodAgentConfigSessionSkillsList Method = "agent_config.session.skills.list"
	// MethodAgentConfigSessionSkillsUpsert — session-safe verb: upserts an
	// ephemeral personal skill under the caller's real triple. The skill is
	// session-scoped and never promotes to the agent/tenant scope.
	// Identity-mandatory; does NOT require the admin scope. The wire-transport
	// route is `POST /v1/agent_config/session/skills/upsert`.
	MethodAgentConfigSessionSkillsUpsert Method = "agent_config.session.skills.upsert"
	// MethodAgentConfigSessionSkillsDelete — session-safe verb: deletes an
	// ephemeral personal skill under the caller's real triple.
	// Identity-mandatory; does NOT require the admin scope. The wire-transport
	// route is `POST /v1/agent_config/session/skills/delete`.
	MethodAgentConfigSessionSkillsDelete Method = "agent_config.session.skills.delete"

	// MethodAgentConfigUserGet — user-tier verb (the middle tier of the
	// authorization matrix): reads the caller's OWN durable, versioned
	// config variant — the active revision keyed under their real
	// (tenant, user). Identity-mandatory; requires the verified
	// `auth.ScopeAgentConfigUser` claim (NOT admin). The wire-transport route
	// is `POST /v1/agent_config/user/get`.
	MethodAgentConfigUserGet Method = "agent_config.user.get"
	// MethodAgentConfigUserSetRevision — user-tier verb: writes a NEW
	// immutable revision of the caller's durable config variant from a
	// structurally-bounded safe-subset payload (user prompt + narrow-only
	// disables + personal-skill names) — no base / connections / model, so a
	// user caller physically cannot widen a capability. Requires the verified
	// `auth.ScopeAgentConfigUser` claim. The wire-transport route is
	// `POST /v1/agent_config/user/set_revision`.
	MethodAgentConfigUserSetRevision Method = "agent_config.user.set_revision"
	// MethodAgentConfigUserListRevisions — user-tier verb: reads the caller's
	// own variant revision chain, newest-first. Requires the verified
	// `auth.ScopeAgentConfigUser` claim. The wire-transport route is
	// `POST /v1/agent_config/user/list_revisions`.
	MethodAgentConfigUserListRevisions Method = "agent_config.user.list_revisions"
	// MethodAgentConfigUserDiff — user-tier verb: server-side compare of two
	// existing revisions of the caller's own variant. Requires the verified
	// `auth.ScopeAgentConfigUser` claim. The wire-transport route is
	// `POST /v1/agent_config/user/diff`.
	MethodAgentConfigUserDiff Method = "agent_config.user.diff"
	// MethodAgentConfigUserRollback — user-tier verb: repoints the caller's
	// own variant active pointer to an existing revision WITHOUT mutating any
	// revision. Requires the verified `auth.ScopeAgentConfigUser` claim. The
	// wire-transport route is `POST /v1/agent_config/user/rollback`.
	MethodAgentConfigUserRollback Method = "agent_config.user.rollback"

	// MethodAgentConfigUserSkillsList — durable-per-user skills verb: lists
	// the caller's user-scope (durable, cross-session) personal skills under
	// their real (tenant, user). CLAIM-FREE — a valid identity is enough (NO
	// admin, NO `auth.ScopeAgentConfigUser`): a personal skill cannot widen
	// capability (the capability filter is default-deny and the injection-time
	// redactor scrubs any tool a skill names that is outside the run's allowed
	// set), so authoring one is as safe as the session-scoped rung. The
	// wire-transport route is `POST /v1/agent_config/user/skills/list`.
	MethodAgentConfigUserSkillsList Method = "agent_config.user.skills.list"
	// MethodAgentConfigUserSkillsUpsert — durable-per-user skills verb:
	// upserts a DURABLE personal skill at user scope (persists across ALL of
	// the caller's conversations, keyed (tenant, user)). CLAIM-FREE, forced to
	// `skills.ScopeUser`. The wire-transport route is
	// `POST /v1/agent_config/user/skills/upsert`.
	MethodAgentConfigUserSkillsUpsert Method = "agent_config.user.skills.upsert"
	// MethodAgentConfigUserSkillsDelete — durable-per-user skills verb:
	// deletes one of the caller's durable user-scope personal skills.
	// CLAIM-FREE. The wire-transport route is
	// `POST /v1/agent_config/user/skills/delete`.
	MethodAgentConfigUserSkillsDelete Method = "agent_config.user.skills.delete"

