server

type ACPEnvironmentOverlay func(session.SessionID, tool.Environment) (tool.Environment, error)

type AccessKind int

type ActivityGapError struct{}

type ActivityReplayStatus struct {
	Available     bool
	Complete      bool
	Authoritative bool
}

type AgentDefSessionEngineFactory func(ctx context.Context, sel ProviderSelector, profile SessionProfile, mode session.PermissionMode, limits session.Limits, defName string) (SessionEngineResult, error)

type AgentDefSessionSelection struct {
	Name   string
	Limits session.Limits
}

type Authenticator struct {
	// contains filtered or unexported fields
}

type AuthorizationTimer interface{ Stop() bool }

type AuthorizationTimerFactory func(time.Duration, func()) AuthorizationTimer

type CORSPolicy struct {
	// contains filtered or unexported fields
}

type CapabilityReason string

type ClassificationEntry struct {
	Kind      AccessKind
	Rationale string
}

type CleanupCandidate struct {
	ID             session.SessionID
	Kind           session.SessionKind
	State          session.State
	Reason         string
	ModifiedAt     time.Time
	EstimatedBytes int64
	// contains filtered or unexported fields
}

type CleanupCounts struct {
	Total    int
	ByKind   map[string]int
	ByState  map[string]int
	ByReason map[string]int
}

type CleanupItemError struct {
	ItemHandle string
	ReasonCode string
	Message    string
}

type CleanupJob struct {
	ID        string
	State     string
	Processed int
	Deleted   int
	Skipped   int
	Stale     int
	Failed    int
	Errors    []CleanupItemError
}

type CleanupPlan struct {
	Token             string
	JobID             string
	Available         bool
	UnavailableReason string
	Generation        string
	PolicyVersion     string
	Eligible          []CleanupCandidate
	EligibleCounts    CleanupCounts
	Protected         CleanupCounts
	EstimatedBytes    int64
}

type CleanupScope struct {
	Kinds []session.SessionKind
}

type ClientMCPGrant struct {
	// contains filtered or unexported fields
}

type Clock func() time.Time

type Command struct {
	// Name is the command's invocation name (without the leading "/").
	Name string
	// Description is a short, capped one-line summary for the palette.
	Description string
}

type CommandSourceBinding interface {
	prompt.CommandExpander
	prompt.CommandLister
}

type CommandSourceResolver interface {
	Borrow(context.Context, session.SessionID, *session.Principal, string) (CommandSourceBinding, func(), error)
	Activate(context.Context, session.SessionID, *session.Principal, string) error
	Retire(session.SessionID)
}

