durable

type AbortQueryRemovalRequest struct {
	VerifyQueryRuntimeRequest
	Fence      QueryRemovalFence
	Settlement QueryRemovalSettlement
}

type AuditMetadata struct {
	ActorKind     string
	ActorID       string
	RequestID     string
	CorrelationID string
	DecisionID    string
	PolicyVersion string
	ReasonCode    string
}

type BeginQueryRemovalRequest struct {
	QueryRuntimeTarget
	RequestID       string
	ExpectedVersion int64
}

type BuildAdmission struct {
	QueryIdentity BuildQueryIdentity
	BuildTarget
	State       string
	Epoch       int64
	Version     int64
	CutoffEpoch int64
	ChangedAt   time.Time
}

type BuildAdmissionError struct {
	BuildID         string
	State           string
	RetirementEpoch int64
	ReferenceKind   string
	CommandID       string
}

type BuildBlockers struct {
	OpenExecutions         int64
	PendingTasks           int64
	AsyncCallbacks         int64
	DelayedRuns            int64
	PendingChildDeliveries int64
	ChildObligations       int64
}

type BuildFacts struct{ Executions, Running, PendingTasks int64 }

type BuildLifecycleFacts struct {
	QueryRetention     QueryRetentionFacts
	Admission          BuildAdmission
	Blockers           BuildBlockers
	ObservationVersion ObservationVersion
}

type BuildQueryIdentity struct {
	ArtifactDigest           string
	ConfigurationDigest      string
	ConfigurationVersion     string
	EnrollmentEvidenceDigest string
	ProbePolicyID            string
	ProbePolicyVersion       int64
	VerifierID               string
	MaximumProofValidity     time.Duration
}

type BuildRetirementRequest struct {
	BuildTarget
	RequestID       string
	ExpectedVersion int64
	ExpectedEpoch   int64
}

type BuildTarget struct {
	NamespaceTarget
	BuildID string
}

type CancelExecutionReceipt struct {
	Key
	Receipt
}

type CancelExecutionRequest struct {
	Key
	RequestID string `json:"request_id"`
	BuildID   string `json:"build_id"`
	Reason    string `json:"reason,omitempty"`
}

type CarriedSignal struct {
	Version  int       `json:"version"`
	Source   Key       `json:"source"`
	Sequence int64     `json:"sequence"`
	Time     time.Time `json:"time"`
	Signal   Signal    `json:"signal"`
}

type ChildCancellationSpec struct {
	CommandID string `json:"command_id"`
	TargetID  string `json:"target_id"`
}

type ChildDelivery struct {
	Source        Key               `json:"source"`
	ID            string            `json:"id"`
	Kind          ChildDeliveryKind `json:"kind"`
	Target        Key               `json:"target"`
	TargetBuildID string            `json:"target_build_id"`
	TargetQueue   string            `json:"target_queue"`
	Message       ChildMessage      `json:"message"`
	CreatedAt     time.Time         `json:"created_at"`
	AvailableAt   time.Time         `json:"available_at"`
	Owner         string            `json:"owner"`
	Epoch         int64             `json:"epoch"`
	Attempt       int64             `json:"attempt"`
	LeaseUntil    time.Time         `json:"lease_until"`
	Done          bool              `json:"done"`
	Disposition   string            `json:"disposition,omitempty"`
}

type ChildDeliveryBatch struct {
	Next          Execution
	Request       CommitRequest
	Children      []ChildExecution
	Parent        *ChildExecution
	ParentBuildID string
}

type ChildDeliveryClaimRequest struct {
	Namespace, BuildID, Owner string
	LeaseDuration             time.Duration
}

type ChildDeliveryKind string

type ChildDeliveryReceipt struct {
	Target Key `json:"target"`
	Receipt
	Disposition string `json:"disposition"`
}

type ChildDeliveryRequest struct {
	Source     Key    `json:"source"`
	DeliveryID string `json:"delivery_id"`
	RequestID  string `json:"request_id"`
	Owner      string `json:"owner"`
	Epoch      int64  `json:"epoch"`
}

type ChildExecution struct {
	Parent     Key `json:"parent"`
	CurrentKey Key `json:"current_key"`
	ChildStartSpec
	State     State     `json:"state"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type ChildMessage struct {
	Version        int               `json:"version"`
	CommandID      string            `json:"command_id"`
	CancellationID string            `json:"cancellation_id,omitempty"`
	Parent         Key               `json:"parent"`
	Child          Key               `json:"child"`
	Policy         ParentClosePolicy `json:"policy"`
	State          State             `json:"state,omitempty"`
	Output         []byte            `json:"output,omitempty"`
	CloseEvent     EventInput        `json:"close_event"`
	Disposition    string            `json:"disposition,omitempty"`
	FinalRun       *RunMetadata      `json:"final_run,omitempty"`
}

type ChildStartError struct {
	CommandID string
	Err       error
}

type ChildStartSpec struct {
	CommandID         string            `json:"command_id"`
	Start             StartRequest      `json:"start"`
	ParentQueue       string            `json:"parent_queue"`
	ParentClosePolicy ParentClosePolicy `json:"parent_close_policy"`
}

type ChildStarted struct {
	Version           int               `json:"version"`
	CommandID         string            `json:"command_id"`
	Child             Key               `json:"child"`
	WorkflowType      string            `json:"workflow_type"`
	BuildID           string            `json:"build_id"`
	Queue             string            `json:"queue"`
	ParentClosePolicy ParentClosePolicy `json:"parent_close_policy"`
}

type ClaimRequest struct {
	// BuildID restricts claims to a pinned build. Empty permits any build.
	BuildID       string
	Namespace     string
	Queue         string
	Kind          TaskKind
	Owner         string
	LeaseDuration time.Duration
}