	// MethodAgentConfigUserSkillsImportValidate — the ZERO-WRITE first
	// phase of the two-phase verified-caller skill-package import: the
	// caller names a caller-owned immutable artifact ref + the effective
	// agent, and the runtime parses/validates the package, reviews the
	// capability applicability, snapshots the user-scope config base, and
	// seals the bounded versioned review into an opaque `proposal_token`
	// (never a durable proposal id, never a ledger row). CLAIM-FREE like
	// the sibling durable-per-user skills verbs — a personal skill cannot
	// widen capability. The wire-transport route is
	// `POST /v1/agent_config/user/skills/import_validate`.
	MethodAgentConfigUserSkillsImportValidate Method = "agent_config.user.skills.import_validate"
	// MethodAgentConfigUserSkillsImportCommit — the explicit second phase:
	// the caller echoes the opaque proposal token + the reviewed hashes +
	// the expected config content hash + the replacement consent; the
	// runtime freshly revalidates everything and performs THE ONE atomic
	// package+membership write, replay-safe (a response-loss retry
	// returns the same terminal result without a second write). The
	// wire-transport route is
	// `POST /v1/agent_config/user/skills/import_commit`.
	MethodAgentConfigUserSkillsImportCommit Method = "agent_config.user.skills.import_commit"

	// MethodAgentConfigCompositionPreview — the read-only effective-
	// composition preview: reports what the strict run-start composer
	// WOULD compose for a target (tenant, user, session) + effective
	// boot-agent WITHOUT materialising anything — no lifecycle creation,
	// no pack verb, no revision write. A verified caller previews its own
	// exact triple; an admin / console:fleet caller may address a
	// SAME-TENANT user only with signed effective-agent reach (the
	// widening is audited on the canonical `audit.admin_scope_used`
	// event BEFORE the composition read). The wire-transport route is
	// `POST /v1/agent_config/composition/preview`.
	MethodAgentConfigCompositionPreview Method = "agent_config.composition.preview"

	// MethodPauseList — the paginated,
	// identity-scope-filtered snapshot of currently-paused runs from
	// the unified pause/resume Coordinator. Read-only: it
	// does NOT mutate the registry and does NOT call Resume — resume
	// actions continue through MethodResume / MethodApprove /
	// MethodReject. The wire-transport route is
	// `POST /v1/pause/list`. Identity-mandatory; a cross-tenant filter
	// requires the verified `auth.ScopeAdmin` claim. NOT a
	// task-control method — `IsControlMethod(MethodPauseList)` returns
	// false; the control nine stays exclusive. See
	MethodPauseList Method = "pause.list"

	// MethodFlowsList — Returns the
	// paginated catalog of registered engine-graph flows with aggregate
	// run metrics (runs-in-window, p50/p95 latency, success rate, last
	// run, per-flow Budget). Identity-mandatory; a cross-tenant
	// filter requires the verified `auth.ScopeAdmin` claim. NOT a
	// task-control method — `IsFlowsMethod` returns true; `IsControlMethod`
	// returns false.
	MethodFlowsList Method = "flows.list"
	// MethodFlowsDescribe — Returns a single flow's full
	// engine-graph description: nodes + edges + per-node descriptor +
	// per-node policy + a string source reference (Go path or YAML
	// descriptor — never executable code) + live Budget
	// consumption. Identity-mandatory; an unknown flow id fails with
	// CodeNotFound.
	MethodFlowsDescribe Method = "flows.describe"
	// MethodFlowsRunsList — Returns a flow's paginated run
	// history (per-run status / trigger / timing / cost / identity).
	// Identity-mandatory; a cross-tenant filter requires the verified
	// `auth.ScopeAdmin` claim.
	MethodFlowsRunsList Method = "flows.runs.list"
	// MethodFlowsRunsDescribe — Returns a single flow run's
	// per-node execution timeline + final-output reference. Heavy outputs
	// are shipped by-reference via FlowArtifactRef — NEVER inline
	// bytes. Identity-mandatory; an unknown run id fails with
	// CodeNotFound.
	MethodFlowsRunsDescribe Method = "flows.runs.describe"
	// MethodFlowsRun — Invokes a one-shot run of a registered
	// flow. This is the ONLY mutating Flows-page method; it is gated on
	// identity AND the verified `auth.ScopeAdmin` claim (closed
	// scope set). A request without the claim is rejected with
	// CodeScopeMismatch (HTTP 403). Every other Flows-page method is
	// read-only.
	MethodFlowsRun Method = "flows.run"
	// MethodFlowsMetrics — Returns a flow's time-bucketed
	// sparkline aggregates (runs-per-bucket, p95 latency, success rate,
	// cost, budget consumption) over a window. Read-only; identity-
	// mandatory.
	MethodFlowsMetrics Method = "flows.metrics"

