openshellv1

type AddAllowRules struct {
	Host  string              `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	Port  uint32              `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	Rules []*sandboxv1.L7Rule `protobuf:"bytes,3,rep,name=rules,proto3" json:"rules,omitempty"`
	// contains filtered or unexported fields
}

type AddDenyRules struct {
	Host      string                  `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	Port      uint32                  `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	DenyRules []*sandboxv1.L7DenyRule `protobuf:"bytes,3,rep,name=deny_rules,json=denyRules,proto3" json:"deny_rules,omitempty"`
	// contains filtered or unexported fields
}

type AddNetworkRule struct {
	RuleName string                       `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	Rule     *sandboxv1.NetworkPolicyRule `protobuf:"bytes,2,opt,name=rule,proto3" json:"rule,omitempty"`
	// contains filtered or unexported fields
}

type ApproveAllDraftChunksRequest struct {

	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Include chunks with security_notes (default false: skips them).
	IncludeSecurityFlagged bool `` /* 130-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ApproveAllDraftChunksResponse struct {

	// New policy version after merge.
	PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	// SHA-256 hash of the new policy.
	PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// Number of chunks approved.
	ChunksApproved uint32 `protobuf:"varint,3,opt,name=chunks_approved,json=chunksApproved,proto3" json:"chunks_approved,omitempty"`
	// Number of chunks skipped (security-flagged).
	ChunksSkipped uint32 `protobuf:"varint,4,opt,name=chunks_skipped,json=chunksSkipped,proto3" json:"chunks_skipped,omitempty"`
	// contains filtered or unexported fields
}

type ApproveDraftChunkRequest struct {

	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Chunk ID to approve.
	ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	// contains filtered or unexported fields
}

type ApproveDraftChunkResponse struct {

	// New policy version after merge.
	PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	// SHA-256 hash of the new policy.
	PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// contains filtered or unexported fields
}

type AttachSandboxProviderRequest struct {

	// Sandbox name (canonical lookup key).
	SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"`
	// Provider name to attach.
	ProviderName string `protobuf:"bytes,2,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
	// Expected resource version for optimistic concurrency control.
	// If 0, the server uses the current version (backward compatibility).
	// If non-zero, the server validates that the sandbox's current resource_version
	// matches this value before applying the mutation, returning ABORTED on mismatch.
	ExpectedResourceVersion uint64 `` /* 133-byte string literal not displayed */
	// contains filtered or unexported fields
}

type AttachSandboxProviderResponse struct {
	Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// True when the provider was newly attached. False means it was already attached.
	Attached bool `protobuf:"varint,2,opt,name=attached,proto3" json:"attached,omitempty"`
	// contains filtered or unexported fields
}

type ClearDraftChunksRequest struct {

	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type ClearDraftChunksResponse struct {

	// Number of chunks cleared.
	ChunksCleared uint32 `protobuf:"varint,1,opt,name=chunks_cleared,json=chunksCleared,proto3" json:"chunks_cleared,omitempty"`
	// contains filtered or unexported fields
}

type CreateProviderRequest struct {
	Provider *datamodelv1.Provider `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// contains filtered or unexported fields
}

type CreateSandboxRequest struct {
	Spec *SandboxSpec `protobuf:"bytes,1,opt,name=spec,proto3" json:"spec,omitempty"`
	// Optional user-supplied sandbox name. When empty the server generates one.
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// Optional labels for the sandbox (key-value metadata).
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// contains filtered or unexported fields
}

type CreateSshSessionRequest struct {

	// Sandbox id.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// contains filtered or unexported fields
}