type CommitRequest struct {
	Key
	RequestID        string                  `json:"request_id"`
	ExpectedRevision int64                   `json:"expected_revision"`
	Token            TaskToken               `json:"token"`
	Events           []EventInput            `json:"events"`
	Tasks            []TaskSpec              `json:"tasks,omitempty"`
	Children         []ChildStartSpec        `json:"children,omitempty"`
	CancelChildren   []ChildCancellationSpec `json:"cancel_children,omitempty"`
	Continuation     *ContinueSpec           `json:"continuation,omitempty"`
	State            State                   `json:"state,omitempty"`
	Output           []byte                  `json:"output,omitempty"`
	TaskUpdate       *TaskUpdate             `json:"task_update,omitempty"`
	Conditions       []TaskCondition         `json:"conditions,omitempty"`
	CancelTasks      []string                `json:"cancel_tasks,omitempty"`
	// CancelPendingTasks fences existing pending tasks before creating Tasks.
	// The source must complete; new cleanup work remains runnable.
	CancelPendingTasks bool `json:"cancel_pending_tasks,omitempty"`
	// AsyncSecret is required only for an asynchronous grant. Receipts store its
	// request fingerprint, never this secret. Do not log callback requests.
	AsyncSecret string `json:"async_secret,omitempty"`
	// IntentDigest binds the complete client request, independently of derived
	// revision/task observations. Only the trusted coordinator may construct it.
	// Keep it private; LookupReceipt uses it as a recovery proof.
	IntentDigest string `json:"intent_digest,omitempty"`
}

type CompatibilityFacts struct {
	// QueryRemovalGuardSchemaVersion describes native enforcement, not host trust readiness.
	QueryRemovalGuardSchemaVersion int `json:",omitempty"`
	WorkerDrainSchemaVersion       int `json:",omitempty"`
	// QueryRetentionSchemaVersion describes current store capability only. It is
	// not proof that a host artifact or controller is query-retention qualified.
	QueryRetentionSchemaVersion int `json:",omitempty"`
	NamespaceTarget
	Enrolled       bool
	SchemaVersion  int
	WriterProtocol int
	Version        int64
	EnrolledAt     time.Time
	ObservedAt     time.Time
}

type ContinuationBatch struct {
	RetrySuppressed bool
	Spec            ContinueSpec
	RetryEvent      *EventInput
	Execution       Execution
	History         []Event
	Terminal        EventInput
}

type ContinueSpec struct {
	RunID        string        `json:"run_id"`
	WorkflowType string        `json:"workflow_type"`
	BuildID      string        `json:"build_id"`
	Queue        string        `json:"queue"`
	Input        []byte        `json:"input,omitempty"`
	RunTimeout   time.Duration `json:"run_timeout,omitempty"`
}

type ContinuedRun struct {
	Version int          `json:"version"`
	Next    ContinueSpec `json:"next"`
}

type DeferralReferenceKind string

type DeferralTargetState string

type Delivery struct {
	ID             string
	Destination    Destination
	SchemaVersion  int
	InstallationID string
	Namespace      string
	AppID          string
	TenantID       string
	WorkflowID     string
	RunID          string
	SourceKind     string
	SourceID       string
	Sequence       int64
	OccurredAt     time.Time
	Action         string
	Outcome        string
	Target         string
	Metadata       AuditMetadata
	Fingerprint    string
}

type DeliveryClaim struct {
	DeliveryScope
	Owner         string
	Limit         int
	LeaseDuration time.Duration
}

type DeliveryCompatibilityStore interface {
	CheckDeliveryCompatibility(context.Context, int) error
}

type DeliveryRecord struct {
	Delivery      Delivery
	Owner         string
	Epoch         int64
	LeaseUntil    time.Time
	Attempts      int64
	NextAttemptAt time.Time
	AcceptedAt    time.Time
	DeliveredAt   time.Time
	Receipt       SinkReceipt
	ErrorCategory string
}

type DeliveryRetry struct {
	Token    DeliveryToken
	Delay    time.Duration
	Category string
}

type DeliveryScope struct {
	InstallationID string
	Destination    Destination
}

type DeliverySource struct {
	Key        Key
	Kind       string
	ID         string
	Sequence   int64
	OccurredAt time.Time
	Action     string
	Outcome    string
	Target     string
	Metadata   AuditMetadata
}

type DeliveryStatus struct {
	Blocked          int64
	Pending          int64
	OldestAcceptedAt time.Time
	Records          []DeliveryRecord
}

type DeliveryStatusRequest struct {
	DeliveryScope
	After string
	Limit int
}

type DeliveryToken struct {
	DeliveryScope
	ID    string
	Owner string
	Epoch int64
}

type Destination string

type Event struct {
	EventInput
	Sequence int64     `json:"sequence"`
	Time     time.Time `json:"time"`
}

type EventInput struct {
	Type    string `json:"type"`
	Payload []byte `json:"payload,omitempty"`
}

type Execution struct {
	Key
	WorkflowType        string    `json:"workflow_type"`
	BuildID             string    `json:"build_id"`
	AdmissionEpoch      int64     `json:"admission_epoch"`
	State               State     `json:"state"`
	Revision            int64     `json:"revision"`
	LastSequence        int64     `json:"last_sequence"`
	Input               []byte    `json:"input,omitempty"`
	Output              []byte    `json:"output,omitempty"`
	CreatedAt           time.Time `json:"created_at"`
	UpdatedAt           time.Time `json:"updated_at"`
	RunDeadlineAt       time.Time `json:"run_deadline_at,omitempty"`
	ExecutionDeadlineAt time.Time `json:"execution_deadline_at,omitempty"`
	// Each existing run is an independent root until an atomic handoff links it.
	FirstRunID     string               `json:"first_run_id"`
	PreviousRunID  string               `json:"previous_run_id,omitempty"`
	NextRunID      string               `json:"next_run_id,omitempty"`
	RunNumber      int64                `json:"run_number"`
	FirstStartedAt time.Time            `json:"first_started_at"`
	RunTimeout     time.Duration        `json:"run_timeout,omitempty"`
	RetryPolicy    *WorkflowRetryPolicy `json:"retry_policy,omitempty"`
	RetryAttempt   int64                `json:"retry_attempt"`
	RunAvailableAt time.Time            `json:"run_available_at"`
}