	// MethodTopologySnapshot — Returns the
	// canonical TopologyProjection of the Runtime's engine — the static
	// node graph + live per-edge queue depth. Request → reply (on-demand
	// cold-start surface); the paired in-flight surface is the
	// `topology.changed` canonical event. The wire-transport route is
	// the existing `POST /v1/control/{method}` REST surface. NOT a
	// task-control method (it reaches the engine's read-only Topology
	// accessor, not the steering inbox) and NOT a streaming-events or
	// search method — `IsControlMethod` / `IsStreamingEventsMethod` /
	// `IsSearchMethod` all return false; `IsTopologyMethod` returns
	// true. Identity-mandatory; a cross-tenant snapshot requires the
	// `auth.ScopeAdmin` claim.
	MethodTopologySnapshot Method = "topology.snapshot"

	// MethodArtifactsList — Returns the
	// identity-scope-filtered catalog of artifacts from the runtime's
	// content-addressed artifact store, with the filter
	// extensions (mime / source / size-range / created-range / tags)
	// applied as a Go-side projection. Identity-mandatory; a cross-tenant
	// list requires the `auth.ScopeAdmin` claim. The wire-transport
	// route is the existing `POST /v1/control/{method}` REST surface. NOT a
	// task-control, streaming-events, search, posture, pause, or topology
	// method — `IsArtifactsMethod` is its own O(1) predicate. See
	MethodArtifactsList Method = "artifacts.list"
	// MethodArtifactsPut — The Console (and
	// Playground) file-upload pipeline: accepts bytes +
	// PutOpts, routes the payload through `audit.Redactor`, stores it via
	// `artifacts.ArtifactStore.PutBytes`, and returns the canonical
	// ArtifactRef. Heavy bytes never travel inline through the LLM edge
	// the put returns a reference, never echoes the body.
	// Identity-mandatory; a body whose scope tenant disagrees with the
	// caller's verified tenant is rejected with CodeScopeMismatch.
	MethodArtifactsPut Method = "artifacts.put"

	// MethodArtifactsGet — The driver-independent byte read.
	// It resolves through `artifacts.ArtifactStore.Get`, so EVERY
	// registered driver serves it — the in-memory default included.
	// That is what distinguishes it from `artifacts.get_ref`, which
	// type-asserts the optional `artifacts.Presigner` capability and
	// answers `CodePresignUnsupported` when the assertion misses.
	//
	// The two are NOT parallel implementations of one feature.
	// `artifacts.get` is the CONTRACT — the universal read every client
	// can rely on. `artifacts.get_ref` is a TRANSPORT OPTIMISATION for
	// stores that can hand bytes off their own edge, so a large media
	// download need not transit the Runtime. Both resolve the same ref
	// under the same verified identity and the same flat,
	// non-elevatable body-identity posture; they differ in who serves
	// the bytes, not in who may read them.
	//
	// The response is truthful about its own bound: it carries
	// `total_size_bytes`, `returned_bytes` and `truncated` alongside the
	// window, so a bounded read is never mistakable for a complete one.
	// A request above the operator's configured fetch ceiling is SERVED
	// AT THE CEILING and reports it through those same fields rather
	// than being refused. Identity-mandatory; a scope naming a tenant
	// other than the verified one is refused flat with
	// `CodeScopeMismatch`, exactly as `artifacts.get_ref` is. Routes
	// through the control surface at `POST /v1/control/artifacts.get`.
	MethodArtifactsGet Method = "artifacts.get"

	// MethodArtifactsGetRef — The read-side
	// presigned-URL resolver: invokes `artifacts.Presigner.PresignGet` via
	// type-assertion on the underlying ArtifactStore. Drivers that do not
	// implement `Presigner` (in-mem / fs / sqlite-blob / postgres-blob)
	// return `CodePresignUnsupported` loudly — no silent fallback. The
	// Console's Preview / Download / Share / bulk-Download all route
	// through this single resolver. Identity-mandatory;
	// expiry is bounded [1m, 7d].
	MethodArtifactsGetRef Method = "artifacts.get_ref"

	// MethodArtifactsDelete — The admin-gated, audited
	// "evict an artifact" mutation: removes the keyed artifact from the
	// scope via the shipped `ArtifactStore.Delete` (idempotent). Requires
	// the verified `admin` scope claim (Delete
	// is a mutating verb, strictly more than the read scope); fails closed
	// without it. Emits `artifacts.deleted` for audit. Routes through the
	// control surface at `POST /v1/control/artifacts.delete`.
	MethodArtifactsDelete Method = "artifacts.delete"

