@agent-vm/gateway-control-contracts 0.0.114 → 0.0.115

package/dist/index.js

@@ -1,5 +1,403 @@
+import { GatewayRuntimeFrameworkIdentitySchema, GatewayRuntimeFrameworkKindSchema, GatewayRuntimeTrustedInvocationContextSchema, GatewayRuntimeTrustedInvocationCorrelationSchema, GatewayRuntimeTrustedInvocationPrincipalSchema, GatewayRuntimeTrustedInvocationPrincipalSchema as GatewayRuntimeTrustedInvocationPrincipalSchema$1, GatewayRuntimeTrustedInvocationRequesterSchema, GatewayStablePrincipalDigestSchema, ManagedAgentProjectionSchema, ManagedAgentProjectionSchema as ManagedAgentProjectionSchema$1 } from "@agent-vm/agent-portal-sdk/contracts";
 import { CONTROL_PROTOCOL_VERSION, ControlCorrelationSchema, ControlRpcErrorSchema, ControlRpcResultBaseSchema, ControlSessionStateSchema, KnownControlDomainSchema } from "@agent-vm/control-protocol-contracts";
 import { z } from "zod/v4";
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
+import { jsonObjectSchema, mcpConfigSchema, toolPortalBackendKindSchema, toolPortalConfigSchema } from "@agent-vm/config-contracts";
+//#region src/gateway-control-principal.ts
+function lengthPrefixedUtf8(value) {
+	return `${Buffer.byteLength(value, "utf8")}:${value}`;
+}
+function canonicalStablePrincipalMaterial(principal) {
+	const frameworkIdentityValue = principal.frameworkIdentity.kind === "openclaw" ? principal.frameworkIdentity.agentId : principal.frameworkIdentity.profileName;
+	return [
+		principal.agentId,
+		principal.frameworkIdentity.kind,
+		frameworkIdentityValue,
+		principal.toolPortalProfileId,
+		principal.profileAssignmentRevision
+	].map(lengthPrefixedUtf8).join("");
+}
+function deriveGatewayControlStablePrincipal(options) {
+	return GatewayStablePrincipalDigestSchema.parse(createHash("sha256").update("agent-vm-gateway-stable-principal-v4", "utf8").update("\0").update(canonicalStablePrincipalMaterial(options.principal), "utf8").digest("hex"));
+}
+//#endregion
+//#region src/gateway-runtime-portal-context.ts
+const GatewayRuntimePortalSurfaceClassSchema = z.enum(["mcp", "protected_uds"]);
+const GatewayRuntimePortalSemanticSnapshotSchema = z.object({
+	activeRevision: z.string().min(1),
+	agentProjections: z.record(z.string().min(1), ManagedAgentProjectionSchema$1),
+	bindingRevision: z.string().min(1),
+	catalogRevision: z.string().min(1),
+	desiredRevision: z.string().min(1),
+	profilePolicyRevision: z.string().min(1),
+	projectionCohortDigest: z.string().regex(/^projection-cohort:[a-f0-9]{64}$/u),
+	providerRevision: z.string().min(1),
+	schemaRevision: z.string().min(1),
+	schemaVersion: z.literal(1),
+	surfaceEligibilityByProfile: z.record(z.string().min(1), z.record(z.string().min(1), z.array(GatewayRuntimePortalSurfaceClassSchema).min(1)))
+}).strict();
+//#endregion
+//#region src/gateway-runtime-approval.ts
+const GATEWAY_RUNTIME_APPROVAL_AUDIENCE = "agent-vm-controller-approval";
+const GatewayRuntimeApprovalFingerprintSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+function canonicalApprovalJson(value) {
+	if (value === null || typeof value === "boolean" || typeof value === "string") return JSON.stringify(value);
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new TypeError("Approval fingerprint values must be finite.");
+		return JSON.stringify(value);
+	}
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalApprovalJson(item)).join(",")}]`;
+	if (typeof value === "object") return `{${Object.entries(value).filter(([, fieldValue]) => fieldValue !== void 0).toSorted(([leftName], [rightName]) => leftName.localeCompare(rightName)).map(([fieldName, fieldValue]) => `${JSON.stringify(fieldName)}:${canonicalApprovalJson(fieldValue)}`).join(",")}}`;
+	throw new TypeError("Approval fingerprint values must be JSON-compatible.");
+}
+const GatewayRuntimeApprovalAuthorityContextSchema = z.object({
+	controllerEpoch: z.string().min(1),
+	frameworkEpoch: z.string().min(1),
+	gatewayEpoch: z.string().min(1),
+	runtimeEpoch: z.string().min(1),
+	zoneId: z.string().min(1)
+}).strict();
+const GatewayRuntimeApprovalSemanticRevisionCohortSchema = z.object({
+	activeRevision: z.string().min(1),
+	bindingRevision: z.string().min(1),
+	catalogRevision: z.string().min(1),
+	profilePolicyRevision: z.string().min(1),
+	providerRevision: z.string().min(1),
+	schemaRevision: z.string().min(1)
+}).strict();
+const GatewayRuntimeApprovalCallSchema = z.object({
+	arguments: jsonObjectSchema,
+	id: z.string().min(1),
+	name: z.string().min(1),
+	namespace: z.string().min(1)
+}).strict();
+const GatewayRuntimeApprovalChallengeIntentSchema = z.object({
+	backendKind: toolPortalBackendKindSchema,
+	call: GatewayRuntimeApprovalCallSchema,
+	operationId: z.string().uuid(),
+	semanticRevisions: GatewayRuntimeApprovalSemanticRevisionCohortSchema,
+	surfaceClass: GatewayRuntimePortalSurfaceClassSchema,
+	trustedContext: GatewayRuntimeTrustedInvocationContextSchema
+}).strict();
+const GatewayRuntimeApprovalChallengeSchema = z.object({
+	approvalId: z.string().uuid(),
+	createdAt: z.string().datetime(),
+	expiresAt: z.string().datetime(),
+	fingerprint: GatewayRuntimeApprovalFingerprintSchema,
+	intent: GatewayRuntimeApprovalChallengeIntentSchema
+}).strict();
+const approvalDispatchAuthorityShape = {
+	approvalId: z.string().uuid(),
+	authorityContext: GatewayRuntimeApprovalAuthorityContextSchema,
+	expiresAt: z.string().datetime(),
+	fingerprint: GatewayRuntimeApprovalFingerprintSchema,
+	operationId: z.string().uuid(),
+	stablePrincipal: GatewayStablePrincipalDigestSchema
+};
+const GatewayRuntimeMcpProviderDispatchReservationSchema = z.object({
+	...approvalDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.mcp_provider),
+	reservationId: z.string().uuid()
+}).strict();
+const GatewayRuntimeControllerHostActionDispatchReservationSchema = z.object({
+	...approvalDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.controller_host_action),
+	reservationId: z.string().uuid()
+}).strict();
+const GatewayRuntimeToolVmRunnerDispatchReservationSchema = z.object({
+	...approvalDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.tool_vm_runner),
+	reservationId: z.string().uuid()
+}).strict();
+const GatewayRuntimeApprovalDispatchReservationSchema = z.discriminatedUnion("backendKind", [
+	GatewayRuntimeMcpProviderDispatchReservationSchema,
+	GatewayRuntimeControllerHostActionDispatchReservationSchema,
+	GatewayRuntimeToolVmRunnerDispatchReservationSchema
+]);
+const GatewayRuntimeGatewayDispatchReservationSchema = z.discriminatedUnion("backendKind", [GatewayRuntimeMcpProviderDispatchReservationSchema, GatewayRuntimeToolVmRunnerDispatchReservationSchema]);
+const GatewayRuntimeMcpProviderDispatchGrantSchema = z.object({
+	...approvalDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.mcp_provider),
+	grantId: z.string().uuid()
+}).strict();
+const GatewayRuntimeToolVmRunnerDispatchGrantSchema = z.object({
+	...approvalDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.tool_vm_runner),
+	grantId: z.string().uuid()
+}).strict();
+const GatewayRuntimeApprovalDispatchGrantSchema = z.discriminatedUnion("backendKind", [GatewayRuntimeMcpProviderDispatchGrantSchema, GatewayRuntimeToolVmRunnerDispatchGrantSchema]);
+const directDispatchAuthorityShape = {
+	fingerprint: GatewayRuntimeApprovalFingerprintSchema,
+	kind: z.literal("without-approval"),
+	operationId: z.string().uuid()
+};
+const GatewayRuntimeMcpProviderDirectDispatchAuthoritySchema = z.object({
+	...directDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.mcp_provider)
+}).strict();
+const GatewayRuntimeToolVmRunnerDirectDispatchAuthoritySchema = z.object({
+	...directDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.tool_vm_runner)
+}).strict();