type ExecutionCancellation struct {
	Version   int    `json:"version"`
	RequestID string `json:"request_id"`
	Reason    string `json:"reason,omitempty"`
}

type ExecutionList struct {
	Namespace    string `json:"namespace"`
	WorkflowID   string `json:"workflow_id,omitempty"`
	WorkflowType string `json:"workflow_type,omitempty"`
	BuildID      string `json:"build_id,omitempty"`
	State        State  `json:"state,omitempty"`
	Cursor       string `json:"cursor,omitempty"`
	Limit        int    `json:"limit"`
}

type ExecutionTarget struct {
	Key
	Selection RunSelection `json:"selection,omitempty"`
}

type ExecutionTermination struct {
	Version   int    `json:"version"`
	RequestID string `json:"request_id"`
	Reason    string `json:"reason,omitempty"`
}

type ExecutionTimeout struct {
	Version    int                  `json:"version"`
	Kind       ExecutionTimeoutKind `json:"kind"`
	DeadlineAt time.Time            `json:"deadline_at"`
}

type ExecutionTimeoutClaimRequest struct {
	Namespace     string        `json:"namespace"`
	Owner         string        `json:"owner"`
	LeaseDuration time.Duration `json:"lease_duration"`
}

type ExecutionTimeoutKind string

type ExecutionTimeoutRequest struct {
	Key
	RequestID string `json:"request_id"`
	Owner     string `json:"owner"`
	Epoch     int64  `json:"epoch"`
}

type ExecutionTimeoutTask struct {
	Key
	Kind       ExecutionTimeoutKind `json:"kind"`
	DeadlineAt time.Time            `json:"deadline_at"`
	Owner      string               `json:"owner"`
	Epoch      int64                `json:"epoch"`
	Attempt    int64                `json:"attempt"`
	LeaseUntil time.Time            `json:"lease_until"`
}

type FinishQueryRemovalRequest struct {
	Fence     QueryRemovalFence
	RequestID string
}

type HeartbeatConfig struct {
	Timeout time.Duration `json:"timeout"`
}

type HeartbeatRequest struct {
	Key
	RequestID     string        `json:"request_id"`
	Token         TaskToken     `json:"token"`
	Sequence      int64         `json:"sequence"`
	Progress      []byte        `json:"progress,omitempty"`
	LeaseDuration time.Duration `json:"lease_duration"`
	// AsyncSecret proves ownership after handoff. Asynchronous heartbeats use
	// zero LeaseDuration because they have no worker lease to renew.
	AsyncSecret string `json:"async_secret,omitempty"`
}

type Key struct {
	Namespace  string `json:"namespace"`
	WorkflowID string `json:"workflow_id"`
	RunID      string `json:"run_id"`
}

type LegacyAttempt struct {
	Attempt   Delivery
	OutcomeID string
}

type LegacyAttemptList struct {
	InstallationID string
	Namespace      string
	After          string
	Limit          int
}

type LegacyAuditStore interface {
	BeginLegacyAttempt(context.Context, SecurityAudit) (LegacyAttempt, error)
	CompleteLegacyAttempt(context.Context, LegacyOutcome) error
	UnresolvedLegacyAttempts(context.Context, LegacyAttemptList) ([]LegacyAttempt, error)
}

type LegacyOutcome struct {
	AttemptID string // the accepted attempt delivery ID
	Audit     SecurityAudit
}

type LifecycleOperation string

type LifecycleReceipt struct {
	WorkerDrain *WorkerDrainRequest `json:",omitempty"`
	NamespaceTarget
	Operation       LifecycleOperation
	RequestID       string
	RequestDigest   string
	CommandDigest   string
	ResponseVersion int
	AcceptedAt      time.Time
	DeliveryID      string
	Enrollment      *RetirementEnrollment
	QueryRuntime    *QueryRuntimeBinding
	QueryAbort      *QueryRemovalAbortEvidence `json:",omitempty"`
	Build           *BuildAdmission
}

type LifecycleReceiptLookup struct {
	NamespaceTarget
	Operation     LifecycleOperation
	RequestID     string
	RequestDigest string
	CommandDigest string
}

type LifecycleStore interface {
	WorkerDrainStore
	RetirementEnrollmentStore
	RegisterBuild(context.Context, RegisterBuildRequest) (LifecycleReceipt, error)
	InspectBuildLifecycle(context.Context, BuildTarget) (BuildLifecycleFacts, error)
	BeginBuildRetirement(context.Context, BuildRetirementRequest) (LifecycleReceipt, error)
	FinalizeBuildRetirement(context.Context, BuildRetirementRequest) (LifecycleReceipt, error)
	AbortBuildRetirement(context.Context, BuildRetirementRequest) (LifecycleReceipt, error)
}

type NamespaceConfig struct {
	InstallationID string
	Namespace      string
	AppID          string
	TenantID       string
	RequireAudit   bool
	RequireHooks   bool
	SchemaVersion  int
}

type NamespaceList struct {
	InstallationID string
	After          string
	Limit          int
}

type NamespaceRecord struct {
	NamespaceConfig
	CoverageStartedAt time.Time
	WriterProtocol    int
}

type NamespaceStore interface {
	RegisterNamespace(context.Context, NamespaceConfig) (NamespaceRecord, error)
	GetNamespace(context.Context, string, string) (NamespaceRecord, error)
	ListNamespaces(context.Context, NamespaceList) ([]NamespaceRecord, error)
}