	// MethodMemoryList — Returns the
	// paginated, identity-scope-filtered set of memory records the
	// Console Memory page renders. Read-only — it composes over the
	// shipped `MemoryStore.Snapshot` surface and the
	// `events.aggregate` counters. The wire-transport route
	// is `POST /v1/memory/list`. Identity-mandatory; a cross-tenant
	// filter requires the verified `auth.ScopeAdmin` (or
	// `auth.ScopeConsoleFleet`) claim from the closed two-scope
	// set — NO new memory scope is minted (audit B1). NOT a control /
	// search / posture / pause / topology method; `IsMemoryMethod` is
	// its own O(1) predicate. See
	MethodMemoryList Method = "memory.list"

	// MethodMemoryGet — Returns the full detail of a single
	// memory record: metadata + post-redaction value (below the
	// heavy-content threshold) OR a by-reference `MemoryArtifactRef`
	// (at or above the threshold) — NEVER inline bytes above threshold.
	// The wire-transport route is `POST /v1/memory/get`. Same identity-
	// scope contract as MethodMemoryList.
	MethodMemoryGet Method = "memory.get"

	// MethodMemoryHealth — Returns aggregate memory-health
	// counters (total records / expiring-in-1h / identity-rejected-24h
	// / recovery-dropped-24h) plus the per-scope driver mapping. The
	// 24-h-window counters derive from `events.aggregate` over the
	// `memory.*` event types. The wire-transport route is
	// `POST /v1/memory/health`. Same identity-scope contract as
	// MethodMemoryList.
	MethodMemoryHealth Method = "memory.health"

	// MethodMemoryStrategyTrace — Returns the live
	// read-only projection of how the configured memory strategy is
	// compacting the caller's session memory right now (the rolling-
	// summary text + the verbatim-turn count + the token estimate +
	// health) — the strategy's real `GetLLMContext` + `Health` output, not
	// a fabricated selection trace. The wire-transport route is
	// `POST /v1/memory/strategy_trace`. Same identity-scope contract as
	// MethodMemoryList (read scope; no admin claim).
	MethodMemoryStrategyTrace Method = "memory.strategy_trace"

	// MethodMemoryPut — The admin-gated, audited
	// "add a memory turn" mutation: appends an operator-supplied
	// conversation turn to the caller's session memory via the shipped
	// `MemoryStore.AddTurn`. Requires the verified `admin` scope claim;
	// fails closed without it. The wire-transport route is
	// `POST /v1/memory/put`.
	MethodMemoryPut Method = "memory.put"

	// MethodMemoryDelete — The admin-gated, audited
	// "evict a memory turn" mutation: removes the keyed turn from the
	// caller's session memory via a `Snapshot` → drop-turn → `Restore`
	// read-modify-write on the shipped MemoryStore. Requires the verified
	// `admin` scope claim; fails closed without it. The
	// wire-transport route is `POST /v1/memory/delete`.
	MethodMemoryDelete Method = "memory.delete"

	// MethodMCPServersList — paged, filterable list of the configured
	// MCP southbound servers with live state.
	MethodMCPServersList Method = "mcp.servers.list"
	// MethodMCPServersGet — single-server detail read.
	MethodMCPServersGet Method = "mcp.servers.get"
	// MethodMCPServersResources — list of the resources a server
	// advertises.
	MethodMCPServersResources Method = "mcp.servers.resources"
	// MethodMCPServersPrompts — list of the prompts a server
	// advertises.
	MethodMCPServersPrompts Method = "mcp.servers.prompts"
	// MethodMCPServersRefreshDiscovery — control-plane verb: re-runs
	// the server's tools/resources/prompts discovery.
	MethodMCPServersRefreshDiscovery Method = "mcp.servers.refresh_discovery"
	// MethodMCPServersProbe — control-plane verb: runs a transport
	// ping / tools-list round-trip.
	MethodMCPServersProbe Method = "mcp.servers.probe"
	// MethodMCPServersHealth — handshake-latency sparkline + reconnect
	// history + transport-error rate.
	MethodMCPServersHealth Method = "mcp.servers.health"
	// MethodMCPServersBindingsList — list of a server's OAuth bindings
	// (metadata only — never token plaintext).
	MethodMCPServersBindingsList Method = "mcp.servers.bindings.list"
	// MethodMCPServersPolicy — read-only ToolPolicy projection.
	MethodMCPServersPolicy Method = "mcp.servers.policy"
	// MethodMCPServersRefreshBinding — admin verb: initiates an OAuth
	// (re)connect flow for a binding. Requires the `auth.ScopeAdmin`
	// claim.
	MethodMCPServersRefreshBinding Method = "mcp.servers.refresh_binding"
	// MethodMCPServersRevokeBinding — admin verb: revokes an OAuth
	// binding. Requires the `auth.ScopeAdmin` claim.
	MethodMCPServersRevokeBinding Method = "mcp.servers.revoke_binding"
	// MethodMCPServersSetRawHTMLTrust — admin verb: sets the per-server
	// raw-HTML opt-in flag and emits the `mcp.raw_html_trust_toggled`
	// audit event. Requires the `auth.ScopeAdmin` claim.
	MethodMCPServersSetRawHTMLTrust Method = "mcp.servers.set_raw_html_trust"

