@agent-vm/gateway-control-contracts 0.0.113 → 0.0.115

package/dist/index.js

@@ -1,9 +1,1433 @@
-import { ControlCorrelationSchema, ControlRpcErrorSchema, ControlRpcResultBaseSchema, ControlSessionStateSchema, KnownControlDomainSchema } from "@agent-vm/control-protocol-contracts";
+import { GatewayRuntimeFrameworkIdentitySchema, GatewayRuntimeFrameworkKindSchema, GatewayRuntimeTrustedInvocationContextSchema, GatewayRuntimeTrustedInvocationCorrelationSchema, GatewayRuntimeTrustedInvocationPrincipalSchema, GatewayRuntimeTrustedInvocationPrincipalSchema as GatewayRuntimeTrustedInvocationPrincipalSchema$1, GatewayRuntimeTrustedInvocationRequesterSchema, GatewayStablePrincipalDigestSchema, ManagedAgentProjectionSchema, ManagedAgentProjectionSchema as ManagedAgentProjectionSchema$1 } from "@agent-vm/agent-portal-sdk/contracts";
+import { CONTROL_PROTOCOL_VERSION, ControlCorrelationSchema, ControlRpcErrorSchema, ControlRpcResultBaseSchema, ControlSessionStateSchema, KnownControlDomainSchema } from "@agent-vm/control-protocol-contracts";
 import { z } from "zod/v4";
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
+import { jsonObjectSchema, mcpConfigSchema, toolPortalBackendKindSchema, toolPortalConfigSchema } from "@agent-vm/config-contracts";
+//#region src/gateway-control-principal.ts
+function lengthPrefixedUtf8(value) {
+	return `${Buffer.byteLength(value, "utf8")}:${value}`;
+}
+function canonicalStablePrincipalMaterial(principal) {
+	const frameworkIdentityValue = principal.frameworkIdentity.kind === "openclaw" ? principal.frameworkIdentity.agentId : principal.frameworkIdentity.profileName;
+	return [
+		principal.agentId,
+		principal.frameworkIdentity.kind,
+		frameworkIdentityValue,
+		principal.toolPortalProfileId,
+		principal.profileAssignmentRevision
+	].map(lengthPrefixedUtf8).join("");
+}
+function deriveGatewayControlStablePrincipal(options) {
+	return GatewayStablePrincipalDigestSchema.parse(createHash("sha256").update("agent-vm-gateway-stable-principal-v4", "utf8").update("\0").update(canonicalStablePrincipalMaterial(options.principal), "utf8").digest("hex"));
+}
+//#endregion
+//#region src/gateway-runtime-portal-context.ts
+const GatewayRuntimePortalSurfaceClassSchema = z.enum(["mcp", "protected_uds"]);
+const GatewayRuntimePortalSemanticSnapshotSchema = z.object({
+	activeRevision: z.string().min(1),
+	agentProjections: z.record(z.string().min(1), ManagedAgentProjectionSchema$1),
+	bindingRevision: z.string().min(1),
+	catalogRevision: z.string().min(1),
+	desiredRevision: z.string().min(1),
+	profilePolicyRevision: z.string().min(1),
+	projectionCohortDigest: z.string().regex(/^projection-cohort:[a-f0-9]{64}$/u),
+	providerRevision: z.string().min(1),
+	schemaRevision: z.string().min(1),
+	schemaVersion: z.literal(1),
+	surfaceEligibilityByProfile: z.record(z.string().min(1), z.record(z.string().min(1), z.array(GatewayRuntimePortalSurfaceClassSchema).min(1)))
+}).strict();
+//#endregion
+//#region src/gateway-runtime-approval.ts
+const GATEWAY_RUNTIME_APPROVAL_AUDIENCE = "agent-vm-controller-approval";
+const GatewayRuntimeApprovalFingerprintSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+function canonicalApprovalJson(value) {
+	if (value === null || typeof value === "boolean" || typeof value === "string") return JSON.stringify(value);
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new TypeError("Approval fingerprint values must be finite.");
+		return JSON.stringify(value);
+	}
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalApprovalJson(item)).join(",")}]`;
+	if (typeof value === "object") return `{${Object.entries(value).filter(([, fieldValue]) => fieldValue !== void 0).toSorted(([leftName], [rightName]) => leftName.localeCompare(rightName)).map(([fieldName, fieldValue]) => `${JSON.stringify(fieldName)}:${canonicalApprovalJson(fieldValue)}`).join(",")}}`;
+	throw new TypeError("Approval fingerprint values must be JSON-compatible.");
+}
+const GatewayRuntimeApprovalAuthorityContextSchema = z.object({
+	controllerEpoch: z.string().min(1),
+	frameworkEpoch: z.string().min(1),
+	gatewayEpoch: z.string().min(1),
+	runtimeEpoch: z.string().min(1),
+	zoneId: z.string().min(1)
+}).strict();
+const GatewayRuntimeApprovalSemanticRevisionCohortSchema = z.object({
+	activeRevision: z.string().min(1),
+	bindingRevision: z.string().min(1),
+	catalogRevision: z.string().min(1),
+	profilePolicyRevision: z.string().min(1),
+	providerRevision: z.string().min(1),
+	schemaRevision: z.string().min(1)
+}).strict();
+const GatewayRuntimeApprovalCallSchema = z.object({
+	arguments: jsonObjectSchema,
+	id: z.string().min(1),
+	name: z.string().min(1),
+	namespace: z.string().min(1)
+}).strict();
+const GatewayRuntimeApprovalChallengeIntentSchema = z.object({
+	backendKind: toolPortalBackendKindSchema,
+	call: GatewayRuntimeApprovalCallSchema,
+	operationId: z.string().uuid(),
+	semanticRevisions: GatewayRuntimeApprovalSemanticRevisionCohortSchema,
+	surfaceClass: GatewayRuntimePortalSurfaceClassSchema,
+	trustedContext: GatewayRuntimeTrustedInvocationContextSchema
+}).strict();
+const GatewayRuntimeApprovalChallengeSchema = z.object({
+	approvalId: z.string().uuid(),
+	createdAt: z.string().datetime(),
+	expiresAt: z.string().datetime(),
+	fingerprint: GatewayRuntimeApprovalFingerprintSchema,
+	intent: GatewayRuntimeApprovalChallengeIntentSchema
+}).strict();
+const approvalDispatchAuthorityShape = {
+	approvalId: z.string().uuid(),
+	authorityContext: GatewayRuntimeApprovalAuthorityContextSchema,
+	expiresAt: z.string().datetime(),
+	fingerprint: GatewayRuntimeApprovalFingerprintSchema,
+	operationId: z.string().uuid(),
+	stablePrincipal: GatewayStablePrincipalDigestSchema
+};
+const GatewayRuntimeMcpProviderDispatchReservationSchema = z.object({
+	...approvalDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.mcp_provider),
+	reservationId: z.string().uuid()
+}).strict();
+const GatewayRuntimeControllerHostActionDispatchReservationSchema = z.object({
+	...approvalDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.controller_host_action),
+	reservationId: z.string().uuid()
+}).strict();
+const GatewayRuntimeToolVmRunnerDispatchReservationSchema = z.object({
+	...approvalDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.tool_vm_runner),
+	reservationId: z.string().uuid()
+}).strict();
+const GatewayRuntimeApprovalDispatchReservationSchema = z.discriminatedUnion("backendKind", [
+	GatewayRuntimeMcpProviderDispatchReservationSchema,
+	GatewayRuntimeControllerHostActionDispatchReservationSchema,
+	GatewayRuntimeToolVmRunnerDispatchReservationSchema
+]);
+const GatewayRuntimeGatewayDispatchReservationSchema = z.discriminatedUnion("backendKind", [GatewayRuntimeMcpProviderDispatchReservationSchema, GatewayRuntimeToolVmRunnerDispatchReservationSchema]);
+const GatewayRuntimeMcpProviderDispatchGrantSchema = z.object({
+	...approvalDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.mcp_provider),
+	grantId: z.string().uuid()
+}).strict();
+const GatewayRuntimeToolVmRunnerDispatchGrantSchema = z.object({
+	...approvalDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.tool_vm_runner),
+	grantId: z.string().uuid()
+}).strict();
+const GatewayRuntimeApprovalDispatchGrantSchema = z.discriminatedUnion("backendKind", [GatewayRuntimeMcpProviderDispatchGrantSchema, GatewayRuntimeToolVmRunnerDispatchGrantSchema]);
+const directDispatchAuthorityShape = {
+	fingerprint: GatewayRuntimeApprovalFingerprintSchema,
+	kind: z.literal("without-approval"),
+	operationId: z.string().uuid()
+};
+const GatewayRuntimeMcpProviderDirectDispatchAuthoritySchema = z.object({
+	...directDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.mcp_provider)
+}).strict();
+const GatewayRuntimeToolVmRunnerDirectDispatchAuthoritySchema = z.object({
+	...directDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.tool_vm_runner)
+}).strict();
+const GatewayRuntimeControllerHostActionDirectDispatchAuthoritySchema = z.object({
+	...directDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.controller_host_action)
+}).strict();
+const GatewayRuntimeMcpProviderApprovalGrantDispatchAuthoritySchema = z.object({
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.mcp_provider),
+	grant: GatewayRuntimeMcpProviderDispatchGrantSchema,
+	kind: z.literal("approval-grant")
+}).strict();
+const GatewayRuntimeToolVmRunnerApprovalGrantDispatchAuthoritySchema = z.object({
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.tool_vm_runner),
+	grant: GatewayRuntimeToolVmRunnerDispatchGrantSchema,
+	kind: z.literal("approval-grant")
+}).strict();
+const GatewayRuntimeControllerHostActionApprovalReservationDispatchAuthoritySchema = z.object({
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.controller_host_action),
+	kind: z.literal("controller-approval-reservation"),
+	reservation: GatewayRuntimeControllerHostActionDispatchReservationSchema
+}).strict();
+const GatewayRuntimeToolPortalDispatchAuthoritySchema = z.union([
+	GatewayRuntimeMcpProviderDirectDispatchAuthoritySchema,
+	GatewayRuntimeToolVmRunnerDirectDispatchAuthoritySchema,
+	GatewayRuntimeControllerHostActionDirectDispatchAuthoritySchema,
+	GatewayRuntimeMcpProviderApprovalGrantDispatchAuthoritySchema,
+	GatewayRuntimeToolVmRunnerApprovalGrantDispatchAuthoritySchema,
+	GatewayRuntimeControllerHostActionApprovalReservationDispatchAuthoritySchema
+]);
+const GatewayRuntimeApprovalNotDispatchedReasonSchema = z.enum([
+	"consumed-without-dispatch",
+	"denied",
+	"expired",
+	"revoked",
+	"stale-authority",
+	"stale-fingerprint"
+]);
+const GatewayRuntimeApprovalAmbiguousReasonSchema = z.literal("dispatch-armed");
+const GatewayRuntimeApprovalAdmissionResultSchema = z.discriminatedUnion("kind", [
+	z.object({
+		challenge: GatewayRuntimeApprovalChallengeSchema,
+		kind: z.literal("approval-required")
+	}).strict(),
+	z.object({
+		kind: z.literal("dispatch-reserved"),
+		reservation: GatewayRuntimeApprovalDispatchReservationSchema
+	}).strict(),
+	z.object({
+		kind: z.literal("not-dispatched"),
+		operationId: z.string().uuid(),
+		reason: GatewayRuntimeApprovalNotDispatchedReasonSchema
+	}).strict(),
+	z.object({
+		kind: z.literal("ambiguous"),
+		operationId: z.string().uuid(),
+		reason: GatewayRuntimeApprovalAmbiguousReasonSchema
+	}).strict()
+]);
+const GatewayRuntimeApprovalArmDispatchCommandSchema = z.object({ reservation: GatewayRuntimeGatewayDispatchReservationSchema }).strict();
+const GatewayRuntimeApprovalArmDispatchResultSchema = z.discriminatedUnion("kind", [
+	z.object({
+		grant: GatewayRuntimeApprovalDispatchGrantSchema,
+		kind: z.literal("dispatch-armed")
+	}).strict(),
+	z.object({
+		kind: z.literal("not-dispatched"),
+		operationId: z.string().uuid(),
+		reason: GatewayRuntimeApprovalNotDispatchedReasonSchema
+	}).strict(),
+	z.object({
+		kind: z.literal("ambiguous"),
+		operationId: z.string().uuid(),
+		reason: GatewayRuntimeApprovalAmbiguousReasonSchema
+	}).strict()
+]);
+const GatewayRuntimeApprovalDecisionCommandSchema = z.object({
+	approvalId: z.string().uuid(),
+	decision: z.enum(["approve", "deny"])
+}).strict();
+const GatewayRuntimeApprovalRevokeCommandSchema = z.object({ approvalId: z.string().uuid() }).strict();
+function deriveGatewayRuntimeApprovalFingerprint(props) {
+	return `sha256:${createHash("sha256").update(canonicalApprovalJson(props), "utf8").digest("hex")}`;
+}
+function deriveGatewayRuntimeApprovalId(fingerprint) {
+	const hexadecimal = fingerprint.slice(7, 39).split("");
+	hexadecimal[12] = "5";
+	hexadecimal[16] = (Number.parseInt(hexadecimal[16] ?? "0", 16) & 3 | 8).toString(16);
+	const value = hexadecimal.join("");
+	return `${value.slice(0, 8)}-${value.slice(8, 12)}-${value.slice(12, 16)}-${value.slice(16, 20)}-${value.slice(20)}`;
+}
+//#endregion
+//#region src/gateway-runtime-readiness-snapshot.ts
+const GATEWAY_RUNTIME_READINESS_SNAPSHOT_VERSION = 1;
+const GATEWAY_RUNTIME_ATTACHMENT_SNAPSHOT_VERSION = 1;
+const BoundedIdentitySchema = z.string().min(1).max(256);