type CreateSshSessionResponse struct {

	// Sandbox id. [A-Za-z0-9._-]{1,128}.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Session token for the gateway tunnel. URL-safe ASCII
	// ([A-Za-z0-9._~+/=-]) up to 4096 bytes. No shell metacharacters or
	// whitespace.
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// Gateway host for SSH proxy connection. IPv4 address, bracketed IPv6
	// address, or DNS hostname (Punycode-encoded for IDN). Alphanumeric plus
	// `.-:[]` only, up to 253 bytes.
	GatewayHost string `protobuf:"bytes,3,opt,name=gateway_host,json=gatewayHost,proto3" json:"gateway_host,omitempty"`
	// Gateway port for SSH proxy connection. Must be in range 1..=65535.
	GatewayPort uint32 `protobuf:"varint,4,opt,name=gateway_port,json=gatewayPort,proto3" json:"gateway_port,omitempty"`
	// Gateway scheme. Must be exactly "http" or "https".
	GatewayScheme string `protobuf:"bytes,5,opt,name=gateway_scheme,json=gatewayScheme,proto3" json:"gateway_scheme,omitempty"`
	// Optional host key fingerprint. If non-empty, [A-Za-z0-9:+/=-] only.
	HostKeyFingerprint string `protobuf:"bytes,7,opt,name=host_key_fingerprint,json=hostKeyFingerprint,proto3" json:"host_key_fingerprint,omitempty"`
	// Expiry timestamp in milliseconds since epoch. 0 means no expiry.
	ExpiresAtMs int64 `protobuf:"varint,8,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"`
	// contains filtered or unexported fields
}

type DeleteProviderProfileRequest struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

type DeleteProviderProfileResponse struct {
	Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"`
	// contains filtered or unexported fields
}

type DeleteProviderRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type DeleteProviderResponse struct {
	Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"`
	// contains filtered or unexported fields
}

type DeleteSandboxRequest struct {

	// Sandbox name (canonical lookup key).
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type DeleteSandboxResponse struct {
	Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"`
	// contains filtered or unexported fields
}

type DeleteServiceRequest struct {

	// Sandbox name.
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Service name within the sandbox. Empty selects the unnamed endpoint.
	Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
	// contains filtered or unexported fields
}

type DeleteServiceResponse struct {

	// True when an endpoint existed and was deleted.
	Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"`
	// contains filtered or unexported fields
}

type DenialSummary struct {

	// Sandbox ID that produced this summary.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Denied destination host.
	Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
	// Denied destination port.
	Port uint32 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	// Binary that attempted the connection.
	Binary string `protobuf:"bytes,4,opt,name=binary,proto3" json:"binary,omitempty"`
	// Process ancestor chain.
	Ancestors []string `protobuf:"bytes,5,rep,name=ancestors,proto3" json:"ancestors,omitempty"`
	// Denial reason from OPA evaluation.
	DenyReason string `protobuf:"bytes,6,opt,name=deny_reason,json=denyReason,proto3" json:"deny_reason,omitempty"`
	// First denial timestamp (ms since epoch).
	FirstSeenMs int64 `protobuf:"varint,7,opt,name=first_seen_ms,json=firstSeenMs,proto3" json:"first_seen_ms,omitempty"`
	// Most recent denial timestamp (ms since epoch).
	LastSeenMs int64 `protobuf:"varint,8,opt,name=last_seen_ms,json=lastSeenMs,proto3" json:"last_seen_ms,omitempty"`
	// Number of denials in the current window.
	Count uint32 `protobuf:"varint,9,opt,name=count,proto3" json:"count,omitempty"`
	// Events dropped during aggregator cooldown.
	SuppressedCount uint32 `protobuf:"varint,10,opt,name=suppressed_count,json=suppressedCount,proto3" json:"suppressed_count,omitempty"`
	// Cumulative lifetime count (never resets).
	TotalCount uint32 `protobuf:"varint,11,opt,name=total_count,json=totalCount,proto3" json:"total_count,omitempty"`
	// Distinct cmdline strings observed (sanitized of credentials).
	SampleCmdlines []string `protobuf:"bytes,12,rep,name=sample_cmdlines,json=sampleCmdlines,proto3" json:"sample_cmdlines,omitempty"`
	// SHA-256 of the binary for audit trail.
	BinarySha256 string `protobuf:"bytes,13,opt,name=binary_sha256,json=binarySha256,proto3" json:"binary_sha256,omitempty"`
	// True if emitted by stale-flush rather than threshold.
	Persistent bool `protobuf:"varint,14,opt,name=persistent,proto3" json:"persistent,omitempty"`
	// Denial category: "l4_deny", "l7_deny", "l7_audit", "ssrf".
	DenialStage string `protobuf:"bytes,15,opt,name=denial_stage,json=denialStage,proto3" json:"denial_stage,omitempty"`
	// Observed HTTP request patterns (from L7 inspection).
	L7RequestSamples []*L7RequestSample `protobuf:"bytes,16,rep,name=l7_request_samples,json=l7RequestSamples,proto3" json:"l7_request_samples,omitempty"`
	// True if L7 inspection was active during observation window.
	L7InspectionActive bool `protobuf:"varint,17,opt,name=l7_inspection_active,json=l7InspectionActive,proto3" json:"l7_inspection_active,omitempty"`
	// contains filtered or unexported fields
}