	// MethodMCPReadResource — the MCP Apps host's resource read: fetches
	// a `ui://` resource's HTML (an MCP App's UI document) scoped to the
	// request identity triple, heavy-content aware (content at or above
	// the heavy threshold rides by reference with a loud bypass event,
	// never inline). NOT a control method; routed through the MCP Apps
	// dispatcher (`IsMCPAppsMethod`). Identity-mandatory.
	MethodMCPReadResource Method = "mcp.servers.read_resource"
	// MethodMCPAppsCallTool — the MCP Apps host's app-tool-call proxy:
	// an in-iframe MCP App asks the host to invoke an MCP tool, and the
	// request re-enters the EXISTING identity + approval-gate + tool-side
	// -OAuth invocation path (no new bypass). An app call to a gated
	// tool parks on the unified pause primitive exactly as a planner call
	// does. NOT a control method; routed through the MCP Apps
	// dispatcher. Identity-mandatory.
	MethodMCPAppsCallTool Method = "mcp.apps.call_tool"
	// MethodMCPAppsToolContext — the MCP Apps host's tool-context read: a
	// rendered MCP App fetches the tool context (the input arguments + the
	// lowered result) that produced it, keyed by the server source id + the
	// stable tool-call id carried on the `mcp.app_available` discovery
	// event. The runtime captures the context at the tool-invocation site
	// (heavy-aware — a large result rides by reference); the read projects
	// it inline OR as an artifact reference. An unknown or cross-identity
	// id fails with CodeNotFound (existence is never revealed across
	// identities). NOT a control method; routed through the MCP Apps
	// dispatcher. Identity-mandatory.
	MethodMCPAppsToolContext Method = "mcp.apps.tool_context"

	// MethodToolsList — Returns the
	// catalog of registered tools visible to the caller's identity
	// scope, with optional facet filters (scope / transport / OAuth
	// status / approval policy / reliability tier) plus aggregate
	// counters (Total / Active / Pending approval / Awaiting OAuth) for
	// the filtered view. Powers the Console Tools page catalog table.
	// Identity-mandatory; a cross-tenant fan-in requires the
	// `auth.ScopeAdmin` claim. NOT a control / search /
	// posture / topology method — `IsToolsMethod` returns true. The
	// wire-transport route is `POST /v1/tools/list`. See
	MethodToolsList Method = "tools.list"
	// MethodToolsGet — Returns a single tool's catalog row
	// projection by ID. The lighter sibling of `tools.describe` — the
	// row shape the Console renders in the detail-panel header.
	MethodToolsGet Method = "tools.get"
	// MethodToolsDescribe — Returns the full manifest of a
	// registered tool descriptor: transport, version, scopes, the
	// argument / output JSON Schemas, examples, OAuth binding scope,
	// approval policy, and the reliability shell.
	// Powers the Tools-page Manifest / Inputs / Outputs tabs.
	MethodToolsDescribe Method = "tools.describe"
	// MethodToolsMetrics — Returns per-tool error-rate
	// gauges over a selectable window (1h / 24h / 7d) plus a status
	// pill (`Healthy` / `Degraded` / `Offline`). Powers the Tools-page
	// Status + Error-rate right-rail card.
	MethodToolsMetrics Method = "tools.metrics"
	// MethodToolsContentStats — Returns the per-tool
	// distribution of recent result sizes vs the heavy-content
	// threshold (RFC §6.5) plus the negotiated `DisplayMode`
	// snapshot. Powers the Tools-page Content-size card.
	MethodToolsContentStats Method = "tools.content_stats"
	// MethodToolsSetApprovalPolicy — ADMIN method: updates a
	// tool's approval policy. Requires the verified `auth.ScopeAdmin`
	// claim (there is NO `tools.admin` scope — the closed
	// two-scope set is the only admit surface). Emits an
	// `audit.admin_scope_used` event through the shipped audit.Redactor.
	MethodToolsSetApprovalPolicy Method = "tools.set_approval_policy"
	// MethodToolsRevokeOAuth — ADMIN method: revokes all
	// OAuth bindings for a tool. Requires the verified `auth.ScopeAdmin`
	// claim. Emits an `audit.admin_scope_used` event through
	// the shipped audit.Redactor.
	MethodToolsRevokeOAuth Method = "tools.revoke_oauth"