type NamespaceTarget struct {
	InstallationID string
	Namespace      string
}

type ObservationVersion struct {
	CompatibilityVersion int64
	BuildVersion         int64
	ObservedAt           time.Time
}

type OutboxStore interface {
	AppendSecurityAudit(context.Context, SecurityAudit) (Delivery, error)
	ClaimDeliveries(context.Context, DeliveryClaim) ([]DeliveryRecord, error)
	RenewDelivery(context.Context, DeliveryToken, time.Duration) (time.Time, error)
	AcknowledgeDelivery(context.Context, DeliveryToken, SinkReceipt) error
	RetryDelivery(context.Context, DeliveryRetry) error
	BlockDelivery(context.Context, DeliveryToken) error
	DeliveryStatus(context.Context, DeliveryStatusRequest) (DeliveryStatus, error)
}

type ParentClosePolicy string

type QueryRejectionDiagnostic struct {
	Stage           string             `json:"stage"`
	Reason          string             `json:"reason"`
	SQLState        string             `json:"sqlstate,omitempty"`
	Target          QueryRuntimeTarget `json:"target"`
	RequestID       string             `json:"request_id,omitempty"`
	Operation       LifecycleOperation `json:"operation,omitempty"`
	BindingState    string             `json:"binding_state,omitempty"`
	BindingVersion  int64              `json:"binding_version,omitempty"`
	VerifiedAt      time.Time          `json:"verified_at"`
	ValidUntil      time.Time          `json:"valid_until"`
	ObservedAt      time.Time          `json:"observed_at"`
	SettledAt       time.Time          `json:"settled_at"`
	IdentityMatches bool               `json:"identity_matches,omitempty"`
	Removed         bool               `json:"removed,omitempty"`
	AdmissionClosed bool               `json:"admission_closed,omitempty"`
	InFlight        int64              `json:"in_flight,omitempty"`
	UnknownClaims   int64              `json:"unknown_claims,omitempty"`
	ExpectedDigest  string             `json:"expected_digest,omitempty"`
	ActualDigest    string             `json:"actual_digest,omitempty"`
}

type QueryRejectionError struct {
	// contains filtered or unexported fields
}

type QueryRemovalAbortEvidence struct {
	Fence      QueryRemovalFence
	Settlement QueryRemovalSettlement
}

type QueryRemovalAbortVerifier interface {
	VerifyAbort(context.Context, QueryRuntimeBinding, QueryRemovalFence) (QueryRemovalSettlement, QueryRuntimeVerification, error)
}

type QueryRemovalClosure struct {
	ExternalScope   QueryRemovalExternalScope
	CutoffReceiptID string
	CutoffDigest    string
	CoverageDigest  string
	Disposition     string
	TerminalDigest  string
	CutoffAt        time.Time
	TerminalAt      time.Time
	EvidenceDigest  string
	Attestation     string
}

type QueryRemovalCommitLookup struct{ QueryRemovalRevalidationLookup }

type QueryRemovalCommitReceipt struct {
	Request       QueryRemovalCommitRequest
	RequestDigest string
	ReceiptDigest string
	AcceptedAt    time.Time
	DeliveryID    string
}

type QueryRemovalCommitRequest struct {
	Guard                 QueryRemovalGuardReference
	RequestID             string
	CommandDigest         string
	ExpectedCurrentDigest string
	CurrentRequestID      string
	Permission            QueryRemovalPermission
}

type QueryRemovalCommitStatus struct {
	Receipt    QueryRemovalCommitReceipt
	Guard      QueryRemovalGuard
	Current    QueryRemovalCurrent
	ObservedAt time.Time
}

type QueryRemovalCurrent struct {
	GuardID        string
	RootDigest     string
	RequestID      string
	MaterialDigest string
	ObservedAt     time.Time
}

type QueryRemovalDisposition string

type QueryRemovalEvidence struct {
	BuildFinalizationRequestID     string
	BuildFinalizationRequestDigest string
	Disposition                    string
	CandidateProof                 QueryRuntimeVerification
	SurvivorProof                  QueryRuntimeVerification
	Process                        QueryRemovalProcess
	Positive                       QueryRemovalPositiveEffect
	ExcludedInstances              []string
	ObservedAt                     time.Time
	ValidUntil                     time.Time
	CandidateAttestation           string
	SurvivorAttestation            string
	ProcessAttestation             string
	ScopeAttestation               string
	PermissionAttestation          string
	ResultAttestation              string
	PreEffectAttestation           string
	AssociationAttestation         string
}

type QueryRemovalExternalScope struct {
	AuthorityID             string
	OperationScopeID        string
	AttemptID               string
	ProviderOperationID     string
	CoverageDigest          string
	ExcludedInstancesDigest string
	ProducerID              string
	ProfileID               string
	ProfileVersion          int64
	VerifierID              string
}

type QueryRemovalFacts struct {
	Fence     QueryRemovalFence
	CheckedAt time.Time
}

type QueryRemovalFence struct {
	Candidate             QueryRuntimeIdentity
	CandidateStateVersion int64
	Survivor              QueryRuntimeIdentity
	SurvivorStateVersion  int64
	SurvivorProof         QueryRuntimeVerification
	BuildEpoch            int64
	BuildVersion          int64
	BuildState            string
	RemovalEpoch          int64
	RequestID             string
	AcceptedAt            time.Time
	ValidUntil            time.Time
}

type QueryRemovalGuard struct {
	GuardID             string
	RootDigest          string
	OriginalDigest      string
	ExternalScopeDigest string
	CandidateDigest     string
	ProcessDigest       string
	InitialRequestID    string
	State               string
	CloseRequestID      string
	CloseDigest         string
}