+const GatewayRuntimeControllerHostActionDirectDispatchAuthoritySchema = z.object({
+	...directDispatchAuthorityShape,
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.controller_host_action)
+}).strict();
+const GatewayRuntimeMcpProviderApprovalGrantDispatchAuthoritySchema = z.object({
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.mcp_provider),
+	grant: GatewayRuntimeMcpProviderDispatchGrantSchema,
+	kind: z.literal("approval-grant")
+}).strict();
+const GatewayRuntimeToolVmRunnerApprovalGrantDispatchAuthoritySchema = z.object({
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.tool_vm_runner),
+	grant: GatewayRuntimeToolVmRunnerDispatchGrantSchema,
+	kind: z.literal("approval-grant")
+}).strict();
+const GatewayRuntimeControllerHostActionApprovalReservationDispatchAuthoritySchema = z.object({
+	backendKind: z.literal(toolPortalBackendKindSchema.enum.controller_host_action),
+	kind: z.literal("controller-approval-reservation"),
+	reservation: GatewayRuntimeControllerHostActionDispatchReservationSchema
+}).strict();
+const GatewayRuntimeToolPortalDispatchAuthoritySchema = z.union([
+	GatewayRuntimeMcpProviderDirectDispatchAuthoritySchema,
+	GatewayRuntimeToolVmRunnerDirectDispatchAuthoritySchema,
+	GatewayRuntimeControllerHostActionDirectDispatchAuthoritySchema,
+	GatewayRuntimeMcpProviderApprovalGrantDispatchAuthoritySchema,
+	GatewayRuntimeToolVmRunnerApprovalGrantDispatchAuthoritySchema,
+	GatewayRuntimeControllerHostActionApprovalReservationDispatchAuthoritySchema
+]);
+const GatewayRuntimeApprovalNotDispatchedReasonSchema = z.enum([
+	"consumed-without-dispatch",
+	"denied",
+	"expired",
+	"revoked",
+	"stale-authority",
+	"stale-fingerprint"
+]);
+const GatewayRuntimeApprovalAmbiguousReasonSchema = z.literal("dispatch-armed");
+const GatewayRuntimeApprovalAdmissionResultSchema = z.discriminatedUnion("kind", [
+	z.object({
+		challenge: GatewayRuntimeApprovalChallengeSchema,
+		kind: z.literal("approval-required")
+	}).strict(),
+	z.object({
+		kind: z.literal("dispatch-reserved"),
+		reservation: GatewayRuntimeApprovalDispatchReservationSchema
+	}).strict(),
+	z.object({
+		kind: z.literal("not-dispatched"),
+		operationId: z.string().uuid(),
+		reason: GatewayRuntimeApprovalNotDispatchedReasonSchema
+	}).strict(),
+	z.object({
+		kind: z.literal("ambiguous"),
+		operationId: z.string().uuid(),
+		reason: GatewayRuntimeApprovalAmbiguousReasonSchema
+	}).strict()
+]);
+const GatewayRuntimeApprovalArmDispatchCommandSchema = z.object({ reservation: GatewayRuntimeGatewayDispatchReservationSchema }).strict();
+const GatewayRuntimeApprovalArmDispatchResultSchema = z.discriminatedUnion("kind", [
+	z.object({
+		grant: GatewayRuntimeApprovalDispatchGrantSchema,
+		kind: z.literal("dispatch-armed")
+	}).strict(),
+	z.object({
+		kind: z.literal("not-dispatched"),
+		operationId: z.string().uuid(),
+		reason: GatewayRuntimeApprovalNotDispatchedReasonSchema
+	}).strict(),
+	z.object({
+		kind: z.literal("ambiguous"),
+		operationId: z.string().uuid(),
+		reason: GatewayRuntimeApprovalAmbiguousReasonSchema
+	}).strict()
+]);
+const GatewayRuntimeApprovalDecisionCommandSchema = z.object({
+	approvalId: z.string().uuid(),
+	decision: z.enum(["approve", "deny"])
+}).strict();
+const GatewayRuntimeApprovalRevokeCommandSchema = z.object({ approvalId: z.string().uuid() }).strict();
+function deriveGatewayRuntimeApprovalFingerprint(props) {
+	return `sha256:${createHash("sha256").update(canonicalApprovalJson(props), "utf8").digest("hex")}`;
+}
+function deriveGatewayRuntimeApprovalId(fingerprint) {
+	const hexadecimal = fingerprint.slice(7, 39).split("");
+	hexadecimal[12] = "5";
+	hexadecimal[16] = (Number.parseInt(hexadecimal[16] ?? "0", 16) & 3 | 8).toString(16);
+	const value = hexadecimal.join("");
+	return `${value.slice(0, 8)}-${value.slice(8, 12)}-${value.slice(12, 16)}-${value.slice(16, 20)}-${value.slice(20)}`;
+}
+//#endregion
+//#region src/gateway-runtime-readiness-snapshot.ts
+const GATEWAY_RUNTIME_READINESS_SNAPSHOT_VERSION = 1;
+const GATEWAY_RUNTIME_ATTACHMENT_SNAPSHOT_VERSION = 1;
+const BoundedIdentitySchema = z.string().min(1).max(256);
+const PositiveSafeIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const NonNegativeSafeIntegerSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const GatewayRuntimeManagedPluginClientKindSchema = z.enum(["openclaw-managed-plugin", "hermes-managed-plugin"]);
+const GatewayRuntimeExpectedAttachmentIdentitySchema = z.object({
+	attachmentGeneration: PositiveSafeIntegerSchema,
+	clientKind: GatewayRuntimeManagedPluginClientKindSchema,
+	configuredAgentIds: z.array(BoundedIdentitySchema).min(1).max(128).readonly(),
+	frameworkEpoch: BoundedIdentitySchema,
+	gatewayEpoch: BoundedIdentitySchema,
+	protocolVersion: PositiveSafeIntegerSchema,
+	projectionCohortDigest: z.string().regex(/^projection-cohort:[a-f0-9]{64}$/u),
+	runtimeEpoch: BoundedIdentitySchema,
+	schemaVersion: PositiveSafeIntegerSchema
+}).strict().superRefine((identity, context) => {
+	if (new Set(identity.configuredAgentIds).size !== identity.configuredAgentIds.length) context.addIssue({
+		code: "custom",
+		message: "Gateway runtime configured agent ids must be unique.",
+		path: ["configuredAgentIds"]
+	});
+}).readonly();
+const GatewayRuntimeAttachmentSnapshotSchema = z.object({
+	connectionId: z.string().uuid().optional(),
+	expected: GatewayRuntimeExpectedAttachmentIdentitySchema,
+	observationSequence: NonNegativeSafeIntegerSchema,
+	snapshotVersion: z.literal(1),
+	status: z.enum([
+		"awaiting-attachment",
+		"attached",
+		"attachment-lost",
+		"retired"
+	])
+}).strict().superRefine((snapshot, context) => {
+	const requiresConnectionIdentity = snapshot.status === "attached" || snapshot.status === "attachment-lost";
+	if (requiresConnectionIdentity && snapshot.connectionId === void 0) context.addIssue({
+		code: "custom",
+		message: "Accepted and lost attachment snapshots require a connection identity.",
+		path: ["connectionId"]
+	});
+	if (!requiresConnectionIdentity && snapshot.connectionId !== void 0) context.addIssue({
+		code: "custom",
+		message: "Awaiting and retired attachment snapshots cannot claim a connection identity.",
+		path: ["connectionId"]
+	});
+}).readonly();
+const GatewayRuntimeUdsPublicationSnapshotSchema = z.object({
+	identity: z.literal("managed-plugin-private-uds"),
+	protocolVersion: PositiveSafeIntegerSchema,
+	schemaVersion: PositiveSafeIntegerSchema,
+	socketPath: z.string().min(1).max(256).startsWith("/"),
+	status: z.enum(["published", "retired"])
+}).strict().readonly();
+const GatewayRuntimeRequiredBackendKindSchema = z.enum([
+	"controller_host_action",
+	"mcp_provider",
+	"tool_vm_runner"
+]);
+const GatewayRuntimeRequiredBackendsReadinessSchema = z.object({
+	readyBackendKinds: z.array(GatewayRuntimeRequiredBackendKindSchema).max(3).readonly(),
+	revision: BoundedIdentitySchema,
+	status: z.literal("ready")
+}).strict().superRefine((readiness, context) => {
+	if (new Set(readiness.readyBackendKinds).size !== readiness.readyBackendKinds.length) context.addIssue({
+		code: "custom",
+		message: "Gateway runtime ready backend kinds must be unique.",
+		path: ["readyBackendKinds"]
+	});
+}).readonly();
+const GatewayRuntimeFatalEvidenceSchema = z.object({
+	failureCode: BoundedIdentitySchema,
+	kind: z.literal("fatal"),
+	observedGatewayEpoch: BoundedIdentitySchema,
+	processEpoch: BoundedIdentitySchema,
+	role: z.enum(["framework-service", "tool-portal-service"]),
+	schemaVersion: z.literal(1),
+	serviceId: BoundedIdentitySchema
+}).strict().readonly();
+/**
+* Role-local Tool Portal evidence. The controller must join this with framework,
+* backend, ingress, and control-session evidence before admitting the Gateway.