+const PositiveSafeIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const NonNegativeSafeIntegerSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const GatewayRuntimeManagedPluginClientKindSchema = z.enum(["openclaw-managed-plugin", "hermes-managed-plugin"]);
+const GatewayRuntimeExpectedAttachmentIdentitySchema = z.object({
+	attachmentGeneration: PositiveSafeIntegerSchema,
+	clientKind: GatewayRuntimeManagedPluginClientKindSchema,
+	configuredAgentIds: z.array(BoundedIdentitySchema).min(1).max(128).readonly(),
+	frameworkEpoch: BoundedIdentitySchema,
+	gatewayEpoch: BoundedIdentitySchema,
+	protocolVersion: PositiveSafeIntegerSchema,
+	projectionCohortDigest: z.string().regex(/^projection-cohort:[a-f0-9]{64}$/u),
+	runtimeEpoch: BoundedIdentitySchema,
+	schemaVersion: PositiveSafeIntegerSchema
+}).strict().superRefine((identity, context) => {
+	if (new Set(identity.configuredAgentIds).size !== identity.configuredAgentIds.length) context.addIssue({
+		code: "custom",
+		message: "Gateway runtime configured agent ids must be unique.",
+		path: ["configuredAgentIds"]
+	});
+}).readonly();
+const GatewayRuntimeAttachmentSnapshotSchema = z.object({
+	connectionId: z.string().uuid().optional(),
+	expected: GatewayRuntimeExpectedAttachmentIdentitySchema,
+	observationSequence: NonNegativeSafeIntegerSchema,
+	snapshotVersion: z.literal(1),
+	status: z.enum([
+		"awaiting-attachment",
+		"attached",
+		"attachment-lost",
+		"retired"
+	])
+}).strict().superRefine((snapshot, context) => {
+	const requiresConnectionIdentity = snapshot.status === "attached" || snapshot.status === "attachment-lost";
+	if (requiresConnectionIdentity && snapshot.connectionId === void 0) context.addIssue({
+		code: "custom",
+		message: "Accepted and lost attachment snapshots require a connection identity.",
+		path: ["connectionId"]
+	});
+	if (!requiresConnectionIdentity && snapshot.connectionId !== void 0) context.addIssue({
+		code: "custom",
+		message: "Awaiting and retired attachment snapshots cannot claim a connection identity.",
+		path: ["connectionId"]
+	});
+}).readonly();
+const GatewayRuntimeUdsPublicationSnapshotSchema = z.object({
+	identity: z.literal("managed-plugin-private-uds"),
+	protocolVersion: PositiveSafeIntegerSchema,
+	schemaVersion: PositiveSafeIntegerSchema,
+	socketPath: z.string().min(1).max(256).startsWith("/"),
+	status: z.enum(["published", "retired"])
+}).strict().readonly();
+const GatewayRuntimeRequiredBackendKindSchema = z.enum([
+	"controller_host_action",
+	"mcp_provider",
+	"tool_vm_runner"
+]);
+const GatewayRuntimeRequiredBackendsReadinessSchema = z.object({
+	readyBackendKinds: z.array(GatewayRuntimeRequiredBackendKindSchema).max(3).readonly(),
+	revision: BoundedIdentitySchema,
+	status: z.literal("ready")
+}).strict().superRefine((readiness, context) => {
+	if (new Set(readiness.readyBackendKinds).size !== readiness.readyBackendKinds.length) context.addIssue({
+		code: "custom",
+		message: "Gateway runtime ready backend kinds must be unique.",
+		path: ["readyBackendKinds"]
+	});
+}).readonly();
+const GatewayRuntimeFatalEvidenceSchema = z.object({
+	failureCode: BoundedIdentitySchema,
+	kind: z.literal("fatal"),
+	observedGatewayEpoch: BoundedIdentitySchema,
+	processEpoch: BoundedIdentitySchema,
+	role: z.enum(["framework-service", "tool-portal-service"]),
+	schemaVersion: z.literal(1),
+	serviceId: BoundedIdentitySchema
+}).strict().readonly();
+/**
+* Role-local Tool Portal evidence. The controller must join this with framework,
+* backend, ingress, and control-session evidence before admitting the Gateway.
+*/
+const GatewayRuntimeReadinessSnapshotSchema = z.object({
+	controlEndpoint: z.object({
+		identity: z.object({
+			bootId: BoundedIdentitySchema,
+			controllerEpoch: BoundedIdentitySchema,
+			generationId: BoundedIdentitySchema,
+			peerId: BoundedIdentitySchema,
+			processEpoch: BoundedIdentitySchema,
+			zoneId: BoundedIdentitySchema
+		}).strict().readonly(),
+		listener: z.object({
+			host: z.string().min(1).max(253),
+			port: z.number().int().min(1).max(65535),
+			readyPath: z.string().min(1).max(256).startsWith("/"),
+			socketPath: z.string().min(1).max(256).startsWith("/")
+		}).strict().readonly()
+	}).strict().readonly(),
+	kind: z.literal("tool-portal-role-readiness"),
+	providerRevision: BoundedIdentitySchema,
+	requiredBackends: GatewayRuntimeRequiredBackendsReadinessSchema,
+	semanticRevision: BoundedIdentitySchema,
+	serviceIdentity: z.object({
+		processEpoch: BoundedIdentitySchema,
+		role: z.literal("tool-portal"),
+		serviceId: BoundedIdentitySchema
+	}).strict().readonly(),
+	snapshotVersion: z.literal(1),
+	uds: z.object({
+		attachment: GatewayRuntimeAttachmentSnapshotSchema,
+		publication: GatewayRuntimeUdsPublicationSnapshotSchema
+	}).strict().readonly()
+}).strict().superRefine((snapshot, context) => {
+	if (snapshot.controlEndpoint.identity.processEpoch !== snapshot.serviceIdentity.processEpoch) context.addIssue({
+		code: "custom",
+		message: "Gateway runtime service and control endpoint process epochs must match.",
+		path: [
+			"controlEndpoint",
+			"identity",
+			"processEpoch"
+		]
+	});
+	if (snapshot.uds.publication.status === "retired" && snapshot.uds.attachment.status !== "retired") context.addIssue({
+		code: "custom",
+		message: "A retired UDS publication requires a retired attachment lifecycle.",
+		path: [
+			"uds",
+			"attachment",
+			"status"
+		]
+	});
+}).readonly();
+function freezeExpectedAttachmentIdentity(identity) {
+	return Object.freeze({
+		...identity,
+		configuredAgentIds: Object.freeze([...identity.configuredAgentIds].toSorted())
+	});
+}
+function createGatewayRuntimeAttachmentSnapshot(input) {
+	const parsed = GatewayRuntimeAttachmentSnapshotSchema.parse(input);
+	return Object.freeze({
+		...parsed,
+		expected: freezeExpectedAttachmentIdentity(parsed.expected)
+	});
+}
+function createGatewayRuntimeReadinessSnapshot(input) {
+	const parsed = GatewayRuntimeReadinessSnapshotSchema.parse(input);
+	const attachment = createGatewayRuntimeAttachmentSnapshot(parsed.uds.attachment);
+	return Object.freeze({
+		...parsed,
+		controlEndpoint: Object.freeze({
+			identity: Object.freeze({ ...parsed.controlEndpoint.identity }),
+			listener: Object.freeze({ ...parsed.controlEndpoint.listener })
+		}),
+		serviceIdentity: Object.freeze({ ...parsed.serviceIdentity }),
+		requiredBackends: Object.freeze({
+			...parsed.requiredBackends,
+			readyBackendKinds: Object.freeze([...parsed.requiredBackends.readyBackendKinds].toSorted())
+		}),
+		uds: Object.freeze({
+			attachment,
+			publication: Object.freeze({ ...parsed.uds.publication })
+		})
+	});
+}
+//#endregion
+//#region src/gateway-control-admission.ts
+const GATEWAY_CONTROL_ADMISSION_LIMITS = {
+	authority: {
+		maxBytes: 1572864,
+		maxMessages: 96
+	},
+	diagnostic: {
+		maxBytes: 1048576,
+		maxMessages: 64
+	},
+	liveness: {
+		maxBytes: 1048576,
+		maxMessages: 64
+	},
+	maxFrameBytes: 65536,
+	perPrincipalAuthority: {
+		maxBytes: 131072,
+		maxMessages: 8
+	},
+	safety: {
+		maxBytes: 524288,
+		maxMessages: 32
+	}
+};
+const GATEWAY_CONTROL_PROCESS_ADMISSION_LIMITS = {
+	maxActiveSessions: 32,
+	maxNonSafetyBytes: 33554432,
+	maxNonSafetyMessages: 2048
+};
+function dequeueFirstCoalescedMessage(messages) {
+	const first = messages.entries().next().value;
+	if (first === void 0) return;
+	messages.delete(first[0]);
+	return first[1];
+}
+const serviceCycle = [
+	"safety",
+	"safety",
+	"safety",
+	"safety",
+	"safety",
+	"safety",
+	"safety",
+	"safety",
+	"authority",
+	"authority",
+	"authority",
+	"authority",
+	"liveness",
+	"liveness",
+	"diagnostic"
+];
+function canReserve(accounting, byteLength, limits) {
+	return accounting.byteCount + byteLength <= limits.maxBytes && accounting.messageCount + 1 <= limits.maxMessages;
+}
+function release(accounting, byteLength) {
+	accounting.byteCount -= byteLength;
+	accounting.messageCount -= 1;
+}
+function requirePositiveLimit(name, value) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new RangeError(`${name} must be a positive safe integer.`);
+}
+function validateMessage(message) {
+	if (message.id.length === 0 || !Number.isSafeInteger(message.byteLength) || message.byteLength <= 0) return {
+		reason: "invalid_message",
+		status: "fence"
+	};
+	if (message.byteLength > GATEWAY_CONTROL_ADMISSION_LIMITS.maxFrameBytes) return {
+		reason: "frame_too_large",
+		status: "fence"
+	};
+	if (message.messageClass === "authority" && (message.stablePrincipal === void 0 || message.stablePrincipal.length === 0)) return {
+		reason: "invalid_message",
+		status: "fence"
+	};
+	if ((message.messageClass === "diagnostic" || message.messageClass === "liveness") && (message.coalesceKey === void 0 || message.coalesceKey.length === 0)) return {
+		reason: "invalid_message",
+		status: "fence"
+	};
+}
+function isGatewayControlProcessAdmissionMessage(message) {
+	return "zoneId" in message && typeof message.zoneId === "string";
+}
+function gatewayControlProcessCoalescingKey(message) {
+	return message.messageClass === "liveness" || message.messageClass === "diagnostic" ? `${message.messageClass}\u0000${message.coalesceKey ?? ""}` : void 0;
+}
+function createGatewayControlAdmissionScheduler() {
+	const safety = [];
+	const safetyAccounting = {
+		byteCount: 0,
+		messageCount: 0
+	};
+	const authorityByPrincipal = /* @__PURE__ */ new Map();
+	const authorityPrincipalOrder = [];
+	const authorityAccounting = {
+		byteCount: 0,
+		messageCount: 0
+	};
+	const livenessByKey = /* @__PURE__ */ new Map();
+	const livenessAccounting = {
+		byteCount: 0,
+		messageCount: 0
+	};
+	const diagnosticByKey = /* @__PURE__ */ new Map();
+	const diagnosticAccounting = {
+		byteCount: 0,
+		messageCount: 0
+	};
+	const inFlightMessages = /* @__PURE__ */ new Map();
+	let serviceCursor = 0;
+	let authorityPrincipalCursor = 0;
+	let coalescedMessages = 0;
+	let droppedMessages = 0;
+	let fencedMessages = 0;
+	let refusedMessages = 0;
+	let shedMessages = 0;
+	const dequeueAuthority = () => {
+		if (authorityPrincipalOrder.length === 0) return;
+		for (let offset = 0; offset < authorityPrincipalOrder.length; offset += 1) {
+			const index = (authorityPrincipalCursor + offset) % authorityPrincipalOrder.length;
+			const principal = authorityPrincipalOrder[index];
+			if (principal === void 0) continue;
+			const queue = authorityByPrincipal.get(principal);
+			const message = queue?.messages.shift();
+			if (queue === void 0 || message === void 0) continue;
+			authorityPrincipalCursor = (index + 1) % authorityPrincipalOrder.length;
+			return message;
+		}
+	};
+	const dequeueClass = (messageClass) => {
+		switch (messageClass) {
+			case "safety": return safety.shift();
+			case "authority": return dequeueAuthority();
+			case "liveness": return dequeueFirstCoalescedMessage(livenessByKey);
+			case "diagnostic": return dequeueFirstCoalescedMessage(diagnosticByKey);
+		}
+		throw new Error("unsupported gateway control admission class");
+	};
+	return {
+		cancelQueued() {
+			const cancelled = [];
+			for (const message of safety.splice(0)) {
+				release(safetyAccounting, message.byteLength);
+				cancelled.push(message);
+			}
+			for (const [principal, queue] of authorityByPrincipal) {
+				for (const message of queue.messages.splice(0)) {
+					release(queue, message.byteLength);
+					release(authorityAccounting, message.byteLength);
+					cancelled.push(message);
+				}
+				if (queue.messageCount === 0) authorityByPrincipal.delete(principal);
+			}
+			for (let index = authorityPrincipalOrder.length - 1; index >= 0; index -= 1) if (!authorityByPrincipal.has(authorityPrincipalOrder[index] ?? "")) authorityPrincipalOrder.splice(index, 1);
+			authorityPrincipalCursor = authorityPrincipalOrder.length === 0 ? 0 : Math.min(authorityPrincipalCursor, authorityPrincipalOrder.length - 1);
+			for (const message of livenessByKey.values()) {
+				release(livenessAccounting, message.byteLength);
+				cancelled.push(message);
+			}
+			livenessByKey.clear();
+			for (const message of diagnosticByKey.values()) {
+				release(diagnosticAccounting, message.byteLength);
+				cancelled.push(message);
+			}
+			diagnosticByKey.clear();