	// MethodTasksList — Returns the
	// paginated list of tasks visible to the caller's identity scope,
	// with optional facet filters (status / kind / parent-task /
	// identity / time-window / error-class / latency-above / free-text)
	// plus per-status aggregate counters (Pending / Running / Paused /
	// Failed / Complete / Cancelled) for the filtered view. Powers the
	// Console Tasks-page kanban board + list-mode table. Identity-
	// mandatory; a cross-tenant fan-in requires the `auth.ScopeAdmin`
	// claim. NOT a control / search / posture method —
	// `IsTasksMethod` returns true. The wire-transport route is
	// `POST /v1/tasks/list`. See
	MethodTasksList Method = "tasks.list"
	// MethodTasksGet — Returns the enriched detail of a
	// single task: the full Task projection (heavy values via
	// ArtifactRef), parent-session reference, parent-task
	// reference (when child), per-step cost rollup aggregated from
	// `llm.cost.recorded` events, and the planner-checkpoint reference
	// at spawn time. A cross-tenant TaskID lookup returns CodeNotFound
	// (existence is never revealed across tenants). The wire-transport
	// route is `POST /v1/tasks/get`.
	MethodTasksGet Method = "tasks.get"

	// MethodAgentsList — Returns the
	// catalog of agents registered under the caller's identity scope,
	// with optional facet filters (status / planner type / free-text
	// search) plus aggregate counters. Powers the Console Agents page
	// cards grid. Identity-mandatory; a cross-tenant fan-in requires the
	// `auth.ScopeAdmin` claim. `IsAgentsMethod` returns true.
	// The wire-transport route is `POST /v1/agents/list`.
	MethodAgentsList Method = "agents.list"
	// MethodAgentsGet — Returns one agent's full
	// registration-identity projection: agent_id / incarnation /
	// version_hash, hosting, status, health, and the
	// AgentConfig projection. Powers the Agents detail header + the
	// Identity / Autonomy tabs.
	MethodAgentsGet Method = "agents.get"
	// MethodAgentsTools — Returns the agent's tool bindings
	// joined to per-binding OAuth status. Powers the Tools tab.
	MethodAgentsTools Method = "agents.tools"
	// MethodAgentsMemory — Returns the agent's configured
	// memory strategy, TTL, and scope. Powers the Memory tab.
	MethodAgentsMemory Method = "agents.memory"
	// MethodAgentsGovernance — Returns the agent's
	// per-identity-tier cost ceilings + spend and rate-limit
	// posture. Powers the Cost tab.
	MethodAgentsGovernance Method = "agents.governance"
	// MethodAgentsSkills — Returns the agent's attached
	// skills (imported + generated skills). Powers the Skills
	// tab.
	MethodAgentsSkills Method = "agents.skills"
	// MethodAgentsPermissions — Returns the agent's
	// permission model — V1 default is implicit ("every authenticated
	// user in the tenant"); an explicit ACL surface is post-V1.
	MethodAgentsPermissions Method = "agents.permissions"
	// MethodAgentsMetrics — Returns the registry-wide rollup
	// (Active Agents / Running Tasks / Total Cost / Total Tokens) for
	// the caller's identity scope. Powers the Agents page hero numbers.
	MethodAgentsMetrics Method = "agents.metrics"

	// MethodAgentsPause — The fleet-control verb that
	// pauses an agent (stop accepting new tasks until Resume). Wraps the
	// shipped `registry.Pause` in-process control verb behind a Protocol
	// method so the Console can drive it. MUTATES registry state and
	// therefore requires the elevated `auth.ScopeAdmin` control claim;
	// emits `agent.paused`. `IsAgentsControlMethod` returns true.
	// Supersedes the earlier deferral.
	MethodAgentsPause Method = "agents.pause"
	// MethodAgentsDrain — Gracefully drains an agent (accept
	// no new tasks, finish existing). Wraps `registry.Drain`; emits
	// `agent.drained`. Control-scope gated.
	MethodAgentsDrain Method = "agents.drain"
	// MethodAgentsRestart — Restarts an agent (bump
	// incarnation; rehydrate from StateStore). Wraps `registry.Restart`;
	// emits `agent.restart_requested`. Control-scope gated.
	MethodAgentsRestart Method = "agents.restart"
	// MethodAgentsForceStop — Hard-stops an agent. Wraps
	// `registry.ForceStop`; emits `agent.force_stopped`. Control-scope
	// gated.
	MethodAgentsForceStop Method = "agents.force_stop"
	// MethodAgentsDeregister — Removes an agent from the
	// registry (irreversible). Wraps `registry.Deregister`; emits
	// `agent.deregistered`. Control-scope gated.
	MethodAgentsDeregister Method = "agents.deregister"