type QueryRemovalGuardCloseReceipt struct {
	Request       QueryRemovalGuardCloseRequest
	RequestDigest string
	ReceiptDigest string
	AcceptedAt    time.Time
	DeliveryID    string
}

type QueryRemovalGuardCloseRequest struct {
	Guard         QueryRemovalGuardReference
	RequestID     string
	CommandDigest string
	Closure       QueryRemovalClosure
}

type QueryRemovalGuardProbe struct {
	Original          QueryRemovalOriginal
	ExternalScope     QueryRemovalExternalScope
	EvidenceReference string
	Survivor          QueryRuntimeTarget
	SurvivorVersion   int64
}

type QueryRemovalGuardReceipt struct {
	Commit *QueryRemovalCommitReceipt
	Close  *QueryRemovalGuardCloseReceipt
}

type QueryRemovalGuardReceiptLookup struct {
	QueryRemovalRevalidationLookup
	Kind string
}

type QueryRemovalGuardReference struct {
	QueryRuntimeTarget
	OriginalDigest string
	GuardID        string
	RootDigest     string
}

type QueryRemovalGuardVerifier interface {
	VerifyRevalidation(context.Context, QueryRemovalGuardProbe) (QueryRemovalEvidence, error)
	VerifyPermission(context.Context, QueryRemovalGuardReference, string) (QueryRemovalPermission, error)
	VerifyClosure(context.Context, QueryRemovalGuardReference, string) (QueryRemovalClosure, error)
}

type QueryRemovalOriginal struct {
	QueryRuntimeTarget
	BeginRequestID        string
	BeginRequestDigest    string
	FenceDigest           string
	CandidateStateVersion int64
	RemovalEpoch          int64
}

type QueryRemovalPermission struct {
	ExternalScope         QueryRemovalExternalScope
	PermissionID          string
	PermissionDigest      string
	CommandID             string
	StepDigest            string
	ResourceDigest        string
	IncarnationDigest     string
	RevalidationRequestID string
	RevalidationDigest    string
	AcceptedAt            time.Time
	EvidenceDigest        string
	Attestation           string
}

type QueryRemovalPositiveEffect struct {
	PermissionID      string
	PermissionDigest  string
	ResultID          string
	ResultDigest      string
	CommandID         string
	ResourceID        string
	IncarnationID     string
	AssociationDigest string
	PreEffectDigest   string
	PreEffectAt       time.Time
	AcceptedAt        time.Time
	CompletedAt       time.Time
}

type QueryRemovalPreparedAbortVerifier interface {
	VerifyPreparedAbort(ctx context.Context, binding QueryRuntimeBinding, fence QueryRemovalFence, requestID, commandDigest string) (QueryRemovalSettlement, QueryRuntimeVerification, error)
}

type QueryRemovalProcess struct {
	HostID           string
	ProcessID        string
	DescriptorID     string
	DescriptorDigest string
	RegistrationID   string
	DrainRuntimeID   string
	DrainOperationID string
	DrainDeadline    time.Time
	Role             string
	Admission        string
	Claims           string
	DrainOutcome     string
	ObservedAt       time.Time
	ValidUntil       time.Time
}

type QueryRemovalRevalidationLookup struct {
	QueryRuntimeTarget
	RequestID     string
	CommandDigest string
	RequestDigest string
}

type QueryRemovalRevalidationMaterial struct {
	Request            QueryRemovalRevalidationRequest
	RequestDigest      string
	GuardID            string
	RootDigest         string
	Candidate          QueryRuntimeIdentity
	CandidateState     string
	CandidateVersion   int64
	RemovalEpoch       int64
	Build              BuildAdmission
	RetainedExecutions int64
	Survivor           QueryRuntimeIdentity
	SurvivorVersion    int64
	AcceptedAt         time.Time
	ValidUntil         time.Time
	DeliveryID         string
	MaterialDigest     string
}

type QueryRemovalRevalidationReceipt struct {
	Schema              string    `json:"schema"`
	GuardID             string    `json:"guard_id"`
	RootDigest          string    `json:"root_digest"`
	RequestID           string    `json:"request_id"`
	RequestDigest       string    `json:"request_digest"`
	MaterialDigest      string    `json:"material_digest"`
	OriginalDigest      string    `json:"original_digest"`
	ExternalScopeDigest string    `json:"external_scope_digest"`
	CandidateDigest     string    `json:"candidate_digest"`
	BuildDigest         string    `json:"build_digest"`
	SurvivorDigest      string    `json:"survivor_digest"`
	ProcessDigest       string    `json:"process_digest"`
	ExclusionDigest     string    `json:"exclusion_digest"`
	CoverageDigest      string    `json:"coverage_digest"`
	Disposition         string    `json:"disposition"`
	AcceptedAt          time.Time `json:"accepted_at"`
	ValidUntil          time.Time `json:"valid_until"`
}

type QueryRemovalRevalidationRequest struct {
	Original              QueryRemovalOriginal
	ExternalScope         QueryRemovalExternalScope
	RequestID             string
	CommandDigest         string
	ExpectedCurrentDigest string
	Survivor              QueryRuntimeTarget
	SurvivorVersion       int64
	Evidence              QueryRemovalEvidence
}

type QueryRemovalRevalidationStore interface {
	RevalidateQueryRuntimeRemoval(context.Context, QueryRemovalRevalidationRequest) (QueryRemovalRevalidationReceipt, error)
	LookupQueryRemovalRevalidation(context.Context, QueryRemovalRevalidationLookup) (QueryRemovalRevalidationMaterial, error)
	BindQueryRemovalCommit(context.Context, QueryRemovalCommitRequest) (QueryRemovalCommitReceipt, error)
	CheckQueryRemovalCommit(context.Context, QueryRemovalCommitLookup) (QueryRemovalCommitStatus, error)
	CloseQueryRemovalGuard(context.Context, QueryRemovalGuardCloseRequest) (QueryRemovalGuardCloseReceipt, error)
	LookupQueryRemovalGuardReceipt(context.Context, QueryRemovalGuardReceiptLookup) (QueryRemovalGuardReceipt, error)
}