+			return cancelled;
+		},
+		complete(completionToken) {
+			const message = inFlightMessages.get(completionToken);
+			if (message === void 0 || !inFlightMessages.delete(completionToken)) throw new Error("gateway control admission message is not in flight");
+			switch (message.messageClass) {
+				case "safety":
+					release(safetyAccounting, message.byteLength);
+					return;
+				case "authority": {
+					const principal = message.stablePrincipal ?? "";
+					const queue = authorityByPrincipal.get(principal);
+					if (queue === void 0) throw new Error("gateway control authority principal is not admitted");
+					release(queue, message.byteLength);
+					release(authorityAccounting, message.byteLength);
+					if (queue.messageCount === 0) {
+						authorityByPrincipal.delete(principal);
+						const index = authorityPrincipalOrder.indexOf(principal);
+						if (index >= 0) {
+							authorityPrincipalOrder.splice(index, 1);
+							authorityPrincipalCursor = authorityPrincipalOrder.length === 0 ? 0 : Math.min(authorityPrincipalCursor, authorityPrincipalOrder.length - 1);
+						}
+					}
+					return;
+				}
+				case "liveness":
+					release(livenessAccounting, message.byteLength);
+					return;
+				case "diagnostic":
+					release(diagnosticAccounting, message.byteLength);
+					return;
+			}
+		},
+		enqueue(message) {
+			const invalid = validateMessage(message);
+			if (invalid !== void 0) {
+				fencedMessages += 1;
+				return invalid;
+			}
+			switch (message.messageClass) {
+				case "safety":
+					if (!canReserve(safetyAccounting, message.byteLength, GATEWAY_CONTROL_ADMISSION_LIMITS.safety)) {
+						fencedMessages += 1;
+						return {
+							reason: "safety_capacity",
+							status: "fence"
+						};
+					}
+					safety.push(message);
+					safetyAccounting.byteCount += message.byteLength;
+					safetyAccounting.messageCount += 1;
+					return { status: "admitted" };
+				case "authority": {
+					const principal = message.stablePrincipal ?? "";
+					const queue = authorityByPrincipal.get(principal) ?? {
+						byteCount: 0,
+						messageCount: 0,
+						messages: []
+					};
+					if (!canReserve(queue, message.byteLength, GATEWAY_CONTROL_ADMISSION_LIMITS.perPrincipalAuthority)) {
+						refusedMessages += 1;
+						return {
+							reason: "principal_capacity",
+							status: "refused"
+						};
+					}
+					if (!canReserve(authorityAccounting, message.byteLength, GATEWAY_CONTROL_ADMISSION_LIMITS.authority)) {
+						fencedMessages += 1;
+						return {
+							reason: "authority_capacity",
+							status: "fence"
+						};
+					}
+					if (!authorityByPrincipal.has(principal)) {
+						authorityByPrincipal.set(principal, queue);
+						authorityPrincipalOrder.push(principal);
+					}
+					queue.messages.push(message);
+					queue.byteCount += message.byteLength;
+					queue.messageCount += 1;
+					authorityAccounting.byteCount += message.byteLength;
+					authorityAccounting.messageCount += 1;
+					return { status: "admitted" };
+				}
+				case "liveness":
+				case "diagnostic": {
+					const isLiveness = message.messageClass === "liveness";
+					const messages = isLiveness ? livenessByKey : diagnosticByKey;
+					const accounting = isLiveness ? livenessAccounting : diagnosticAccounting;
+					const limits = isLiveness ? GATEWAY_CONTROL_ADMISSION_LIMITS.liveness : GATEWAY_CONTROL_ADMISSION_LIMITS.diagnostic;
+					const key = message.coalesceKey ?? "";
+					const prior = messages.get(key);
+					const nextBytes = accounting.byteCount - (prior?.byteLength ?? 0) + message.byteLength;
+					const nextMessages = accounting.messageCount + (prior === void 0 ? 1 : 0);
+					if (nextBytes > limits.maxBytes || nextMessages > limits.maxMessages) {
+						if (isLiveness) {
+							shedMessages += 1;
+							return {
+								reason: "liveness_capacity",
+								status: "shed"
+							};
+						}
+						droppedMessages += 1;
+						return {
+							reason: "diagnostic_capacity",
+							status: "dropped"
+						};
+					}
+					messages.set(key, message);
+					accounting.byteCount = nextBytes;
+					accounting.messageCount = nextMessages;
+					if (prior !== void 0) coalescedMessages += 1;
+					return prior === void 0 ? { status: "admitted" } : {
+						replacedMessage: prior,
+						status: "replaced"
+					};
+				}
+			}
+			throw new Error("unsupported gateway control admission class");
+		},
+		dequeue(options = {}) {
+			for (let offset = 0; offset < serviceCycle.length; offset += 1) {
+				const index = (serviceCursor + offset) % serviceCycle.length;
+				const messageClass = serviceCycle[index];
+				if (messageClass === void 0) continue;
+				if (options.allowedMessageClasses !== void 0 && !options.allowedMessageClasses.includes(messageClass)) continue;
+				const message = dequeueClass(messageClass);
+				if (message !== void 0) {
+					serviceCursor = (index + 1) % serviceCycle.length;
+					const completionToken = Object.freeze({ completionTokenId: Symbol("gateway-control-admission-completion") });
+					inFlightMessages.set(completionToken, message);
+					return {
+						completionToken,
+						message
+					};
+				}
+			}
+		},
+		diagnostics() {
+			return {
+				authorityBytes: authorityAccounting.byteCount,
+				authorityMessages: authorityAccounting.messageCount,
+				diagnosticBytes: diagnosticAccounting.byteCount,
+				diagnosticMessages: diagnosticAccounting.messageCount,
+				livenessBytes: livenessAccounting.byteCount,
+				livenessMessages: livenessAccounting.messageCount,
+				safetyBytes: safetyAccounting.byteCount,
+				safetyMessages: safetyAccounting.messageCount,
+				coalescedMessages,
+				droppedMessages,
+				fencedMessages,
+				refusedMessages,
+				shedMessages
+			};
+		}
+	};
+}
+function createGatewayControlProcessAdmission(options = {}) {
+	const maxActiveSessions = options.maxActiveSessions ?? GATEWAY_CONTROL_PROCESS_ADMISSION_LIMITS.maxActiveSessions;
+	const maxNonSafetyBytes = options.maxNonSafetyBytes ?? GATEWAY_CONTROL_PROCESS_ADMISSION_LIMITS.maxNonSafetyBytes;
+	const maxNonSafetyMessages = options.maxNonSafetyMessages ?? GATEWAY_CONTROL_PROCESS_ADMISSION_LIMITS.maxNonSafetyMessages;
+	const schedulersByZone = /* @__PURE__ */ new Map();
+	const queuedCoalescibleMessagesByZone = /* @__PURE__ */ new Map();
+	const inFlightMessages = /* @__PURE__ */ new Map();
+	const zoneOrder = [];
+	let zoneCursor = 0;
+	let nonSafetyBytes = 0;
+	let nonSafetyMessages = 0;
+	requirePositiveLimit("maxActiveSessions", maxActiveSessions);
+	requirePositiveLimit("maxNonSafetyBytes", maxNonSafetyBytes);
+	requirePositiveLimit("maxNonSafetyMessages", maxNonSafetyMessages);
+	return {
+		complete(completionToken) {
+			const message = inFlightMessages.get(completionToken);
+			if (message === void 0 || !inFlightMessages.delete(completionToken)) throw new Error("gateway control process admission message is not in flight");
+			const scheduler = schedulersByZone.get(message.zoneId);
+			if (scheduler === void 0) throw new Error("gateway control process admission zone is not registered");
+			scheduler.complete(completionToken);
+			if (message.messageClass !== "safety") {
+				nonSafetyMessages -= 1;
+				nonSafetyBytes -= message.byteLength;
+			}
+		},
+		registerZone(zoneId) {
+			if (zoneId.length === 0) return { status: "capacity_refused" };
+			if (schedulersByZone.has(zoneId)) return { status: "admitted" };
+			if (schedulersByZone.size >= maxActiveSessions) return { status: "capacity_refused" };
+			schedulersByZone.set(zoneId, createGatewayControlAdmissionScheduler());
+			queuedCoalescibleMessagesByZone.set(zoneId, /* @__PURE__ */ new Map());
+			zoneOrder.push(zoneId);
+			return { status: "admitted" };
+		},
+		unregisterZone(zoneId) {
+			const scheduler = schedulersByZone.get(zoneId);
+			if (scheduler === void 0) return;
+			for (;;) {
+				const work = scheduler.dequeue();
+				if (work === void 0) break;
+				const { completionToken, message } = work;
+				if (message.messageClass !== "safety") {
+					nonSafetyBytes -= message.byteLength;
+					nonSafetyMessages -= 1;
+				}
+				scheduler.complete(completionToken);
+			}
+			for (const [completionToken, message] of inFlightMessages) {
+				if (message.zoneId !== zoneId) continue;
+				inFlightMessages.delete(completionToken);
+				scheduler.complete(completionToken);
+				if (message.messageClass !== "safety") {
+					nonSafetyBytes -= message.byteLength;
+					nonSafetyMessages -= 1;
+				}
+			}
+			schedulersByZone.delete(zoneId);
+			queuedCoalescibleMessagesByZone.delete(zoneId);
+			const index = zoneOrder.indexOf(zoneId);
+			if (index >= 0) {
+				zoneOrder.splice(index, 1);
+				zoneCursor = zoneOrder.length === 0 ? 0 : Math.min(zoneCursor, zoneOrder.length - 1);
+			}
+		},
+		enqueue(message) {
+			const scheduler = schedulersByZone.get(message.zoneId);
+			if (scheduler === void 0) return {
+				reason: "global_capacity",
+				status: "refused"
+			};
+			const coalescingKey = gatewayControlProcessCoalescingKey(message);
+			const priorCoalescibleMessage = coalescingKey === void 0 ? void 0 : queuedCoalescibleMessagesByZone.get(message.zoneId)?.get(coalescingKey);
+			const nonSafetyMessageDelta = priorCoalescibleMessage === void 0 ? 1 : 0;
+			const nonSafetyByteDelta = message.byteLength - (priorCoalescibleMessage?.byteLength ?? 0);
+			if (message.messageClass !== "safety" && (nonSafetyMessages + nonSafetyMessageDelta > maxNonSafetyMessages || nonSafetyBytes + nonSafetyByteDelta > maxNonSafetyBytes)) return message.messageClass === "authority" ? {
+				reason: "global_capacity",
+				status: "refused"
+			} : message.messageClass === "liveness" ? {
+				reason: "global_capacity",
+				status: "shed"
+			} : {
+				reason: "global_capacity",
+				status: "dropped"
+			};
+			const before = scheduler.diagnostics();
+			const result = scheduler.enqueue(message);
+			if (message.messageClass !== "safety" && (result.status === "admitted" || result.status === "replaced")) {
+				const after = scheduler.diagnostics();
+				const beforeMessages = before.authorityMessages + before.livenessMessages + before.diagnosticMessages;
+				const afterMessages = after.authorityMessages + after.livenessMessages + after.diagnosticMessages;
+				const beforeBytes = before.authorityBytes + before.livenessBytes + before.diagnosticBytes;
+				const afterBytes = after.authorityBytes + after.livenessBytes + after.diagnosticBytes;
+				nonSafetyMessages += afterMessages - beforeMessages;
+				nonSafetyBytes += afterBytes - beforeBytes;
+				if (coalescingKey !== void 0) queuedCoalescibleMessagesByZone.get(message.zoneId)?.set(coalescingKey, message);
+			}
+			return result;
+		},
+		dequeue() {
+			if (zoneOrder.length === 0) return;
+			for (let offset = 0; offset < zoneOrder.length; offset += 1) {
+				const index = (zoneCursor + offset) % zoneOrder.length;
+				const zoneId = zoneOrder[index];
+				const work = (zoneId === void 0 ? void 0 : schedulersByZone.get(zoneId))?.dequeue();
+				if (zoneId === void 0 || work === void 0) continue;
+				const { completionToken, message } = work;
+				if (!isGatewayControlProcessAdmissionMessage(message) || message.zoneId !== zoneId) throw new Error("gateway control process admission message lost its zone identity");
+				const coalescingKey = gatewayControlProcessCoalescingKey(message);
+				if (coalescingKey !== void 0) {
+					const queuedMessages = queuedCoalescibleMessagesByZone.get(zoneId);
+					if (queuedMessages?.get(coalescingKey) === message) queuedMessages.delete(coalescingKey);
+				}
+				zoneCursor = (index + 1) % zoneOrder.length;
+				inFlightMessages.set(completionToken, message);
+				return {
+					completionToken,
+					message
+				};
+			}
+		},
+		diagnostics() {
+			return {
+				activeSessions: schedulersByZone.size,
+				nonSafetyBytes,
+				nonSafetyMessages
+			};
+		}
+	};
+}
+//#endregion
+//#region src/gateway-control-admission-executor.ts
+const GATEWAY_CONTROL_ADMISSION_EXECUTION_LIMITS = {
+	authority: 4,
+	diagnostic: 1,
+	liveness: 2,
+	safety: 8
+};
+const GATEWAY_CONTROL_ADMISSION_CLASSES = [