type DetachSandboxProviderRequest struct {

	// Sandbox name (canonical lookup key).
	SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"`
	// Provider name to detach.
	ProviderName string `protobuf:"bytes,2,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
	// Expected resource version for optimistic concurrency control.
	// If 0, the server uses the current version (backward compatibility).
	// If non-zero, the server validates that the sandbox's current resource_version
	// matches this value before applying the mutation, returning ABORTED on mismatch.
	ExpectedResourceVersion uint64 `` /* 133-byte string literal not displayed */
	// contains filtered or unexported fields
}

type DetachSandboxProviderResponse struct {
	Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// True when the provider was removed. False means it was not attached.
	Detached bool `protobuf:"varint,2,opt,name=detached,proto3" json:"detached,omitempty"`
	// contains filtered or unexported fields
}

type DraftChunkPayload struct {

	// Proposed network_policies map key.
	RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	// Proposed network policy rule.
	ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,2,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"`
	// Human-readable explanation of why this rule is proposed.
	Rationale string `protobuf:"bytes,3,opt,name=rationale,proto3" json:"rationale,omitempty"`
	// Security concerns flagged by analysis (empty if none).
	SecurityNotes string `protobuf:"bytes,4,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"`
	// Analysis confidence (0.0-1.0). 0 for mechanistic mode.
	Confidence float32 `protobuf:"fixed32,5,opt,name=confidence,proto3" json:"confidence,omitempty"`
	// When the user approved/rejected (ms since epoch). 0 if undecided.
	DecidedAtMs int64 `protobuf:"varint,6,opt,name=decided_at_ms,json=decidedAtMs,proto3" json:"decided_at_ms,omitempty"`
	// Denormalized endpoint host for dedup and display.
	Host string `protobuf:"bytes,7,opt,name=host,proto3" json:"host,omitempty"`
	// Denormalized endpoint port for dedup and display.
	Port int32 `protobuf:"varint,8,opt,name=port,proto3" json:"port,omitempty"`
	// Binary path that triggered the denial.
	Binary string `protobuf:"bytes,9,opt,name=binary,proto3" json:"binary,omitempty"`
	// Current draft version for the owning sandbox.
	DraftVersion int64 `protobuf:"varint,10,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"`
	// Gateway prover verdict for this chunk; empty until prover runs.
	// Mirrors PolicyChunk.validation_result.
	ValidationResult string `protobuf:"bytes,11,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"`
	// Operator-supplied free-form rejection text; empty for non-rejected
	// chunks. Mirrors PolicyChunk.rejection_reason.
	RejectionReason string `protobuf:"bytes,12,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"`
	// contains filtered or unexported fields
}

type DraftHistoryEntry struct {

	// Event timestamp (ms since epoch).
	TimestampMs int64 `protobuf:"varint,1,opt,name=timestamp_ms,json=timestampMs,proto3" json:"timestamp_ms,omitempty"`
	// Event type: "denial_detected", "analysis_cycle", "approved",
	// "rejected", "edited", "undone", "cleared".
	EventType string `protobuf:"bytes,2,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
	// Human-readable description.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// Associated chunk ID (if applicable).
	ChunkId string `protobuf:"bytes,4,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	// contains filtered or unexported fields
}