type Config struct {
	// BuildID is the composed binary build identity exposed by GetServerInfo only.
	BuildID string
	// ServerImplementation is the stable composition family exposed by GetServerInfo.
	// NewService admits only [a-z][a-z0-9-]{0,63}; invalid values report "unknown".
	// It must not identify an instance, deployment, topology, configuration,
	// capabilities, or authentication.
	ServerImplementation string
	// ProviderEndpoint returns the configured endpoint for a provider already known
	// to the caller and composition. It must not perform discovery, session/store or
	// config reads, or other side effects; GetServerInfo sanitizes its result before
	// every response boundary. nil and unknown providers report unavailable.
	ProviderEndpoint func(providerID string) string
	// Engine is the shared agent engine that drives every run. Required.
	Engine *agent.Engine
	// DebugSessionEngine builds dedicated no-filesystem debug-session engines.
	// Nil disables creation and makes persisted debug sessions fail closed at
	// rehydration rather than falling back to Engine or SessionEngine.
	DebugSessionEngine DebugSessionEngineFactory
	// AgentDefSessionEngine builds the dedicated engine for a session bound to
	// a named AgentDef (ADR 0353). Nil rejects a create naming
	// agent_definition_name with ErrInvalidArgument, mirroring the
	// DebugSessionEngine-nil posture. The composition root (internal/app)
	// supplies it.
	AgentDefSessionEngine AgentDefSessionEngineFactory
	// DebugMCP reports whether the debug factory can currently borrow selected
	// direct tools from the published direct MCP runtime. It is read on every
	// capabilities request because the runtime can change after startup. Nil
	// means unavailable.
	DebugMCP func() bool
	// Store persists and looks up sessions. Required.
	Store port.SessionStore
	// SessionCleared drops process-local state tied to a source session after a
	// successful ClearSession successor publication. nil is inert.
	SessionCleared func(session.SessionID)
	// StorageManagementAuthorized gates process-wide storage health. A nil
	// authorizer disables the management capability. It must be derived from the
	// trusted request context, never request-supplied owner data.
	StorageManagementAuthorized func(context.Context) bool
	// LocalStorageMaintenanceSingleWriter is true only when composition has proved
	// the store itself is private to this process (the in-process IsLive registry
	// plus backend family locks are then sufficient). Management authorization is
	// not such a proof. Any durable or otherwise shareable store must leave this
	// false and wire a working SessionLease before destructive migration, cleanup,
	// or automatic retention is advertised or run.
	LocalStorageMaintenanceSingleWriter bool
	// SessionLiveness carries process-local engine-owned child activity. Service's
	// own runs map covers top-level runs; delegation children never enter that map,
	// so destructive maintenance must consult both. Cross-process activity remains
	// protected by SessionLease.
	SessionLiveness port.SessionLiveness
	// RetentionPolicy is the effective operator policy projected into health.
	RetentionPolicy RetentionPolicy
	// StorageMaintenanceStatus reports the shared retention/migration/cleanup lifecycle.
	StorageMaintenanceStatus func() StorageMaintenanceStatus
	// StorageMaintenanceUpdate receives sanitized lifecycle transitions. nil keeps
	// maintenance APIs functional without process-wide health observability.
	StorageMaintenanceUpdate func(StorageMaintenanceEvent)
	// OwnershipEnforced is true only when the request edge has a verifier wired.
	// Its zero value preserves the ownerless compatibility path. When enabled,
	// create retries compare the verified issuer/subject pair before exposing an
	// existing caller-selected ID, and the store must implement port.SessionCreator
	// so no generated, forked, or scheduled session can overwrite an existing snapshot.
	OwnershipEnforced bool
	// ClientMCPOnCreate permits CLIENT-PROVIDED MCP servers on a session-creating
	// API request (CreateSessionRequest.mcp_servers and its HTTP peer). It is a
	// deployment/composition policy (listener-scoped authority), NOT an
	// inference the server package makes from its own socket state.
	//
	// The zero value FAILS CLOSED: a Service built without an explicit grant
	// refuses the field. That direction is deliberate — accepting an arbitrary
	// outbound endpoint plus its auth headers from an API caller lends the server's
	// ambient network authority to a remote principal, so a composition root that
	// has not thought about it must not accidentally grant it. mecated derives it
	// from listener topology (clientMCPOnCreateForListeners): permitted only on a
	// UNIX-socket gRPC listener with HTTP disabled. An attacker-named endpoint
	// carrying caller-supplied credentials lends greater ambient authority than
	// ordinary loopback traffic.
	//
	// It gates the WIRE surface only. The in-process CreateSessionWithMCP /
	// LoadSessionWithMCP entries are unaffected: their caller is the ACP adapter,
	// which is a stdio peer of the operator's own editor and has no listener at
	// all, so listener-derived policy is meaningless there.
	//
	// The SAME value drives the mcp_servers_on_create advertisement (FeatureScope),
	// so a deployment cannot advertise what it will refuse.
	ClientMCPOnCreate bool
	// PlacementProvider is the deployment-owned atomic placement seam.
	// Bind authorizes creation/successor choices, Reattach resolves only an exact
	// persisted EnvironmentRef, and ListWorktrees issues source-scoped ephemeral
	// selectors. app.Build always supplies the trusted local default; alternative
	// composition may supply one provider that owns worktree or remote placements.
	// It is mandatory.
	PlacementProvider PlacementProvider
	// PlacementScope is the trusted deployment scope supplied to every provider
	// Bind. It must be non-empty when PlacementProvider is configured.
	PlacementScope PlacementScope
	// ExecutionTemplateAllowed is an operator-owned per-principal grant. A nil
	// function denies all public template selection even if the shared provider
	// mTLS client has a broader allowlist.
	ExecutionTemplateAllowed func(*session.Principal, string, string) bool
	// ExecutionAccess is an optional host-only run-ownership seam. Local and no-FS
	// placements leave it nil and perform no lifecycle RPCs.
	ExecutionAccess ExecutionAccess
	// ReferenceIntents enables owner-safe reconciliation of provider-retained
	// publication/deletion outcomes. Nil is fully inert.
	ReferenceIntents ReferenceIntentLifecycle
	// SessionReadLedger optionally selects a durable read-before-write ledger for
	// each session independently of its placement's content backend. The returned
	// handle must be non-nil; nil fails the run closed.
	SessionReadLedger func(session.SessionID) tool.ReadLedger
	// RootAuthority mints a complete authority set for a newly composed root.
	// A nil callback preserves host-managed legacy sessions; app.Build always wires
	// this callback with its assembled catalog. Carryover forks copy their source
	// authority instead of invoking it.
	RootAuthority func(session.SessionKind) session.Authority
	// RootAuthorityForOperation mints authority from the runtime pinned in ctx for
	// direct operations that build roots after their operation boundary.
	RootAuthorityForOperation func(context.Context, session.SessionKind) session.Authority
	ReviewDetails             *ReviewDetailRegistry
	// GuardrailCoverage projects the effective checker route and rules over the
	// already-assembled, session-specific authority. Nil reports guardrails disabled.
	GuardrailCoverage func(*session.Session) GuardrailCoverage
	// DefaultMode is applied when a CreateSession request leaves mode
	// unspecified. Defaults to session.ModeDefault when empty.
	DefaultMode session.PermissionMode
	// MaxAllowedMode is the server ceiling: the most-permissive mode sessions may
	// enter. SetMode rejects a requested mode above this ceiling with ErrInvalidArgument.
	// Empty means no ceiling (all modes reachable). Populated by the composition layer
	// from Config.MaxAllowedMode via the permission-mode token.
	MaxAllowedMode session.PermissionMode
	// EnforcingCheckerConfigured reports whether a guardrails checker is configured
	// in enforcing (not advisory) mode. Used by SetMode to gate entry into ModeAuto,
	// which requires an enforcing checker. Set by the composition root from the
	// resolved checker state at startup.
	EnforcingCheckerConfigured bool
	// DefaultLimits are the stop limits applied to a session created without
	// explicit limits. Because a zero Limits value DISABLES every stop condition
	// by design in package session, the composition root injects non-zero
	// defaults here so a default session is always bounded. Per-field: a request
	// that supplies any non-zero limit field is taken as explicit and used as-is.
	DefaultLimits session.Limits
	// Now supplies the creation timestamp; defaults to time.Now.
	Now Clock
	// AuthorizationTimer creates process-local expiry observations. It defaults to time.AfterFunc.
	AuthorizationTimer AuthorizationTimerFactory
	// NewID allocates session ids; defaults to a crypto-random hex generator.
	NewID IDGenerator
	// MCPProvider exposes the connected MCP servers' resources/prompts to the
	// catalog-level inspection RPCs. Optional and nil-safe: when nil, the list
	// RPCs return empty and the read/get RPCs return ErrNoMCPProvider.
	MCPProvider mcp.Provider
	// MCPSources is the startup inventory fallback used only when MCPStatus is nil.
	// Production direct MCP composition supplies the reconciler's cached status.
	MCPSources []source.SourceInfo
	// MCPRefresh reconciles direct MCP sources and returns the exact immutable
	// runtime snapshot considered by this request. It is nil when direct refresh
	// is unavailable. Shared reconciliation outlives caller cancellation.
	MCPRefresh func(ctx context.Context) (MCPRefreshSnapshot, error)
	// MCPStatus returns the reconciler's cached publication/source status without
	// consulting an upstream source. It is nil when direct MCP is unavailable.
	MCPStatus func() MCPSourceStatus
	// Commands owns source-only slash-command bindings for each session, backing
	// ListCommands and the run-path expander. The resolver receives only the
	// authoritative stored owner/profile; execution placement is not a command
	// source. Optional and nil-safe: when nil (command expansion disabled, or no
	// expander enumerates), ListCommands returns an empty list.
	Commands CommandSourceResolver

	// SharedEngineRoot is the verified host project-composition root the shared
	// engine's policy collaborators were assembled for. Every filesystem-capable
	// placement with a different composition root must use SessionEngine, including
	// guest execution namespaces, custom environment kinds, and rootless shared deployments.
	SharedEngineRoot string

	// Agents is the resolved agent-definition snapshot taken at startup. It backs
	// ListAgents and is a pure read of this snapshot (no live discovery). The
	// composition root (internal/app) resolves the registry once and projects each
	// def into the proto form (name/description/resolved model/effective read-only
	// tool scope/permission mode/color) so the server adapter never imports the
	// agents adapter. May be empty (agent definitions disabled or none found).
	Agents []*mecatlv1.AgentInfo

	// Models seeds the resolved selectable-model inventory projected by composition.
	// It carries public ModelInfo metadata only and remains the compatibility path
	// when ModelInventory is nil.
	Models []*mecatlv1.ModelInfo
	// ModelInventory is the read-only composition-owned models/status publication
	// shared by wire responses, model-facing discovery and schedule validation.
	// When supplied, compatibility setters do not write another local snapshot.
	ModelInventory ModelInventory