+*/
+const GatewayRuntimeReadinessSnapshotSchema = z.object({
+	controlEndpoint: z.object({
+		identity: z.object({
+			bootId: BoundedIdentitySchema,
+			controllerEpoch: BoundedIdentitySchema,
+			generationId: BoundedIdentitySchema,
+			peerId: BoundedIdentitySchema,
+			processEpoch: BoundedIdentitySchema,
+			zoneId: BoundedIdentitySchema
+		}).strict().readonly(),
+		listener: z.object({
+			host: z.string().min(1).max(253),
+			port: z.number().int().min(1).max(65535),
+			readyPath: z.string().min(1).max(256).startsWith("/"),
+			socketPath: z.string().min(1).max(256).startsWith("/")
+		}).strict().readonly()
+	}).strict().readonly(),
+	kind: z.literal("tool-portal-role-readiness"),
+	providerRevision: BoundedIdentitySchema,
+	requiredBackends: GatewayRuntimeRequiredBackendsReadinessSchema,
+	semanticRevision: BoundedIdentitySchema,
+	serviceIdentity: z.object({
+		processEpoch: BoundedIdentitySchema,
+		role: z.literal("tool-portal"),
+		serviceId: BoundedIdentitySchema
+	}).strict().readonly(),
+	snapshotVersion: z.literal(1),
+	uds: z.object({
+		attachment: GatewayRuntimeAttachmentSnapshotSchema,
+		publication: GatewayRuntimeUdsPublicationSnapshotSchema
+	}).strict().readonly()
+}).strict().superRefine((snapshot, context) => {
+	if (snapshot.controlEndpoint.identity.processEpoch !== snapshot.serviceIdentity.processEpoch) context.addIssue({
+		code: "custom",
+		message: "Gateway runtime service and control endpoint process epochs must match.",
+		path: [
+			"controlEndpoint",
+			"identity",
+			"processEpoch"
+		]
+	});
+	if (snapshot.uds.publication.status === "retired" && snapshot.uds.attachment.status !== "retired") context.addIssue({
+		code: "custom",
+		message: "A retired UDS publication requires a retired attachment lifecycle.",
+		path: [
+			"uds",
+			"attachment",
+			"status"
+		]
+	});
+}).readonly();
+function freezeExpectedAttachmentIdentity(identity) {
+	return Object.freeze({
+		...identity,
+		configuredAgentIds: Object.freeze([...identity.configuredAgentIds].toSorted())
+	});
+}
+function createGatewayRuntimeAttachmentSnapshot(input) {
+	const parsed = GatewayRuntimeAttachmentSnapshotSchema.parse(input);
+	return Object.freeze({
+		...parsed,
+		expected: freezeExpectedAttachmentIdentity(parsed.expected)
+	});
+}
+function createGatewayRuntimeReadinessSnapshot(input) {
+	const parsed = GatewayRuntimeReadinessSnapshotSchema.parse(input);
+	const attachment = createGatewayRuntimeAttachmentSnapshot(parsed.uds.attachment);
+	return Object.freeze({
+		...parsed,
+		controlEndpoint: Object.freeze({
+			identity: Object.freeze({ ...parsed.controlEndpoint.identity }),
+			listener: Object.freeze({ ...parsed.controlEndpoint.listener })
+		}),
+		serviceIdentity: Object.freeze({ ...parsed.serviceIdentity }),
+		requiredBackends: Object.freeze({
+			...parsed.requiredBackends,
+			readyBackendKinds: Object.freeze([...parsed.requiredBackends.readyBackendKinds].toSorted())
+		}),
+		uds: Object.freeze({
+			attachment,
+			publication: Object.freeze({ ...parsed.uds.publication })
+		})
+	});
+}
+//#endregion
 //#region src/gateway-control-admission.ts
 const GATEWAY_CONTROL_ADMISSION_LIMITS = {
 	authority: {
@@ -669,6 +1067,11 @@ function classifyGatewayControlAdmission(options) {
 			status: "fence"
 		};
 		switch (message.operation) {
+			case "gateway_runtime_readiness": return {
+				coalesceKey: "gateway-runtime-readiness",
+				messageClass: "liveness",
+				status: "classified"
+			};
 			case "runtime_status": return {
 				coalesceKey: `runtime-status:${message.payload.statusKind}`,
 				messageClass: "liveness",
@@ -687,6 +1090,20 @@ function classifyGatewayControlAdmission(options) {
 		status: "classified"
 	};
 	if (options.direction === "controller_to_gateway") switch (message.operation) {
+		case "tool_vm_binding_publish": {
+			if (message.kind !== "command") return {
+				reason: "direction_violation",
+				status: "fence"
+			};
+			const stablePrincipal = message.payload.binding.stablePrincipal;
+			return {
+				authoritySchedulingKey: stablePrincipal,
+				coalesceKey: `tool-vm-binding:${stablePrincipal}`,
+				messageClass: "authority",
+				stablePrincipal,
+				status: "classified"
+			};
+		}
 		case "operation_cancel": return options.controllerSafetyOperation === true && message.payload.initiatedBy === "controller" ? {
 			messageClass: "safety",
 			status: "classified"
@@ -711,7 +1128,10 @@ function classifyGatewayControlAdmission(options) {
 		case "lease_use_start":
 		case "lease_use_heartbeat":
 		case "lease_use_end":
-		case "tool_portal_controller_host_action": return {
+		case "tool_portal_controller_host_action":
+		case "tool_portal_admission_reserve":
+		case "tool_portal_dispatch_arm":
+		case "tool_vm_binding_request": return {
 			reason: "direction_violation",
 			status: "fence"
 		};
@@ -745,6 +1165,10 @@ function classifyGatewayControlAdmission(options) {
 			reason: "direction_violation",
 			status: "fence"
 		};
+		case "tool_vm_binding_publish": return {
+			reason: "direction_violation",
+			status: "fence"
+		};
 		case "lease_create":
 		case "lease_get":
 		case "lease_peek":
@@ -752,7 +1176,10 @@ function classifyGatewayControlAdmission(options) {
 		case "lease_release":
 		case "lease_use_start":
 		case "lease_use_end":
-		case "tool_portal_controller_host_action": return authorityClassification(options.stablePrincipal);
+		case "tool_portal_controller_host_action":
+		case "tool_portal_admission_reserve":
+		case "tool_portal_dispatch_arm":
+		case "tool_vm_binding_request": return authorityClassification(options.stablePrincipal);
 	}
 	return {
 		reason: "direction_violation",
@@ -760,6 +1187,221 @@ function classifyGatewayControlAdmission(options) {
 	};
 }
 //#endregion
+//#region src/gateway-runtime-control-endpoint.ts
+const GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_LISTEN_HOST = "127.0.0.1";
+const GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_GUEST_PORT = 18790;
+const GatewayRuntimeToolPortalProductionControlEndpointSchema = z.object({
+	host: z.literal(GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_LISTEN_HOST),
+	port: z.literal(GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_GUEST_PORT)
+}).strict().readonly();
+const GATEWAY_RUNTIME_TOOL_PORTAL_PRODUCTION_CONTROL_ENDPOINT = GatewayRuntimeToolPortalProductionControlEndpointSchema.parse({
+	host: GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_LISTEN_HOST,
+	port: GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_GUEST_PORT
+});
+//#endregion
+//#region src/gateway-runtime-portal-admission.ts
+const GATEWAY_RUNTIME_PORTAL_ADMISSION_FILE_NAME = "gateway-runtime-portal-admission.json";
+const GatewayRuntimeManagedToolPortalConfigSchema = toolPortalConfigSchema.transform((config, context) => {
+	if (config.mode !== "managed") {
+		context.addIssue({
+			code: "custom",
+			message: "Gateway runtime admission requires managed Tool Portal configuration.",
+			path: ["mode"]
+		});
+		return z.NEVER;
+	}
+	return config;
+});
+const GatewayRuntimePortalAdmissionMaterialSchema = z.object({
+	effectiveMcpConfig: mcpConfigSchema,
+	effectiveToolPortalConfig: GatewayRuntimeManagedToolPortalConfigSchema,
+	semanticSnapshot: GatewayRuntimePortalSemanticSnapshotSchema
+}).strict();
+//#endregion
+//#region src/gateway-runtime-portal-semantic-revision.ts
+function sortedStrings(values) {
+	return [...values].toSorted();
+}
+function normalizedToolSelector(selector) {
+	return {
+		allow: selector.allow === "*" ? "*" : sortedStrings(selector.allow),
+		deny: sortedStrings(selector.deny)
+	};
+}
+function normalizedMcpProviders(providers) {
+	return Object.fromEntries(Object.entries(providers).map(([providerId, provider]) => {
+		const secretPolicies = Object.fromEntries(Object.entries(provider.secretPolicies).map(([secretName, policy]) => [secretName, {
+			hosts: sortedStrings(policy.hosts),
+			injection: policy.injection
+		}]));
+		const transport = provider.transport.kind === "stdio" ? {
+			args: provider.transport.args,
+			command: provider.transport.command,
+			...provider.transport.connectionTimeoutMs === void 0 ? {} : { connectionTimeoutMs: provider.transport.connectionTimeoutMs },
+			...provider.transport.cwd === void 0 ? {} : { cwd: provider.transport.cwd },
+			env: provider.transport.env,
+			kind: provider.transport.kind,
+			...provider.transport.networkAccess === void 0 ? {} : { networkAccess: provider.transport.networkAccess },
+			requiredEgressHosts: sortedStrings(provider.transport.requiredEgressHosts)
+		} : {
+			...provider.transport.connectionTimeoutMs === void 0 ? {} : { connectionTimeoutMs: provider.transport.connectionTimeoutMs },
+			headers: provider.transport.headers,
+			kind: provider.transport.kind,
+			requiredEgressHosts: sortedStrings(provider.transport.requiredEgressHosts),
+			url: provider.transport.url
+		};
+		return [providerId, {
+			discovery: provider.discovery,
+			kind: provider.kind,
+			namespace: provider.namespace,
+			secretPolicies,
+			transport
+		}];
+	}));
+}
+function normalizedSurfaceEligibility(surfaceEligibilityByProfile) {
+	return Object.fromEntries(Object.entries(surfaceEligibilityByProfile).map(([profileId, capabilities]) => [profileId, Object.fromEntries(Object.entries(capabilities).map(([capabilityId, surfaceClasses]) => [capabilityId, sortedStrings(surfaceClasses)]))]));
