protocol

type AbortRequest struct {
	DebugletId string `protobuf:"bytes,1,opt,name=debuglet_id,json=debugletId,proto3" json:"debuglet_id,omitempty"`
	Reason     string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type AbortResponse struct {
	// contains filtered or unexported fields
}

type AddressSelfCheck struct {

	// The executor's local IPv4 source toward the dispatcher is a private
	// (RFC 1918) address; absent when unknown.
	Ipv4LocalPrivate *bool `protobuf:"varint,1,opt,name=ipv4_local_private,json=ipv4LocalPrivate,proto3,oneof" json:"ipv4_local_private,omitempty"`
	// The executor's resolver answered the dispatcher's name with an A (AAAA)
	// record whose address then passed the dispatcher's TLS identity check.
	ResolvesA    bool `protobuf:"varint,2,opt,name=resolves_a,json=resolvesA,proto3" json:"resolves_a,omitempty"`
	ResolvesAaaa bool `protobuf:"varint,3,opt,name=resolves_aaaa,json=resolvesAaaa,proto3" json:"resolves_aaaa,omitempty"`
	// contains filtered or unexported fields
}

type AttributionState struct {
	State            string `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`                                                          // available or unavailable.
	Reason           string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`                                                        // Empty when available; epoch_zero, chain_exhausted, refresh_failing, disclosure_held, clock_unready or clock_drift.
	Epoch            int64  `protobuf:"varint,3,opt,name=epoch,proto3" json:"epoch,omitempty"`                                                         // Current key-schedule epoch.
	InstalledEpoch   *int64 `protobuf:"varint,4,opt,name=installed_epoch,json=installedEpoch,proto3,oneof" json:"installed_epoch,omitempty"`           // Oldest epoch a kernel tagger slot may still sign with; absent when none holds a key.
	LastRefreshAgeMs *int64 `protobuf:"varint,5,opt,name=last_refresh_age_ms,json=lastRefreshAgeMs,proto3,oneof" json:"last_refresh_age_ms,omitempty"` // Since the oldest last successful kernel key install; absent without one.
	RefreshError     string `protobuf:"bytes,6,opt,name=refresh_error,json=refreshError,proto3" json:"refresh_error,omitempty"`                        // Short error of a failing kernel key refresh, at most 128 bytes; empty when none fails.
	DisclosureHeldMs *int64 `protobuf:"varint,7,opt,name=disclosure_held_ms,json=disclosureHeldMs,proto3,oneof" json:"disclosure_held_ms,omitempty"`   // How long an installed key has held disclosure back; absent when not held.
	// contains filtered or unexported fields
}

type BandwidthRequest struct {
	Limits   []*DestinationLimit `protobuf:"bytes,1,rep,name=limits,proto3" json:"limits,omitempty"`
	Revision uint64              `protobuf:"varint,2,opt,name=revision,proto3" json:"revision,omitempty"` // Session-local full snapshot revision; zero is legacy.
	// contains filtered or unexported fields
}

type BandwidthResponse struct {
	Revision uint64 `protobuf:"varint,1,opt,name=revision,proto3" json:"revision,omitempty"` // Latest full snapshot applied by this session.
	// contains filtered or unexported fields
}

type BindSessionRequest struct {
	ExecutorId string `protobuf:"bytes,1,opt,name=executor_id,json=executorId,proto3" json:"executor_id,omitempty"`
	// contains filtered or unexported fields
}

type BindSessionResponse struct {
	LeaseDurationMs int64 `protobuf:"varint,1,opt,name=lease_duration_ms,json=leaseDurationMs,proto3" json:"lease_duration_ms,omitempty"` // Original initial lease; repeats never rearm it.
	// contains filtered or unexported fields
}

type ClockState struct {
	State            string `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`                                                        // synced, unsynced or unknown.
	EstimatedErrorNs *int64 `protobuf:"varint,2,opt,name=estimated_error_ns,json=estimatedErrorNs,proto3,oneof" json:"estimated_error_ns,omitempty"` // Kernel esterror; absent unknown.
	MaxErrorNs       *int64 `protobuf:"varint,3,opt,name=max_error_ns,json=maxErrorNs,proto3,oneof" json:"max_error_ns,omitempty"`                   // Kernel maxerror; absent unknown.
	ErrorBoundNs     int64  `protobuf:"varint,4,opt,name=error_bound_ns,json=errorBoundNs,proto3" json:"error_bound_ns,omitempty"`                   // The operator's configured bound on estimated_error_ns.
	Readiness        string `protobuf:"bytes,5,opt,name=readiness,proto3" json:"readiness,omitempty"`                                                // ready, degraded or unknown.
	Reason           string `protobuf:"bytes,6,opt,name=reason,proto3" json:"reason,omitempty"`                                                      // Empty unless degraded: unsynced or error_exceeds_bound.
	// contains filtered or unexported fields
}