	// DefaultCapabilities is the NEUTRAL per-(default provider+default model) input
	// capability — the catalog ∩ adapter INTERSECTION computed once in composition
	// (internal/app modelCapability for the registry default + cfg.Model). It is the
	// single source for BOTH the shared/default-engine session_capabilities echo
	// (when a session uses no per-session engine) AND ProviderCapabilities() (the ACP
	// gate). The server adapter holds only this neutral value — it never imports the
	// catalog or registry. The zero value (text-only) is the safe default for a
	// child/member service with no provider.
	DefaultCapabilities port.ProviderCapabilities
	// ResolveCapabilities returns the composition-owned capability intersection for
	// an exact persisted provider/model pair. It lets GetSession remain accurate
	// after process restart before the per-session engine is rebuilt. Nil preserves
	// the default-only behavior for lightweight consumers and tests.
	ResolveCapabilities func(providerID, modelID string, mode session.PermissionMode) port.ProviderCapabilities
	// ResolveSessionModel returns the composition-resolved identity for persisted
	// selector labels. GetSession uses it after restart before run entry rebuilds the
	// per-session engine. It must be side-effect free; nil preserves the default-only
	// behavior for lightweight consumers and tests.
	ResolveSessionModel func(ProviderSelector, session.PermissionMode) ResolvedModel

	// Posture is the SERVER-WIDE operator posture-ladder tier as a string
	// ("strict"/"trusted"/"auto"/"yolo"), projected into the ServerCapabilities echo.
	// It tracks the server ceiling (strict and trusted share the accept-edits
	// ceiling), so a client uses it to bound which modes it may cycle to. It does
	// not grant allow-all: that follows each session's permission MODE. It never
	// changes per session.
	// Empty (the zero value / an unconfigured child service) yields no badge. String
	// passthrough — no enum on the wire (the EvNoProgress/StopBudget discipline).
	Posture string
	// ProjectTrusted is the effective project-trust decision for the launch
	// workspace, projected into the ServerCapabilities echo as CHROME ONLY. nil
	// (an unconfigured child service) leaves the echo unset.
	ProjectTrusted *bool
	// SubagentAskReviewer is the headless subagent ask reviewer state ("on",
	// "off", "inert"), projected into the ServerCapabilities echo. nil (an
	// unconfigured child service) leaves the echo unset.
	SubagentAskReviewer *string
	// DeploymentID is an optional, opaque, operator-set label for this deployment,
	// surfaced on GetServerInfo. It is empty by default and is NEVER derived from
	// hostname, pod name, or environment: infrastructure topology is not something
	// an authenticated caller is owed, and a label the operator did not choose is a
	// leak with no consenting author. Bounded and validated at the composition
	// root (mecated --deployment-id), not here.
	DeploymentID string

	// DefaultResolvedModel is the EFFECTIVE provider+model the DEFAULT/shared engine
	// resolved to (the registry default provider + cfg.Model + the default context
	// window), computed once in composition. It is the single source for the
	// resolved_model echo of a session that uses no per-session engine, the SAME
	// composition-computed single-source discipline as DefaultCapabilities — the
	// server holds only this value and never recomputes the resolution in a handler.
	// The zero value (empty ids) is the safe default for a child/member service with
	// no provider; a client maps it to a no-model-segment header.
	DefaultResolvedModel ResolvedModel

	// DefaultModelPending is true when the DEFAULT/shared engine booted with an
	// UNRESOLVED default model (issue #262 review finding 1: the sole
	// intent-driven — ToolHive gateway — provider probed down at Build, so
	// cfg.Model stayed ""). It routes EVERY zero-selector session through the
	// per-session engine factory (sessionNeedsPerFactory) and, for a session
	// persisted before a restart into a still-down proxy, through rehydration
	// (needsRehydration) too — so the model is resolved AT SESSION-BUILD TIME
	// (resolve-at-use, mirroring the Deps.ContextWindow precedent, but at
	// session granularity) instead of being frozen at the shared engine's
	// Build-time construction. Without this, a post-boot heal
	// (registry.healDefaultModel) updates the registry's resolved default but
	// never reaches a zero-selector session, which keeps sending an empty
	// model id to the provider (the R1.4 "no-restart" promise silently broken
	// for the flagship sole-provider case). Static for the process lifetime
	// (set once in composition from the SAME condition healDefaultModel guards
	// on: an intent-driven default provider with no resolved model at Build);
	// false everywhere else (a keyed default, or an operator-configured
	// --model/--default-model) — byte-identical to today.
	DefaultModelPending bool

	// Skills is the resolved skills-inventory snapshot taken at startup. It backs
	// ListSkills and is a pure read of this snapshot (no live discovery — skills
	// are discovered once at build time and immutable for the process lifetime).
	// The composition root (internal/app) discovers the skills once and projects
	// each into the proto form (name + description); that PROJECTION (skillSnapshot)
	// lives in internal/app, not here, so the server adapter holds only the proto
	// snapshot and never reaches into the skills adapter's discovery types. May be
	// empty (skills disabled or none found).
	Skills []*mecatlv1.SkillInfo

	// Soul is the resolved soul (persona) BUILD-TIME SNAPSHOT taken at startup. It
	// backs GetSoul and is a pure read of this snapshot — the soul is selected once
	// (USER-wins precedence, project trust gate, drift check) and is immutable for the
	// process lifetime, so no live re-read is warranted. The composition root
	// (internal/app) projects the winning soul's content + soulMeta into the proto form
	// (soulSnapshot) so the server adapter never reaches into the soul adapter or the
	// composition-layer soulMeta type. nil when no soul source is wired (--no-soul or
	// none present); a nil Soul makes capabilities().Soul false and GetSoul return an
	// empty (present=false) snapshot.
	Soul *mecatlv1.SoulInfo

	// UserModel lists the CURRENT user-model entries, backing GetUserModel. Unlike
	// Soul (a startup snapshot) it is a LIVE lister: the composition root closes over
	// the user-model store's Index so a refresh reflects entries saved since startup.
	// It is the same seam idiom as Commands. Optional and nil-safe: when nil (user
	// model disabled) capabilities().UserModel is false and GetUserModel returns empty.
	UserModel UserModelLister

	// ReflectSession enables explicit completed-session reflection independently of
	// automatic learning mode. Attempts expose only content-free lifecycle
	// projections from the verified caller's private partition. Proposals and the
	// mutation callbacks expose the bounded, caller-partitioned staged-learning
	// review surface.
	ReflectSession          ExplicitReflector
	Attempts                learning.AttemptRepository
	AttemptPrincipal        func(*session.Principal) string
	Proposals               learning.ProposalRepository
	ProposalManifest        ProposalManifestLoader
	ProposalPrincipal       func(*session.Principal) string
	PromoteProposal         ProposalPromoter
	UndoProposal            ProposalUndoer
	ProjectPromotionAllowed func(project string) bool
	ProposalActionAvailable func(project string) (bool, string)