	// MethodAuthRotateToken — Rotates the
	// operator's current Protocol-auth token: the Runtime re-mints a
	// JWT for the caller's already-verified `(tenant, user, session)`
	// identity and returns it once (one-time-reveal). The ONLY net-new
	// Protocol method Harbor ships — the Console Settings page is
	// otherwise a pure consumer of the posture methods. ADMIN
	// method: requires the verified `auth.ScopeAdmin` claim (the
	// closed two-scope set — there is NO `auth.admin` scope). A request
	// without the claim is rejected 403 with CodeIdentityScopeRequired.
	// Every successful rotation emits a redacted `audit.admin_scope_used`
	// event. NOT a control / search / posture / pause / topology
	// method — `IsAuthMethod` is its own O(1) predicate. The
	// wire-transport route is `POST /v1/auth/rotate_token`. See
	MethodAuthRotateToken Method = "auth.rotate_token" //nolint:gosec // G101 false positive — this is a Protocol method name, not a credential.

	// MethodSessionsList — Returns the
	// paginated, identity-scope-filtered projection of the
	// SessionRegistry the Console Sessions page renders — the
	// past-and-active durable record of every Harbor execution the
	// operator has access to. Carries the full filter set (status /
	// agent / user / tenant / started-window / has-intervention /
	// has-failed-task / cost-above) plus cursor pagination. Read-only;
	// identity-mandatory. A cross-tenant filter (a `tenant_ids` entry
	// outside the caller's verified tenant) requires the verified
	// `auth.ScopeAdmin` claim (closed two-scope set — NO new
	// scope is minted). NOT a control / streaming-events / search /
	// posture / pause / topology / artifacts / memory / mcp / tools /
	// flows method — `IsSessionsMethod` is its own O(1) predicate. The
	// wire-transport route is `POST /v1/sessions/list`. See
	MethodSessionsList Method = "sessions.list"
	// MethodSessionsInspect — Returns the full per-session
	// snapshot the Console Sessions detail view renders — the
	// right-rail Session Summary projection (id / status / started /
	// duration / events / tasks / agent / user / tenant / cost / last
	// activity) plus the capped `recent_interventions` /
	// `recent_artifacts` slices. Read-only; identity-mandatory; same
	// cross-tenant scope contract as MethodSessionsList. The
	// wire-transport route is `POST /v1/sessions/inspect`.
	MethodSessionsInspect Method = "sessions.inspect"
	// MethodSessionsDelete — the identity-scoped data-lifecycle erasure
	// method: deletes a whole session and CASCADES deletion of its
	// scoped State, Memory, and Artifacts. Own-session-only — a caller
	// erases solely their own verified `(tenant, user, session)`; a body
	// identity mismatching the verified identity is rejected
	// `identity_required` before any further logic, and there is NO
	// admin / cross-tenant erasure path. A session with a RUNNING task is
	// refused fail-loud with the distinct `session_running` (409) code,
	// mirroring the GC never-reap-running invariant — no store is touched
	// on refusal. A successful erasure emits a redacted, content-free
	// `session.erased` audit event under the actor's observability scope
	// (never re-persisted under the erased triple). The mutating sibling
	// of `sessions.list` / `sessions.inspect`; it routes through the same
	// Sessions handler. Identity-mandatory. The wire-transport route is
	// `POST /v1/sessions/delete`.
	MethodSessionsDelete Method = "sessions.delete"
	// MethodSessionsSetTitle — sets or clears a session's human-readable
	// title. The write scope is the owning `(tenant, user)` —
	// the same scope `sessions.list` reads at — NOT own-session-only:
	// the body `Identity`'s tenant/user MUST equal the verified identity,
	// but the target `session_id` (a dedicated request field) MAY name a
	// sibling session of the same owner. The wire verb ALWAYS writes
	// `manual` provenance (empty title clears both fields to unset);
	// `auto` provenance is not expressible over the wire. An over-bound
	// or malformed title fails loud with `CodeInvalidRequest` (400) —
	// never a silent clamp. Publishes the content-free
	// `session.title_changed` event on success (identity scope + session
	// id + source only — never the title string). The mutating sibling
	// of `sessions.list` / `sessions.inspect` / `sessions.delete`; it
	// routes through the same Sessions handler. Identity-mandatory. The
	// wire-transport route is `POST /v1/sessions/set_title`.
	MethodSessionsSetTitle Method = "sessions.set_title"