type ConnectivityReport struct {
	Ipv4             *EgressTest          `protobuf:"bytes,1,opt,name=ipv4,proto3" json:"ipv4,omitempty"`
	Ipv6             *EgressTest          `protobuf:"bytes,2,opt,name=ipv6,proto3" json:"ipv6,omitempty"`
	Listeners        []*ListenerChallenge `protobuf:"bytes,3,rep,name=listeners,proto3" json:"listeners,omitempty"`                                        // At most one TCP and one UDP sample.
	ListenersEnabled bool                 `protobuf:"varint,4,opt,name=listeners_enabled,json=listenersEnabled,proto3" json:"listeners_enabled,omitempty"` // False means no connect-back test was requested.
	TcpReason        string               `protobuf:"bytes,5,opt,name=tcp_reason,json=tcpReason,proto3" json:"tcp_reason,omitempty"`                       // disabled or bind_failed when no challenge is present.
	UdpReason        string               `protobuf:"bytes,6,opt,name=udp_reason,json=udpReason,proto3" json:"udp_reason,omitempty"`
	// contains filtered or unexported fields
}

type ControlBinding struct {
	DispatcherIncarnation string `protobuf:"bytes,1,opt,name=dispatcher_incarnation,json=dispatcherIncarnation,proto3" json:"dispatcher_incarnation,omitempty"`
	SessionId             string `protobuf:"bytes,2,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	// contains filtered or unexported fields
}

type DebugletAllocateRequest struct {
	DebugletId    string          `protobuf:"bytes,1,opt,name=debuglet_id,json=debugletId,proto3" json:"debuglet_id,omitempty"`
	ExecutorId    string          `protobuf:"bytes,2,opt,name=executor_id,json=executorId,proto3" json:"executor_id,omitempty"`
	TransactionId string          `protobuf:"bytes,3,opt,name=transaction_id,json=transactionId,proto3" json:"transaction_id,omitempty"`
	Policy        *DebugletPolicy `protobuf:"bytes,4,opt,name=policy,proto3" json:"policy,omitempty"`
	// contains filtered or unexported fields
}

type DebugletAllocateResponse struct {
	AllocatedLimits []*DestinationLimit `protobuf:"bytes,1,rep,name=allocated_limits,json=allocatedLimits,proto3" json:"allocated_limits,omitempty"`
	// contains filtered or unexported fields
}

type DebugletExitRequest struct {
	DebugletId   string  `protobuf:"bytes,1,opt,name=debuglet_id,json=debugletId,proto3" json:"debuglet_id,omitempty"`
	ExitCode     int32   `protobuf:"varint,2,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
	ErrorMessage *string `protobuf:"bytes,3,opt,name=error_message,json=errorMessage,proto3,oneof" json:"error_message,omitempty"`
	// contains filtered or unexported fields
}

type DebugletExitResponse struct {
	// contains filtered or unexported fields
}

type DebugletIdent struct {
	DebugletId      string          `protobuf:"bytes,1,opt,name=debuglet_id,json=debugletId,proto3" json:"debuglet_id,omitempty"`
	ExecutorId      string          `protobuf:"bytes,2,opt,name=executor_id,json=executorId,proto3" json:"executor_id,omitempty"`
	OriginalBinding *ControlBinding `protobuf:"bytes,3,opt,name=original_binding,json=originalBinding,proto3" json:"original_binding,omitempty"`
	// contains filtered or unexported fields
}

type DebugletOutput struct {
	Output    []byte                 `protobuf:"bytes,1,opt,name=output,proto3" json:"output,omitempty"`
	Timestamp *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
	Sequence  int64                  `protobuf:"varint,3,opt,name=sequence,proto3" json:"sequence,omitempty"`
	// contains filtered or unexported fields
}

type DebugletOutputEnd struct {
	LastSequence int64                `protobuf:"varint,1,opt,name=last_sequence,json=lastSequence,proto3" json:"last_sequence,omitempty"`
	Status       DebugletOutputStatus `protobuf:"varint,2,opt,name=status,proto3,enum=debuglet.protocol.DebugletOutputStatus" json:"status,omitempty"`
	Reason       string               `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type DebugletOutputStatus int32