	// DreamReviewer is the transport-neutral, process-local manual consolidation
	// coordinator. DreamCapabilities is the composition-computed availability
	// snapshot for the exact Build-owned project-memory and user-model stores. Both
	// zero values keep manual dreaming unavailable.
	DreamReviewer     DreamReviewer
	DreamCapabilities DreamCapabilities

	// LearnedSkills exposes caller-partitioned, agent-owned lifecycle records. The
	// publisher atomically refreshes the shared live Skill catalog after mutations.
	LearnedSkills             learning.SkillRepository
	PublishLearnedSkills      func(context.Context, learning.SkillPartition) error
	BeginSkillPublication     func(learning.SkillPartition) func()
	LiveSkillGeneration       func(learning.SkillPartition) uint64
	SkillActionAvailable      func(learning.SkillPartition, string) (bool, string)
	LearnedSkillNameAvailable func(string) bool
	LiveSkills                func(context.Context) []*mecatlv1.SkillInfo
	// SkillSourceFor returns the read-only skill source for the caller's skill view, the
	// view LiveSkills lists. It backs ListSkillFiles and ReadSkillFile. Nil, or a nil
	// result, means skills are disabled.
	SkillSourceFor func(context.Context) tool.SkillSource

	// TitleGenerationEligible is the composition-resolved eligibility check for
	// server-owned automatic title generation. Nil and false keep the durable
	// lifecycle disabled; true persists pending at session creation. It receives
	// only the neutral fixed session selector, never registry or credential access.
	TitleGenerationEligible func(ProviderSelector) bool
	// TitleGenerator is the optional Build-owned, server-private title call. When
	// absent automatic work is unavailable; it never receives session authority.
	TitleGenerator SessionTitleGenerator
	// TitleGeneratorForSession resolves a title generator for the session's fixed
	// provider selector. It takes precedence over TitleGenerator when present.
	TitleGeneratorForSession func(ProviderSelector) SessionTitleGenerator

	// SessionEngine builds a PER-SESSION engine over a non-default provider/model
	// selector AND/OR client-provided streaming-HTTP MCP servers (the ACP
	// session/new mcpServers). It is the seam that lets a session bind its OWN
	// provider/model or mount its OWN MCP tools without leaking them (or the
	// provider registry) into the shared Engine every other session uses. When nil,
	// a non-default selector or non-empty MCP specs are rejected with
	// ErrInvalidArgument; a session with the zero selector and no client MCP always
	// uses the shared Engine (zero overhead). The composition root (internal/app)
	// supplies it.
	SessionEngine SessionEngineFactory
	// SessionEngineWithTools is required when MCPBroker is wired. It receives the
	// exact wrappers owned by the local broker attachment.
	SessionEngineWithTools SessionEngineWithToolsFactory
	// SessionContextEngine derives the engine from authoritative stored source scope.
	// It is composition-only; client input never selects a source context.
	SessionContextEngine SessionContextEngineFactory
	// MCPBroker owns logical broker state; Service owns only local attachments.
	MCPBroker brokercontract.Service
	// IdentityBroker is the agent identity broker, or nil when it is not
	// enabled. With it set, every root session with an owner has a broker
	// session; see openIdentityBrokerSession.
	IdentityBroker identitybroker.Service
	// MCPConnectorInspector exposes local-only inventory for the bundled broker.
	MCPConnectorInspector brokercontract.ConnectorInspector
	// WorkspaceEnrollment advertises the optional pre-prompt enrollment capability.
	// It must be true only when MCPBroker attachments implement the enrollment boundary.
	WorkspaceEnrollment bool

	// ModeNeedsEngine reports whether a given session PermissionMode resolves a model
	// that DIFFERS from the shared engine's model — i.e. whether a
	// plan slot is configured and active. It is the composition-injected predicate that
	// lets a DEFAULT-FS session (which normally rides the shared engine, zero overhead)
	// be PROMOTED to a per-session factory engine when its mode would change the model.
	// The Service never resolves a model itself; it asks this predicate.
	//
	// When nil (no plan slot configured) a default-FS session is NEVER promoted
	// (a mode flip changes nothing, the shared engine is unchanged). This is the
	// regression-guard seam: composition wires it ONLY when a plan slot is active.
	ModeNeedsEngine func(mode session.PermissionMode) bool

	// OperationPin pins one immutable direct-MCP runtime for a root run. The
	// returned context carries the generation into composition factories and child
	// engines; release is called only when the run registry settles. Nil disables
	// runtime publication integration.
	OperationPin func(context.Context) (context.Context, func(), error)
	// OperationRevision reads the revision carried by OperationPin. Shared and
	// cached engines are rebuilt before use when their tag differs.
	OperationRevision func(context.Context) (uint64, bool)
	// SharedEngineRevision tags Engine's build-time direct-MCP generation.
	SharedEngineRevision uint64

	// MemberEngine builds a team member's Engine from the shared team and the
	// member spec (see engine/agent.MemberEngine). It is the seam that wires
	// the agent-team RPCs: when nil, those RPCs return ErrTeamsDisabled. The
	// composition root supplies it (internal/app), capturing the per-member
	// catalog (read-only base + MemberTools, plus mutating tools only for a
	// Mutating member) and the provider/model.
	MemberEngine MemberEngineFactory
	// MemberEngineForOperation resolves the direct RunTeam member factory from the
	// operation-pinned context acquired at RunTeam. Nil uses MemberEngine.
	MemberEngineForOperation func(context.Context) MemberEngineFactory
	// TeamGoalUntrusted, when true, re-fences the gRPC/HTTP CreateTeam goal as
	// UNTRUSTED data in member and synthesis prompts (threaded to
	// agent.WithUntrustedGoal). DEFAULT false: the goal is the team's TRUSTED
	// top-level instruction (its provenance is the deployment/operator that owns the
	// gRPC front door, not a peer — peer messages and task descriptions stay fenced
	// regardless). A multi-tenant / relay deployment that interpolates untrusted
	// end-user text into the goal should set this true so the goal is fenced as data.
	// It is a composition decision (the deployment knows the goal's provenance); the
	// supervisor only takes the bool.
	TeamGoalUntrusted bool
	// TeamTokenBudget is the team-wide cumulative token budget threaded into every
	// CreateTeam supervisor (agent.WithTeamTokenBudget). 0 disables. The per-request
	// proto knob is deferred.
	TeamTokenBudget int
	// Forker isolates a Mutating team member's workspace (force-copy: own `.git`).
	// Optional; required only if a Mutating member is spawned.
	Forker tool.EnvironmentForker
	// ReadOnlyForker isolates a read-only-isolated team member's workspace as a cheap
	// git worktree (shares the base repo's `.git` ⇒ full history) so an inspect-only
	// member can run a shell (git log/show, build, test) confined to a throwaway
	// checkout. Optional; required only if the member factory marks any read-only
	// member IsolateReadOnly (which the composition root does only when this is
	// wired). When nil, read-only members base-share with no shell.
	ReadOnlyForker tool.EnvironmentForker
	// SharedBaseWorkspace re-views a team's base workspace for a BASE-SHARING
	// read-only member (the no-shell fallback tier) so it never inherits a relaxed
	// base's out-of-root reach (the path-escape-posture Scenario 5 boundary —
	// threaded to agent.WithTeamSharedBaseWorkspace). The composition root wires it
	// whenever the Workspaces factory may return a relaxed workspace (auto/yolo).
	// Optional; nil shares the base verbatim.
	SharedBaseWorkspace func(tool.Workspace) tool.Workspace
	// TeamHooks fires the team lifecycle hooks (TeammateIdle) and is passed to
	// member coordination tools for the TaskCreated / TaskCompleted gates.
	// Optional.
	TeamHooks port.HookRunner
	// MaxTeams caps the number of live (un-cleaned) teams the registry holds at
	// once, bounding the leak when clients create teams but never CleanupTeam.
	// CreateTeam returns ErrTooManyTeams (ResourceExhausted) when the cap is
	// reached; cleaning up a created/done team frees a slot. Defaults to
	// defaultMaxTeams when zero.
	MaxTeams int