+}
+function normalizedCatalogInputs(props) {
+	return {
+		profiles: Object.fromEntries(Object.entries(props.toolPortalConfig.profiles).map(([profileId, profile]) => [profileId, Object.fromEntries(Object.entries(profile.namespaces).map(([namespaceId, namespacePolicy]) => [namespaceId, {
+			...namespacePolicy.backend.kind === "tool_vm_runner" ? { operations: Object.fromEntries(Object.entries(namespacePolicy.backend.operations).map(([operationName, operation]) => [operationName, {
+				description: operation.description,
+				kind: operation.kind
+			}])) } : {},
+			tools: normalizedToolSelector(namespacePolicy.tools)
+		}]))])),
+		providers: normalizedMcpProviders(props.mcpConfig.providers)
+	};
+}
+function normalizedProfilePolicyInputs(props) {
+	return {
+		profiles: Object.fromEntries(Object.entries(props.toolPortalConfig.profiles).map(([profileId, profile]) => [profileId, Object.fromEntries(Object.entries(profile.namespaces).map(([namespaceId, namespacePolicy]) => [namespaceId, {
+			calls: {
+				requiresApproval: normalizedToolSelector(namespacePolicy.calls.requiresApproval),
+				withoutApproval: normalizedToolSelector(namespacePolicy.calls.withoutApproval)
+			},
+			tools: normalizedToolSelector(namespacePolicy.tools)
+		}]))])),
+		surfaceEligibilityByProfile: normalizedSurfaceEligibility(props.surfaceEligibilityByProfile)
+	};
+}
+function normalizedBindingInputs(config) {
+	return Object.fromEntries(Object.entries(config.profiles).map(([profileId, profile]) => [profileId, Object.fromEntries(Object.entries(profile.namespaces).map(([namespaceId, namespacePolicy]) => [namespaceId, namespacePolicy.backend.kind === "tool_vm_runner" ? {
+		kind: namespacePolicy.backend.kind,
+		operations: Object.fromEntries(Object.entries(namespacePolicy.backend.operations).map(([operationName, operation]) => [operationName, operation.kind === "command.fixed" ? {
+			executable: operation.executable,
+			kind: operation.kind,
+			mandatoryArgvPrefix: operation.mandatoryArgvPrefix,
+			workingDirectory: operation.workingDirectory
+		} : operation.kind === "process.start" ? {
+			executable: operation.executable,
+			kind: operation.kind,
+			mandatoryArgvPrefix: operation.mandatoryArgvPrefix,
+			maxRuntimeMs: operation.maxRuntimeMs,
+			retainOutputBytes: operation.retainOutputBytes,
+			workingDirectory: operation.workingDirectory
+		} : operation.kind === "process.wait" ? {
+			kind: operation.kind,
+			timeoutMs: operation.timeoutMs
+		} : { kind: operation.kind }])),
+		profile: namespacePolicy.backend.profile
+	} : { kind: namespacePolicy.backend.kind }]))]));
+}
+function canonicalJson(value) {
+	return JSON.stringify(value, (_key, nestedValue) => {
+		if (typeof nestedValue !== "object" || nestedValue === null || Array.isArray(nestedValue)) return nestedValue;
+		return Object.fromEntries(Object.entries(nestedValue).toSorted(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey)));
+	});
+}
+function revision(domain, material) {
+	return `${domain}:${createHash("sha256").update(`${domain}\0`, "utf8").update(canonicalJson(material), "utf8").digest("hex")}`;
+}
+function frameworkIdentityKey(identity) {
+	return identity.kind === "openclaw" ? `openclaw:${identity.agentId}` : `hermes:${identity.profileName}`;
+}
+function assertExactManagedAgentProjectionInputs(props) {
+	const projectionAgentIds = props.agentProjections.map((projection) => projection.agentId);
+	if (new Set(projectionAgentIds).size !== projectionAgentIds.length) throw new Error("Managed Agent Projection agent ids must be unique.");
+	const configuredAgentIds = sortedStrings(Object.keys(props.configuredAgents));
+	const sortedProjectionAgentIds = sortedStrings(projectionAgentIds);
+	if (configuredAgentIds.length !== sortedProjectionAgentIds.length || configuredAgentIds.some((agentId, index) => agentId !== sortedProjectionAgentIds[index])) throw new Error("Managed Agent Projection agent ids must exactly match configured Tool Portal agent ids.");
+	if (new Set(props.agentProjections.map((projection) => projection.frameworkIdentity.kind)).size !== 1) throw new Error("Managed Agent Projections must share one framework kind.");
+	const frameworkIdentityKeys = props.agentProjections.map((projection) => frameworkIdentityKey(projection.frameworkIdentity));
+	if (new Set(frameworkIdentityKeys).size !== frameworkIdentityKeys.length) throw new Error("Managed Agent Projection framework identities must be unique.");
+	for (const projection of props.agentProjections) {
+		if (projection.frameworkIdentity.kind === "openclaw" && projection.frameworkIdentity.agentId !== projection.agentId) throw new Error(`OpenClaw projection identity must match agent '${projection.agentId}'.`);
+		if (props.configuredAgents[projection.agentId]?.profile !== projection.toolPortalProfileId) throw new Error(`Managed Agent Projection Tool Portal profile does not match for agent '${projection.agentId}'.`);
+	}
+}
+function deriveManagedAgentProjection(input) {
+	return ManagedAgentProjectionSchema.parse({
+		...input,
+		profileAssignmentRevision: revision("profile-assignment", input)
+	});
+}
+function deriveManagedAgentProjectionCohortDigest(agentProjections) {
+	return revision("projection-cohort", { agentProjections: [...agentProjections].toSorted((leftProjection, rightProjection) => leftProjection.agentId.localeCompare(rightProjection.agentId)) });
+}
+function deriveGatewayRuntimePortalSemanticSnapshot(props) {
+	assertExactManagedAgentProjectionInputs({
+		agentProjections: props.agentProjections,
+		configuredAgents: props.toolPortalConfig.agents
+	});
+	const projections = props.agentProjections.map((projection) => deriveManagedAgentProjection(projection)).toSorted((leftProjection, rightProjection) => leftProjection.agentId.localeCompare(rightProjection.agentId));
+	const agentProjections = Object.fromEntries(projections.map((projection) => [projection.agentId, projection]));
+	const projectionCohortDigest = deriveManagedAgentProjectionCohortDigest(projections);
+	const providerRevision = revision("provider", normalizedMcpProviders(props.mcpConfig.providers));
+	const catalogRevision = revision("catalog", normalizedCatalogInputs({
+		mcpConfig: props.mcpConfig,
+		toolPortalConfig: props.toolPortalConfig
+	}));
+	const profilePolicyRevision = revision("profile-policy", normalizedProfilePolicyInputs({
+		surfaceEligibilityByProfile: props.surfaceEligibilityByProfile,
+		toolPortalConfig: props.toolPortalConfig
+	}));
+	const bindingRevision = revision("binding", normalizedBindingInputs(props.toolPortalConfig));
+	const schemaRevision = revision("schema", {
+		mcpConfigSchemaVersion: props.mcpConfig.schemaVersion,
+		toolPortalConfigSchemaVersion: props.toolPortalConfig.schemaVersion
+	});
+	const desiredRevision = revision("portal-admission", {
+		agentProjections,
+		bindingRevision,
+		catalogRevision,
+		profilePolicyRevision,
+		projectionCohortDigest,
+		providerRevision,
+		schemaRevision,
+		surfaceEligibilityByProfile: normalizedSurfaceEligibility(props.surfaceEligibilityByProfile)
+	});
+	return GatewayRuntimePortalSemanticSnapshotSchema.parse({
+		activeRevision: desiredRevision,
+		agentProjections,
+		bindingRevision,
+		catalogRevision,
+		desiredRevision,
+		profilePolicyRevision,
+		projectionCohortDigest,
+		providerRevision,
+		schemaRevision,
+		schemaVersion: 1,
+		surfaceEligibilityByProfile: normalizedSurfaceEligibility(props.surfaceEligibilityByProfile)
+	});
+}
+function assertGatewayRuntimePortalSemanticSnapshotMatchesInputs(props) {
+	if (canonicalJson(deriveGatewayRuntimePortalSemanticSnapshot({
+		agentProjections: Object.values(props.semanticSnapshot.agentProjections).map((projection) => ({
+			agentId: projection.agentId,
+			frameworkIdentity: projection.frameworkIdentity,
+			toolPortalProfileId: projection.toolPortalProfileId
+		})),
+		mcpConfig: props.mcpConfig,
+		surfaceEligibilityByProfile: props.semanticSnapshot.surfaceEligibilityByProfile,
+		toolPortalConfig: props.toolPortalConfig
+	})) !== canonicalJson(props.semanticSnapshot)) throw new Error("Gateway runtime semantic snapshot does not match the protected Tool Portal and MCP inputs.");
+}
+//#endregion
 //#region src/index.ts
 const GatewayControlDomainSchema = z.literal("gateway_control");
 const GatewayControlHelloSchema = z.object({
@@ -785,6 +1427,7 @@ const GatewayControlHelloResponseSchema = z.object({
 }).strict();
 const GatewayControlRpcOperationSchema = z.enum([
 	"control_ping",
+	"gateway_runtime_readiness",
 	"caller_context_register",
 	"lease_create",
 	"lease_get",
@@ -797,7 +1440,11 @@ const GatewayControlRpcOperationSchema = z.enum([
 	"lease_use_end",
 	"health_event",
 	"runtime_status",
+	"tool_vm_binding_publish",
+	"tool_vm_binding_request",
 	"tool_portal_controller_host_action",
+	"tool_portal_admission_reserve",
+	"tool_portal_dispatch_arm",
 	"operation_cancel",
 	"recovery_command"
 ]);
@@ -833,21 +1480,8 @@ const GatewayControlCapabilityRefSchema = z.object({
 }).strict();
 const GatewayControlToolCallCorrelationSchema = ControlCorrelationSchema.extend({ capability: GatewayControlCapabilityRefSchema.optional() }).strict();