type DebugletPolicy struct {
	FloorBw     int64        `protobuf:"varint,1,opt,name=floor_bw,json=floorBw,proto3" json:"floor_bw,omitempty"`             // min bits/s required
	CeilBw      int64        `protobuf:"varint,2,opt,name=ceil_bw,json=ceilBw,proto3" json:"ceil_bw,omitempty"`                // max bits/s it could use
	TimeoutMs   int64        `protobuf:"varint,3,opt,name=timeout_ms,json=timeoutMs,proto3" json:"timeout_ms,omitempty"`       // timeout in ms
	Addresses   []string     `protobuf:"bytes,4,rep,name=addresses,proto3" json:"addresses,omitempty"`                         // e.g., SCION or network endpoints
	RequireIcmp bool         `protobuf:"varint,5,opt,name=require_icmp,json=requireIcmp,proto3" json:"require_icmp,omitempty"` // whether ICMP is required
	ListenUdp   bool         `protobuf:"varint,6,opt,name=listen_udp,json=listenUdp,proto3" json:"listen_udp,omitempty"`       // whether the debuglet should setup a UDP listening server
	ListenTcp   bool         `protobuf:"varint,7,opt,name=listen_tcp,json=listenTcp,proto3" json:"listen_tcp,omitempty"`       // whether the debuglet should setup a TCP listening server
	ListenScion bool         `protobuf:"varint,8,opt,name=listen_scion,json=listenScion,proto3" json:"listen_scion,omitempty"` // whether the debuglet should setup a SCION listening server
	EgressGrant *EgressGrant `protobuf:"bytes,9,opt,name=egress_grant,json=egressGrant,proto3" json:"egress_grant,omitempty"`
	// contains filtered or unexported fields
}

type DebugletStateRequest struct {
	DebugletId  string            `protobuf:"bytes,1,opt,name=debuglet_id,json=debugletId,proto3" json:"debuglet_id,omitempty"`
	ExecutorId  string            `protobuf:"bytes,2,opt,name=executor_id,json=executorId,proto3" json:"executor_id,omitempty"`
	State       RunState          `protobuf:"varint,3,opt,name=state,proto3,enum=debuglet.protocol.RunState" json:"state,omitempty"`
	TcpListener *ListenerEndpoint `protobuf:"bytes,4,opt,name=tcp_listener,json=tcpListener,proto3" json:"tcp_listener,omitempty"` // Bound run listener; not evidence of external reachability.
	// contains filtered or unexported fields
}

type DebugletStateResponse struct {
	// contains filtered or unexported fields
}

type DebugletStreamRequest struct {

	// Types that are valid to be assigned to Msg:
	//
	//	*DebugletStreamRequest_Ident
	//	*DebugletStreamRequest_Output
	//	*DebugletStreamRequest_End
	Msg isDebugletStreamRequest_Msg `protobuf_oneof:"msg"`
	// contains filtered or unexported fields
}

type DebugletStreamRequest_End struct {
	End *DebugletOutputEnd `protobuf:"bytes,3,opt,name=end,proto3,oneof"`
}

type DebugletStreamRequest_Ident struct {
	Ident *DebugletIdent `protobuf:"bytes,1,opt,name=ident,proto3,oneof"`
}

type DebugletStreamRequest_Output struct {
	Output *DebugletOutput `protobuf:"bytes,2,opt,name=output,proto3,oneof"`
}

type DebugletStreamResponse struct {
	CommittedSequence int64              `protobuf:"varint,1,opt,name=committed_sequence,json=committedSequence,proto3" json:"committed_sequence,omitempty"`
	End               *DebugletOutputEnd `protobuf:"bytes,2,opt,name=end,proto3" json:"end,omitempty"`
	// contains filtered or unexported fields
}

type DestinationLimit struct {
	Address   string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
	BitsLimit int64  `protobuf:"varint,2,opt,name=bits_limit,json=bitsLimit,proto3" json:"bits_limit,omitempty"`
	Denied    bool   `protobuf:"varint,3,opt,name=denied,proto3" json:"denied,omitempty"` // The destination is opted out: refuse new connections and close active ones.
	// contains filtered or unexported fields
}

type DisclosureDeliveryObservation struct {
	Anchor             []byte `protobuf:"bytes,1,opt,name=anchor,proto3" json:"anchor,omitempty"`
	StoredThroughEpoch int64  `protobuf:"varint,2,opt,name=stored_through_epoch,json=storedThroughEpoch,proto3" json:"stored_through_epoch,omitempty"`
	ScheduledToAckNs   int64  `protobuf:"varint,3,opt,name=scheduled_to_ack_ns,json=scheduledToAckNs,proto3" json:"scheduled_to_ack_ns,omitempty"`
	SampleAgeNs        int64  `protobuf:"varint,4,opt,name=sample_age_ns,json=sampleAgeNs,proto3" json:"sample_age_ns,omitempty"` // Actual monotonic age; repeating a report never refreshes it.
	// contains filtered or unexported fields
}