	// MaxSessionEngines caps the number of live (un-released) PER-SESSION engines
	// the registry holds at once (CWE-770). A per-session engine is registered when
	// a session needs a non-default provider/model selector OR client-provided MCP
	// servers. The ACP surface drains them on editor disconnect, but the gRPC/HTTP
	// surfaces have no teardown signal, so without a cap a hostile authed client
	// could call CreateSession with a valid provider_id repeatedly (never closing)
	// and grow the map unbounded. createSession returns ErrTooManySessionEngines
	// (ResourceExhausted) when the cap is reached; CloseSession / EndSession frees a
	// slot. It is a generous count (a session is multi-turn and its engine MUST
	// persist across turns, so this is NOT terminal-state eviction). Defaults to
	// defaultMaxSessionEngines when zero.
	MaxSessionEngines int

	// OnCloseSession, when non-nil, is invoked by CloseSession with the closing
	// session id BEFORE the per-session engine teardown. It is the composition
	// seam for releasing session-scoped state the Service does not own — currently
	// the per-session LEARNED permission rules (issue #3), evicted via
	// permstore.Memory.Forget so they do not outlive the session. Optional and
	// nil-safe.
	OnCloseSession func(session.SessionID)

	// EventLog durably records the relay-side event projection per session.
	// Relays observe every event, including the
	// drain-to-discard tail, while their run-scoped recorders coalesce streaming
	// text deltas before Append; the loop itself stays storage-agnostic (it only
	// emits). Optional and nil-safe: when nil the relay records nothing
	// (byte-identical to the pre-3a behaviour). The composition root wires the
	// durable jsonlstore Store (which also implements EventLog) or an in-memory
	// sibling when no store dir is configured.
	EventLog port.EventLog

	// Diagnostics is the operational logging sink the relay uses to WARN once per
	// recorder after EventLog.Append failures (a best-effort durable log must not
	// break the live stream). Optional and nil-safe: when nil, Append failures are
	// silently tolerated (the durability gap is the only effect). The composition
	// root supplies the same sink the rest of the build uses.
	Diagnostics port.Diagnostics

	// SessionLoadFailureMetric records one bounded class for each non-not-found
	// GetSession load failure under ownership enforcement. It receives no target,
	// principal, locator, cause, blob, or size. Optional and nil-safe; diagnostics
	// remain enabled when this callback is nil.
	SessionLoadFailureMetric func(port.SessionLoadFailureClass)

	// ReplayApprovals repopulates the in-memory learned-rule store (permstore) for a
	// loaded session from its durable EventLog allow-always verdicts. The permstore
	// is in-memory and lost on restart, so without this a previously allow-always'd
	// tool would re-ask after a process restart. The composition root (internal/app)
	// supplies the closure — it owns BOTH the EventLog and the Policy.Learn seam, so
	// it reads the verdicts, correlates each allow-always askID back to its ToolCall
	// in the loaded conversation (the askID encodes the call id; see agent.newAskID),
	// and re-Learns the reconstructed rule. Keeping the correlation in composition
	// keeps the EventLog event METADATA-ONLY (no raw args on the wire) while the real
	// rule is rebuilt from history the session already carries (no leak).
	//
	// The Service invokes it from loadAndReopen (the single run-entry funnel) AT MOST
	// ONCE per session id per process: a freshly-created in-memory session learns
	// live, so it never needs a replay, and a re-run of an already-replayed session
	// would only re-derive idempotent rules. Optional and nil-safe: when nil (no
	// store, or replay not wired) loadAndReopen does nothing extra.
	ReplayApprovals func(ctx context.Context, sess *session.Session)

	// ResolveContextWindow is THE live-first context-window resolver injected by
	// composition (the SAME reg.windowResolver the engine reads via Deps.ContextWindow,
	// wrapped to int64: override→live→catalog→128k floor). Service.ResolvedModel
	// consults it for BOTH the default-session and the per-session-engine branch, so
	// the wire echo is byte-identical to the engine's resolve-at-use window. nil keeps
	// the baked DefaultResolvedModel.ContextWindow verbatim — the memstore/driver/test
	// paths. Only the ContextWindow scalar is resolved; provider/model identity never
	// recomputes.
	ResolveContextWindow func(providerID, modelID string) int64
	// AwaitContextWindow blocks run admission until composition can safely resolve
	// the effective provider/model window. Nil preserves compatibility for embedders.
	AwaitContextWindow func(context.Context, string, string) error

	// SessionLease is the OPTIONAL cross-process single-writer seam. When wired, the run-entry funnel acquires a per-session
	// lease (AFTER the same-process runEntryMu, so same-process exclusion stays
	// cheap) before driving the engine, refreshes it from a Service-owned renewer
	// goroutine, and releases it on CloseSession / shutdown. A competing process
	// holding the lease makes StartRunContent / resumeFromAwaiting fail with
	// ErrSessionLeasedElsewhere. Optional and nil-safe: when nil there is NO
	// acquire, NO renewer, and NO release — the single-writer-by-affinity
	// posture. The loop NEVER imports port.SessionLease;
	// the renewer and the held-lease registry live entirely on Service (the same
	// storage-agnostic discipline as EventLog). A backend that reports
	// ErrLeaseUnsupported is stickily disabled (one INFO, then the no-lease path).
	SessionLease port.SessionLease

	// MutationCapability is the process-local admission gate shared by Service
	// and the engine's guarded persistence/recorder adapters. Composition supplies
	// one instance to both. When nil, Service creates the matching local gate;
	// no-lease and unsupported-lease paths remain pass-through.
	MutationCapability *SessionMutationCapability