+	"authority",
+	"diagnostic",
+	"liveness",
+	"safety"
+];
+function executionMessage(request, work) {
+	return {
+		byteLength: request.byteLength,
+		...request.coalesceKey === void 0 ? {} : { coalesceKey: request.coalesceKey },
+		id: request.id,
+		messageClass: request.messageClass,
+		payload: work,
+		...request.stablePrincipal === void 0 ? {} : { stablePrincipal: request.stablePrincipal }
+	};
+}
+function createGatewayControlAdmissionExecutor(options = {}) {
+	const scheduler = createGatewayControlAdmissionScheduler();
+	const scheduleImmediate = options.scheduleImmediate ?? ((callback) => setImmediate(callback));
+	const executionLimits = {
+		...GATEWAY_CONTROL_ADMISSION_EXECUTION_LIMITS,
+		...options.executionLimits
+	};
+	const activeByClass = {
+		authority: 0,
+		diagnostic: 0,
+		liveness: 0,
+		safety: 0
+	};
+	let pumpScheduled = false;
+	let admissionGeneration = 0;
+	let closedReason;
+	const activeWork = /* @__PURE__ */ new Set();
+	for (const messageClass of GATEWAY_CONTROL_ADMISSION_CLASSES) {
+		const limit = executionLimits[messageClass];
+		if (!Number.isSafeInteger(limit) || limit <= 0) throw new RangeError(`${messageClass} execution limit must be a positive safe integer.`);
+	}
+	const schedulePump = () => {
+		if (pumpScheduled || closedReason !== void 0) return;
+		pumpScheduled = true;
+		scheduleImmediate(() => {
+			pumpScheduled = false;
+			pump();
+		});
+	};
+	const pump = () => {
+		if (closedReason !== void 0) return;
+		for (;;) {
+			const allowedMessageClasses = GATEWAY_CONTROL_ADMISSION_CLASSES.filter((messageClass) => activeByClass[messageClass] < executionLimits[messageClass]);
+			if (allowedMessageClasses.length === 0) return;
+			const admittedWork = scheduler.dequeue({ allowedMessageClasses });
+			if (admittedWork === void 0) return;
+			const { completionToken, message } = admittedWork;
+			const messageClass = message.messageClass;
+			const work = message.payload;
+			activeByClass[messageClass] += 1;
+			activeWork.add(work);
+			(async () => {
+				let executionError;
+				try {
+					await work.execute();
+				} catch (error) {
+					executionError = error;
+				} finally {
+					scheduler.complete(completionToken);
+					activeByClass[messageClass] -= 1;
+					activeWork.delete(work);
+					schedulePump();
+				}
+				if (work.settled || work.admissionGeneration !== admissionGeneration) return;
+				work.settled = true;
+				if (executionError === void 0) {
+					work.resolve({ status: "executed" });
+					return;
+				}
+				work.reject(executionError);
+			})();
+		}
+	};
+	return {
+		close: (reason) => {
+			if (closedReason !== void 0) return;
+			closedReason = reason;
+			admissionGeneration += 1;
+			for (const message of scheduler.cancelQueued()) {
+				const work = message.payload;
+				if (!work.settled) {
+					work.settled = true;
+					work.onCancel?.(reason);
+					work.resolve({
+						reason,
+						status: "closed"
+					});
+				}
+			}
+			for (const work of activeWork) if (!work.settled) {
+				work.settled = true;
+				work.onCancel?.(reason);
+				work.resolve({
+					reason,
+					status: "closed"
+				});
+			}
+		},
+		diagnostics: () => ({
+			activeByClass: { ...activeByClass },
+			scheduler: scheduler.diagnostics()
+		}),
+		submit: (request) => {
+			if (closedReason !== void 0) {
+				const closed = {
+					reason: closedReason,
+					status: "closed"
+				};
+				return {
+					admission: closed,
+					completion: Promise.resolve(closed)
+				};
+			}
+			let resolveCompletion;
+			let rejectCompletion;
+			const completion = new Promise((resolve, reject) => {
+				resolveCompletion = resolve;
+				rejectCompletion = reject;
+			});
+			const work = {
+				admissionGeneration,
+				execute: request.execute,
+				...request.onCancel === void 0 ? {} : { onCancel: request.onCancel },
+				payload: request.payload,
+				reject: rejectCompletion,
+				resolve: resolveCompletion,
+				settled: false
+			};
+			const result = scheduler.enqueue(executionMessage(request, work));
+			switch (result.status) {
+				case "admitted":
+					schedulePump();
+					return {
+						admission: { status: "admitted" },
+						completion
+					};
+				case "replaced":
+					if (!result.replacedMessage.payload.settled) {
+						result.replacedMessage.payload.settled = true;
+						result.replacedMessage.payload.onCancel?.("replaced");
+						result.replacedMessage.payload.resolve({ status: "replaced" });
+					}
+					schedulePump();
+					return {
+						admission: { status: "replaced" },
+						completion
+					};
+				case "dropped":
+				case "fence":
+				case "refused":
+				case "shed":
+					resolveCompletion(result);
+					return {
+						admission: result,
+						completion
+					};
+			}
+			throw new Error("unsupported gateway control admission result");
+		}
+	};
+}
+//#endregion
+//#region src/gateway-control-admission-classification.ts
+function authorityClassification(stablePrincipal) {
+	return stablePrincipal === void 0 || stablePrincipal.length === 0 ? {
+		reason: "stable_principal_required",
+		status: "refused"
+	} : {
+		authoritySchedulingKey: stablePrincipal,
+		messageClass: "authority",
+		stablePrincipal,
+		status: "classified"
+	};
+}
+function diagnosticCoalesceKey(payload) {
+	return JSON.stringify([
+		payload.eventKind,
+		"leaseId" in payload ? payload.leaseId : void 0,
+		"transitionId" in payload ? payload.transitionId : void 0,
+		"operation" in payload ? payload.operation : void 0,
+		"channelProviderId" in payload ? payload.channelProviderId : void 0
+	]);
+}
+function classifyGatewayControlAdmission(options) {
+	const message = options.message;
+	if (message.kind === "command_result") return options.matchedPendingResult === true ? {
+		messageClass: "safety",
+		status: "classified"
+	} : {
+		reason: "forged_command_result",
+		status: "fence"
+	};
+	if (message.kind === "heartbeat") return {
+		coalesceKey: `${options.direction}:control-heartbeat`,
+		messageClass: "liveness",
+		status: "classified"
+	};
+	if (message.kind === "event") {
+		if (options.direction !== "gateway_to_controller") return {
+			reason: "direction_violation",
+			status: "fence"
+		};
+		switch (message.operation) {
+			case "gateway_runtime_readiness": return {
+				coalesceKey: "gateway-runtime-readiness",
+				messageClass: "liveness",
+				status: "classified"
+			};
+			case "runtime_status": return {
+				coalesceKey: `runtime-status:${message.payload.statusKind}`,
+				messageClass: "liveness",
+				status: "classified"
+			};
+			case "health_event": return {
+				coalesceKey: diagnosticCoalesceKey(message.payload),
+				messageClass: "diagnostic",
+				status: "classified"
+			};
+		}
+	}
+	if (message.operation === "control_ping") return {
+		coalesceKey: `${options.direction}:control-ping`,
+		messageClass: "liveness",
+		status: "classified"
+	};
+	if (options.direction === "controller_to_gateway") switch (message.operation) {
+		case "tool_vm_binding_publish": {
+			if (message.kind !== "command") return {
+				reason: "direction_violation",
+				status: "fence"
+			};
+			const stablePrincipal = message.payload.binding.stablePrincipal;
+			return {
+				authoritySchedulingKey: stablePrincipal,
+				coalesceKey: `tool-vm-binding:${stablePrincipal}`,
+				messageClass: "authority",
+				stablePrincipal,
+				status: "classified"
+			};
+		}
+		case "operation_cancel": return options.controllerSafetyOperation === true && message.payload.initiatedBy === "controller" ? {
+			messageClass: "safety",
+			status: "classified"
+		} : {
+			reason: "direction_violation",
+			status: "fence"
+		};
+		case "recovery_command": return options.controllerSafetyOperation === true ? {
+			messageClass: "safety",
+			status: "classified"
+		} : {
+			reason: "direction_violation",
+			status: "fence"
+		};
+		case "caller_context_register":
+		case "lease_create":
+		case "lease_get":
+		case "lease_peek":
+		case "lease_reacquire":
+		case "lease_release":
+		case "lease_renew":
+		case "lease_use_start":
+		case "lease_use_heartbeat":
+		case "lease_use_end":
+		case "tool_portal_controller_host_action":
+		case "tool_portal_admission_reserve":
+		case "tool_portal_dispatch_arm":
+		case "tool_vm_binding_request": return {
+			reason: "direction_violation",
+			status: "fence"
+		};
+	}
+	switch (message.operation) {
+		case "caller_context_register": return authorityClassification(options.stablePrincipal);
+		case "lease_renew": return options.stablePrincipal === void 0 ? {
+			reason: "stable_principal_required",
+			status: "refused"
+		} : {
+			coalesceKey: `${options.stablePrincipal}:lease:${message.payload.leaseId}`,
+			messageClass: "liveness",
+			status: "classified"
+		};
+		case "lease_use_heartbeat": return options.stablePrincipal === void 0 ? {
+			reason: "stable_principal_required",
+			status: "refused"
+		} : {
+			coalesceKey: `${options.stablePrincipal}:lease:${message.payload.leaseId}:use:${message.payload.useId}`,
+			messageClass: "liveness",
+			status: "classified"
+		};
+		case "operation_cancel": return message.payload.initiatedBy === "gateway" ? {
+			reason: "unproven_gateway_cancel",
+			status: "refused"
+		} : {
+			reason: "direction_violation",
+			status: "fence"
+		};
+		case "recovery_command": return {
+			reason: "direction_violation",
+			status: "fence"
+		};
+		case "tool_vm_binding_publish": return {
+			reason: "direction_violation",
+			status: "fence"
+		};
+		case "lease_create":
+		case "lease_get":
+		case "lease_peek":
+		case "lease_reacquire":
+		case "lease_release":
+		case "lease_use_start":
+		case "lease_use_end":
+		case "tool_portal_controller_host_action":
+		case "tool_portal_admission_reserve":
+		case "tool_portal_dispatch_arm":
+		case "tool_vm_binding_request": return authorityClassification(options.stablePrincipal);
+	}
+	return {
+		reason: "direction_violation",
+		status: "fence"
+	};
+}
+//#endregion
+//#region src/gateway-runtime-control-endpoint.ts
+const GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_LISTEN_HOST = "127.0.0.1";
+const GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_GUEST_PORT = 18790;
+const GatewayRuntimeToolPortalProductionControlEndpointSchema = z.object({
+	host: z.literal(GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_LISTEN_HOST),
+	port: z.literal(GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_GUEST_PORT)
+}).strict().readonly();
+const GATEWAY_RUNTIME_TOOL_PORTAL_PRODUCTION_CONTROL_ENDPOINT = GatewayRuntimeToolPortalProductionControlEndpointSchema.parse({
+	host: GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_LISTEN_HOST,
+	port: GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_GUEST_PORT
+});
+//#endregion
+//#region src/gateway-runtime-portal-admission.ts
+const GATEWAY_RUNTIME_PORTAL_ADMISSION_FILE_NAME = "gateway-runtime-portal-admission.json";
+const GatewayRuntimeManagedToolPortalConfigSchema = toolPortalConfigSchema.transform((config, context) => {
+	if (config.mode !== "managed") {
+		context.addIssue({
+			code: "custom",
+			message: "Gateway runtime admission requires managed Tool Portal configuration.",
+			path: ["mode"]
+		});
+		return z.NEVER;
+	}
+	return config;
+});
+const GatewayRuntimePortalAdmissionMaterialSchema = z.object({
+	effectiveMcpConfig: mcpConfigSchema,
+	effectiveToolPortalConfig: GatewayRuntimeManagedToolPortalConfigSchema,
+	semanticSnapshot: GatewayRuntimePortalSemanticSnapshotSchema
+}).strict();
+//#endregion
+//#region src/gateway-runtime-portal-semantic-revision.ts
+function sortedStrings(values) {
+	return [...values].toSorted();
+}
+function normalizedToolSelector(selector) {
+	return {
+		allow: selector.allow === "*" ? "*" : sortedStrings(selector.allow),
+		deny: sortedStrings(selector.deny)
+	};
+}
+function normalizedMcpProviders(providers) {
+	return Object.fromEntries(Object.entries(providers).map(([providerId, provider]) => {
+		const secretPolicies = Object.fromEntries(Object.entries(provider.secretPolicies).map(([secretName, policy]) => [secretName, {
+			hosts: sortedStrings(policy.hosts),