type DispatcherServiceClient interface {
	// Optional address reflection on this dispatcher's authenticated listener.
	// It returns only the caller's peer address; it cannot initiate a connection.
	ReflectAddress(ctx context.Context, in *ReflectAddressRequest, opts ...grpc.CallOption) (*ReflectAddressResponse, error)
	Heartbeat(ctx context.Context, in *HeartbeatRequest, opts ...grpc.CallOption) (*HeartbeatResponse, error)
	Resources(ctx context.Context, in *ResourcesRequest, opts ...grpc.CallOption) (*ResourcesResponse, error)
	DebugletState(ctx context.Context, in *DebugletStateRequest, opts ...grpc.CallOption) (*DebugletStateResponse, error)
	// Request resource allocation before a debuglet starts. The dispatcher can then have the caller wait until the resources have been allocated.
	DebugletAllocate(ctx context.Context, in *DebugletAllocateRequest, opts ...grpc.CallOption) (*DebugletAllocateResponse, error)
	ExperimentReady(ctx context.Context, in *ExperimentReadyRequest, opts ...grpc.CallOption) (*ExperimentReadyResponse, error)
	DebugletExit(ctx context.Context, in *DebugletExitRequest, opts ...grpc.CallOption) (*DebugletExitResponse, error)
	DebugletStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[DebugletStreamRequest, DebugletStreamResponse], error)
	BindSession(ctx context.Context, in *BindSessionRequest, opts ...grpc.CallOption) (*BindSessionResponse, error)
	RenewLease(ctx context.Context, in *RenewLeaseRequest, opts ...grpc.CallOption) (*RenewLeaseResponse, error)
}

type DispatcherServiceServer interface {
	// Optional address reflection on this dispatcher's authenticated listener.
	// It returns only the caller's peer address; it cannot initiate a connection.
	ReflectAddress(context.Context, *ReflectAddressRequest) (*ReflectAddressResponse, error)
	Heartbeat(context.Context, *HeartbeatRequest) (*HeartbeatResponse, error)
	Resources(context.Context, *ResourcesRequest) (*ResourcesResponse, error)
	DebugletState(context.Context, *DebugletStateRequest) (*DebugletStateResponse, error)
	// Request resource allocation before a debuglet starts. The dispatcher can then have the caller wait until the resources have been allocated.
	DebugletAllocate(context.Context, *DebugletAllocateRequest) (*DebugletAllocateResponse, error)
	ExperimentReady(context.Context, *ExperimentReadyRequest) (*ExperimentReadyResponse, error)
	DebugletExit(context.Context, *DebugletExitRequest) (*DebugletExitResponse, error)
	DebugletStream(grpc.BidiStreamingServer[DebugletStreamRequest, DebugletStreamResponse]) error
	BindSession(context.Context, *BindSessionRequest) (*BindSessionResponse, error)
	RenewLease(context.Context, *RenewLeaseRequest) (*RenewLeaseResponse, error)
	// contains filtered or unexported methods
}

type DispatcherService_DebugletStreamClient = grpc.BidiStreamingClient[DebugletStreamRequest, DebugletStreamResponse]

type DispatcherService_DebugletStreamServer = grpc.BidiStreamingServer[DebugletStreamRequest, DebugletStreamResponse]

type EgressGrant struct {
	Version           uint32   `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	BitsPerSecond     int64    `protobuf:"varint,2,opt,name=bits_per_second,json=bitsPerSecond,proto3" json:"bits_per_second,omitempty"`
	BurstBytes        int64    `protobuf:"varint,3,opt,name=burst_bytes,json=burstBytes,proto3" json:"burst_bytes,omitempty"`
	Bytes             int64    `protobuf:"varint,4,opt,name=bytes,proto3" json:"bytes,omitempty"`
	AttemptsPerSecond int64    `protobuf:"varint,5,opt,name=attempts_per_second,json=attemptsPerSecond,proto3" json:"attempts_per_second,omitempty"`
	AttemptBurst      int64    `protobuf:"varint,6,opt,name=attempt_burst,json=attemptBurst,proto3" json:"attempt_burst,omitempty"`
	Attempts          int64    `protobuf:"varint,7,opt,name=attempts,proto3" json:"attempts,omitempty"`
	Addresses         []string `protobuf:"bytes,8,rep,name=addresses,proto3" json:"addresses,omitempty"` // Normalized address literals pinned by admission.
	NotBeforeUnix     int64    `protobuf:"varint,9,opt,name=not_before_unix,json=notBeforeUnix,proto3" json:"not_before_unix,omitempty"`
	ExpiresUnix       int64    `protobuf:"varint,10,opt,name=expires_unix,json=expiresUnix,proto3" json:"expires_unix,omitempty"`
	// contains filtered or unexported fields
}

type EgressTest struct {
	State  string `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"` // reachable, unreachable or untested.
	Reason string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
	Nonce  []byte `protobuf:"bytes,3,opt,name=nonce,proto3" json:"nonce,omitempty"` // Correlated with a directly received ReflectAddress call.
	// contains filtered or unexported fields
}

