task

type Autonomy struct {
	Level  Level   `yaml:"level,omitempty" json:"level,omitempty"`
	Grants []Grant `yaml:"grants,omitempty" json:"grants,omitempty"`
}

type Capability struct {
	// DenyTools are tool names or toolset names the child must not have.
	DenyTools []string
	// DenyCommands are shell command patterns the child may not run, matched
	// against the AST (see permissions.DeniedBy) so wrappers cannot smuggle one.
	DenyCommands []string
	// ProtectProject means the run must not execute in the user's checkout.
	// The runner satisfies it with a throwaway worktree, which is what makes
	// "read-only" mean "cannot change YOUR project" rather than the impractical
	// "performs no writes anywhere" — builds and tests write caches and temp
	// files constantly, and forbidding that would forbid the work.
	ProtectProject bool
	// Mutating reports whether this run may change project state at all. Drives
	// worktree retention and the concurrency lease.
	Mutating bool
}

type Concurrency struct {
	Key    string            `yaml:"key,omitempty" json:"key,omitempty"`
	Policy ConcurrencyPolicy `yaml:"policy,omitempty" json:"policy,omitempty"`
}

type ConcurrencyPolicy string

type Coordination string

type Delivery struct {
	Desktop Notify `yaml:"desktop,omitempty" json:"desktop,omitempty"`
	// Channel reuses the gateway's existing "channel:conversation" address when
	// the user has one paired. Empty means inbox only.
	Channel   string `yaml:"channel,omitempty" json:"channel,omitempty"`
	ChannelOn Notify `yaml:"channel_on,omitempty" json:"channel_on,omitempty"`
}

type Execution struct {
	// Steps are the mechanical part of the job, worked out when the task was
	// SET UP rather than learned from it later. The design phase already runs
	// the work once to validate it, and that run is where it becomes obvious
	// which commands are deterministic — `go get -u ./...`, fetch, normalise,
	// build — and which needed someone to think.
	//
	// A run does the mechanical part directly and pays no model for it. If the
	// steps do everything the goal needed and nothing changed, the run is over
	// and no agent starts at all: the common Monday costs nothing.
	//
	// They are an OPTIMISATION and never the definition. A step that fails is
	// drift, not a verdict — the agent takes over and works out the current
	// state. Nothing here can make a run succeed; only verification does that.
	Steps []string `yaml:"steps,omitempty" json:"steps,omitempty"`
	// KnownGood records an approach that WORKED once, with the date it worked.
	// It is a hint and never the definition: a repository drifts, and a run
	// that treats last quarter's steps as authoritative will confidently do the
	// wrong thing. A run starts here and checks whether the assumptions still
	// hold before relying on any of it.
	KnownGood string `yaml:"known_good,omitempty" json:"known_good,omitempty"`
}

type Git struct {
	Worktree    *bool  `yaml:"worktree,omitempty" json:"worktree,omitempty"`
	PullRequest PRMode `yaml:"pull_request,omitempty" json:"pull_request,omitempty"`
	Branch      string `yaml:"branch,omitempty" json:"branch,omitempty"`
	// Remote is where a branch is published. Default origin.
	Remote string `yaml:"remote,omitempty" json:"remote,omitempty"`
}

type Grant string

type Level string

type Limits struct {
	Timeout    string  `yaml:"timeout,omitempty" json:"timeout,omitempty"`
	MaxCostUSD float64 `yaml:"max_cost_usd,omitempty" json:"max_cost_usd,omitempty"`
}

type Missed string

type Notify string

type OnPush struct {
	Branch string `yaml:"branch,omitempty" json:"branch,omitempty"`
}

type Ownership struct {
	// Projects are the checkouts this responsibility spans. Empty means the
	// task's own Project and nothing else, which is the common case.
	Projects []string `yaml:"projects,omitempty" json:"projects,omitempty"`

	// Coordination decides what happens when the work succeeds in some
	// projects and not others. This is a real product decision, not a detail:
	// "PR opened in repo A" while repo B could not be updated is a WORSE
	// outcome than doing nothing, if the two changes only make sense together.
	Coordination Coordination `yaml:"coordination,omitempty" json:"coordination,omitempty"`