 const GatewayControlTrustedCallerContextIdSchema = z.string().uuid();
-const GatewayControlAdmissionPrincipalSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const GatewayControlTrustedLeaseContextSchema = z.object({
-	agentId: z.string().min(1),
-	agentWorkspaceDir: z.string().min(1),
-	approvalScopeId: z.string().min(1).optional(),
-	callerContextId: GatewayControlTrustedCallerContextIdSchema,
-	custodyScopeId: z.string().min(1).optional(),
-	hostWorkMountDir: z.string().min(1),
-	profileId: z.string().min(1),
-	sessionKeyDigest: z.string().min(32),
-	workMountDir: z.string().min(1),
-	zoneId: z.string().min(1)
-}).strict();
 const GatewayControlCallerContextRefSchema = z.object({ callerContextId: GatewayControlTrustedCallerContextIdSchema }).strict();
-const GatewayControlRegisteredCallerContextRefSchema = GatewayControlCallerContextRefSchema.extend({ admissionPrincipal: GatewayControlAdmissionPrincipalSchema }).strict();
+const GatewayControlRegisteredCallerContextRefSchema = GatewayControlCallerContextRefSchema.extend({ admissionPrincipal: GatewayStablePrincipalDigestSchema }).strict();
 const GatewayControlCallerContextProofAlgorithmSchema = z.literal("hmac-sha256");
 const GatewayControlCallerContextProofSchema = z.object({
 	algorithm: GatewayControlCallerContextProofAlgorithmSchema,
@@ -861,36 +1495,27 @@ const GatewayControlCallerContextAgentAuthoritySchema = z.object({
 function buildGatewayControlCallerContextProofPayload(input) {
 	const purpose = input.purpose ?? "tool_vm_lease";
 	return [
-		"gateway-control-caller-context-v1",
+		"gateway-control-caller-context-v4",
 		input.zoneId,
-		input.agentId,
-		input.agentWorkspaceDir,
-		input.workMountDir,
-		input.sessionKey,
+		deriveGatewayControlStablePrincipal({ principal: input.principal }),
 		purpose
 	].join("\0");
 }
 function buildGatewayControlCallerContextAgentAuthorityPayload(input) {
 	const purpose = input.purpose ?? "tool_vm_lease";
 	return [
-		"gateway-control-agent-authority-v1",
+		"gateway-control-agent-authority-v4",
 		input.zoneId,
-		input.agentId,
-		input.agentWorkspaceDir,
-		input.workMountDir,
-		input.sessionKey,
+		deriveGatewayControlStablePrincipal({ principal: input.principal }),
 		purpose
 	].join("\0");
 }
 const GatewayControlCallerContextRegisterPayloadSchema = z.object({
 	adapterEvidence: z.object({
 		agentAuthority: GatewayControlCallerContextAgentAuthoritySchema,
-		agentId: z.string().min(1),
-		agentWorkspaceDir: z.string().min(1),
+		principal: GatewayRuntimeTrustedInvocationPrincipalSchema$1,
 		proof: GatewayControlCallerContextProofSchema,
 		purpose: z.enum(["tool_vm_lease", "tool_portal_controller_host_action"]).optional(),
-		sessionKey: z.string().min(1),
-		workMountDir: z.string().min(1),
 		zoneId: z.string().min(1)
 	}).strict(),
 	correlation: GatewayControlToolCallCorrelationSchema.optional()
@@ -898,7 +1523,11 @@ const GatewayControlCallerContextRegisterPayloadSchema = z.object({
 const GatewayControlLeaseCreateIntentPayloadSchema = z.object({
 	callerContext: GatewayControlCallerContextRefSchema,
 	correlation: GatewayControlToolCallCorrelationSchema.optional(),
-	gatewayWorkspaceDir: z.string().min(1).optional(),
+	idleTtlHintMs: z.number().int().positive().optional()
+}).strict();
+const GatewayControlToolVmBindingRequestPayloadSchema = z.object({
+	callerContext: GatewayControlCallerContextRefSchema,
+	correlation: GatewayControlToolCallCorrelationSchema.optional(),
 	idleTtlHintMs: z.number().int().positive().optional()
 }).strict();
 const GatewayControlLeaseIdPayloadSchema = z.object({
@@ -1013,7 +1642,7 @@ const GatewayControlToolVmLeaseCallerContextStateSchema = z.enum([
 	"not_applicable"
 ]);
 const GatewayControlControllerRequestHealthOperationSchema = z.enum([
-	"zone-git-push",
+	"workspace-git-push",
 	"lease-create",
 	"lease-get",
 	"lease-peek",
@@ -1116,41 +1745,44 @@ const GatewayControlRuntimeStatusPayloadSchema = z.object({
 	]).optional(),
 	statusKind: z.string().min(1)
 }).strict();
-const GatewayControlZoneGitPushControllerHostActionPayloadSchema = z.object({
-	actionId: z.literal("zone_git_push"),
+const GatewayControlGitObjectIdSchema = z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u, "expected an exact lowercase SHA-1 or SHA-256 object id");
+const GatewayControlWorkspaceGitPushControllerHostActionPayloadSchema = z.object({
+	actionId: z.literal("workspace_git_push"),
+	approvalReservation: GatewayRuntimeControllerHostActionDispatchReservationSchema.optional(),
 	callerContext: GatewayControlCallerContextRefSchema,
 	correlation: GatewayControlToolCallCorrelationSchema,
-	expectedHead: z.string().min(1)
+	expectedHead: GatewayControlGitObjectIdSchema
 }).strict();
 const GatewayControlControllerHostProbePayloadSchema = z.object({
 	actionId: z.literal("controller_host_probe"),
+	approvalReservation: GatewayRuntimeControllerHostActionDispatchReservationSchema.optional(),
 	callerContext: GatewayControlCallerContextRefSchema,
 	correlation: GatewayControlToolCallCorrelationSchema
 }).strict();
-const GatewayControlToolPortalControllerHostActionPayloadSchema = z.discriminatedUnion("actionId", [GatewayControlZoneGitPushControllerHostActionPayloadSchema, GatewayControlControllerHostProbePayloadSchema]);
-const GatewayControlZoneGitCommitSummarySchema = z.object({
-	sha: z.string().min(1),
+const GatewayControlToolPortalControllerHostActionPayloadSchema = z.discriminatedUnion("actionId", [GatewayControlWorkspaceGitPushControllerHostActionPayloadSchema, GatewayControlControllerHostProbePayloadSchema]);
+const GatewayControlWorkspaceGitCommitSummarySchema = z.object({
+	sha: GatewayControlGitObjectIdSchema,
 	subject: z.string()
 }).strict();
-const GatewayControlZoneGitPushResultSchema = z.object({
+const GatewayControlWorkspaceGitPushResultSchema = z.object({
 	branch: z.string().min(1),
-	localHead: z.string().min(1),
-	pushedCommits: z.array(GatewayControlZoneGitCommitSummarySchema),
-	remoteHead: z.string().min(1)
+	localHead: GatewayControlGitObjectIdSchema,
+	pushedCommits: z.array(GatewayControlWorkspaceGitCommitSummarySchema),
+	remoteHead: GatewayControlGitObjectIdSchema
 }).strict();
 const GatewayControlControllerHostProbeResultSchema = z.object({
 	entryNames: z.array(z.string().min(1)).max(64),
 	probeKind: z.literal("controller_cache_dir_listing")
 }).strict();
-const GatewayControlZoneGitPushControllerHostActionResultSchema = z.object({
-	actionId: z.literal("zone_git_push"),
-	result: GatewayControlZoneGitPushResultSchema
+const GatewayControlWorkspaceGitPushControllerHostActionResultSchema = z.object({
+	actionId: z.literal("workspace_git_push"),
+	result: GatewayControlWorkspaceGitPushResultSchema
 }).strict();
 const GatewayControlControllerHostProbeActionResultSchema = z.object({
 	actionId: z.literal("controller_host_probe"),
 	result: GatewayControlControllerHostProbeResultSchema
 }).strict();
-const GatewayControlToolPortalControllerHostActionResultSchema = z.discriminatedUnion("actionId", [GatewayControlZoneGitPushControllerHostActionResultSchema, GatewayControlControllerHostProbeActionResultSchema]);
+const GatewayControlToolPortalControllerHostActionResultSchema = z.discriminatedUnion("actionId", [GatewayControlWorkspaceGitPushControllerHostActionResultSchema, GatewayControlControllerHostProbeActionResultSchema]);
 const GatewayControlActiveOperationIdSchema = z.string().uuid();
 const GatewayInitiatedOperationCancelPayloadSchema = z.object({
 	activeOperationId: GatewayControlActiveOperationIdSchema,
@@ -1180,6 +1812,8 @@ const GatewayControlRecoveryCommandPayloadSchema = z.discriminatedUnion("action"
 	}).strict()
 ]);
 const GatewayControlPingPayloadSchema = z.object({}).strict();
+const GatewayControlToolPortalAdmissionReservePayloadSchema = z.object({ intent: GatewayRuntimeApprovalChallengeIntentSchema }).strict();
+const GatewayControlToolPortalDispatchArmPayloadSchema = z.object({ reservation: GatewayRuntimeGatewayDispatchReservationSchema }).strict();
 const GatewayControlHeartbeatPayloadSchema = z.object({
 	elapsedMs: z.number().int().nonnegative().optional(),
 	observedAtMs: z.number().int().positive()
@@ -1188,12 +1822,69 @@ const GatewayControlRpcErrorSchema = ControlRpcErrorSchema;
 const GatewayControlSessionStateSchema = ControlSessionStateSchema;
 const GatewayControlToolVmSshAccessSchema = z.object({
 	host: z.string().min(1),
-	identityPem: z.string().min(1).optional(),
-	knownHostsLine: z.string().min(1).optional(),
 	port: z.number().int().positive(),
 	user: z.string().min(1)
 }).strict();
-const GatewayControlLeaseSnapshotSchema = z.object({
+const GatewayControlPrivateToolVmSshAccessSchema = GatewayControlToolVmSshAccessSchema.extend({
+	identityPem: z.string().min(1),
+	knownHostsLine: z.string().min(1)
+}).strict();
+const GatewayControlToolVmBindingPublicationAuthoritySchema = z.object({
+	attachmentGeneration: z.number().int().positive(),
+	connectionId: z.string().uuid(),
+	controllerEpoch: z.string().min(1),
+	gatewayEpoch: z.string().min(1),
+	processEpoch: z.string().min(1),
+	sessionId: z.string().uuid(),
+	zoneId: z.string().min(1)
+}).strict();
+const GatewayControlToolVmBindingAccessGrantSchema = z.object({
+	agentId: z.string().min(1),
+	idleTtlMs: z.number().int().positive(),
+	leafGeneration: z.string().min(1),