type ExecutorCapabilities struct {
	SchemaVersion   uint32   `protobuf:"varint,1,opt,name=schema_version,json=schemaVersion,proto3" json:"schema_version,omitempty"`
	Protocols       []string `protobuf:"bytes,2,rep,name=protocols,proto3" json:"protocols,omitempty"`
	EnforcementMode string   `protobuf:"bytes,3,opt,name=enforcement_mode,json=enforcementMode,proto3" json:"enforcement_mode,omitempty"` // Actual packet counter: ebpf or fallback; empty unknown.
	// Additive within schema version 1: absent from older executors, which
	// leaves attribution unknown.
	Attribution *AttributionState `protobuf:"bytes,4,opt,name=attribution,proto3" json:"attribution,omitempty"`
	// Additive within schema version 1: absent from older executors, which
	// leaves the tagging mode unknown.
	Tagging *TaggingMode `protobuf:"bytes,5,opt,name=tagging,proto3" json:"tagging,omitempty"`
	// Additive within schema version 1; empty or absent is unknown.
	// Why the counter is fallback: configured, no_interface, not_permitted,
	// unsupported or attach_failed. Empty when enforcement_mode is ebpf.
	EnforcementReason string      `protobuf:"bytes,6,opt,name=enforcement_reason,json=enforcementReason,proto3" json:"enforcement_reason,omitempty"`
	Icmp              *ProbeState `protobuf:"bytes,7,opt,name=icmp,proto3" json:"icmp,omitempty"` // Raw ICMPv4 socket probe of this process.
	// contains filtered or unexported fields
}

type ExecutorServiceClient interface {
	Hello(ctx context.Context, in *HelloRequest, opts ...grpc.CallOption) (*HelloResponse, error)
	Upload(ctx context.Context, in *UploadRequest, opts ...grpc.CallOption) (*UploadResponse, error)
	Abort(ctx context.Context, in *AbortRequest, opts ...grpc.CallOption) (*AbortResponse, error)
	Bandwidth(ctx context.Context, in *BandwidthRequest, opts ...grpc.CallOption) (*BandwidthResponse, error)
	ProbeSession(ctx context.Context, in *ProbeSessionRequest, opts ...grpc.CallOption) (*ProbeSessionResponse, error)
	// Optional. Reads one retained run without scheduling, starting, finalizing
	// or deleting it. An executor without inspection answers UNIMPLEMENTED,
	// which is never a missing-row answer.
	InspectRetainedRun(ctx context.Context, in *InspectRetainedRunRequest, opts ...grpc.CallOption) (*InspectRetainedRunResponse, error)
	VerifyTags(ctx context.Context, in *VerifyTagsRequest, opts ...grpc.CallOption) (*VerifyTagsResponse, error)
}

type ExecutorServiceServer interface {
	Hello(context.Context, *HelloRequest) (*HelloResponse, error)
	Upload(context.Context, *UploadRequest) (*UploadResponse, error)
	Abort(context.Context, *AbortRequest) (*AbortResponse, error)
	Bandwidth(context.Context, *BandwidthRequest) (*BandwidthResponse, error)
	ProbeSession(context.Context, *ProbeSessionRequest) (*ProbeSessionResponse, error)
	// Optional. Reads one retained run without scheduling, starting, finalizing
	// or deleting it. An executor without inspection answers UNIMPLEMENTED,
	// which is never a missing-row answer.
	InspectRetainedRun(context.Context, *InspectRetainedRunRequest) (*InspectRetainedRunResponse, error)
	VerifyTags(context.Context, *VerifyTagsRequest) (*VerifyTagsResponse, error)
	// contains filtered or unexported methods
}

type ExperimentParticipant struct {
	Id         string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	ExecutorId string `protobuf:"bytes,2,opt,name=executor_id,json=executorId,proto3" json:"executor_id,omitempty"`
	Metadata   []byte `protobuf:"bytes,3,opt,name=metadata,proto3" json:"metadata,omitempty"`
	ReadyAtNs  int64  `protobuf:"varint,4,opt,name=ready_at_ns,json=readyAtNs,proto3" json:"ready_at_ns,omitempty"`
	// contains filtered or unexported fields
}

type ExperimentReadyRequest struct {
	DebugletId string `protobuf:"bytes,1,opt,name=debuglet_id,json=debugletId,proto3" json:"debuglet_id,omitempty"`
	ExecutorId string `protobuf:"bytes,2,opt,name=executor_id,json=executorId,proto3" json:"executor_id,omitempty"`
	Metadata   []byte `protobuf:"bytes,3,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// contains filtered or unexported fields
}

type ExperimentReadyResponse struct {
	ExperimentId string                   `protobuf:"bytes,1,opt,name=experiment_id,json=experimentId,proto3" json:"experiment_id,omitempty"`
	StartTimeNs  int64                    `protobuf:"varint,2,opt,name=start_time_ns,json=startTimeNs,proto3" json:"start_time_ns,omitempty"` // Zero means pending; callers poll without holding a mutation.
	Participants []*ExperimentParticipant `protobuf:"bytes,3,rep,name=participants,proto3" json:"participants,omitempty"`
	// contains filtered or unexported fields
}