	// MethodSessionTurnsList — the `sessions.turns.list` consumer
	// conversation-page read: one newest-first keyset page of the
	// caller's exact session, served entirely from the turn projection
	// (never a raw history / task fallback). The consumer lane is
	// exact-session; a foreign-session list answers typed not-found
	// (non-oracular). The operations projection is GET-ONLY and rejected
	// here. Identity-mandatory; the wire-transport route is
	// `POST /v1/sessions/turns/list` (pinned explicitly — nested session
	// routes are never derived generically).
	MethodSessionTurnsList Method = "sessions.turns.list"
	// MethodSessionTurnsGet — the `sessions.turns.get` single-turn read:
	// one (session, task) read on either the consumer conversation lane
	// (exact-session, effective-agent-gated) or — under a verified admin
	// OR console:fleet claim — the structurally distinct operations DTO
	// lane (no query / answer / reasoning / App URI / tool_call_id /
	// App context / pause tokens; a widened read emits one
	// `audit.admin_scope_used` event). Identity-mandatory; the
	// wire-transport route is `POST /v1/sessions/turns/get` (pinned
	// explicitly — never derived).
	MethodSessionTurnsGet Method = "sessions.turns.get"

	// MethodObservabilityQuery — the ONE bounded administrative query
	// surface over the observability rollup projection: exact integer /
	// decimal measure values (cost is integer micro-units of USD) over a
	// mandatory aligned bucket window, closed group/measure/sort sets, a
	// full-query-bound deterministic cursor, and a MANDATORY freshness
	// block (state current | catching_up | unavailable, the rollup
	// watermark, and the retention / window-coverage quality). An
	// ordinary caller's query is forced to its own verified triple; a
	// widened (admin OR console:fleet) fan-in emits exactly one
	// `audit.admin_scope_used` event BEFORE the read reaches storage.
	// Identity-mandatory; the wire-transport route is
	// `POST /v1/observability/query`.
	MethodObservabilityQuery Method = "observability.query"

	// MethodRunsSetOverrides — Records the
	// reasoning-effort / temperature / max-tokens / system-prompt
	// override the Console Playground page applies to the NEXT message
	// in a session. The override is session-scoped (keyed by the
	// identity triple) and one-shot: it applies to the next
	// `user_message` / `start` and is consumed at that point — it does
	// NOT apply retroactively to past messages, and a session that sets
	// an override then never sends drops it. Identity-mandatory
	// (`session_id` required; tenant / user inferred from the verified
	// JWT); a cross-session override is rejected with CodeScopeMismatch.
	// NOT a control / streaming-events / search / posture / pause /
	// topology / artifacts / memory / mcp / tools / flows / agents /
	// sessions / tasks method — `IsRunsMethod` is its own O(1)
	// predicate. The wire-transport route is `POST /v1/runs/set_overrides`.
	MethodRunsSetOverrides Method = "runs.set_overrides"

	// MethodStateHistory — the State-snapshots surface's by-id,
	// identity-scoped, read-only TAIL-FIRST windowed read of a session's
	// durable event stream. Returns a bounded backward page of flat
	// `StateEvent` (events with `Sequence < before`, the most-recent K,
	// oldest-first within the window) plus the discovered head/tail
	// sequence and a scroll-up cursor; heavy content rides by a routable
	// `StateArtifactRef`, never inline. Reduction to chat messages stays
	// client-side. Identity-mandatory: an incomplete triple is rejected
	// with CodeIdentityRequired; an unknown or cross-identity session is
	// CodeNotFound (existence is never revealed across identities,
	// mirroring `tasks.get`); a cross-tenant read requires the verified
	// `auth.ScopeAdmin` claim on the ctx (the request body carries no
	// elevation knob). NOT a control / streaming-events / search /
	// posture / pause / topology / artifacts / memory / mcp / tools /
	// flows / agents / sessions / tasks / runs method — `IsStateMethod`
	// is its own O(1) predicate. The wire-transport route is
	// `POST /v1/state/history`.
	MethodStateHistory Method = "state.history"

	// MethodEventsList — the durable, time-ranged, cross-session raw-event
	// read. It completes the events surface beside `events.subscribe` (the
	// forward-only live tail) and `events.aggregate` (bucketed counts with
	// no payloads): `events.list` returns a bounded, tail-first page of the
	// flat `StateEvent` rows the SSE and `state.history` already project —
	// the existing `EventFilter` (identity axes + `since`/`until` time
	// bounds + event-type selector) plus a sequence-based scroll-up cursor
	// mirroring `state.history`'s paging grammar. Non-widened callers read
	// only their own identity tuple's rows; a cross-tenant (fleet) read
	// requires the verified `admin` OR `console:fleet` claim (the closed
	// two-scope set, matching `events.aggregate`), derived server-side from
	// the verified session — never the request body — and emits one
	// `audit.admin_scope_used` per widened request. Heavy payloads ride by
	// a routable `StateArtifactRef`, never inline (RFC §6.5). NOT a control
	// / streaming-events / search / posture / pause / topology / artifacts
	// / memory / mcp / tools / flows / agents / sessions / tasks / runs /
	// state method — `IsEventsListMethod` is its own O(1) predicate. The
	// wire-transport route is `POST /v1/events/list`.
	MethodEventsList Method = "events.list"
)