+			injection: policy.injection
+		}]));
+		const transport = provider.transport.kind === "stdio" ? {
+			args: provider.transport.args,
+			command: provider.transport.command,
+			...provider.transport.connectionTimeoutMs === void 0 ? {} : { connectionTimeoutMs: provider.transport.connectionTimeoutMs },
+			...provider.transport.cwd === void 0 ? {} : { cwd: provider.transport.cwd },
+			env: provider.transport.env,
+			kind: provider.transport.kind,
+			...provider.transport.networkAccess === void 0 ? {} : { networkAccess: provider.transport.networkAccess },
+			requiredEgressHosts: sortedStrings(provider.transport.requiredEgressHosts)
+		} : {
+			...provider.transport.connectionTimeoutMs === void 0 ? {} : { connectionTimeoutMs: provider.transport.connectionTimeoutMs },
+			headers: provider.transport.headers,
+			kind: provider.transport.kind,
+			requiredEgressHosts: sortedStrings(provider.transport.requiredEgressHosts),
+			url: provider.transport.url
+		};
+		return [providerId, {
+			discovery: provider.discovery,
+			kind: provider.kind,
+			namespace: provider.namespace,
+			secretPolicies,
+			transport
+		}];
+	}));
+}
+function normalizedSurfaceEligibility(surfaceEligibilityByProfile) {
+	return Object.fromEntries(Object.entries(surfaceEligibilityByProfile).map(([profileId, capabilities]) => [profileId, Object.fromEntries(Object.entries(capabilities).map(([capabilityId, surfaceClasses]) => [capabilityId, sortedStrings(surfaceClasses)]))]));
+}
+function normalizedCatalogInputs(props) {
+	return {
+		profiles: Object.fromEntries(Object.entries(props.toolPortalConfig.profiles).map(([profileId, profile]) => [profileId, Object.fromEntries(Object.entries(profile.namespaces).map(([namespaceId, namespacePolicy]) => [namespaceId, {
+			...namespacePolicy.backend.kind === "tool_vm_runner" ? { operations: Object.fromEntries(Object.entries(namespacePolicy.backend.operations).map(([operationName, operation]) => [operationName, {
+				description: operation.description,
+				kind: operation.kind
+			}])) } : {},
+			tools: normalizedToolSelector(namespacePolicy.tools)
+		}]))])),
+		providers: normalizedMcpProviders(props.mcpConfig.providers)
+	};
+}
+function normalizedProfilePolicyInputs(props) {
+	return {
+		profiles: Object.fromEntries(Object.entries(props.toolPortalConfig.profiles).map(([profileId, profile]) => [profileId, Object.fromEntries(Object.entries(profile.namespaces).map(([namespaceId, namespacePolicy]) => [namespaceId, {
+			calls: {
+				requiresApproval: normalizedToolSelector(namespacePolicy.calls.requiresApproval),
+				withoutApproval: normalizedToolSelector(namespacePolicy.calls.withoutApproval)
+			},
+			tools: normalizedToolSelector(namespacePolicy.tools)
+		}]))])),
+		surfaceEligibilityByProfile: normalizedSurfaceEligibility(props.surfaceEligibilityByProfile)
+	};
+}
+function normalizedBindingInputs(config) {
+	return Object.fromEntries(Object.entries(config.profiles).map(([profileId, profile]) => [profileId, Object.fromEntries(Object.entries(profile.namespaces).map(([namespaceId, namespacePolicy]) => [namespaceId, namespacePolicy.backend.kind === "tool_vm_runner" ? {
+		kind: namespacePolicy.backend.kind,
+		operations: Object.fromEntries(Object.entries(namespacePolicy.backend.operations).map(([operationName, operation]) => [operationName, operation.kind === "command.fixed" ? {
+			executable: operation.executable,
+			kind: operation.kind,
+			mandatoryArgvPrefix: operation.mandatoryArgvPrefix,
+			workingDirectory: operation.workingDirectory
+		} : operation.kind === "process.start" ? {
+			executable: operation.executable,
+			kind: operation.kind,
+			mandatoryArgvPrefix: operation.mandatoryArgvPrefix,
+			maxRuntimeMs: operation.maxRuntimeMs,
+			retainOutputBytes: operation.retainOutputBytes,
+			workingDirectory: operation.workingDirectory
+		} : operation.kind === "process.wait" ? {
+			kind: operation.kind,
+			timeoutMs: operation.timeoutMs
+		} : { kind: operation.kind }])),
+		profile: namespacePolicy.backend.profile
+	} : { kind: namespacePolicy.backend.kind }]))]));
+}
+function canonicalJson(value) {
+	return JSON.stringify(value, (_key, nestedValue) => {
+		if (typeof nestedValue !== "object" || nestedValue === null || Array.isArray(nestedValue)) return nestedValue;
+		return Object.fromEntries(Object.entries(nestedValue).toSorted(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey)));
+	});
+}
+function revision(domain, material) {
+	return `${domain}:${createHash("sha256").update(`${domain}\0`, "utf8").update(canonicalJson(material), "utf8").digest("hex")}`;
+}
+function frameworkIdentityKey(identity) {
+	return identity.kind === "openclaw" ? `openclaw:${identity.agentId}` : `hermes:${identity.profileName}`;
+}
+function assertExactManagedAgentProjectionInputs(props) {
+	const projectionAgentIds = props.agentProjections.map((projection) => projection.agentId);
+	if (new Set(projectionAgentIds).size !== projectionAgentIds.length) throw new Error("Managed Agent Projection agent ids must be unique.");
+	const configuredAgentIds = sortedStrings(Object.keys(props.configuredAgents));
+	const sortedProjectionAgentIds = sortedStrings(projectionAgentIds);
+	if (configuredAgentIds.length !== sortedProjectionAgentIds.length || configuredAgentIds.some((agentId, index) => agentId !== sortedProjectionAgentIds[index])) throw new Error("Managed Agent Projection agent ids must exactly match configured Tool Portal agent ids.");
+	if (new Set(props.agentProjections.map((projection) => projection.frameworkIdentity.kind)).size !== 1) throw new Error("Managed Agent Projections must share one framework kind.");
+	const frameworkIdentityKeys = props.agentProjections.map((projection) => frameworkIdentityKey(projection.frameworkIdentity));
+	if (new Set(frameworkIdentityKeys).size !== frameworkIdentityKeys.length) throw new Error("Managed Agent Projection framework identities must be unique.");
+	for (const projection of props.agentProjections) {
+		if (projection.frameworkIdentity.kind === "openclaw" && projection.frameworkIdentity.agentId !== projection.agentId) throw new Error(`OpenClaw projection identity must match agent '${projection.agentId}'.`);
+		if (props.configuredAgents[projection.agentId]?.profile !== projection.toolPortalProfileId) throw new Error(`Managed Agent Projection Tool Portal profile does not match for agent '${projection.agentId}'.`);
+	}
+}
+function deriveManagedAgentProjection(input) {
+	return ManagedAgentProjectionSchema.parse({
+		...input,
+		profileAssignmentRevision: revision("profile-assignment", input)
+	});
+}
+function deriveManagedAgentProjectionCohortDigest(agentProjections) {
+	return revision("projection-cohort", { agentProjections: [...agentProjections].toSorted((leftProjection, rightProjection) => leftProjection.agentId.localeCompare(rightProjection.agentId)) });
+}
+function deriveGatewayRuntimePortalSemanticSnapshot(props) {
+	assertExactManagedAgentProjectionInputs({
+		agentProjections: props.agentProjections,
+		configuredAgents: props.toolPortalConfig.agents
+	});
+	const projections = props.agentProjections.map((projection) => deriveManagedAgentProjection(projection)).toSorted((leftProjection, rightProjection) => leftProjection.agentId.localeCompare(rightProjection.agentId));
+	const agentProjections = Object.fromEntries(projections.map((projection) => [projection.agentId, projection]));
+	const projectionCohortDigest = deriveManagedAgentProjectionCohortDigest(projections);
+	const providerRevision = revision("provider", normalizedMcpProviders(props.mcpConfig.providers));
+	const catalogRevision = revision("catalog", normalizedCatalogInputs({
+		mcpConfig: props.mcpConfig,
+		toolPortalConfig: props.toolPortalConfig
+	}));
+	const profilePolicyRevision = revision("profile-policy", normalizedProfilePolicyInputs({
+		surfaceEligibilityByProfile: props.surfaceEligibilityByProfile,
+		toolPortalConfig: props.toolPortalConfig
+	}));
+	const bindingRevision = revision("binding", normalizedBindingInputs(props.toolPortalConfig));
+	const schemaRevision = revision("schema", {
+		mcpConfigSchemaVersion: props.mcpConfig.schemaVersion,
+		toolPortalConfigSchemaVersion: props.toolPortalConfig.schemaVersion
+	});
+	const desiredRevision = revision("portal-admission", {
+		agentProjections,
+		bindingRevision,
+		catalogRevision,
+		profilePolicyRevision,
+		projectionCohortDigest,
+		providerRevision,
+		schemaRevision,
+		surfaceEligibilityByProfile: normalizedSurfaceEligibility(props.surfaceEligibilityByProfile)
+	});
+	return GatewayRuntimePortalSemanticSnapshotSchema.parse({
+		activeRevision: desiredRevision,
+		agentProjections,
+		bindingRevision,
+		catalogRevision,
+		desiredRevision,
+		profilePolicyRevision,
+		projectionCohortDigest,
+		providerRevision,
+		schemaRevision,
+		schemaVersion: 1,
+		surfaceEligibilityByProfile: normalizedSurfaceEligibility(props.surfaceEligibilityByProfile)
+	});
+}
+function assertGatewayRuntimePortalSemanticSnapshotMatchesInputs(props) {
+	if (canonicalJson(deriveGatewayRuntimePortalSemanticSnapshot({
+		agentProjections: Object.values(props.semanticSnapshot.agentProjections).map((projection) => ({
+			agentId: projection.agentId,
+			frameworkIdentity: projection.frameworkIdentity,
+			toolPortalProfileId: projection.toolPortalProfileId
+		})),
+		mcpConfig: props.mcpConfig,
+		surfaceEligibilityByProfile: props.semanticSnapshot.surfaceEligibilityByProfile,
+		toolPortalConfig: props.toolPortalConfig
+	})) !== canonicalJson(props.semanticSnapshot)) throw new Error("Gateway runtime semantic snapshot does not match the protected Tool Portal and MCP inputs.");
+}
+//#endregion
 //#region src/index.ts
 const GatewayControlDomainSchema = z.literal("gateway_control");
+const GatewayControlHelloSchema = z.object({
+	attachmentGeneration: z.number().int().positive(),
+	controllerEpoch: z.string().min(1),
+	domain: GatewayControlDomainSchema,
+	gatewayEpoch: z.string().min(1),
+	peerId: z.string().min(1),
+	processEpoch: z.string().min(1),
+	protocolVersion: z.literal(CONTROL_PROTOCOL_VERSION)
+}).strict();
+const GatewayControlHelloResponseSchema = z.object({
+	attachmentGeneration: z.number().int().positive(),
+	connectionId: z.string().uuid(),
+	controllerEpoch: z.string().min(1),
+	outcome: z.enum([
+		"accepted",
+		"rejected",
+		"generation_mismatch",
+		"stale_attachment"
+	]),
+	sessionId: z.string().uuid()
+}).strict();
 const GatewayControlRpcOperationSchema = z.enum([
 	"control_ping",
+	"gateway_runtime_readiness",
 	"caller_context_register",
 	"lease_create",
 	"lease_get",
@@ -16,7 +1440,11 @@ const GatewayControlRpcOperationSchema = z.enum([
 	"lease_use_end",
 	"health_event",
 	"runtime_status",
+	"tool_vm_binding_publish",
+	"tool_vm_binding_request",
 	"tool_portal_controller_host_action",
+	"tool_portal_admission_reserve",
+	"tool_portal_dispatch_arm",
 	"operation_cancel",
 	"recovery_command"
 ]);
@@ -52,19 +1480,8 @@ const GatewayControlCapabilityRefSchema = z.object({
 }).strict();
 const GatewayControlToolCallCorrelationSchema = ControlCorrelationSchema.extend({ capability: GatewayControlCapabilityRefSchema.optional() }).strict();
 const GatewayControlTrustedCallerContextIdSchema = z.string().uuid();
-const GatewayControlTrustedLeaseContextSchema = z.object({
-	agentId: z.string().min(1),
-	agentWorkspaceDir: z.string().min(1),
-	approvalScopeId: z.string().min(1).optional(),
-	callerContextId: GatewayControlTrustedCallerContextIdSchema,
-	custodyScopeId: z.string().min(1).optional(),
-	hostWorkMountDir: z.string().min(1),
-	profileId: z.string().min(1),
-	sessionKeyDigest: z.string().min(32),
-	workMountDir: z.string().min(1),
-	zoneId: z.string().min(1)
-}).strict();
 const GatewayControlCallerContextRefSchema = z.object({ callerContextId: GatewayControlTrustedCallerContextIdSchema }).strict();
+const GatewayControlRegisteredCallerContextRefSchema = GatewayControlCallerContextRefSchema.extend({ admissionPrincipal: GatewayStablePrincipalDigestSchema }).strict();
 const GatewayControlCallerContextProofAlgorithmSchema = z.literal("hmac-sha256");