type HeartbeatRequest struct {
	ExecutorId    string                `protobuf:"bytes,1,opt,name=executor_id,json=executorId,proto3" json:"executor_id,omitempty"`
	TimestampNs   int64                 `protobuf:"varint,2,opt,name=timestamp_ns,json=timestampNs,proto3" json:"timestamp_ns,omitempty"`
	TeslaKeyEpoch int64                 `protobuf:"varint,3,opt,name=tesla_key_epoch,json=teslaKeyEpoch,proto3" json:"tesla_key_epoch,omitempty"`
	TeslaKey      []byte                `protobuf:"bytes,4,opt,name=tesla_key,json=teslaKey,proto3" json:"tesla_key,omitempty"`
	Capabilities  *ExecutorCapabilities `protobuf:"bytes,5,opt,name=capabilities,proto3" json:"capabilities,omitempty"`                     // Absent means no new observation.
	VantagePoint  *VantagePointReport   `protobuf:"bytes,6,opt,name=vantage_point,json=vantagePoint,proto3" json:"vantage_point,omitempty"` // Absent means no new observation.
	// Anchor k_0 of the chain tesla_key belongs to. Empty means the chain this
	// session announced in its hello. A different anchor names an earlier chain
	// of this executor that the dispatcher has on record, so the tail of a chain
	// can still be disclosed after the executor restarted onto a new one.
	TeslaKeyAnchor []byte `protobuf:"bytes,7,opt,name=tesla_key_anchor,json=teslaKeyAnchor,proto3" json:"tesla_key_anchor,omitempty"`
	// Keys of earlier chains of this executor that are due now, beside the
	// current chain's key above: after a restart, the tail of the chain it
	// retired. Each names its chain by anchor, as tesla_key_anchor does.
	ExtraDisclosures []*TeslaDisclosure `protobuf:"bytes,8,rep,name=extra_disclosures,json=extraDisclosures,proto3" json:"extra_disclosures,omitempty"`
	// contains filtered or unexported fields
}

type HeartbeatResponse struct {

	// At most the current disclosure plus four requested earlier chains.
	DisclosureReceipts []*TeslaDisclosureReceipt `protobuf:"bytes,1,rep,name=disclosure_receipts,json=disclosureReceipts,proto3" json:"disclosure_receipts,omitempty"`
	// contains filtered or unexported fields
}

type HelloRequest struct {
	ControlVersion        uint32 `protobuf:"varint,1,opt,name=control_version,json=controlVersion,proto3" json:"control_version,omitempty"`
	DispatcherIncarnation string `protobuf:"bytes,2,opt,name=dispatcher_incarnation,json=dispatcherIncarnation,proto3" json:"dispatcher_incarnation,omitempty"`
	SessionId             string `protobuf:"bytes,3,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	SessionToken          []byte `protobuf:"bytes,4,opt,name=session_token,json=sessionToken,proto3" json:"session_token,omitempty"`             // Private offer token; never persist or log.
	LeaseDurationMs       int64  `protobuf:"varint,5,opt,name=lease_duration_ms,json=leaseDurationMs,proto3" json:"lease_duration_ms,omitempty"` // Strict v3 control lease; receiver clocks only.
	OutputVersion         uint32 `protobuf:"varint,6,opt,name=output_version,json=outputVersion,proto3" json:"output_version,omitempty"`
	// contains filtered or unexported fields
}