type QueryRemovalSettlement struct {
	FenceDigest         string
	VerifierID          string
	EvidenceDigest      string
	Disposition         QueryRemovalDisposition
	ExternalOperationID string
	SettledAt           time.Time
}

type QueryRetentionFacts struct {
	BuildTarget
	RetainedExecutions int64
	ActiveBindings     int64
	VerifiedBindings   int64
	ObservedAt         time.Time
}

type QueryRuntimeBinding struct {
	QueryRuntimeIdentity
	State        string
	Version      int64
	RemovalEpoch int64
	CreatedAt    time.Time
	ChangedAt    time.Time
	Verification QueryRuntimeVerification
	Removal      QueryRemovalFence
}

type QueryRuntimeIdentity struct {
	QueryRuntimeTarget
	InstanceID      string
	IdentityVersion int64
	BuildIdentity   BuildQueryIdentity
}

type QueryRuntimeList struct {
	NamespaceTarget
	InstanceID string
	BuildID    string
	After      string
	Limit      int
}

type QueryRuntimePage struct {
	Items      []QueryRuntimeBinding
	Next       string
	ObservedAt time.Time
}

type QueryRuntimeStore interface {
	RegisterQueryRuntime(context.Context, RegisterQueryRuntimeRequest) (LifecycleReceipt, error)
	RecordQueryRuntimeVerification(context.Context, VerifyQueryRuntimeRequest) (LifecycleReceipt, error)
	InspectQueryRetention(context.Context, BuildTarget) (QueryRetentionFacts, error)
	ListQueryRuntimes(context.Context, QueryRuntimeList) (QueryRuntimePage, error)
	BeginQueryRuntimeRemoval(context.Context, BeginQueryRemovalRequest) (LifecycleReceipt, error)
	CheckQueryRuntimeRemoval(context.Context, QueryRemovalFence) (QueryRemovalFacts, error)
	FinishQueryRuntimeRemoval(context.Context, FinishQueryRemovalRequest) (LifecycleReceipt, error)
	AbortQueryRuntimeRemoval(context.Context, AbortQueryRemovalRequest) (LifecycleReceipt, error)
}

type QueryRuntimeTarget struct {
	BuildTarget
	RuntimeID string
}

type QueryRuntimeVerification struct {
	Identity           QueryRuntimeIdentity
	ProofID            string
	VerifierID         string
	EvidenceDigest     string
	ProbePolicyID      string
	ProbePolicyVersion int64
	VerifiedAt         time.Time
	ValidUntil         time.Time
	AcceptedAt         time.Time
}

type ReadPosition struct {
	CreatedAt  time.Time `json:"created_at"`
	WorkflowID string    `json:"workflow_id"`
	ID         string    `json:"id"`
	Binding    string    `json:"binding"`
}

type ReadStore interface {
	ListExecutions(context.Context, ExecutionList) ([]Execution, string, error)
	ListTasks(context.Context, TaskList) ([]Task, string, error)
	ReadDeliveryStatus(context.Context, ScopedDeliveryStatus) (DeliveryStatus, error)
	ReadBuildFacts(context.Context, string, string) (BuildFacts, error)
}

type Receipt struct {
	Revision      int64 `json:"revision"`
	FirstSequence int64 `json:"first_sequence"`
	LastSequence  int64 `json:"last_sequence"`
}

type ReceiptRequest struct {
	Key
	RequestID    string `json:"request_id"`
	IntentDigest string `json:"intent_digest"`
}

type RegisterBuildRequest struct {
	Identity      *BuildQueryIdentity `json:",omitempty"`
	CommandDigest string              `json:",omitempty"`
	BuildTarget
	RequestID       string
	ExpectedVersion int64
}

type RegisterQueryRuntimeRequest struct {
	Identity      QueryRuntimeIdentity
	RequestID     string
	CommandDigest string
}

type RetirementEnrollment struct {
	Compatibility         CompatibilityFacts
	HistoricalBuildCount  int64
	HistoricalBuildDigest string
}

type RetirementEnrollmentRequest struct {
	NamespaceTarget
	RequestID      string
	SchemaVersion  int
	WriterProtocol int
}

type RetirementEnrollmentStore interface {
	InspectCompatibility(context.Context, NamespaceTarget) (CompatibilityFacts, error)
	EnrollRetirement(context.Context, RetirementEnrollmentRequest) (LifecycleReceipt, error)
	LookupLifecycleReceipt(context.Context, LifecycleReceiptLookup) (LifecycleReceipt, error)
}

type RunMetadata struct {
	RetryAttempt   int64     `json:"retry_attempt,omitempty"`
	RunAvailableAt time.Time `json:"run_available_at,omitzero"`
	Key
	FirstRunID          string        `json:"first_run_id"`
	PreviousRunID       string        `json:"previous_run_id,omitempty"`
	RunNumber           int64         `json:"run_number"`
	FirstStartedAt      time.Time     `json:"first_started_at"`
	CreatedAt           time.Time     `json:"created_at"`
	RunTimeout          time.Duration `json:"run_timeout,omitempty"`
	RunDeadlineAt       time.Time     `json:"run_deadline_at,omitempty"`
	ExecutionDeadlineAt time.Time     `json:"execution_deadline_at,omitempty"`
}

type RunSelection string

type RunStarted struct {
	Version int         `json:"version"`
	Run     RunMetadata `json:"run"`
}

type ScopedDeliveryStatus struct {
	DeliveryStatusRequest
	Key
}

type SecurityAudit struct {
	InstallationID string
	Namespace      string
	WorkflowID     string
	RunID          string
	AttemptID      string
	OccurredAt     time.Time
	Action         string
	Outcome        string
	Target         string
	Metadata       AuditMetadata
}