	// LeaseOwner is this process's owner-identity string for SessionLease, built
	// once per Build (e.g. "<hostname>-<pid>-<nonce>") so two Builds in one
	// process get distinct owners. Ignored when SessionLease is nil.
	LeaseOwner string

	// LeaseTTL is the lease lifetime requested at Acquire and the renew window;
	// the renewer ticks at LeaseRenewInterval (default LeaseTTL/3). A non-positive
	// value defaults to defaultLeaseTTL. Ignored when SessionLease is nil.
	LeaseTTL time.Duration

	// LeaseRenewInterval is how often the renewer refreshes a held lease. A
	// non-positive value defaults to LeaseTTL/3. Ignored when SessionLease is nil.
	LeaseRenewInterval time.Duration

	// Scheduler is the OPTIONAL in-process scheduled-tasks tick loop (issue #189).
	// When wired, NewService stores it on the Service so Close drains it
	// (Stop cancels the tick loop + joins in-flight fires) and Drain arms its drain
	// gate (no new fires mid-tick during shutdown). The scheduler is STARTED by
	// composition (app.Build) AFTER NewService — its FireFunc closes over the
	// Service, so Build calls SetFire then Start; NewService does NOT start it.
	// nil = no scheduling (the byte-identical default).
	//
	// NOTE: this field is the LEGACY late-attach path. The schedule surface now
	// lives on the store-shaped scheduleManager — see ScheduleManager
	// below. NewService still seeds the Service's manager-side scheduler reference
	// from this field for byte-identical Close/Drain; composition attaches the
	// scheduler via SetScheduler (delegated to the manager) AFTER NewService.
	Scheduler *scheduler.Scheduler

	// ScheduleManager is the pre-Service store-shaped schedule manager:
	// the validated create/read/update/fire seam constructed BEFORE buildEngine
	// from the store + now-func, with the scheduler / model-inventory as
	// late-bound atomic fields. When non-nil, the Service delegates its nine
	// port.ScheduleManager methods + EmitScheduleEvent + GetFire to it — the RPC
	// surface is byte-identical. When nil, the Service self-constructs one from
	// Store (the legacy test path + any caller that does not pre-construct); a
	// store that backs no ScheduleStore yields a nil manager (the honest
	// no-scheduling path). Composition (app.Build) constructs the manager from
	// the store before buildEngine and hands it here — the SAME manager its
	// shared catalog's Schedule tool factory resolves (one manager, one
	// truth). The field is the CONCRETE *scheduleManager (exposed to
	// composition as the ScheduleManagerImpl alias) so the typed-nil
	// discipline holds end-to-end: a store with no ScheduleStore yields an
	// untyped nil here, never a non-nil interface boxing a nil pointer.
	ScheduleManager *scheduleManager

	// PlanModeAutoApprove is the OPT-IN, OPERATOR-TIER-ONLY, DEFAULT-OFF flag that
	// auto-approves a plan-mode PresentPlan ask when the run ends without a human
	// operator. It is a deliberate autonomous-approval capability — an operator
	// deployment decision, NEVER load-bearing for safety. When true AND the engine
	// is headless (no interactive client attached), the Service auto-resolves a
	// parked plan-approval ask via the EXISTING ApprovePlan path (ModeDefault + a
	// loud note). It does NOT fire when interactive (a human can approve), NOT in
	// non-plan modes, NOT for non-plan asks. DEFAULT false (the existing safe
	// default: headless plan ask is auto-denied by the engine). Composition
	// (internal/app) sets this from Config.PlanModeAutoApprove; the cmd mains wire
	// the --plan-mode-auto-approve flag.
	PlanModeAutoApprove bool

	// Interactive reports whether a HUMAN approver is attached to the main engine's
	// runs (a live Converse / HTTP-SSE client that can answer a permission ask).
	// It mirrors app.Config.Interactive (threaded onto the engine's Deps.Interactive)
	// and gates the PlanModeAutoApprove observer: an interactive deployment NEVER
	// auto-approves (the human answers). DEFAULT false (fail-safe: the observer
	// treats the deployment as headless).
	Interactive bool
}

type CreateSessionOption func(*createSessionOpts)

type DebugSessionEngineFactory func(ctx context.Context, sel ProviderSelector, profile SessionProfile, mode session.PermissionMode, target session.SessionID, targetFingerprint string, targetOwner *session.Principal, selectedServers, toolCeiling []string) (SessionEngineResult, error)

type DreamCapabilities struct {
	Generate          bool
	Decide            bool
	UnavailableReason string
	Targets           map[DreamTarget]DreamTargetCapability
}

type DreamDecision string

type DreamOperation struct {
	Kind                   string
	Survivor               DreamParticipant
	Sources                []DreamParticipant
	Replacement            DreamReplacement
	Reason                 string
	ExactDuplicateEligible bool
}

type DreamParticipant struct {
	Key         string
	Value       string
	Description string
}

type DreamReceipt struct {
	ID          string
	Target      DreamTarget
	Disposition DreamDecision
	Planned     int
	Applied     int
	Conflicted  int
	Skipped     int
	Failed      int
}

type DreamReplacement struct {
	Value       string
	Description string
}

type DreamReview struct {
	ID                 string
	Target             DreamTarget
	ExpiresAt          time.Time
	Operations         []DreamOperation
	PlannedOperations  int
	PlannedSourceCount int
}

type DreamReviewer interface {
	Generate(context.Context, DreamTarget) (DreamReview, error)
	Decide(context.Context, string, DreamDecision) (DreamReceipt, error)
}

type DreamTarget string

type DreamTargetCapability struct {
	Generate          bool
	Decide            bool
	UnavailableReason string
}

type ExecutionAccess interface {
	Applies(session.EnvironmentRef) bool
	AcquireRun(context.Context, ExecutionRunRequest) (ExecutionRunHandle, error)
}

type ExecutionRunHandle interface {
	Environment() tool.Environment
	Renew(context.Context) error
	Release(context.Context) error
}

type ExecutionRunRequest struct {
	Ref       session.EnvironmentRef
	Principal *session.Principal
	BindingID session.SessionID
	RunID     string
}

type ExecutionSelection struct {
	Kind         PlacementSelectorKind
	ID, Revision string
}

type ExecutionTemplateCatalog interface {
	ListExecutionTemplates(context.Context, *session.Principal) ([]ExecutionTemplateInfo, string, error)
}

type ExecutionTemplateInfo struct {
	ID, Revision, Name, Description, DisplayToken string
	Extensions                                    map[string]string
	DeclaredExecutionFiles, DeclaredBuiltInShell  bool
}

type ExecutionWorkspaceAcquirer func(context.Context) (tool.Workspace, func() error, error)

type ExplicitReflector func(context.Context, *session.Session) (ReflectionReceipt, error)