type HelloResponse struct {
	ExecutorId             string `protobuf:"bytes,1,opt,name=executor_id,json=executorId,proto3" json:"executor_id,omitempty"`             // Unique ID for this executor instance
	Version                string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`                                     // Optional: software version or capabilities
	SourceIp               string `protobuf:"bytes,3,opt,name=source_ip,json=sourceIp,proto3" json:"source_ip,omitempty"`                   // Source IP for packet attribution
	TeslaDelaySec          int64  `protobuf:"varint,4,opt,name=tesla_delay_sec,json=teslaDelaySec,proto3" json:"tesla_delay_sec,omitempty"` // TESLA epoch length I in seconds (historical name; not the disclosure delay)
	TeslaAnchorTimestampNs int64  ``                                                                                                        // Reference wall-clock time for epoch 0
	/* 132-byte string literal not displayed */
	TeslaAnchorKey        []byte  `protobuf:"bytes,6,opt,name=tesla_anchor_key,json=teslaAnchorKey,proto3" json:"tesla_anchor_key,omitempty"` // Public anchor k_0 = H^L(seed); used to verify disclosed keys
	IcmpEnabled           bool    `protobuf:"varint,7,opt,name=icmp_enabled,json=icmpEnabled,proto3" json:"icmp_enabled,omitempty"`           // Whether the executor can handle ICMP packets
	PricePerBwS           int64   `protobuf:"varint,8,opt,name=price_per_bw_s,json=pricePerBwS,proto3" json:"price_per_bw_s,omitempty"`       // Price per bit/s of bandwidth
	Currency              string  `protobuf:"bytes,9,opt,name=currency,proto3" json:"currency,omitempty"`
	PublicHost            *string `protobuf:"bytes,10,opt,name=public_host,json=publicHost,proto3,oneof" json:"public_host,omitempty"` // Optional: public host for the executor at which debuglet listeners can be contacted
	SuiWallet             *string `protobuf:"bytes,11,opt,name=sui_wallet,json=suiWallet,proto3,oneof" json:"sui_wallet,omitempty"`
	ControlVersion        uint32  `protobuf:"varint,12,opt,name=control_version,json=controlVersion,proto3" json:"control_version,omitempty"`                     // Selected control protocol version
	DispatcherIncarnation string  `protobuf:"bytes,13,opt,name=dispatcher_incarnation,json=dispatcherIncarnation,proto3" json:"dispatcher_incarnation,omitempty"` // Echoed dispatcher identity
	SessionId             string  `protobuf:"bytes,14,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`                                     // Echoed session identity
	LeaseDurationMs       int64   `protobuf:"varint,15,opt,name=lease_duration_ms,json=leaseDurationMs,proto3" json:"lease_duration_ms,omitempty"`                // Exact echo of the offered duration.
	// Single-use enrollment credential, presented only until this node's
	// certificate is bound to its executor ID. Never persist or log it.
	EnrollmentToken *string               `protobuf:"bytes,16,opt,name=enrollment_token,json=enrollmentToken,proto3,oneof" json:"enrollment_token,omitempty"`
	OutputVersion   uint32                `protobuf:"varint,17,opt,name=output_version,json=outputVersion,proto3" json:"output_version,omitempty"`
	Capabilities    *ExecutorCapabilities `protobuf:"bytes,18,opt,name=capabilities,proto3" json:"capabilities,omitempty"`                     // Optional additive discovery observation.
	VantagePoint    *VantagePointReport   `protobuf:"bytes,19,opt,name=vantage_point,json=vantagePoint,proto3" json:"vantage_point,omitempty"` // Optional; sent with capabilities.
	// TESLA disclosure delay d: the key of epoch i is disclosed once epoch i+d
	// starts, at tesla_anchor_timestamp_ns + (i+d)*tesla_delay_sec. At least 2;
	// zero from an executor that predates it, which disclosed after one epoch.
	TeslaDisclosureDelayEpochs int64 `` /* 145-byte string literal not displayed */
	// TESLA chain length L: the chain serves epochs below it. Zero from an
	// executor that predates it; the schedule's length is then unknown.
	TeslaChainLength    int64  `protobuf:"varint,21,opt,name=tesla_chain_length,json=teslaChainLength,proto3" json:"tesla_chain_length,omitempty"`
	TeslaScheduleProof  []byte `protobuf:"bytes,23,opt,name=tesla_schedule_proof,json=teslaScheduleProof,proto3" json:"tesla_schedule_proof,omitempty"`     // JSON AttributionScheduleProof signed by the enrolled TLS identity.
	BandwidthVersion    uint32 `protobuf:"varint,22,opt,name=bandwidth_version,json=bandwidthVersion,proto3" json:"bandwidth_version,omitempty"`            // 1 supports ordered full allocation snapshots; 2 also applies DestinationLimit.denied before acknowledging.
	EgressBudgetVersion uint32 `protobuf:"varint,24,opt,name=egress_budget_version,json=egressBudgetVersion,proto3" json:"egress_budget_version,omitempty"` // 1 enforces an immutable aggregate egress grant.
	// contains filtered or unexported fields
}

type HostPlatform struct {
	Os            string  `protobuf:"bytes,1,opt,name=os,proto3" json:"os,omitempty"`                                             // Go GOOS.
	Arch          string  `protobuf:"bytes,2,opt,name=arch,proto3" json:"arch,omitempty"`                                         // Go GOARCH.
	KernelRelease string  `protobuf:"bytes,3,opt,name=kernel_release,json=kernelRelease,proto3" json:"kernel_release,omitempty"`  // uname release.
	Cpus          uint32  `protobuf:"varint,4,opt,name=cpus,proto3" json:"cpus,omitempty"`                                        // Logical CPUs usable by the process.
	MemoryBytes   *uint64 `protobuf:"varint,5,opt,name=memory_bytes,json=memoryBytes,proto3,oneof" json:"memory_bytes,omitempty"` // Total physical memory.
	BuildVersion  string  `protobuf:"bytes,6,opt,name=build_version,json=buildVersion,proto3" json:"build_version,omitempty"`     // Executor build version.
	// contains filtered or unexported fields
}