type Signal struct {
	Version int    `json:"version"`
	ID      string `json:"id"`
	Name    string `json:"name"`
	Input   []byte `json:"input,omitempty"`
}

type SignalConsumption struct {
	Version   int    `json:"version"`
	CommandID string `json:"command_id"`
	SignalID  string `json:"signal_id"`
}

type SignalReceipt struct {
	Key
	Receipt
	Started bool `json:"started"`
}

type SignalRequest struct {
	Key
	RequestID string `json:"request_id"`
	BuildID   string `json:"build_id"`
	Name      string `json:"name"`
	Input     []byte `json:"input,omitempty"`
}

type SignalStartOutcome struct {
	Receipt   SignalReceipt
	Recovered bool
}

type SignalStartOutcomeStore interface {
	SignalWithStartOutcome(context.Context, SignalWithStartRequest) (SignalStartOutcome, error)
}

type SignalWithStartRequest struct {
	Start StartRequest `json:"start"`
	Name  string       `json:"name"`
	Input []byte       `json:"input,omitempty"`
}

type SinkReceipt struct {
	MappingVersion  int
	SinkFingerprint string
	Evidence        string
	ID              string
	DeliveryID      string
	Destination     Destination
	SchemaVersion   int
	Fingerprint     string
}

type StartRequest struct {
	Key
	RequestID        string               `json:"request_id"`
	WorkflowType     string               `json:"workflow_type"`
	BuildID          string               `json:"build_id"`
	Queue            string               `json:"queue"`
	Input            []byte               `json:"input,omitempty"`
	RunTimeout       time.Duration        `json:"run_timeout,omitempty"`
	ExecutionTimeout time.Duration        `json:"execution_timeout,omitempty"`
	RetryPolicy      *WorkflowRetryPolicy `json:"retry_policy,omitempty"`
}

type State string

type Store interface {
	StartExecution(context.Context, StartRequest) (Receipt, error)
	// Signal receipts are scoped by namespace/workflow across runs and survive
	// target closure. Acceptance records history and runnable work atomically.
	SignalExecution(context.Context, SignalRequest) (SignalReceipt, error)
	SignalWithStart(context.Context, SignalWithStartRequest) (SignalReceipt, error)
	// RequestCancelExecution records acceptance and a wakeup, not terminal state.
	RequestCancelExecution(context.Context, CancelExecutionRequest) (CancelExecutionReceipt, error)
	GetExecution(context.Context, Key) (Execution, error)
	// ResolveExecution fixes one snapshot without claiming tasks or writing history.
	ResolveExecution(context.Context, ExecutionTarget) (Execution, error)
	GetChildExecution(context.Context, Key, string) (ChildExecution, error)
	GetParentExecution(context.Context, Key) (ChildExecution, error)
	ListChildExecutions(context.Context, Key, string, int) ([]ChildExecution, error)
	ClaimChildDelivery(context.Context, ChildDeliveryClaimRequest) (*ChildDelivery, error)
	ApplyChildDelivery(context.Context, ChildDeliveryRequest) (ChildDeliveryReceipt, error)
	GetChildDelivery(context.Context, Key, string) (ChildDelivery, error)
	ListChildDeliveries(context.Context, Key, string, int) ([]ChildDelivery, error)
	// GetTask returns persisted state, including finished tasks, in one namespace.
	GetTask(context.Context, Key, string) (Task, error)
	// ReadHistory returns events after the exclusive cursor, in sequence order.
	// Limits must be between 1 and 1000. A missing run is ErrNotFound.
	ReadHistory(ctx context.Context, key Key, after int64, limit int) ([]Event, error)
	// ClaimTask returns nil when no eligible task exists. Reclaims increment epoch.
	ClaimTask(context.Context, ClaimRequest) (*Task, error)
	// ClaimTimeoutTask grants expired activity processing without consuming an execution attempt.
	ClaimTimeoutTask(context.Context, TimeoutClaimRequest) (*Task, error)
	// Execution expiry has independent ownership and needs no workflow build.
	ClaimExecutionTimeout(context.Context, ExecutionTimeoutClaimRequest) (*ExecutionTimeoutTask, error)
	ApplyExecutionTimeout(context.Context, ExecutionTimeoutRequest) (Receipt, error)
	RenewTask(context.Context, Key, TaskToken, time.Duration) (time.Time, error)
	// RecordHeartbeat changes task progress without appending workflow history.
	RecordHeartbeat(context.Context, HeartbeatRequest) (Receipt, error)
	CommitTransition(context.Context, CommitRequest) (Receipt, error)
	// LookupReceipt recovers a matching client intent without checking current
	// ownership or lifecycle. A missing receipt is false,nil; a missing run is
	// ErrNotFound. Errors return false and a zero receipt. A miss cannot rule out
	// an in-flight commit. Legacy receipts reject lookup with ErrRequestConflict.
	LookupReceipt(context.Context, ReceiptRequest) (Receipt, bool, error)
}

type Task struct {
	Key
	TaskSpec
	Owner      string        `json:"owner"`
	Epoch      int64         `json:"epoch"`
	Attempt    int64         `json:"attempt"`
	LeaseUntil time.Time     `json:"lease_until"`
	Version    int64         `json:"version"`
	DeadlineAt time.Time     `json:"deadline_at,omitempty"`
	Progress   []byte        `json:"progress,omitempty"`
	Done       bool          `json:"done"`
	LeaseKind  TaskLeaseKind `json:"lease_kind,omitempty"`
	// HeartbeatAt starts at attempt activation and advances on accepted progress.
	HeartbeatAt       time.Time     `json:"heartbeat_at,omitempty"`
	HeartbeatTimeout  time.Duration `json:"heartbeat_timeout,omitempty"`
	HeartbeatLimit    time.Time     `json:"heartbeat_limit,omitempty"`
	HeartbeatSequence int64         `json:"heartbeat_sequence,omitempty"`
	HeartbeatEpoch    int64         `json:"heartbeat_epoch,omitempty"`
	// AsyncKeyHash verifies callback secrets without exposing them in task JSON.
	AsyncKeyHash string `json:"-"`
}