type FeatureScope struct {
	// ExactPlanAskControl requires durable failure recording for accepted
	// server-owned plan continuations.
	ExactPlanAskControl bool
	// ClientMCPOnCreate reports whether this deployment accepts
	// CreateSessionRequest.mcp_servers.
	ClientMCPOnCreate bool
	// SessionActivityInventory reports whether ListSessions reads an atomic,
	// activity-projecting metadata pager.
	SessionActivityInventory bool
}

type ForkSuccessorRequest struct {
	Source          session.SessionID
	Placement       SuccessorPlacement
	Title           string
	ProviderID      string
	ModelID         string
	ReasoningEffort string
}

type GuardrailCoverage struct {
	Enabled                           bool
	CheckerProviderID, CheckerModelID string
	Entries                           []GuardrailCoverageEntry
}

type GuardrailCoverageEntry struct {
	Tool, Phase, Job, Mode, RuleID, RuleOrigin, Inspection, Reason string
}

type GuardrailReviewDetail struct {
	ReviewID, Concern, SourceDisplay, NextAction string
}

type HTTPHandler struct {
	// contains filtered or unexported fields
}

type HarnessServer struct {
	mecatlv1.UnimplementedHarnessServiceServer
	// contains filtered or unexported fields
}

type HealthHandler struct {
	// contains filtered or unexported fields
}

type IDGenerator func() session.SessionID

type ListSessionsPage struct {
	Sessions   []SessionSummary
	NextCursor string
	TotalCount int
}

type ListSessionsPageRequest struct {
	PageSize int
	Cursor   string
}

type LocalSessionContextServer struct {
	mecatlv1.UnimplementedLocalSessionContextServiceServer
	// contains filtered or unexported fields
}

type MCPAuthorizationControl struct {
	SessionID       session.SessionID
	AuthorizationID string
}

type MCPAuthorizationResult struct {
	Status session.AuthorizationStatus
	Event  session.Event
	Run    *agent.Run
}

type MCPRefreshResult struct {
	Revision uint64
	Changed  bool
}

type MCPRefreshSnapshot struct {
	Revision  uint64
	Changed   bool
	ToolNames []string
}

type MCPSourceStatus struct {
	Sources     []source.SourceInfo
	Revision    uint64
	Stale       bool
	Reconciling bool
}

type MemberEngineFactory func(t *team.Team, spec agent.MemberSpec, routedModel string) agent.MemberBuild

type ModeScopedWorkspace interface {
	ForPermissionMode(mode session.PermissionMode) tool.Workspace
}

type ModelInventory interface {
	CurrentModelSnapshot() ModelSnapshot
}

type ModelSnapshot struct {
	Models         []*mecatlv1.ModelInfo
	ProviderStatus []*mecatlv1.ProviderStatus
}

type OwnerlessCutoverInventory struct {
	SessionsAvailable          bool
	SessionsUnavailableReason  string
	SessionCount               int
	SessionIDs                 []string
	SessionIDsTruncated        bool
	SchedulesAvailable         bool
	SchedulesUnavailableReason string
	ScheduleCount              int
	ScheduleNames              []string
	ScheduleNamesTruncated     bool
}

type PlacementBindRequest struct {
	Selector  PlacementSelector
	Principal *session.Principal
	Scope     PlacementScope
	Operation PlacementOperation
	// BindingID is the final server-minted session identity. Providers that
	// allocate durable environments use it as their idempotency/reference key.
	BindingID session.SessionID
}

type PlacementBinder struct {
	// contains filtered or unexported fields
}

type PlacementBinding struct {
	Environment tool.Environment
	Ref         session.EnvironmentRef
	Metadata    PlacementMetadata
	// GovernanceRoot is explicit trusted host context for project-scoped
	// governance, including permission, learning, and continuation partitioning.
	// It is independent of harness-context sources and of the execution namespace
	// exposed by Environment.Workspace().Root(). Non-local bindings leave it empty
	// when there is no host governance context; guest roots are never used as a
	// fallback. No-FS bindings always leave it empty.
	GovernanceRoot string
	// Commit publishes a provisional durable reference after the session store
	// definitively publishes the matching binding. Close aborts it only while Commit
	// has not succeeded; an ambiguous commit must remain recoverable.
	Commit func(context.Context) error
	// Close detaches a published placement binding. Service ownership is
	// transferred only after the session snapshot is durably created.
	Close func() error
	// Rollback permanently removes this exact unpublished placement. Providers
	// that provision durable state during Bind must supply it; it is never used
	// after publication or for ordinary EndSession teardown.
	Rollback func() error
}

type PlacementDeleteRequest struct {
	Ref       session.EnvironmentRef
	Principal *session.Principal
	Scope     PlacementScope
}

type PlacementDeleteResult struct {
	Retained bool
}

type PlacementDeleter interface {
	DeletePlacement(context.Context, PlacementDeleteRequest) (PlacementDeleteResult, error)
}

type PlacementDiscoverer interface {
	ListWorktrees(context.Context, PlacementDiscoveryRequest) ([]ScopedWorktree, error)
}

type PlacementDiscoveryRequest struct {
	Source    session.SessionID
	SourceRef session.EnvironmentRef
	Principal *session.Principal
	Scope     PlacementScope
}

type PlacementMetadata struct {
	Kind  string
	Label string
	// Branch is the short branch name, such as "feat/x", not a full ref.
	Branch   string
	Revision string
}

type PlacementOperation string

type PlacementProvider interface {
	Bind(context.Context, PlacementBindRequest) (PlacementBinding, error)
}

type PlacementReattachRequest struct {
	Ref       session.EnvironmentRef
	Principal *session.Principal
	Scope     PlacementScope
	// BindingID identifies the durable reference being reattached.
	BindingID session.SessionID
}

type PlacementReattacher interface {
	Reattach(context.Context, PlacementReattachRequest) (PlacementBinding, error)
}

type PlacementScope string

type PlacementSelector struct {
	Kind      PlacementSelectorKind
	ID        string
	Revision  string
	Source    session.SessionID
	SourceRef session.EnvironmentRef
}

type PlacementSelectorKind string

type PlacementSuccessorRequest struct {
	Ref                  session.EnvironmentRef
	Principal            *session.Principal
	SourceBindingID      session.SessionID
	DestinationBindingID session.SessionID
}

type PlacementSuccessorReservoir interface {
	ReserveSuccessor(context.Context, PlacementSuccessorRequest) (PlacementBinding, error)
}

type PlacementValidator interface {
	ValidatePlacement(context.Context) error
}

type PrincipalValidator interface {
	Validate(ctx context.Context, bearer string) (*session.Principal, error)
}

type ProposalManifestLoader func(context.Context, learning.ProposalPartition, learning.ProposalID) (learning.MaterializationManifest, bool, error)

type ProposalPromoter func(context.Context, learning.ProposalPartition, learning.ProposalID, learning.ProposalVersion, bool) (learning.ProposalRecord, error)

type ProposalUndoer func(context.Context, learning.ProposalPartition, learning.ProposalID, learning.ProposalVersion) (learning.ProposalRecord, error)