+	leaseId: z.string().min(1),
+	profileAssignmentRevision: z.string().min(1),
+	ssh: GatewayControlPrivateToolVmSshAccessSchema,
+	sshBindingId: z.string().min(1),
+	stablePrincipal: GatewayStablePrincipalDigestSchema,
+	tcpSlot: z.number().int().nonnegative(),
+	transport: z.literal("ssh-sandbox"),
+	workdir: z.string().min(1),
+	zoneId: z.string().min(1)
+}).strict();
+const GatewayControlToolVmBindingIdentitySchema = GatewayControlToolVmBindingAccessGrantSchema.pick({
+	agentId: true,
+	leafGeneration: true,
+	leaseId: true,
+	profileAssignmentRevision: true,
+	sshBindingId: true,
+	stablePrincipal: true,
+	zoneId: true
+}).strict();
+const GatewayControlToolVmBindingPublicationSchema = z.discriminatedUnion("kind", [z.object({
+	authority: GatewayControlToolVmBindingPublicationAuthoritySchema,
+	binding: GatewayControlToolVmBindingAccessGrantSchema,
+	kind: z.literal("current"),
+	observedAtMs: z.number().int().positive()
+}).strict(), z.object({
+	authority: GatewayControlToolVmBindingPublicationAuthoritySchema,
+	binding: GatewayControlToolVmBindingIdentitySchema,
+	kind: z.literal("retired"),
+	observedAtMs: z.number().int().positive(),
+	reason: z.enum([
+		"dead",
+		"expired",
+		"released",
+		"replaced",
+		"session_retired"
+	])
+}).strict()]);
+const GatewayControlToolVmBindingRequestResultSchema = z.object({
+	agentId: z.string().min(1),
+	stablePrincipal: GatewayStablePrincipalDigestSchema,
+	status: z.literal("publication_pending")
+}).strict();
+const GatewayControlLeaseSnapshotBaseSchema = z.object({
 	agentId: z.string().min(1),
 	activeUseId: z.string().uuid().optional(),
 	expiresAtMs: z.number().int().positive().optional(),
@@ -1211,6 +1902,13 @@ const GatewayControlLeaseSnapshotSchema = z.object({
 	workdir: z.string().min(1),
 	zoneId: z.string().min(1)
 }).strict();
+const GatewayControlPublicLeaseSnapshotSchema = GatewayControlLeaseSnapshotBaseSchema;
+const GatewayControlPrivateLeaseSnapshotSchema = GatewayControlLeaseSnapshotBaseSchema.extend({
+	leafGeneration: z.string().min(1),
+	ssh: GatewayControlPrivateToolVmSshAccessSchema,
+	sshBindingId: z.string().min(1)
+}).strict();
+const GatewayControlLeaseSnapshotSchema = z.union([GatewayControlPrivateLeaseSnapshotSchema, GatewayControlPublicLeaseSnapshotSchema]);
 const GatewayControlLeaseUseSnapshotSchema = z.object({
 	expiresAt: z.number().int().positive().optional(),
 	heartbeatAfterMs: z.number().int().positive().optional(),
@@ -1225,8 +1923,11 @@ const GatewayControlLeaseUseSnapshotSchema = z.object({
 const GatewayControlRpcDomainCorrelationSchema = ControlCorrelationSchema;
 const GatewayControlRpcForbiddenResponseFieldsSchema = {
 	activeOperationId: z.never().optional(),
+	approvalAdmission: z.never().optional(),
+	approvalDispatch: z.never().optional(),
 	approvalRequired: z.never().optional(),
 	callerContext: z.never().optional(),
+	bindingRequest: z.never().optional(),
 	controllerHostAction: z.never().optional(),
 	error: z.never().optional(),
 	lease: z.never().optional(),
@@ -1265,32 +1966,53 @@ const GatewayControlRpcCallerContextResponsePayloadSchema = z.discriminatedUnion
 	error: GatewayControlRpcErrorSchema,
 	result: GatewayControlRpcErrorResponseResultSchema
 }).strict()]);
-const GatewayControlRpcLeaseResponsePayloadSchema = z.discriminatedUnion("result", [
+const GatewayControlRpcToolVmBindingRequestResponsePayloadSchema = z.discriminatedUnion("result", [GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	bindingRequest: GatewayControlToolVmBindingRequestResultSchema,
+	result: z.literal("ok")
+}).strict(), GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	error: GatewayControlRpcErrorSchema,
+	result: GatewayControlRpcErrorResponseResultSchema
+}).strict()]);
+const GatewayControlRpcLeaseRejectedResponsePayloadSchema = GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	error: GatewayControlRpcErrorSchema.optional(),
+	leaseRejectionReason: GatewayControlLeaseRejectionReasonSchema,
+	result: z.literal("rejected")
+}).strict();
+const GatewayControlRpcLeaseFailedResponsePayloadSchema = GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	error: GatewayControlRpcErrorSchema,
+	leaseRejectionReason: GatewayControlLeaseRejectionReasonSchema.optional(),
+	result: z.enum([
+		"failed",
+		"timeout",
+		"cancelled",
+		"stale_generation",
+		"approval_required",
+		"approval_stale"
+	])
+}).strict();
+const GatewayControlRpcPrivateLeaseResponsePayloadSchema = z.discriminatedUnion("result", [
 	GatewayControlRpcResponseCorrelationSchema.extend({
 		...GatewayControlRpcForbiddenResponseFieldsSchema,
-		lease: GatewayControlLeaseSnapshotSchema,
+		lease: GatewayControlPrivateLeaseSnapshotSchema,
 		result: z.literal("ok")
 	}).strict(),
+	GatewayControlRpcLeaseRejectedResponsePayloadSchema,
+	GatewayControlRpcLeaseFailedResponsePayloadSchema
+]);
+const GatewayControlRpcPublicLeaseResponsePayloadSchema = z.discriminatedUnion("result", [
 	GatewayControlRpcResponseCorrelationSchema.extend({
 		...GatewayControlRpcForbiddenResponseFieldsSchema,
-		error: GatewayControlRpcErrorSchema.optional(),
-		leaseRejectionReason: GatewayControlLeaseRejectionReasonSchema,
-		result: z.literal("rejected")
+		lease: GatewayControlPublicLeaseSnapshotSchema,
+		result: z.literal("ok")
 	}).strict(),
-	GatewayControlRpcResponseCorrelationSchema.extend({
-		...GatewayControlRpcForbiddenResponseFieldsSchema,
-		error: GatewayControlRpcErrorSchema,
-		leaseRejectionReason: GatewayControlLeaseRejectionReasonSchema.optional(),
-		result: z.enum([
-			"failed",
-			"timeout",
-			"cancelled",
-			"stale_generation",
-			"approval_required",
-			"approval_stale"
-		])
-	}).strict()
+	GatewayControlRpcLeaseRejectedResponsePayloadSchema,
+	GatewayControlRpcLeaseFailedResponsePayloadSchema
 ]);
+const GatewayControlRpcLeaseResponsePayloadSchema = z.union([GatewayControlRpcPrivateLeaseResponsePayloadSchema, GatewayControlRpcPublicLeaseResponsePayloadSchema]);
 const GatewayControlRpcLeaseUseResponsePayloadSchema = z.discriminatedUnion("result", [
 	GatewayControlRpcResponseCorrelationSchema.extend({
 		...GatewayControlRpcForbiddenResponseFieldsSchema,
@@ -1336,13 +2058,34 @@ const GatewayControlRpcOperationCancelResponsePayloadSchema = z.discriminatedUni
 	error: GatewayControlRpcErrorSchema,
 	result: GatewayControlRpcErrorResponseResultSchema
 }).strict()]);
+const GatewayControlRpcApprovalAdmissionResponsePayloadSchema = z.discriminatedUnion("result", [GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	approvalAdmission: GatewayRuntimeApprovalAdmissionResultSchema,
+	result: z.literal("ok")
+}).strict(), GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	error: GatewayControlRpcErrorSchema,
+	result: GatewayControlRpcErrorResponseResultSchema
+}).strict()]);
+const GatewayControlRpcApprovalDispatchResponsePayloadSchema = z.discriminatedUnion("result", [GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	approvalDispatch: GatewayRuntimeApprovalArmDispatchResultSchema,
+	result: z.literal("ok")
+}).strict(), GatewayControlRpcResponseCorrelationSchema.extend({
+	...GatewayControlRpcForbiddenResponseFieldsSchema,
+	error: GatewayControlRpcErrorSchema,
+	result: GatewayControlRpcErrorResponseResultSchema
+}).strict()]);
 const GatewayControlRpcResponsePayloadSchema = z.union([
 	GatewayControlRpcBareResponsePayloadSchema,
 	GatewayControlRpcCallerContextResponsePayloadSchema,
+	GatewayControlRpcToolVmBindingRequestResponsePayloadSchema,
 	GatewayControlRpcLeaseResponsePayloadSchema,
 	GatewayControlRpcLeaseUseResponsePayloadSchema,
 	GatewayControlRpcControllerHostActionResponsePayloadSchema,
-	GatewayControlRpcOperationCancelResponsePayloadSchema
+	GatewayControlRpcOperationCancelResponsePayloadSchema,
+	GatewayControlRpcApprovalAdmissionResponsePayloadSchema,
+	GatewayControlRpcApprovalDispatchResponsePayloadSchema
 ]);
 const GatewayControlRpcControlPingCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
 	kind: z.literal("command_result"),
@@ -1354,17 +2097,20 @@ const GatewayControlRpcCallerContextRegisterCommandResultMessageSchema = Gateway
 	operation: z.literal("caller_context_register"),
 	payload: GatewayControlRpcCallerContextResponsePayloadSchema
 }).strict();
-const GatewayControlRpcLeaseCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+const GatewayControlRpcPrivateLeaseCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
 	kind: z.literal("command_result"),
 	operation: z.enum([
 		"lease_create",
 		"lease_get",
-		"lease_peek",
 		"lease_reacquire",
-		"lease_renew",
-		"lease_release"
+		"lease_renew"
 	]),
-	payload: GatewayControlRpcLeaseResponsePayloadSchema
+	payload: GatewayControlRpcPrivateLeaseResponsePayloadSchema
+}).strict();
+const GatewayControlRpcPublicLeaseCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+	kind: z.literal("command_result"),
+	operation: z.enum(["lease_peek", "lease_release"]),
+	payload: GatewayControlRpcPublicLeaseResponsePayloadSchema
 }).strict();
 const GatewayControlRpcLeaseUseCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
 	kind: z.literal("command_result"),
@@ -1390,6 +2136,26 @@ const GatewayControlRpcRecoveryCommandResultMessageSchema = GatewayControlRpcDom
 	operation: z.literal("recovery_command"),
 	payload: GatewayControlRpcBareResponsePayloadSchema