 const GatewayControlCallerContextProofSchema = z.object({
 	algorithm: GatewayControlCallerContextProofAlgorithmSchema,
@@ -78,36 +1495,27 @@ const GatewayControlCallerContextAgentAuthoritySchema = z.object({
 function buildGatewayControlCallerContextProofPayload(input) {
 	const purpose = input.purpose ?? "tool_vm_lease";
 	return [
-		"gateway-control-caller-context-v1",
+		"gateway-control-caller-context-v4",
 		input.zoneId,
-		input.agentId,
-		input.agentWorkspaceDir,
-		input.workMountDir,
-		input.sessionKey,
+		deriveGatewayControlStablePrincipal({ principal: input.principal }),
 		purpose
 	].join("\0");
 }
 function buildGatewayControlCallerContextAgentAuthorityPayload(input) {
 	const purpose = input.purpose ?? "tool_vm_lease";
 	return [
-		"gateway-control-agent-authority-v1",
+		"gateway-control-agent-authority-v4",
 		input.zoneId,
-		input.agentId,
-		input.agentWorkspaceDir,
-		input.workMountDir,
-		input.sessionKey,
+		deriveGatewayControlStablePrincipal({ principal: input.principal }),
 		purpose
 	].join("\0");
 }
 const GatewayControlCallerContextRegisterPayloadSchema = z.object({
 	adapterEvidence: z.object({
 		agentAuthority: GatewayControlCallerContextAgentAuthoritySchema,
-		agentId: z.string().min(1),
-		agentWorkspaceDir: z.string().min(1),
+		principal: GatewayRuntimeTrustedInvocationPrincipalSchema$1,
 		proof: GatewayControlCallerContextProofSchema,
 		purpose: z.enum(["tool_vm_lease", "tool_portal_controller_host_action"]).optional(),
-		sessionKey: z.string().min(1),
-		workMountDir: z.string().min(1),
 		zoneId: z.string().min(1)
 	}).strict(),
 	correlation: GatewayControlToolCallCorrelationSchema.optional()
@@ -115,7 +1523,11 @@ const GatewayControlCallerContextRegisterPayloadSchema = z.object({
 const GatewayControlLeaseCreateIntentPayloadSchema = z.object({
 	callerContext: GatewayControlCallerContextRefSchema,
 	correlation: GatewayControlToolCallCorrelationSchema.optional(),
-	gatewayWorkspaceDir: z.string().min(1).optional(),
+	idleTtlHintMs: z.number().int().positive().optional()
+}).strict();
+const GatewayControlToolVmBindingRequestPayloadSchema = z.object({
+	callerContext: GatewayControlCallerContextRefSchema,
+	correlation: GatewayControlToolCallCorrelationSchema.optional(),
 	idleTtlHintMs: z.number().int().positive().optional()
 }).strict();
 const GatewayControlLeaseIdPayloadSchema = z.object({
@@ -230,7 +1642,7 @@ const GatewayControlToolVmLeaseCallerContextStateSchema = z.enum([
 	"not_applicable"
 ]);
 const GatewayControlControllerRequestHealthOperationSchema = z.enum([
-	"zone-git-push",
+	"workspace-git-push",
 	"lease-create",
 	"lease-get",
 	"lease-peek",
@@ -333,41 +1745,44 @@ const GatewayControlRuntimeStatusPayloadSchema = z.object({
 	]).optional(),
 	statusKind: z.string().min(1)
 }).strict();
-const GatewayControlZoneGitPushControllerHostActionPayloadSchema = z.object({
-	actionId: z.literal("zone_git_push"),
+const GatewayControlGitObjectIdSchema = z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u, "expected an exact lowercase SHA-1 or SHA-256 object id");
+const GatewayControlWorkspaceGitPushControllerHostActionPayloadSchema = z.object({
+	actionId: z.literal("workspace_git_push"),
+	approvalReservation: GatewayRuntimeControllerHostActionDispatchReservationSchema.optional(),
 	callerContext: GatewayControlCallerContextRefSchema,
 	correlation: GatewayControlToolCallCorrelationSchema,
-	expectedHead: z.string().min(1)
+	expectedHead: GatewayControlGitObjectIdSchema
 }).strict();
 const GatewayControlControllerHostProbePayloadSchema = z.object({
 	actionId: z.literal("controller_host_probe"),
+	approvalReservation: GatewayRuntimeControllerHostActionDispatchReservationSchema.optional(),
 	callerContext: GatewayControlCallerContextRefSchema,
 	correlation: GatewayControlToolCallCorrelationSchema
 }).strict();
-const GatewayControlToolPortalControllerHostActionPayloadSchema = z.discriminatedUnion("actionId", [GatewayControlZoneGitPushControllerHostActionPayloadSchema, GatewayControlControllerHostProbePayloadSchema]);
-const GatewayControlZoneGitCommitSummarySchema = z.object({
-	sha: z.string().min(1),
+const GatewayControlToolPortalControllerHostActionPayloadSchema = z.discriminatedUnion("actionId", [GatewayControlWorkspaceGitPushControllerHostActionPayloadSchema, GatewayControlControllerHostProbePayloadSchema]);
+const GatewayControlWorkspaceGitCommitSummarySchema = z.object({
+	sha: GatewayControlGitObjectIdSchema,
 	subject: z.string()
 }).strict();
-const GatewayControlZoneGitPushResultSchema = z.object({
+const GatewayControlWorkspaceGitPushResultSchema = z.object({
 	branch: z.string().min(1),
-	localHead: z.string().min(1),
-	pushedCommits: z.array(GatewayControlZoneGitCommitSummarySchema),
-	remoteHead: z.string().min(1)
+	localHead: GatewayControlGitObjectIdSchema,
+	pushedCommits: z.array(GatewayControlWorkspaceGitCommitSummarySchema),
+	remoteHead: GatewayControlGitObjectIdSchema
 }).strict();
 const GatewayControlControllerHostProbeResultSchema = z.object({
 	entryNames: z.array(z.string().min(1)).max(64),
 	probeKind: z.literal("controller_cache_dir_listing")
 }).strict();
-const GatewayControlZoneGitPushControllerHostActionResultSchema = z.object({
-	actionId: z.literal("zone_git_push"),
-	result: GatewayControlZoneGitPushResultSchema
+const GatewayControlWorkspaceGitPushControllerHostActionResultSchema = z.object({
+	actionId: z.literal("workspace_git_push"),
+	result: GatewayControlWorkspaceGitPushResultSchema
 }).strict();
 const GatewayControlControllerHostProbeActionResultSchema = z.object({
 	actionId: z.literal("controller_host_probe"),
 	result: GatewayControlControllerHostProbeResultSchema
 }).strict();
-const GatewayControlToolPortalControllerHostActionResultSchema = z.discriminatedUnion("actionId", [GatewayControlZoneGitPushControllerHostActionResultSchema, GatewayControlControllerHostProbeActionResultSchema]);
+const GatewayControlToolPortalControllerHostActionResultSchema = z.discriminatedUnion("actionId", [GatewayControlWorkspaceGitPushControllerHostActionResultSchema, GatewayControlControllerHostProbeActionResultSchema]);
 const GatewayControlActiveOperationIdSchema = z.string().uuid();
 const GatewayInitiatedOperationCancelPayloadSchema = z.object({
 	activeOperationId: GatewayControlActiveOperationIdSchema,
@@ -397,6 +1812,8 @@ const GatewayControlRecoveryCommandPayloadSchema = z.discriminatedUnion("action"
 	}).strict()
 ]);
 const GatewayControlPingPayloadSchema = z.object({}).strict();
+const GatewayControlToolPortalAdmissionReservePayloadSchema = z.object({ intent: GatewayRuntimeApprovalChallengeIntentSchema }).strict();
+const GatewayControlToolPortalDispatchArmPayloadSchema = z.object({ reservation: GatewayRuntimeGatewayDispatchReservationSchema }).strict();
 const GatewayControlHeartbeatPayloadSchema = z.object({
 	elapsedMs: z.number().int().nonnegative().optional(),
 	observedAtMs: z.number().int().positive()
@@ -405,12 +1822,69 @@ const GatewayControlRpcErrorSchema = ControlRpcErrorSchema;
 const GatewayControlSessionStateSchema = ControlSessionStateSchema;
 const GatewayControlToolVmSshAccessSchema = z.object({
 	host: z.string().min(1),
-	identityPem: z.string().min(1).optional(),
-	knownHostsLine: z.string().optional(),
 	port: z.number().int().positive(),
 	user: z.string().min(1)
 }).strict();
-const GatewayControlLeaseSnapshotSchema = z.object({
+const GatewayControlPrivateToolVmSshAccessSchema = GatewayControlToolVmSshAccessSchema.extend({
+	identityPem: z.string().min(1),
+	knownHostsLine: z.string().min(1)
+}).strict();
+const GatewayControlToolVmBindingPublicationAuthoritySchema = z.object({
+	attachmentGeneration: z.number().int().positive(),
+	connectionId: z.string().uuid(),
+	controllerEpoch: z.string().min(1),
+	gatewayEpoch: z.string().min(1),
+	processEpoch: z.string().min(1),
+	sessionId: z.string().uuid(),
+	zoneId: z.string().min(1)
+}).strict();
+const GatewayControlToolVmBindingAccessGrantSchema = z.object({
+	agentId: z.string().min(1),
+	idleTtlMs: z.number().int().positive(),
+	leafGeneration: z.string().min(1),
+	leaseId: z.string().min(1),
+	profileAssignmentRevision: z.string().min(1),
+	ssh: GatewayControlPrivateToolVmSshAccessSchema,
+	sshBindingId: z.string().min(1),
+	stablePrincipal: GatewayStablePrincipalDigestSchema,
+	tcpSlot: z.number().int().nonnegative(),
+	transport: z.literal("ssh-sandbox"),
+	workdir: z.string().min(1),
+	zoneId: z.string().min(1)
+}).strict();
+const GatewayControlToolVmBindingIdentitySchema = GatewayControlToolVmBindingAccessGrantSchema.pick({
+	agentId: true,
+	leafGeneration: true,
+	leaseId: true,
+	profileAssignmentRevision: true,
+	sshBindingId: true,
+	stablePrincipal: true,
+	zoneId: true
+}).strict();
+const GatewayControlToolVmBindingPublicationSchema = z.discriminatedUnion("kind", [z.object({
+	authority: GatewayControlToolVmBindingPublicationAuthoritySchema,
+	binding: GatewayControlToolVmBindingAccessGrantSchema,
+	kind: z.literal("current"),
+	observedAtMs: z.number().int().positive()
+}).strict(), z.object({
+	authority: GatewayControlToolVmBindingPublicationAuthoritySchema,
+	binding: GatewayControlToolVmBindingIdentitySchema,
+	kind: z.literal("retired"),
+	observedAtMs: z.number().int().positive(),
+	reason: z.enum([
+		"dead",
+		"expired",
+		"released",
+		"replaced",
+		"session_retired"
+	])
+}).strict()]);
+const GatewayControlToolVmBindingRequestResultSchema = z.object({
+	agentId: z.string().min(1),
+	stablePrincipal: GatewayStablePrincipalDigestSchema,
+	status: z.literal("publication_pending")
+}).strict();
+const GatewayControlLeaseSnapshotBaseSchema = z.object({
 	agentId: z.string().min(1),
 	activeUseId: z.string().uuid().optional(),
 	expiresAtMs: z.number().int().positive().optional(),
@@ -428,6 +1902,13 @@ const GatewayControlLeaseSnapshotSchema = z.object({
 	workdir: z.string().min(1),
 	zoneId: z.string().min(1)
 }).strict();
+const GatewayControlPublicLeaseSnapshotSchema = GatewayControlLeaseSnapshotBaseSchema;
+const GatewayControlPrivateLeaseSnapshotSchema = GatewayControlLeaseSnapshotBaseSchema.extend({
+	leafGeneration: z.string().min(1),
+	ssh: GatewayControlPrivateToolVmSshAccessSchema,
+	sshBindingId: z.string().min(1)
+}).strict();
+const GatewayControlLeaseSnapshotSchema = z.union([GatewayControlPrivateLeaseSnapshotSchema, GatewayControlPublicLeaseSnapshotSchema]);
 const GatewayControlLeaseUseSnapshotSchema = z.object({
 	expiresAt: z.number().int().positive().optional(),
 	heartbeatAfterMs: z.number().int().positive().optional(),
@@ -442,8 +1923,11 @@ const GatewayControlLeaseUseSnapshotSchema = z.object({
 const GatewayControlRpcDomainCorrelationSchema = ControlCorrelationSchema;
 const GatewayControlRpcForbiddenResponseFieldsSchema = {
 	activeOperationId: z.never().optional(),
+	approvalAdmission: z.never().optional(),
+	approvalDispatch: z.never().optional(),
 	approvalRequired: z.never().optional(),
 	callerContext: z.never().optional(),
+	bindingRequest: z.never().optional(),
 	controllerHostAction: z.never().optional(),
 	error: z.never().optional(),
 	lease: z.never().optional(),
@@ -475,39 +1959,60 @@ const GatewayControlRpcBareResponsePayloadSchema = z.discriminatedUnion("result"
 }).strict()]);
 const GatewayControlRpcCallerContextResponsePayloadSchema = z.discriminatedUnion("result", [GatewayControlRpcResponseCorrelationSchema.extend({
 	...GatewayControlRpcForbiddenResponseFieldsSchema,
-	callerContext: GatewayControlCallerContextRefSchema,
+	callerContext: GatewayControlRegisteredCallerContextRefSchema,
 	result: z.literal("ok")
 }).strict(), GatewayControlRpcResponseCorrelationSchema.extend({
 	...GatewayControlRpcForbiddenResponseFieldsSchema,
 	error: GatewayControlRpcErrorSchema,
 	result: GatewayControlRpcErrorResponseResultSchema
 }).strict()]);
-const GatewayControlRpcLeaseResponsePayloadSchema = z.discriminatedUnion("result", [
+const GatewayControlRpcToolVmBindingRequestResponsePayloadSchema = z.discriminatedUnion("result", [GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	bindingRequest: GatewayControlToolVmBindingRequestResultSchema,
+	result: z.literal("ok")