type DraftPolicyUpdate struct {

	// Current draft version.
	DraftVersion uint64 `protobuf:"varint,1,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"`
	// Number of new chunks added in this update.
	NewChunks uint32 `protobuf:"varint,2,opt,name=new_chunks,json=newChunks,proto3" json:"new_chunks,omitempty"`
	// Total pending chunks awaiting approval.
	TotalPending uint32 `protobuf:"varint,3,opt,name=total_pending,json=totalPending,proto3" json:"total_pending,omitempty"`
	// Brief description of what changed.
	Summary string `protobuf:"bytes,4,opt,name=summary,proto3" json:"summary,omitempty"`
	// contains filtered or unexported fields
}

type EditDraftChunkRequest struct {

	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Chunk ID to edit.
	ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	// The modified rule (replaces existing proposed_rule).
	ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,3,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"`
	// contains filtered or unexported fields
}

type EditDraftChunkResponse struct {
	// contains filtered or unexported fields
}

type ExecSandboxEvent struct {

	// Types that are valid to be assigned to Payload:
	//
	//	*ExecSandboxEvent_Stdout
	//	*ExecSandboxEvent_Stderr
	//	*ExecSandboxEvent_Exit
	Payload isExecSandboxEvent_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type ExecSandboxEvent_Exit struct {
	Exit *ExecSandboxExit `protobuf:"bytes,3,opt,name=exit,proto3,oneof"`
}

type ExecSandboxEvent_Stderr struct {
	Stderr *ExecSandboxStderr `protobuf:"bytes,2,opt,name=stderr,proto3,oneof"`
}

type ExecSandboxEvent_Stdout struct {
	Stdout *ExecSandboxStdout `protobuf:"bytes,1,opt,name=stdout,proto3,oneof"`
}

type ExecSandboxExit struct {
	ExitCode int32 `protobuf:"varint,1,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
	// contains filtered or unexported fields
}

type ExecSandboxInput struct {

	// Types that are valid to be assigned to Payload:
	//
	//	*ExecSandboxInput_Start
	//	*ExecSandboxInput_Stdin
	//	*ExecSandboxInput_Resize
	Payload isExecSandboxInput_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type ExecSandboxInput_Resize struct {
	// Terminal window size change.
	Resize *ExecSandboxWindowResize `protobuf:"bytes,3,opt,name=resize,proto3,oneof"`
}

type ExecSandboxInput_Start struct {
	// First message: exec request metadata.
	Start *ExecSandboxRequest `protobuf:"bytes,1,opt,name=start,proto3,oneof"`
}

type ExecSandboxInput_Stdin struct {
	// Subsequent messages: raw stdin bytes.
	Stdin []byte `protobuf:"bytes,2,opt,name=stdin,proto3,oneof"`
}

type ExecSandboxRequest struct {

	// Sandbox id.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Command and arguments.
	Command []string `protobuf:"bytes,2,rep,name=command,proto3" json:"command,omitempty"`
	// Optional working directory.
	Workdir string `protobuf:"bytes,3,opt,name=workdir,proto3" json:"workdir,omitempty"`
	// Optional environment overrides.
	Environment map[string]string `` /* 149-byte string literal not displayed */
	// Optional timeout in seconds. 0 means no timeout.
	TimeoutSeconds uint32 `protobuf:"varint,5,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"`
	// Optional stdin payload passed to the command.
	Stdin []byte `protobuf:"bytes,6,opt,name=stdin,proto3" json:"stdin,omitempty"`
	// Request a pseudo-terminal for the remote command.
	Tty bool `protobuf:"varint,7,opt,name=tty,proto3" json:"tty,omitempty"`
	// Initial terminal columns (used when tty=true, 0 = use default).
	Cols uint32 `protobuf:"varint,8,opt,name=cols,proto3" json:"cols,omitempty"`
	// Initial terminal rows (used when tty=true, 0 = use default).
	Rows uint32 `protobuf:"varint,9,opt,name=rows,proto3" json:"rows,omitempty"`
	// contains filtered or unexported fields
}