 }).strict();
+const GatewayControlRpcApprovalAdmissionCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+	kind: z.literal("command_result"),
+	operation: z.literal("tool_portal_admission_reserve"),
+	payload: GatewayControlRpcApprovalAdmissionResponsePayloadSchema
+}).strict();
+const GatewayControlRpcApprovalDispatchCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+	kind: z.literal("command_result"),
+	operation: z.literal("tool_portal_dispatch_arm"),
+	payload: GatewayControlRpcApprovalDispatchResponsePayloadSchema
+}).strict();
+const GatewayControlRpcToolVmBindingRequestCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+	kind: z.literal("command_result"),
+	operation: z.literal("tool_vm_binding_request"),
+	payload: GatewayControlRpcToolVmBindingRequestResponsePayloadSchema
+}).strict();
+const GatewayControlRpcToolVmBindingPublishCommandResultMessageSchema = GatewayControlRpcDomainCorrelationSchema.extend({
+	kind: z.literal("command_result"),
+	operation: z.literal("tool_vm_binding_publish"),
+	payload: GatewayControlRpcBareResponsePayloadSchema
+}).strict();
 const GatewayControlHeartbeatMessageSchema = z.object({
 	kind: z.literal("heartbeat"),
 	operation: z.never().optional(),
@@ -1398,13 +2164,28 @@ const GatewayControlHeartbeatMessageSchema = z.object({
 const GatewayControlRpcCommandResultMessageSchema = z.discriminatedUnion("operation", [
 	GatewayControlRpcControlPingCommandResultMessageSchema,
 	GatewayControlRpcCallerContextRegisterCommandResultMessageSchema,
-	GatewayControlRpcLeaseCommandResultMessageSchema,
+	GatewayControlRpcPrivateLeaseCommandResultMessageSchema,
+	GatewayControlRpcPublicLeaseCommandResultMessageSchema,
 	GatewayControlRpcLeaseUseCommandResultMessageSchema,
 	GatewayControlRpcControllerHostActionCommandResultMessageSchema,
 	GatewayControlRpcOperationCancelCommandResultMessageSchema,
-	GatewayControlRpcRecoveryCommandResultMessageSchema
+	GatewayControlRpcRecoveryCommandResultMessageSchema,
+	GatewayControlRpcApprovalAdmissionCommandResultMessageSchema,
+	GatewayControlRpcApprovalDispatchCommandResultMessageSchema,
+	GatewayControlRpcToolVmBindingRequestCommandResultMessageSchema,
+	GatewayControlRpcToolVmBindingPublishCommandResultMessageSchema
 ]);
 const GatewayControlRpcCommandMessageSchema = z.discriminatedUnion("operation", [
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("command"),
+		operation: z.literal("tool_vm_binding_request"),
+		payload: GatewayControlToolVmBindingRequestPayloadSchema
+	}).strict(),
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("command"),
+		operation: z.literal("tool_vm_binding_publish"),
+		payload: GatewayControlToolVmBindingPublicationSchema
+	}).strict(),
 	GatewayControlRpcDomainCorrelationSchema.extend({
 		kind: z.literal("command"),
 		operation: z.literal("control_ping"),
@@ -1465,6 +2246,16 @@ const GatewayControlRpcCommandMessageSchema = z.discriminatedUnion("operation",
 		operation: z.literal("tool_portal_controller_host_action"),
 		payload: GatewayControlToolPortalControllerHostActionPayloadSchema
 	}).strict(),
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("command"),
+		operation: z.literal("tool_portal_admission_reserve"),
+		payload: GatewayControlToolPortalAdmissionReservePayloadSchema
+	}).strict(),
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("command"),
+		operation: z.literal("tool_portal_dispatch_arm"),
+		payload: GatewayControlToolPortalDispatchArmPayloadSchema
+	}).strict(),
 	GatewayControlRpcDomainCorrelationSchema.extend({
 		kind: z.literal("command"),
 		operation: z.literal("operation_cancel"),
@@ -1476,16 +2267,28 @@ const GatewayControlRpcCommandMessageSchema = z.discriminatedUnion("operation",
 		payload: GatewayControlRecoveryCommandPayloadSchema
 	}).strict()
 ]);
-const GatewayControlRpcEventMessageSchema = z.discriminatedUnion("operation", [GatewayControlRpcDomainCorrelationSchema.extend({
-	kind: z.literal("event"),
-	operation: z.literal("health_event"),
-	payload: GatewayControlHealthEventPayloadSchema
-}).strict(), GatewayControlRpcDomainCorrelationSchema.extend({
-	kind: z.literal("event"),
-	operation: z.literal("runtime_status"),
-	payload: GatewayControlRuntimeStatusPayloadSchema
-}).strict()]);
-const GatewayControlEventOnlyOperationSchema = z.enum(["health_event", "runtime_status"]);
+const GatewayControlRpcEventMessageSchema = z.discriminatedUnion("operation", [
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("event"),
+		operation: z.literal("gateway_runtime_readiness"),
+		payload: GatewayRuntimeReadinessSnapshotSchema
+	}).strict(),
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("event"),
+		operation: z.literal("health_event"),
+		payload: GatewayControlHealthEventPayloadSchema
+	}).strict(),
+	GatewayControlRpcDomainCorrelationSchema.extend({
+		kind: z.literal("event"),
+		operation: z.literal("runtime_status"),
+		payload: GatewayControlRuntimeStatusPayloadSchema
+	}).strict()
+]);
+const GatewayControlEventOnlyOperationSchema = z.enum([
+	"gateway_runtime_readiness",
+	"health_event",
+	"runtime_status"
+]);
 const GatewayControlRpcCommandResultOperationSchema = GatewayControlRpcOperationSchema.exclude(GatewayControlEventOnlyOperationSchema.options);
 const GatewayControlRpcMessageSchema = z.union([
 	GatewayControlHeartbeatMessageSchema,
@@ -1497,6 +2300,7 @@ const gatewayControlDeliveryPolicyByKind = { heartbeat: "critical_idempotent" };
 const gatewayControlDeliveryPolicyByOperation = {
 	caller_context_register: "critical_idempotent",
 	control_ping: "acked_idempotent",
+	gateway_runtime_readiness: "latest_wins",
 	health_event: "append_only_observation",
 	lease_create: "critical_idempotent",
 	lease_get: "acked_idempotent",
@@ -1510,7 +2314,11 @@ const gatewayControlDeliveryPolicyByOperation = {
 	operation_cancel: "acked_idempotent",
 	recovery_command: "critical_idempotent",
 	runtime_status: "latest_wins",
-	tool_portal_controller_host_action: "single_use_critical"
+	tool_vm_binding_publish: "critical_idempotent",
+	tool_vm_binding_request: "critical_idempotent",
+	tool_portal_controller_host_action: "single_use_critical",
+	tool_portal_admission_reserve: "single_use_critical",
+	tool_portal_dispatch_arm: "single_use_critical"
 };
 function deriveGatewayControlDeliveryPolicy(envelope) {
 	if (envelope.operation === "lease_create" && envelope.idempotencyKey === void 0) return "single_use_critical";
@@ -1530,6 +2338,7 @@ function assertGatewayControlEnvelopeDeliveryPolicy(envelope) {
 const gatewayControlCommandExecutionTimeoutMsByOperation = {
 	caller_context_register: 5e3,
 	control_ping: 5e3,
+	gateway_runtime_readiness: 5e3,
 	health_event: 5e3,
 	lease_create: 18e4,
 	lease_get: 5e3,
@@ -1543,7 +2352,11 @@ const gatewayControlCommandExecutionTimeoutMsByOperation = {
 	operation_cancel: 5e3,
 	recovery_command: 1e4,
 	runtime_status: 5e3,
-	tool_portal_controller_host_action: 12e4
+	tool_vm_binding_publish: 1e4,
+	tool_vm_binding_request: 18e4,
+	tool_portal_controller_host_action: 12e4,
+	tool_portal_admission_reserve: 1e4,
+	tool_portal_dispatch_arm: 1e4
 };
 function buildGatewayControlJsonSchemas() {
 	return {
@@ -1573,6 +2386,6 @@ function assertGatewayControlDomainRegistered() {
 	return KnownControlDomainSchema.extract(["gateway_control"]).parse("gateway_control");
 }
 //#endregion
-export { ControllerInitiatedGatewayOperationCancelPayloadSchema, GATEWAY_CONTROL_ADMISSION_EXECUTION_LIMITS, GATEWAY_CONTROL_ADMISSION_LIMITS, GATEWAY_CONTROL_PROCESS_ADMISSION_LIMITS, GatewayControlActiveOperationIdSchema, GatewayControlAdmissionPrincipalSchema, GatewayControlCallerContextAgentAuthoritySchema, GatewayControlCallerContextProofAlgorithmSchema, GatewayControlCallerContextProofSchema, GatewayControlCallerContextRefSchema, GatewayControlCallerContextRegisterPayloadSchema, GatewayControlCapabilityRefSchema, GatewayControlControllerHostProbeActionResultSchema, GatewayControlControllerHostProbePayloadSchema, GatewayControlControllerHostProbeResultSchema, GatewayControlControllerRequestHealthOperationSchema, GatewayControlDomainSchema, GatewayControlEventOnlyOperationSchema, GatewayControlForbiddenPayloadFieldSchema, GatewayControlHealthEventPayloadSchema, GatewayControlHealthEventResultSchema, GatewayControlHeartbeatPayloadSchema, GatewayControlHelloResponseSchema, GatewayControlHelloSchema, GatewayControlLeaseCreateIntentPayloadSchema, GatewayControlLeaseIdPayloadSchema, GatewayControlLeaseReacquireIntentPayloadSchema, GatewayControlLeaseRejectionReasonSchema, GatewayControlLeaseSnapshotSchema, GatewayControlLeaseStaleEvidenceSchema, GatewayControlLeaseUseEndPayloadSchema, GatewayControlLeaseUseHeartbeatPayloadSchema, GatewayControlLeaseUseSnapshotSchema, GatewayControlLeaseUseStartPayloadSchema, GatewayControlOperationCancelPayloadSchema, GatewayControlPingPayloadSchema, GatewayControlProviderRuntimeHealthSchema, GatewayControlRecoveryCommandPayloadSchema, GatewayControlRegisteredCallerContextRefSchema, GatewayControlRpcBareResponsePayloadSchema, GatewayControlRpcCallerContextResponsePayloadSchema, GatewayControlRpcCommandMessageSchema, GatewayControlRpcCommandResultMessageSchema, GatewayControlRpcCommandResultOperationSchema, GatewayControlRpcControllerHostActionResponsePayloadSchema, GatewayControlRpcDomainCorrelationSchema, GatewayControlRpcErrorSchema, GatewayControlRpcEventMessageSchema, GatewayControlRpcLeaseResponsePayloadSchema, GatewayControlRpcLeaseUseResponsePayloadSchema, GatewayControlRpcMessageSchema, GatewayControlRpcOperationCancelResponsePayloadSchema, GatewayControlRpcOperationSchema, GatewayControlRpcResponseBasePayloadSchema, GatewayControlRpcResponsePayloadSchema, GatewayControlRpcResultSchema, GatewayControlRuntimeFindingSchema, GatewayControlRuntimeStatusPayloadSchema, GatewayControlSessionHealthOperationSchema, GatewayControlSessionStateSchema, GatewayControlToolCallCorrelationSchema, GatewayControlToolPortalControllerHostActionPayloadSchema, GatewayControlToolPortalControllerHostActionResultSchema, GatewayControlToolVmLeaseCallerContextStateSchema, GatewayControlToolVmLeaseLifecycleEventRoleSchema, GatewayControlToolVmLeaseLifecycleTransitionSchema, GatewayControlToolVmSshAccessSchema, GatewayControlToolVmSshHealthOperationSchema, GatewayControlTrustedCallerContextIdSchema, GatewayControlTrustedLeaseContextSchema, GatewayControlZoneGitCommitSummarySchema, GatewayControlZoneGitPushControllerHostActionPayloadSchema, GatewayControlZoneGitPushControllerHostActionResultSchema, GatewayControlZoneGitPushResultSchema, GatewayInitiatedOperationCancelPayloadSchema, assertGatewayControlDomainRegistered, assertGatewayControlEnvelopeDeliveryPolicy, buildGatewayControlCallerContextAgentAuthorityPayload, buildGatewayControlCallerContextProofPayload, buildGatewayControlJsonSchemas, classifyGatewayControlAdmission, createGatewayControlAdmissionExecutor, createGatewayControlAdmissionScheduler, createGatewayControlProcessAdmission, deriveGatewayControlDeliveryPolicy, gatewayControlCommandExecutionTimeoutMsByOperation, gatewayControlDeliveryPolicyByKind, gatewayControlDeliveryPolicyByOperation };
+export { ControllerInitiatedGatewayOperationCancelPayloadSchema, GATEWAY_CONTROL_ADMISSION_EXECUTION_LIMITS, GATEWAY_CONTROL_ADMISSION_LIMITS, GATEWAY_CONTROL_PROCESS_ADMISSION_LIMITS, GATEWAY_RUNTIME_APPROVAL_AUDIENCE, GATEWAY_RUNTIME_ATTACHMENT_SNAPSHOT_VERSION, GATEWAY_RUNTIME_PORTAL_ADMISSION_FILE_NAME, GATEWAY_RUNTIME_READINESS_SNAPSHOT_VERSION, GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_GUEST_PORT, GATEWAY_RUNTIME_TOOL_PORTAL_CONTROL_LISTEN_HOST, GATEWAY_RUNTIME_TOOL_PORTAL_PRODUCTION_CONTROL_ENDPOINT, GatewayControlActiveOperationIdSchema, GatewayControlCallerContextAgentAuthoritySchema, GatewayControlCallerContextProofAlgorithmSchema, GatewayControlCallerContextProofSchema, GatewayControlCallerContextRefSchema, GatewayControlCallerContextRegisterPayloadSchema, GatewayControlCapabilityRefSchema, GatewayControlControllerHostProbeActionResultSchema, GatewayControlControllerHostProbePayloadSchema, GatewayControlControllerHostProbeResultSchema, GatewayControlControllerRequestHealthOperationSchema, GatewayControlDomainSchema, GatewayControlEventOnlyOperationSchema, GatewayControlForbiddenPayloadFieldSchema, GatewayControlHealthEventPayloadSchema, GatewayControlHealthEventResultSchema, GatewayControlHeartbeatPayloadSchema, GatewayControlHelloResponseSchema, GatewayControlHelloSchema, GatewayControlLeaseCreateIntentPayloadSchema, GatewayControlLeaseIdPayloadSchema, GatewayControlLeaseReacquireIntentPayloadSchema, GatewayControlLeaseRejectionReasonSchema, GatewayControlLeaseSnapshotSchema, GatewayControlLeaseStaleEvidenceSchema, GatewayControlLeaseUseEndPayloadSchema, GatewayControlLeaseUseHeartbeatPayloadSchema, GatewayControlLeaseUseSnapshotSchema, GatewayControlLeaseUseStartPayloadSchema, GatewayControlOperationCancelPayloadSchema, GatewayControlPingPayloadSchema, GatewayControlPrivateLeaseSnapshotSchema, GatewayControlPrivateToolVmSshAccessSchema, GatewayControlProviderRuntimeHealthSchema, GatewayControlPublicLeaseSnapshotSchema, GatewayControlRecoveryCommandPayloadSchema, GatewayControlRegisteredCallerContextRefSchema, GatewayControlRpcApprovalAdmissionResponsePayloadSchema, GatewayControlRpcApprovalDispatchResponsePayloadSchema, GatewayControlRpcBareResponsePayloadSchema, GatewayControlRpcCallerContextResponsePayloadSchema, GatewayControlRpcCommandMessageSchema, GatewayControlRpcCommandResultMessageSchema, GatewayControlRpcCommandResultOperationSchema, GatewayControlRpcControllerHostActionResponsePayloadSchema, GatewayControlRpcDomainCorrelationSchema, GatewayControlRpcErrorSchema, GatewayControlRpcEventMessageSchema, GatewayControlRpcLeaseResponsePayloadSchema, GatewayControlRpcLeaseUseResponsePayloadSchema, GatewayControlRpcMessageSchema, GatewayControlRpcOperationCancelResponsePayloadSchema, GatewayControlRpcOperationSchema, GatewayControlRpcPrivateLeaseResponsePayloadSchema, GatewayControlRpcPublicLeaseResponsePayloadSchema, GatewayControlRpcResponseBasePayloadSchema, GatewayControlRpcResponsePayloadSchema, GatewayControlRpcResultSchema, GatewayControlRpcToolVmBindingRequestResponsePayloadSchema, GatewayControlRuntimeFindingSchema, GatewayControlRuntimeStatusPayloadSchema, GatewayControlSessionHealthOperationSchema, GatewayControlSessionStateSchema, GatewayControlToolCallCorrelationSchema, GatewayControlToolPortalAdmissionReservePayloadSchema, GatewayControlToolPortalControllerHostActionPayloadSchema, GatewayControlToolPortalControllerHostActionResultSchema, GatewayControlToolPortalDispatchArmPayloadSchema, GatewayControlToolVmBindingAccessGrantSchema, GatewayControlToolVmBindingIdentitySchema, GatewayControlToolVmBindingPublicationAuthoritySchema, GatewayControlToolVmBindingPublicationSchema, GatewayControlToolVmBindingRequestPayloadSchema, GatewayControlToolVmBindingRequestResultSchema, GatewayControlToolVmLeaseCallerContextStateSchema, GatewayControlToolVmLeaseLifecycleEventRoleSchema, GatewayControlToolVmLeaseLifecycleTransitionSchema, GatewayControlToolVmSshAccessSchema, GatewayControlToolVmSshHealthOperationSchema, GatewayControlTrustedCallerContextIdSchema, GatewayControlWorkspaceGitCommitSummarySchema, GatewayControlWorkspaceGitPushControllerHostActionPayloadSchema, GatewayControlWorkspaceGitPushControllerHostActionResultSchema, GatewayControlWorkspaceGitPushResultSchema, GatewayInitiatedOperationCancelPayloadSchema, GatewayRuntimeApprovalAdmissionResultSchema, GatewayRuntimeApprovalAmbiguousReasonSchema, GatewayRuntimeApprovalArmDispatchCommandSchema, GatewayRuntimeApprovalArmDispatchResultSchema, GatewayRuntimeApprovalAuthorityContextSchema, GatewayRuntimeApprovalCallSchema, GatewayRuntimeApprovalChallengeIntentSchema, GatewayRuntimeApprovalChallengeSchema, GatewayRuntimeApprovalDecisionCommandSchema, GatewayRuntimeApprovalDispatchGrantSchema, GatewayRuntimeApprovalDispatchReservationSchema, GatewayRuntimeApprovalFingerprintSchema, GatewayRuntimeApprovalNotDispatchedReasonSchema, GatewayRuntimeApprovalRevokeCommandSchema, GatewayRuntimeApprovalSemanticRevisionCohortSchema, GatewayRuntimeAttachmentSnapshotSchema, GatewayRuntimeControllerHostActionApprovalReservationDispatchAuthoritySchema, GatewayRuntimeControllerHostActionDirectDispatchAuthoritySchema, GatewayRuntimeControllerHostActionDispatchReservationSchema, GatewayRuntimeExpectedAttachmentIdentitySchema, GatewayRuntimeFatalEvidenceSchema, GatewayRuntimeFrameworkIdentitySchema, GatewayRuntimeFrameworkKindSchema, GatewayRuntimeGatewayDispatchReservationSchema, GatewayRuntimeManagedPluginClientKindSchema, GatewayRuntimeMcpProviderApprovalGrantDispatchAuthoritySchema, GatewayRuntimeMcpProviderDirectDispatchAuthoritySchema, GatewayRuntimeMcpProviderDispatchGrantSchema, GatewayRuntimeMcpProviderDispatchReservationSchema, GatewayRuntimePortalAdmissionMaterialSchema, GatewayRuntimePortalSemanticSnapshotSchema, GatewayRuntimePortalSurfaceClassSchema, GatewayRuntimeReadinessSnapshotSchema, GatewayRuntimeRequiredBackendKindSchema, GatewayRuntimeRequiredBackendsReadinessSchema, GatewayRuntimeToolPortalDispatchAuthoritySchema, GatewayRuntimeToolPortalProductionControlEndpointSchema, GatewayRuntimeToolVmRunnerApprovalGrantDispatchAuthoritySchema, GatewayRuntimeToolVmRunnerDirectDispatchAuthoritySchema, GatewayRuntimeToolVmRunnerDispatchGrantSchema, GatewayRuntimeToolVmRunnerDispatchReservationSchema, GatewayRuntimeTrustedInvocationContextSchema, GatewayRuntimeTrustedInvocationCorrelationSchema, GatewayRuntimeTrustedInvocationPrincipalSchema, GatewayRuntimeTrustedInvocationRequesterSchema, GatewayRuntimeUdsPublicationSnapshotSchema, ManagedAgentProjectionSchema, assertGatewayControlDomainRegistered, assertGatewayControlEnvelopeDeliveryPolicy, assertGatewayRuntimePortalSemanticSnapshotMatchesInputs, buildGatewayControlCallerContextAgentAuthorityPayload, buildGatewayControlCallerContextProofPayload, buildGatewayControlJsonSchemas, classifyGatewayControlAdmission, createGatewayControlAdmissionExecutor, createGatewayControlAdmissionScheduler, createGatewayControlProcessAdmission, createGatewayRuntimeAttachmentSnapshot, createGatewayRuntimeReadinessSnapshot, deriveGatewayControlDeliveryPolicy, deriveGatewayControlStablePrincipal, deriveGatewayRuntimeApprovalFingerprint, deriveGatewayRuntimeApprovalId, deriveGatewayRuntimePortalSemanticSnapshot, deriveManagedAgentProjection, gatewayControlCommandExecutionTimeoutMsByOperation, gatewayControlDeliveryPolicyByKind, gatewayControlDeliveryPolicyByOperation };
 
 //# sourceMappingURL=index.js.map