+}).strict(), GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	error: GatewayControlRpcErrorSchema,
+	result: GatewayControlRpcErrorResponseResultSchema
+}).strict()]);
+const GatewayControlRpcLeaseRejectedResponsePayloadSchema = GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	error: GatewayControlRpcErrorSchema.optional(),
+	leaseRejectionReason: GatewayControlLeaseRejectionReasonSchema,
+	result: z.literal("rejected")
+}).strict();
+const GatewayControlRpcLeaseFailedResponsePayloadSchema = GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	error: GatewayControlRpcErrorSchema,
+	leaseRejectionReason: GatewayControlLeaseRejectionReasonSchema.optional(),
+	result: z.enum([
+		"failed",
+		"timeout",
+		"cancelled",
+		"stale_generation",
+		"approval_required",
+		"approval_stale"
+	])
+}).strict();
+const GatewayControlRpcPrivateLeaseResponsePayloadSchema = z.discriminatedUnion("result", [
 	GatewayControlRpcResponseCorrelationSchema.extend({
 		...GatewayControlRpcForbiddenResponseFieldsSchema,
-		lease: GatewayControlLeaseSnapshotSchema,
+		lease: GatewayControlPrivateLeaseSnapshotSchema,
 		result: z.literal("ok")
 	}).strict(),
+	GatewayControlRpcLeaseRejectedResponsePayloadSchema,
+	GatewayControlRpcLeaseFailedResponsePayloadSchema
+]);
+const GatewayControlRpcPublicLeaseResponsePayloadSchema = z.discriminatedUnion("result", [
 	GatewayControlRpcResponseCorrelationSchema.extend({
 		...GatewayControlRpcForbiddenResponseFieldsSchema,
-		error: GatewayControlRpcErrorSchema.optional(),
-		leaseRejectionReason: GatewayControlLeaseRejectionReasonSchema,
-		result: z.literal("rejected")
+		lease: GatewayControlPublicLeaseSnapshotSchema,
+		result: z.literal("ok")
 	}).strict(),
-	GatewayControlRpcResponseCorrelationSchema.extend({
-		...GatewayControlRpcForbiddenResponseFieldsSchema,
-		error: GatewayControlRpcErrorSchema,
-		leaseRejectionReason: GatewayControlLeaseRejectionReasonSchema.optional(),
-		result: z.enum([
-			"failed",
-			"timeout",
-			"cancelled",
-			"stale_generation",
-			"approval_required",
-			"approval_stale"
-		])
-	}).strict()
+	GatewayControlRpcLeaseRejectedResponsePayloadSchema,
+	GatewayControlRpcLeaseFailedResponsePayloadSchema
 ]);
+const GatewayControlRpcLeaseResponsePayloadSchema = z.union([GatewayControlRpcPrivateLeaseResponsePayloadSchema, GatewayControlRpcPublicLeaseResponsePayloadSchema]);
 const GatewayControlRpcLeaseUseResponsePayloadSchema = z.discriminatedUnion("result", [
 	GatewayControlRpcResponseCorrelationSchema.extend({
 		...GatewayControlRpcForbiddenResponseFieldsSchema,
@@ -553,13 +2058,34 @@ const GatewayControlRpcOperationCancelResponsePayloadSchema = z.discriminatedUni
 	error: GatewayControlRpcErrorSchema,
 	result: GatewayControlRpcErrorResponseResultSchema
 }).strict()]);
+const GatewayControlRpcApprovalAdmissionResponsePayloadSchema = z.discriminatedUnion("result", [GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	approvalAdmission: GatewayRuntimeApprovalAdmissionResultSchema,
+	result: z.literal("ok")
+}).strict(), GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	error: GatewayControlRpcErrorSchema,
+	result: GatewayControlRpcErrorResponseResultSchema
+}).strict()]);
+const GatewayControlRpcApprovalDispatchResponsePayloadSchema = z.discriminatedUnion("result", [GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	approvalDispatch: GatewayRuntimeApprovalArmDispatchResultSchema,
+	result: z.literal("ok")
+}).strict(), GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	error: GatewayControlRpcErrorSchema,
+	result: GatewayControlRpcErrorResponseResultSchema
+}).strict()]);
 const GatewayControlRpcResponsePayloadSchema = z.union([
 	GatewayControlRpcBareResponsePayloadSchema,
 	GatewayControlRpcCallerContextResponsePayloadSchema,
+	GatewayControlRpcToolVmBindingRequestResponsePayloadSchema,
 	GatewayControlRpcLeaseResponsePayloadSchema,
 	GatewayControlRpcLeaseUseResponsePayloadSchema,
 	GatewayControlRpcControllerHostActionResponsePayloadSchema,
-	GatewayControlRpcOperationCancelResponsePayloadSchema
+	GatewayControlRpcOperationCancelResponsePayloadSchema,
+	GatewayControlRpcApprovalAdmissionResponsePayloadSchema,
+	GatewayControlRpcApprovalDispatchResponsePayloadSchema
 ]);
 const GatewayControlRpcControlPingCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
 	kind: z.literal("command_result"),
@@ -571,17 +2097,20 @@ const GatewayControlRpcCallerContextRegisterCommandResultMessageSchema = Gateway
 	operation: z.literal("caller_context_register"),
 	payload: GatewayControlRpcCallerContextResponsePayloadSchema
 }).strict();
-const GatewayControlRpcLeaseCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+const GatewayControlRpcPrivateLeaseCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
 	kind: z.literal("command_result"),
 	operation: z.enum([
 		"lease_create",
 		"lease_get",
-		"lease_peek",
 		"lease_reacquire",
-		"lease_renew",
-		"lease_release"
+		"lease_renew"
 	]),
-	payload: GatewayControlRpcLeaseResponsePayloadSchema
+	payload: GatewayControlRpcPrivateLeaseResponsePayloadSchema
+}).strict();
+const GatewayControlRpcPublicLeaseCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+	kind: z.literal("command_result"),
+	operation: z.enum(["lease_peek", "lease_release"]),
+	payload: GatewayControlRpcPublicLeaseResponsePayloadSchema
 }).strict();
 const GatewayControlRpcLeaseUseCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
 	kind: z.literal("command_result"),
@@ -607,6 +2136,26 @@ const GatewayControlRpcRecoveryCommandResultMessageSchema = GatewayControlRpcDom
 	operation: z.literal("recovery_command"),
 	payload: GatewayControlRpcBareResponsePayloadSchema
 }).strict();
+const GatewayControlRpcApprovalAdmissionCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+	kind: z.literal("command_result"),
+	operation: z.literal("tool_portal_admission_reserve"),
+	payload: GatewayControlRpcApprovalAdmissionResponsePayloadSchema
+}).strict();
+const GatewayControlRpcApprovalDispatchCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+	kind: z.literal("command_result"),
+	operation: z.literal("tool_portal_dispatch_arm"),
+	payload: GatewayControlRpcApprovalDispatchResponsePayloadSchema
+}).strict();
+const GatewayControlRpcToolVmBindingRequestCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+	kind: z.literal("command_result"),
+	operation: z.literal("tool_vm_binding_request"),
+	payload: GatewayControlRpcToolVmBindingRequestResponsePayloadSchema
+}).strict();
+const GatewayControlRpcToolVmBindingPublishCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+	kind: z.literal("command_result"),
+	operation: z.literal("tool_vm_binding_publish"),
+	payload: GatewayControlRpcBareResponsePayloadSchema
+}).strict();
 const GatewayControlHeartbeatMessageSchema = z.object({
 	kind: z.literal("heartbeat"),
 	operation: z.never().optional(),
@@ -615,13 +2164,28 @@ const GatewayControlHeartbeatMessageSchema = z.object({
 const GatewayControlRpcCommandResultMessageSchema = z.discriminatedUnion("operation", [
 	GatewayControlRpcControlPingCommandResultMessageSchema,
 	GatewayControlRpcCallerContextRegisterCommandResultMessageSchema,
-	GatewayControlRpcLeaseCommandResultMessageSchema,
+	GatewayControlRpcPrivateLeaseCommandResultMessageSchema,
+	GatewayControlRpcPublicLeaseCommandResultMessageSchema,
 	GatewayControlRpcLeaseUseCommandResultMessageSchema,
 	GatewayControlRpcControllerHostActionCommandResultMessageSchema,
 	GatewayControlRpcOperationCancelCommandResultMessageSchema,
-	GatewayControlRpcRecoveryCommandResultMessageSchema
+	GatewayControlRpcRecoveryCommandResultMessageSchema,
+	GatewayControlRpcApprovalAdmissionCommandResultMessageSchema,
+	GatewayControlRpcApprovalDispatchCommandResultMessageSchema,
+	GatewayControlRpcToolVmBindingRequestCommandResultMessageSchema,
+	GatewayControlRpcToolVmBindingPublishCommandResultMessageSchema
 ]);
 const GatewayControlRpcCommandMessageSchema = z.discriminatedUnion("operation", [
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("command"),
+		operation: z.literal("tool_vm_binding_request"),
+		payload: GatewayControlToolVmBindingRequestPayloadSchema
+	}).strict(),
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("command"),
+		operation: z.literal("tool_vm_binding_publish"),
+		payload: GatewayControlToolVmBindingPublicationSchema
+	}).strict(),
 	GatewayControlRpcDomainCorrelationSchema.extend({
 		kind: z.literal("command"),
 		operation: z.literal("control_ping"),
@@ -682,6 +2246,16 @@ const GatewayControlRpcCommandMessageSchema = z.discriminatedUnion("operation",
 		operation: z.literal("tool_portal_controller_host_action"),
 		payload: GatewayControlToolPortalControllerHostActionPayloadSchema
 	}).strict(),
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("command"),
+		operation: z.literal("tool_portal_admission_reserve"),
+		payload: GatewayControlToolPortalAdmissionReservePayloadSchema
+	}).strict(),
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("command"),
+		operation: z.literal("tool_portal_dispatch_arm"),
+		payload: GatewayControlToolPortalDispatchArmPayloadSchema
+	}).strict(),
 	GatewayControlRpcDomainCorrelationSchema.extend({
 		kind: z.literal("command"),
 		operation: z.literal("operation_cancel"),
@@ -693,16 +2267,28 @@ const GatewayControlRpcCommandMessageSchema = z.discriminatedUnion("operation",
 		payload: GatewayControlRecoveryCommandPayloadSchema
 	}).strict()
 ]);
-const GatewayControlRpcEventMessageSchema = z.discriminatedUnion("operation", [GatewayControlRpcDomainCorrelationSchema.extend({
-	kind: z.literal("event"),
-	operation: z.literal("health_event"),
-	payload: GatewayControlHealthEventPayloadSchema
-}).strict(), GatewayControlRpcDomainCorrelationSchema.extend({
-	kind: z.literal("event"),
-	operation: z.literal("runtime_status"),
-	payload: GatewayControlRuntimeStatusPayloadSchema
-}).strict()]);
-const GatewayControlEventOnlyOperationSchema = z.enum(["health_event", "runtime_status"]);
+const GatewayControlRpcEventMessageSchema = z.discriminatedUnion("operation", [
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("event"),
+		operation: z.literal("gateway_runtime_readiness"),
+		payload: GatewayRuntimeReadinessSnapshotSchema
+	}).strict(),
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("event"),
+		operation: z.literal("health_event"),
+		payload: GatewayControlHealthEventPayloadSchema
+	}).strict(),
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("event"),
+		operation: z.literal("runtime_status"),
+		payload: GatewayControlRuntimeStatusPayloadSchema
+	}).strict()
+]);
+const GatewayControlEventOnlyOperationSchema = z.enum([
+	"gateway_runtime_readiness",
+	"health_event",
+	"runtime_status"
+]);
 const GatewayControlRpcCommandResultOperationSchema = GatewayControlRpcOperationSchema.exclude(GatewayControlEventOnlyOperationSchema.options);
 const GatewayControlRpcMessageSchema = z.union([
 	GatewayControlHeartbeatMessageSchema,
@@ -714,6 +2300,7 @@ const gatewayControlDeliveryPolicyByKind = { heartbeat: "critical_idempotent" };
 const gatewayControlDeliveryPolicyByOperation = {
 	caller_context_register: "critical_idempotent",
 	control_ping: "acked_idempotent",
+	gateway_runtime_readiness: "latest_wins",
 	health_event: "append_only_observation",
 	lease_create: "critical_idempotent",
 	lease_get: "acked_idempotent",
@@ -727,7 +2314,11 @@ const gatewayControlDeliveryPolicyByOperation = {
 	operation_cancel: "acked_idempotent",
 	recovery_command: "critical_idempotent",
 	runtime_status: "latest_wins",
-	tool_portal_controller_host_action: "single_use_critical"
+	tool_vm_binding_publish: "critical_idempotent",
+	tool_vm_binding_request: "critical_idempotent",
+	tool_portal_controller_host_action: "single_use_critical",
+	tool_portal_admission_reserve: "single_use_critical",
+	tool_portal_dispatch_arm: "single_use_critical"
 };
 function deriveGatewayControlDeliveryPolicy(envelope) {
 	if (envelope.operation === "lease_create" && envelope.idempotencyKey === void 0) return "single_use_critical";
@@ -747,6 +2338,7 @@ function assertGatewayControlEnvelopeDeliveryPolicy(envelope) {