	// Responsibility states what this task is responsible FOR, independently of
	// today's file layout. It is what a run judges its own share against when
	// the repository has moved under it.
	//
	// It is NOT a licence to go looking for more projects. The approved project
	// set is fixed at creation and changes only when the user changes the
	// automation. Drift is allowed WITHIN an approved boundary — paths, build
	// commands, package managers, moved code, refactors, whatever the run finds
	// there. Expanding the boundary is not drift; it is new authority, and
	// authority comes from a person.
	//
	// So if the responsibility grows into a repository nobody approved, the run
	// stops and says so. Discovery is not authorization, the same way a login
	// found in another tool's files is not consent to use it.
	Responsibility string `yaml:"responsibility,omitempty" json:"responsibility,omitempty"`
}

type PRMode string

type Runtime struct {
	Strategy string   `yaml:"strategy,omitempty" json:"strategy,omitempty"`
	Allowed  []string `yaml:"allowed,omitempty" json:"allowed,omitempty"`
	Model    string   `yaml:"model,omitempty" json:"model,omitempty"`
	Fallback []string `yaml:"fallback,omitempty" json:"fallback,omitempty"`
}

type Scope string

type Task struct {
	Version      int         `yaml:"version" json:"version"`
	Name         string      `yaml:"name" json:"name"`
	Description  string      `yaml:"description,omitempty" json:"description,omitempty"`
	Enabled      *bool       `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	Project      string      `yaml:"project,omitempty" json:"project,omitempty"`
	Ownership    Ownership   `yaml:"ownership,omitempty" json:"ownership"`
	Triggers     []Trigger   `yaml:"triggers,omitempty" json:"triggers,omitempty"`
	Instructions string      `yaml:"instructions" json:"instructions"`
	Execution    Execution   `yaml:"execution,omitempty" json:"execution"`
	Runtime      Runtime     `yaml:"runtime,omitempty" json:"runtime"`
	Autonomy     Autonomy    `yaml:"autonomy,omitempty" json:"autonomy"`
	Git          Git         `yaml:"git,omitempty" json:"git"`
	Verify       Verify      `yaml:"verify,omitempty" json:"verify"`
	Delivery     Delivery    `yaml:"delivery,omitempty" json:"delivery"`
	Limits       Limits      `yaml:"limits,omitempty" json:"limits"`
	Concurrency  Concurrency `yaml:"concurrency,omitempty" json:"concurrency"`

	// Resolved by the loader, never authored and never hashed.
	Path  string `yaml:"-" json:"-"`
	Scope Scope  `yaml:"-" json:"-"`
}

type Trigger struct {
	Cron  string `yaml:"cron,omitempty" json:"cron,omitempty"`
	Every string `yaml:"every,omitempty" json:"every,omitempty"`
	At    string `yaml:"at,omitempty" json:"at,omitempty"`
	// TZ evaluates Cron in a named zone ("America/Los_Angeles"); empty = local.
	TZ string `yaml:"tz,omitempty" json:"tz,omitempty"`
	// Missed decides what happens when the daemon was not running at the moment
	// this trigger was due. Meaningless for Manual.
	Missed Missed `yaml:"missed,omitempty" json:"missed,omitempty"`
	// MaxCatchUp bounds how many missed occurrences catch_up will actually run.
	// Without a bound, a laptop returning after months with an hourly task would
	// enqueue thousands of historical runs at once. Ignored unless Missed is
	// catch_up; the excess is dropped newest-first-kept and surfaced on the run.
	MaxCatchUp int `yaml:"max_catch_up,omitempty" json:"max_catch_up,omitempty"`
	// Manual is an explicit "this trigger only fires by hand". A task with no
	// triggers at all is already manual-only; this exists so a file can say so.
	Manual bool `yaml:"manual,omitempty" json:"manual,omitempty"`

	// Reserved kinds. Declared so an author who writes one gets a clear "not
	// implemented yet" instead of an unknown-field parse error, and so the
	// schema slot is taken.
	OnPush  *OnPush  `yaml:"on_push,omitempty" json:"on_push,omitempty"`
	Webhook *Webhook `yaml:"webhook,omitempty" json:"webhook,omitempty"`
}

type Verify struct {
	Commands []string `yaml:"commands,omitempty" json:"commands,omitempty"`

	// Across are checks that run ONCE, after every project has done its share,
	// to test that the projects still agree with each other. Per-project checks
	// cannot answer that: each side can be internally perfect and the pair
	// still inconsistent, which on a cross-cutting change is precisely the
	// failure worth catching. They run in the anchor project's working copy
	// with MEMCODE_TASK_PROJECTS listing every project's working copy.
	Across []string `yaml:"across,omitempty" json:"across,omitempty"`
}

type Webhook struct {
	Secret string `yaml:"secret,omitempty" json:"secret,omitempty"`
}