type HostResourceValue struct {
	Value       *uint64 `protobuf:"varint,1,opt,name=value,proto3,oneof" json:"value,omitempty"`
	Unavailable string  `protobuf:"bytes,2,opt,name=unavailable,proto3" json:"unavailable,omitempty"` // missing, permission, read, limit, invalid or unsupported; empty with value.
	// contains filtered or unexported fields
}

type HostResources struct {
	ProcessRssBytes     *HostResourceValue `protobuf:"bytes,1,opt,name=process_rss_bytes,json=processRssBytes,proto3" json:"process_rss_bytes,omitempty"`
	OpenFds             *HostResourceValue `protobuf:"bytes,2,opt,name=open_fds,json=openFds,proto3" json:"open_fds,omitempty"`
	StateAvailableBytes *HostResourceValue `protobuf:"bytes,3,opt,name=state_available_bytes,json=stateAvailableBytes,proto3" json:"state_available_bytes,omitempty"`
	StateCapacityBytes  *HostResourceValue `protobuf:"bytes,4,opt,name=state_capacity_bytes,json=stateCapacityBytes,proto3" json:"state_capacity_bytes,omitempty"`
	// contains filtered or unexported fields
}

type InspectRetainedRunRequest struct {
	DebugletId     string          `protobuf:"bytes,1,opt,name=debuglet_id,json=debugletId,proto3" json:"debuglet_id,omitempty"`
	ControlBinding *ControlBinding `protobuf:"bytes,2,opt,name=control_binding,json=controlBinding,proto3" json:"control_binding,omitempty"` // The caller's own current session.
	// contains filtered or unexported fields
}

type InspectRetainedRunResponse struct {
	Status RetainedRunStatus `protobuf:"varint,1,opt,name=status,proto3,enum=debuglet.protocol.RetainedRunStatus" json:"status,omitempty"`
	Run    *RetainedRun      `protobuf:"bytes,2,opt,name=run,proto3,oneof" json:"run,omitempty"` // Present exactly when status is FOUND.
	// contains filtered or unexported fields
}

type ListenerChallenge struct {
	Transport string `protobuf:"bytes,1,opt,name=transport,proto3" json:"transport,omitempty"` // tcp or udp.
	Port      uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`          // Sampled from the executor's actual guest listener pool.
	Token     []byte `protobuf:"bytes,3,opt,name=token,proto3" json:"token,omitempty"`         // 32 random bytes proving this temporary listener; never published.
	// contains filtered or unexported fields
}

type ListenerEndpoint struct {
	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
	// contains filtered or unexported fields
}

type NetworkDenials struct {
	RefusedAdmissions uint64 `protobuf:"varint,1,opt,name=refused_admissions,json=refusedAdmissions,proto3" json:"refused_admissions,omitempty"`
	RevokedSockets    uint64 `protobuf:"varint,2,opt,name=revoked_sockets,json=revokedSockets,proto3" json:"revoked_sockets,omitempty"`
	// contains filtered or unexported fields
}

type PacketDropObservations struct {
	IngressVerdicts uint64 `protobuf:"varint,1,opt,name=ingress_verdicts,json=ingressVerdicts,proto3" json:"ingress_verdicts,omitempty"`
	IngressSkbBytes uint64 `protobuf:"varint,2,opt,name=ingress_skb_bytes,json=ingressSkbBytes,proto3" json:"ingress_skb_bytes,omitempty"`
	EgressVerdicts  uint64 `protobuf:"varint,3,opt,name=egress_verdicts,json=egressVerdicts,proto3" json:"egress_verdicts,omitempty"`
	EgressSkbBytes  uint64 `protobuf:"varint,4,opt,name=egress_skb_bytes,json=egressSkbBytes,proto3" json:"egress_skb_bytes,omitempty"`
	// contains filtered or unexported fields
}

type ProbeSessionRequest struct {
	Sequence uint64 `protobuf:"varint,1,opt,name=sequence,proto3" json:"sequence,omitempty"`
	// contains filtered or unexported fields
}

type ProbeSessionResponse struct {
	Sequence uint64 `protobuf:"varint,1,opt,name=sequence,proto3" json:"sequence,omitempty"`
	// contains filtered or unexported fields
}

type ProbeState struct {
	State  string `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`   // available or unavailable.
	Reason string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"` // Empty when available; disabled, not_permitted, ping_socket_only or unsupported.
	// contains filtered or unexported fields
}

type ReflectAddressRequest struct {
	ExecutorId string `protobuf:"bytes,1,opt,name=executor_id,json=executorId,proto3" json:"executor_id,omitempty"`
	Nonce      []byte `protobuf:"bytes,2,opt,name=nonce,proto3" json:"nonce,omitempty"` // 32 random bytes linking this receipt to one report; never published.
	// contains filtered or unexported fields
}

type ReflectAddressResponse struct {
	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
	// contains filtered or unexported fields
}