 const gatewayControlCommandExecutionTimeoutMsByOperation = {
 	caller_context_register: 5e3,
 	control_ping: 5e3,
+	gateway_runtime_readiness: 5e3,
 	health_event: 5e3,
 	lease_create: 18e4,
 	lease_get: 5e3,
@@ -760,7 +2352,11 @@ const gatewayControlCommandExecutionTimeoutMsByOperation = {
 	operation_cancel: 5e3,
 	recovery_command: 1e4,
 	runtime_status: 5e3,
-	tool_portal_controller_host_action: 12e4
+	tool_vm_binding_publish: 1e4,
+	tool_vm_binding_request: 18e4,
+	tool_portal_controller_host_action: 12e4,
+	tool_portal_admission_reserve: 1e4,
+	tool_portal_dispatch_arm: 1e4
 };
 function buildGatewayControlJsonSchemas() {
 	return {
@@ -768,6 +2364,14 @@ function buildGatewayControlJsonSchemas() {
 			io: "input",
 			unrepresentable: "any"
 		}),
+		hello: z.toJSONSchema(GatewayControlHelloSchema, {
+			io: "input",
+			unrepresentable: "any"
+		}),
+		helloResponse: z.toJSONSchema(GatewayControlHelloResponseSchema, {
+			io: "input",
+			unrepresentable: "any"
+		}),
 		message: z.toJSONSchema(GatewayControlRpcMessageSchema, {
 			io: "input",
 			unrepresentable: "any"
@@ -782,6 +2386,6 @@ function assertGatewayControlDomainRegistered() {
 	return KnownControlDomainSchema.extract(["gateway_control"]).parse("gateway_control");
 }
 //#endregion
-export { ControllerInitiatedGatewayOperationCancelPayloadSchema, GatewayControlActiveOperationIdSchema, GatewayControlCallerContextAgentAuthoritySchema, GatewayControlCallerContextProofAlgorithmSchema, GatewayControlCallerContextProofSchema, GatewayControlCallerContextRefSchema, GatewayControlCallerContextRegisterPayloadSchema, GatewayControlCapabilityRefSchema, GatewayControlControllerHostProbeActionResultSchema, GatewayControlControllerHostProbePayloadSchema, GatewayControlControllerHostProbeResultSchema, GatewayControlControllerRequestHealthOperationSchema, GatewayControlDomainSchema, GatewayControlEventOnlyOperationSchema, GatewayControlForbiddenPayloadFieldSchema, GatewayControlHealthEventPayloadSchema, GatewayControlHealthEventResultSchema, GatewayControlHeartbeatPayloadSchema, GatewayControlLeaseCreateIntentPayloadSchema, GatewayControlLeaseIdPayloadSchema, GatewayControlLeaseReacquireIntentPayloadSchema, GatewayControlLeaseRejectionReasonSchema, GatewayControlLeaseSnapshotSchema, GatewayControlLeaseStaleEvidenceSchema, GatewayControlLeaseUseEndPayloadSchema, GatewayControlLeaseUseHeartbeatPayloadSchema, GatewayControlLeaseUseSnapshotSchema, GatewayControlLeaseUseStartPayloadSchema, GatewayControlOperationCancelPayloadSchema, GatewayControlPingPayloadSchema, GatewayControlProviderRuntimeHealthSchema, GatewayControlRecoveryCommandPayloadSchema, GatewayControlRpcBareResponsePayloadSchema, GatewayControlRpcCallerContextResponsePayloadSchema, GatewayControlRpcCommandMessageSchema, GatewayControlRpcCommandResultMessageSchema, GatewayControlRpcCommandResultOperationSchema, GatewayControlRpcControllerHostActionResponsePayloadSchema, GatewayControlRpcDomainCorrelationSchema, GatewayControlRpcErrorSchema, GatewayControlRpcEventMessageSchema, GatewayControlRpcLeaseResponsePayloadSchema, GatewayControlRpcLeaseUseResponsePayloadSchema, GatewayControlRpcMessageSchema, GatewayControlRpcOperationCancelResponsePayloadSchema, GatewayControlRpcOperationSchema, GatewayControlRpcResponseBasePayloadSchema, GatewayControlRpcResponsePayloadSchema, GatewayControlRpcResultSchema, GatewayControlRuntimeFindingSchema, GatewayControlRuntimeStatusPayloadSchema, GatewayControlSessionHealthOperationSchema, GatewayControlSessionStateSchema, GatewayControlToolCallCorrelationSchema, GatewayControlToolPortalControllerHostActionPayloadSchema, GatewayControlToolPortalControllerHostActionResultSchema, GatewayControlToolVmLeaseCallerContextStateSchema, GatewayControlToolVmLeaseLifecycleEventRoleSchema, GatewayControlToolVmLeaseLifecycleTransitionSchema, GatewayControlToolVmSshAccessSchema, GatewayControlToolVmSshHealthOperationSchema, GatewayControlTrustedCallerContextIdSchema, GatewayControlTrustedLeaseContextSchema, GatewayControlZoneGitCommitSummarySchema, GatewayControlZoneGitPushControllerHostActionPayloadSchema, GatewayControlZoneGitPushControllerHostActionResultSchema, GatewayControlZoneGitPushResultSchema, GatewayInitiatedOperationCancelPayloadSchema, assertGatewayControlDomainRegistered, assertGatewayControlEnvelopeDeliveryPolicy, buildGatewayControlCallerContextAgentAuthorityPayload, buildGatewayControlCallerContextProofPayload, buildGatewayControlJsonSchemas, deriveGatewayControlDeliveryPolicy, gatewayControlCommandExecutionTimeoutMsByOperation, gatewayControlDeliveryPolicyByKind, gatewayControlDeliveryPolicyByOperation };
+export { ControllerInitiatedGatewayOperationCancelPayloadSchema, GATEWAY_CONTROL_ADMISSION_EXECUTION_LIMITS, GATEWAY_CONTROL_ADMISSION_LIMITS, GATEWAY_CONTROL_PROCESS_ADMISSION_LIMITS, GATEWAY_RUNTIME_APPROVAL_AUDIENCE, GATEWAY_RUNTIME_ATTACHMENT_SNAPSHOT_VERSION, GATEWAY_RUNTIME_PORTAL_ADMISSION_FILE_NAME, GATEWAY_RUNTIME_READINESS_SNAPSHOT_VERSION, GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_GUEST_PORT, GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_LISTEN_HOST, GATEWAY_RUNTIME_TOOL_PORTAL_PRODUCTION_CONTROL_ENDPOINT, GatewayControlActiveOperationIdSchema, GatewayControlCallerContextAgentAuthoritySchema, GatewayControlCallerContextProofAlgorithmSchema, GatewayControlCallerContextProofSchema, GatewayControlCallerContextRefSchema, GatewayControlCallerContextRegisterPayloadSchema, GatewayControlCapabilityRefSchema, GatewayControlControllerHostProbeActionResultSchema, GatewayControlControllerHostProbePayloadSchema, GatewayControlControllerHostProbeResultSchema, GatewayControlControllerRequestHealthOperationSchema, GatewayControlDomainSchema, GatewayControlEventOnlyOperationSchema, GatewayControlForbiddenPayloadFieldSchema, GatewayControlHealthEventPayloadSchema, GatewayControlHealthEventResultSchema, GatewayControlHeartbeatPayloadSchema, GatewayControlHelloResponseSchema, GatewayControlHelloSchema, GatewayControlLeaseCreateIntentPayloadSchema, GatewayControlLeaseIdPayloadSchema, GatewayControlLeaseReacquireIntentPayloadSchema, GatewayControlLeaseRejectionReasonSchema, GatewayControlLeaseSnapshotSchema, GatewayControlLeaseStaleEvidenceSchema, GatewayControlLeaseUseEndPayloadSchema, GatewayControlLeaseUseHeartbeatPayloadSchema, GatewayControlLeaseUseSnapshotSchema, GatewayControlLeaseUseStartPayloadSchema, GatewayControlOperationCancelPayloadSchema, GatewayControlPingPayloadSchema, GatewayControlPrivateLeaseSnapshotSchema, GatewayControlPrivateToolVmSshAccessSchema, GatewayControlProviderRuntimeHealthSchema, GatewayControlPublicLeaseSnapshotSchema, GatewayControlRecoveryCommandPayloadSchema, GatewayControlRegisteredCallerContextRefSchema, GatewayControlRpcApprovalAdmissionResponsePayloadSchema, GatewayControlRpcApprovalDispatchResponsePayloadSchema, GatewayControlRpcBareResponsePayloadSchema, GatewayControlRpcCallerContextResponsePayloadSchema, GatewayControlRpcCommandMessageSchema, GatewayControlRpcCommandResultMessageSchema, GatewayControlRpcCommandResultOperationSchema, GatewayControlRpcControllerHostActionResponsePayloadSchema, GatewayControlRpcDomainCorrelationSchema, GatewayControlRpcErrorSchema, GatewayControlRpcEventMessageSchema, GatewayControlRpcLeaseResponsePayloadSchema, GatewayControlRpcLeaseUseResponsePayloadSchema, GatewayControlRpcMessageSchema, GatewayControlRpcOperationCancelResponsePayloadSchema, GatewayControlRpcOperationSchema, GatewayControlRpcPrivateLeaseResponsePayloadSchema, GatewayControlRpcPublicLeaseResponsePayloadSchema, GatewayControlRpcResponseBasePayloadSchema, GatewayControlRpcResponsePayloadSchema, GatewayControlRpcResultSchema, GatewayControlRpcToolVmBindingRequestResponsePayloadSchema, GatewayControlRuntimeFindingSchema, GatewayControlRuntimeStatusPayloadSchema, GatewayControlSessionHealthOperationSchema, GatewayControlSessionStateSchema, GatewayControlToolCallCorrelationSchema, GatewayControlToolPortalAdmissionReservePayloadSchema, GatewayControlToolPortalControllerHostActionPayloadSchema, GatewayControlToolPortalControllerHostActionResultSchema, GatewayControlToolPortalDispatchArmPayloadSchema, GatewayControlToolVmBindingAccessGrantSchema, GatewayControlToolVmBindingIdentitySchema, GatewayControlToolVmBindingPublicationAuthoritySchema, GatewayControlToolVmBindingPublicationSchema, GatewayControlToolVmBindingRequestPayloadSchema, GatewayControlToolVmBindingRequestResultSchema, GatewayControlToolVmLeaseCallerContextStateSchema, GatewayControlToolVmLeaseLifecycleEventRoleSchema, GatewayControlToolVmLeaseLifecycleTransitionSchema, GatewayControlToolVmSshAccessSchema, GatewayControlToolVmSshHealthOperationSchema, GatewayControlTrustedCallerContextIdSchema, GatewayControlWorkspaceGitCommitSummarySchema, GatewayControlWorkspaceGitPushControllerHostActionPayloadSchema, GatewayControlWorkspaceGitPushControllerHostActionResultSchema, GatewayControlWorkspaceGitPushResultSchema, GatewayInitiatedOperationCancelPayloadSchema, GatewayRuntimeApprovalAdmissionResultSchema, GatewayRuntimeApprovalAmbiguousReasonSchema, GatewayRuntimeApprovalArmDispatchCommandSchema, GatewayRuntimeApprovalArmDispatchResultSchema, GatewayRuntimeApprovalAuthorityContextSchema, GatewayRuntimeApprovalCallSchema, GatewayRuntimeApprovalChallengeIntentSchema, GatewayRuntimeApprovalChallengeSchema, GatewayRuntimeApprovalDecisionCommandSchema, GatewayRuntimeApprovalDispatchGrantSchema, GatewayRuntimeApprovalDispatchReservationSchema, GatewayRuntimeApprovalFingerprintSchema, GatewayRuntimeApprovalNotDispatchedReasonSchema, GatewayRuntimeApprovalRevokeCommandSchema, GatewayRuntimeApprovalSemanticRevisionCohortSchema, GatewayRuntimeAttachmentSnapshotSchema, GatewayRuntimeControllerHostActionApprovalReservationDispatchAuthoritySchema, GatewayRuntimeControllerHostActionDirectDispatchAuthoritySchema, GatewayRuntimeControllerHostActionDispatchReservationSchema, GatewayRuntimeExpectedAttachmentIdentitySchema, GatewayRuntimeFatalEvidenceSchema, GatewayRuntimeFrameworkIdentitySchema, GatewayRuntimeFrameworkKindSchema, GatewayRuntimeGatewayDispatchReservationSchema, GatewayRuntimeManagedPluginClientKindSchema, GatewayRuntimeMcpProviderApprovalGrantDispatchAuthoritySchema, GatewayRuntimeMcpProviderDirectDispatchAuthoritySchema, GatewayRuntimeMcpProviderDispatchGrantSchema, GatewayRuntimeMcpProviderDispatchReservationSchema, GatewayRuntimePortalAdmissionMaterialSchema, GatewayRuntimePortalSemanticSnapshotSchema, GatewayRuntimePortalSurfaceClassSchema, GatewayRuntimeReadinessSnapshotSchema, GatewayRuntimeRequiredBackendKindSchema, GatewayRuntimeRequiredBackendsReadinessSchema, GatewayRuntimeToolPortalDispatchAuthoritySchema, GatewayRuntimeToolPortalProductionControlEndpointSchema, GatewayRuntimeToolVmRunnerApprovalGrantDispatchAuthoritySchema, GatewayRuntimeToolVmRunnerDirectDispatchAuthoritySchema, GatewayRuntimeToolVmRunnerDispatchGrantSchema, GatewayRuntimeToolVmRunnerDispatchReservationSchema, GatewayRuntimeTrustedInvocationContextSchema, GatewayRuntimeTrustedInvocationCorrelationSchema, GatewayRuntimeTrustedInvocationPrincipalSchema, GatewayRuntimeTrustedInvocationRequesterSchema, GatewayRuntimeUdsPublicationSnapshotSchema, ManagedAgentProjectionSchema, assertGatewayControlDomainRegistered, assertGatewayControlEnvelopeDeliveryPolicy, assertGatewayRuntimePortalSemanticSnapshotMatchesInputs, buildGatewayControlCallerContextAgentAuthorityPayload, buildGatewayControlCallerContextProofPayload, buildGatewayControlJsonSchemas, classifyGatewayControlAdmission, createGatewayControlAdmissionExecutor, createGatewayControlAdmissionScheduler, createGatewayControlProcessAdmission, createGatewayRuntimeAttachmentSnapshot, createGatewayRuntimeReadinessSnapshot, deriveGatewayControlDeliveryPolicy, deriveGatewayControlStablePrincipal, deriveGatewayRuntimeApprovalFingerprint, deriveGatewayRuntimeApprovalId, deriveGatewayRuntimePortalSemanticSnapshot, deriveManagedAgentProjection, gatewayControlCommandExecutionTimeoutMsByOperation, gatewayControlDeliveryPolicyByKind, gatewayControlDeliveryPolicyByOperation };
 
 //# sourceMappingURL=index.js.map