type ExecSandboxStderr struct {
	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
	// contains filtered or unexported fields
}

type ExecSandboxStdout struct {
	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
	// contains filtered or unexported fields
}

type ExecSandboxWindowResize struct {
	Cols uint32 `protobuf:"varint,1,opt,name=cols,proto3" json:"cols,omitempty"`
	Rows uint32 `protobuf:"varint,2,opt,name=rows,proto3" json:"rows,omitempty"`
	// contains filtered or unexported fields
}

type ExposeServiceRequest struct {

	// Sandbox name.
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Service name within the sandbox.
	Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
	// Loopback TCP port inside the sandbox.
	TargetPort uint32 `protobuf:"varint,3,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"`
	// Whether to print/use the browser-facing service URL.
	Domain bool `protobuf:"varint,4,opt,name=domain,proto3" json:"domain,omitempty"`
	// contains filtered or unexported fields
}

type GatewayHeartbeat struct {
	// contains filtered or unexported fields
}

type GatewayMessage struct {

	// Types that are valid to be assigned to Payload:
	//
	//	*GatewayMessage_SessionAccepted
	//	*GatewayMessage_SessionRejected
	//	*GatewayMessage_Heartbeat
	//	*GatewayMessage_RelayOpen
	//	*GatewayMessage_RelayClose
	Payload isGatewayMessage_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type GatewayMessage_Heartbeat struct {
	Heartbeat *GatewayHeartbeat `protobuf:"bytes,3,opt,name=heartbeat,proto3,oneof"`
}

type GatewayMessage_RelayClose struct {
	RelayClose *RelayClose `protobuf:"bytes,5,opt,name=relay_close,json=relayClose,proto3,oneof"`
}

type GatewayMessage_RelayOpen struct {
	RelayOpen *RelayOpen `protobuf:"bytes,4,opt,name=relay_open,json=relayOpen,proto3,oneof"`
}

type GatewayMessage_SessionAccepted struct {
	SessionAccepted *SessionAccepted `protobuf:"bytes,1,opt,name=session_accepted,json=sessionAccepted,proto3,oneof"`
}

type GatewayMessage_SessionRejected struct {
	SessionRejected *SessionRejected `protobuf:"bytes,2,opt,name=session_rejected,json=sessionRejected,proto3,oneof"`
}

type GetDraftHistoryRequest struct {

	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetDraftHistoryResponse struct {

	// Chronological decision history.
	Entries []*DraftHistoryEntry `protobuf:"bytes,1,rep,name=entries,proto3" json:"entries,omitempty"`
	// contains filtered or unexported fields
}

type GetDraftPolicyRequest struct {

	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional status filter: "pending", "approved", "rejected", or "" for all.
	StatusFilter string `protobuf:"bytes,2,opt,name=status_filter,json=statusFilter,proto3" json:"status_filter,omitempty"`
	// contains filtered or unexported fields
}

type GetDraftPolicyResponse struct {

	// Draft policy chunks.
	Chunks []*PolicyChunk `protobuf:"bytes,1,rep,name=chunks,proto3" json:"chunks,omitempty"`
	// LLM-generated summary of all analysis (empty in mechanistic mode).
	RollingSummary string `protobuf:"bytes,2,opt,name=rolling_summary,json=rollingSummary,proto3" json:"rolling_summary,omitempty"`
	// Current draft version.
	DraftVersion uint64 `protobuf:"varint,3,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"`
	// When the last analysis completed (ms since epoch).
	LastAnalyzedAtMs int64 `protobuf:"varint,4,opt,name=last_analyzed_at_ms,json=lastAnalyzedAtMs,proto3" json:"last_analyzed_at_ms,omitempty"`
	// contains filtered or unexported fields
}