type TaskAction string

type TaskCondition struct {
	TaskID          string `json:"task_id"`
	Version         int64  `json:"version"`
	DeadlineElapsed bool   `json:"deadline_elapsed,omitempty"`
}

type TaskKind string

type TaskLeaseKind string

type TaskList struct {
	Key
	Kind   TaskKind `json:"kind,omitempty"`
	Cursor string   `json:"cursor,omitempty"`
	Limit  int      `json:"limit"`
}

type TaskSpec struct {
	ID          string    `json:"id"`
	Kind        TaskKind  `json:"kind"`
	Queue       string    `json:"queue"`
	Payload     []byte    `json:"payload,omitempty"`
	AvailableAt time.Time `json:"available_at"`
	// Relative availability and deadline are resolved by the store on insertion.
	// AvailableAt and AvailableAfter are mutually exclusive. DeadlineAfter is
	// measured from the resolved availability, including a queued retry delay.
	AvailableAfter time.Duration `json:"available_after,omitempty"`
	DeadlineAfter  time.Duration `json:"deadline_after,omitempty"`
	// DeadlineLimit caps the resolved deadline, including when availability is later.
	DeadlineLimit *time.Time `json:"deadline_limit,omitempty"`
}

type TaskToken struct {
	TaskID    string        `json:"task_id"`
	Owner     string        `json:"owner"`
	Epoch     int64         `json:"epoch"`
	LeaseKind TaskLeaseKind `json:"lease_kind,omitempty"`
}

type TaskUpdate struct {
	Action        TaskAction     `json:"action"`
	RetryAt       time.Time      `json:"retry_at,omitempty"`
	RetryAfter    time.Duration  `json:"retry_after,omitempty"`
	DeadlineAfter *time.Duration `json:"deadline_after,omitempty"`
	Progress      *[]byte        `json:"progress,omitempty"`
	// DeadlineLimit caps a newly calculated or retained deadline.
	DeadlineLimit *time.Time `json:"deadline_limit,omitempty"`
	// LeaseDuration renews a retained execution grant in the same transaction.
	LeaseDuration time.Duration `json:"lease_duration,omitempty"`
	// Heartbeat enables progress recording for this retained activity grant.
	Heartbeat *HeartbeatConfig `json:"heartbeat,omitempty"`
	// AsyncKeyHash transfers a live activity grant to asynchronous ownership.
	// Only TaskAwait accepts it; all other update fields must be absent.
	AsyncKeyHash string `json:"async_key_hash,omitempty"`
}

type TimeoutClaimRequest struct {
	Namespace     string
	BuildID       string
	Owner         string
	LeaseDuration time.Duration
}

type VerifyQueryRuntimeRequest struct {
	QueryRuntimeTarget
	RequestID       string
	CommandDigest   string
	ExpectedVersion int64
	Verification    QueryRuntimeVerification
}

type WorkerDrainRequest struct {
	WorkerProcessIdentity
	RequestID     string
	CommandDigest string
	OperationID   string
	Deadline      time.Time
}

type WorkerDrainStore interface {
	RequestWorkerDrain(context.Context, WorkerDrainRequest) (LifecycleReceipt, error)
}

type WorkerProcessIdentity struct {
	BuildTarget
	Queue      string
	RuntimeID  string
	InstanceID string
}

type WorkflowRetryPolicy struct {
	InitialInterval    time.Duration `json:"initial_interval"`
	MaximumInterval    time.Duration `json:"maximum_interval"`
	BackoffCoefficient float64       `json:"backoff_coefficient"`
	MaximumAttempts    int64         `json:"maximum_attempts"`
	NonRetryableTypes  []string      `json:"non_retryable_types,omitempty"`
}

type WorkflowRetryScheduled struct {
	Version     int           `json:"version"`
	Next        RunMetadata   `json:"next"`
	Delay       time.Duration `json:"delay"`
	FailureType string        `json:"failure_type"`
}

type WorkflowRetrySuppressed struct {
	Version            int    `json:"version"`
	Reason             string `json:"reason"`
	SourceLastSequence int64  `json:"source_last_sequence"`
	FailureType        string `json:"failure_type"`
}

type WorkflowTaskDeferral struct {
	Key
	TaskID         string
	RequestID      string
	SourceEpoch    int64
	SourceRevision int64
	ReferenceKind  DeferralReferenceKind
	CommandID      string
	WorkflowTaskDeferralReceipt
	Active bool
}

type WorkflowTaskDeferralReceipt struct {
	Receipt
	TaskVersion           int64
	DeferralCount         int64
	RecordedAt            time.Time
	RetryAt               time.Time
	Reason                string
	TargetBuildID         string
	TargetRetirementEpoch int64
	TargetState           DeferralTargetState
	PolicyVersion         int
}

type WorkflowTaskDeferralRequest struct {
	Key
	RequestID             string
	Token                 TaskToken
	ExpectedRevision      int64
	TargetBuildID         string
	TargetRetirementEpoch int64
	TargetState           DeferralTargetState
	ReferenceKind         DeferralReferenceKind
	CommandID             string
}

type WorkflowTaskDeferralStore interface {
	DeferWorkflowTask(context.Context, WorkflowTaskDeferralRequest) (WorkflowTaskDeferralReceipt, error)
	GetWorkflowTaskDeferral(context.Context, Key, string) (WorkflowTaskDeferral, error)
}