type ProtectedResourceProfile struct {
	Resource string
	Issuer   string
	Audience string
	ClientID string
	Scopes   []string
}

type ProviderSelector struct {
	// ProviderID is the registry id ("" => server default).
	ProviderID string
	// ModelID is the model selector ("" => provider default; a non-empty id the
	// catalog doesn't know is passed through to the provider verbatim).
	ModelID string
	// ReasoningEffort is the per-session reasoning-effort selector: a
	// NEUTRAL token ("" / "auto" => unset, the operator default applies; otherwise
	// low/medium/high/xhigh/max). It is OPAQUE to the adapter — the composition root
	// normalises + clamps it per provider and re-mints the engine's adapter when it
	// differs from the operator default. "" keeps the operator default (and the
	// shared engine on a byte-identical default path). It composes orthogonally with
	// ProviderID/ModelID; unlike ModelID it is meaningful WITHOUT a ProviderID (it
	// rides the server-default provider).
	ReasoningEffort string
}

type ReadyFunc func() bool

type ReferenceDeleteHandle interface {
	Confirm(context.Context) error
	Cancel(context.Context) error
}

type ReferenceIntent struct {
	Ref             session.EnvironmentRef
	Principal       *session.Principal
	BindingID       session.SessionID
	SourceBindingID session.SessionID
	OperationID     string
	PendingDelete   bool
}

type ReferenceIntentLifecycle interface {
	ListReferenceIntents(context.Context, int) ([]ReferenceIntent, error)
	CommitReferenceIntent(context.Context, ReferenceIntent) error
	ConfirmReferenceIntentDelete(context.Context, ReferenceIntent) error
	CancelReferenceIntentDelete(context.Context, ReferenceIntent) error
}

type ReferenceLifecycle interface {
	Applies(session.EnvironmentRef) bool
	PrepareReferenceDelete(context.Context, PlacementSuccessorRequest) (ReferenceDeleteHandle, error)
}

type ReflectionReceipt struct {
	ID          string
	Disposition string
	Reason      string
	Queued      int
	Abstained   bool
	Staged      int
	Promoted    int
	Conflicted  int
	Usage       session.AuxiliaryUsage
}

type ResolvedModel struct {
	ProviderID    string
	ModelID       string
	ContextWindow int64
	// ReasoningEffort is the effective per-session reasoning-effort token,
	// "" when unset. Carried on the resolved-model echo so the wire (and the
	// TUI footer) can show the active effort; it is the value held on the
	// per-session engine record (sessionEngine.reasoningEffort), not recomputed.
	ReasoningEffort string
}

type RetentionPolicy struct {
	// Version changes whenever the effective policy semantics change. When empty,
	// the server derives a stable version from the scalar limits.
	Version           string
	MainMaxAge        time.Duration
	MainMaxCount      int
	ChildMaxAge       time.Duration
	ChildMaxCount     int
	ScheduledMaxAge   time.Duration
	ScheduledMaxCount int
	SweepCadence      time.Duration
}

type ReviewDetailRegistry struct {
	// contains filtered or unexported fields
}

type RunAskAcknowledgement struct {
	RunID string
	AskID string
}

type RunControlAcknowledgement struct {
	RunID string
}

type RunEventRecorder struct {
	// contains filtered or unexported fields
}

type RunSteerAcknowledgement struct {
	Outcome   agent.SteerOutcome
	RunID     string
	MessageID string
}

type ScheduleManagerConfig struct {
	// Store is the port.SessionStore the schedule's origin validation reads
	// (validateScheduleOrigin). It is also the ScheduleStore discovery source
	// when ScheduleStore is nil (the scheduleStoreProvider accessor).
	Store port.SessionStore
	// ScheduleStore is the OPTIONAL explicit port.ScheduleStore override (the
	// --schedule-store-url composition path). When non-nil it WINS over the
	// Store type-assertion discovery: the registry is a remote driver, not the
	// session store's own accessor, so the in-chat Schedule tool + the tick
	// loop + the fire path all share the ONE resolveScheduleStore resolution.
	// When nil, behaviour is byte-identical to the accessor discovery.
	ScheduleStore  port.ScheduleStore
	Now            func() time.Time
	ModelInventory ModelInventory
	Models         *atomic.Pointer[[]*mecatlv1.ModelInfo]
	Diagnostics    port.Diagnostics
	// OwnershipEnforced mirrors server.Config.OwnershipEnforced (true only when
	// the request edge has a verifier wired). It gates whether the manager
	// namespaces the store-facing schedule key by verified caller (issue #368):
	// a schedule Name is a caller-chosen, human-readable
	// key exactly like a memory key, so two DIFFERENT owners may legitimately
	// pick the identical name without colliding — mirroring
	// memory.CallerStore's owner-digest scheme. When false (no verifier wired,
	// or a standalone-constructed manager that leaves this unset), the key is
	// BYTE-IDENTICAL to today: the bare literal name, one flat namespace.
	OwnershipEnforced bool
}

type ScheduleManagerImpl = scheduleManager

type ScheduleServer struct {
	mecatlv1.UnimplementedScheduleServiceServer
	// contains filtered or unexported fields
}

type ScopedWorktree struct {
	Selector string
	Label    string
	// Branch is the short branch name, such as "feat/x", not a full ref.
	Branch   string
	Revision string
	Bare     bool
}

type SecurityConfig struct {
	// AuthToken, when non-empty, requires every RPC/request to present
	// Authorization: Bearer <AuthToken> (gRPC: the "authorization" metadata
	// header). An empty token disables authentication (dev mode).
	AuthToken string
	// RateLimit is the sustained per-client request rate in requests/second. A
	// value <= 0 disables rate limiting entirely. Limiting is applied both
	// per-client (keyed by token or peer IP) and globally.
	RateLimit float64
	// RateBurst is the token-bucket burst size. It defaults to a small multiple
	// of RateLimit when left zero (see newLimiterSet).
	RateBurst int
	// Validator, when non-nil, turns caller identity ON: every request must
	// present a bearer the validator vouches for, and the verified principal is
	// stashed on the handler context (session.WithPrincipal). Nil (the default)
	// leaves the path byte-identical to a mecatl without identity: no
	// validation, no principal, no new failure mode.
	Validator PrincipalValidator
	// HTTP bearer challenges are deliberately generic. The configured resource is
	// a service-wide base identity, while API requests are subordinate paths and
	// the request Host is untrusted; this middleware cannot prove an exact RFC
	// 9728 resource identity for a request.
	// Diagnostics receives sanitized authentication outcome records. Accepted
	// outcomes are emitted once per closed category/transport pair; rejected and
	// unavailable outcomes remain per-request. Nil leaves diagnostics disabled;
	// records never include credentials or validator errors.
	Diagnostics port.Diagnostics
}

type Service struct {
	// contains filtered or unexported fields
}