@cat-factory/contracts 0.47.0 → 0.48.0

package/dist/runners.d.ts

@@ -120,6 +120,61 @@ export declare const runnerPoolResponseMappingSchema: v.ObjectSchema<{
     readonly errorPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
 }, undefined>;
 export type RunnerPoolResponseMapping = v.InferOutput<typeof runnerPoolResponseMappingSchema>;
+/** CPU/memory pair for a pod resource request or limit (k8s quantity strings). */
+export declare const kubernetesResourceQuantitiesSchema: v.ObjectSchema<{
+    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type KubernetesResourceQuantities = v.InferOutput<typeof kubernetesResourceQuantitiesSchema>;
+/** The secret-bundle key the Kubernetes backend reads the ServiceAccount token from. */
+export declare const KUBERNETES_RUNNER_TOKEN_SECRET_KEY = "apiToken";
+export declare const kubernetesRunnerConfigSchema: v.ObjectSchema<{
+    /** Human label for the connection (shown in the UI). */
+    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+    /** Namespace the per-run pods are created in. */
+    readonly namespace: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a valid Kubernetes namespace">]>;
+    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /** The executor-harness image the pod runs (the `default` image variant). */
+    readonly image: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    /** The heavier UI-tester image (Playwright), used for `image:'ui'` dispatches. */
+    readonly imageUi: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Container port the harness HTTP server listens on (default 8080). */
+    readonly harnessPort: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+    /** Name of an `imagePullSecrets` entry for a private registry. */
+    readonly imagePullSecretName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** ServiceAccount the pod runs as (NOT the token used to call the apiserver). */
+    readonly serviceAccountName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Default pod resource requests/limits applied to every run pod. */
+    readonly resources: v.OptionalSchema<v.ObjectSchema<{
+        readonly requests: v.OptionalSchema<v.ObjectSchema<{
+            readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, undefined>;
+        readonly limits: v.OptionalSchema<v.ObjectSchema<{
+            readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, undefined>;
+    }, undefined>, undefined>;
+    /** Per-instance-size limit overrides (t-shirt InstanceSize → cpu/memory). */
+    readonly resourcesBySize: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
+        readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>, undefined>;
+    /** Pod `nodeSelector`. */
+    readonly nodeSelector: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Pod tolerations (passed through to the pod spec verbatim). */
+    readonly tolerations: v.OptionalSchema<v.ArraySchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>, undefined>;
+    /** Extra pod metadata labels. */
+    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Extra pod metadata annotations. */
+    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+}, undefined>;
+export type KubernetesRunnerConfig = v.InferOutput<typeof kubernetesRunnerConfigSchema>;
 /** The full declarative description of an org's runner-pool scheduler API. */
 export declare const runnerPoolManifestSchema: v.ObjectSchema<{
     readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
@@ -254,25 +309,16 @@ export declare const runnerPoolManifestSchema: v.ObjectSchema<{
     }, undefined>;
 }, undefined>;
 export type RunnerPoolManifest = v.InferOutput<typeof runnerPoolManifestSchema>;
-/** A workspace's pool binding, as exposed to clients (never secret values). */
-export declare const runnerPoolConnectionSchema: v.ObjectSchema<{
-    readonly providerId: v.StringSchema<undefined>;
-    readonly label: v.StringSchema<undefined>;
-    readonly baseUrl: v.StringSchema<undefined>;
-    readonly connectedAt: v.NumberSchema<undefined>;
-    /** Which secret keys are set (names only), so the UI can show completeness. */
-    readonly secretKeys: v.ArraySchema<v.StringSchema<undefined>, undefined>;
-}, undefined>;
-export type RunnerPoolConnection = v.InferOutput<typeof runnerPoolConnectionSchema>;
 /**
- * Register (or replace) a workspace's runner pool. The org supplies the actual
- * per-tenant scheduler-API secret values here (write-only); they are encrypted
- * and stored in D1 and never returned. Every `secretRef.key` in the manifest
- * must have a matching entry in `secrets`. A native pool adapter is configured
- * through the same manifest path (per-workspace settings on the manifest's
- * `providerConfig` bag), mirroring the environment provider.
+ * An "agent runner backend" config, discriminated by `kind`. This is the universal
+ * abstraction over WHERE repo-operating coding jobs run: today `manifest` (the BYO
+ * HTTP scheduler pool) and `kubernetes` (native per-run pods); future kinds
+ * (`nomad`, `eks`, …) add a member here + a provider in `@cat-factory/integrations`
+ * — no new table/service/controller/UI window. The provider-registry seam keys on
+ * `kind`.
  */
-export declare const registerRunnerPoolSchema: v.ObjectSchema<{
+export declare const runnerBackendConfigSchema: v.VariantSchema<"kind", [v.ObjectSchema<{
+    readonly kind: v.LiteralSchema<"manifest", undefined>;
     readonly manifest: v.ObjectSchema<{
         readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
         readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
@@ -405,6 +451,449 @@ export declare const registerRunnerPoolSchema: v.ObjectSchema<{
             readonly errorPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
         }, undefined>;
     }, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+    readonly kubernetes: v.ObjectSchema<{
+        /** Human label for the connection (shown in the UI). */
+        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+        /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+        readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+        /** Namespace the per-run pods are created in. */
+        readonly namespace: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a valid Kubernetes namespace">]>;
+        /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+        readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+        readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+        /** The executor-harness image the pod runs (the `default` image variant). */
+        readonly image: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        /** The heavier UI-tester image (Playwright), used for `image:'ui'` dispatches. */
+        readonly imageUi: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        /** Container port the harness HTTP server listens on (default 8080). */
+        readonly harnessPort: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+        /** Name of an `imagePullSecrets` entry for a private registry. */
+        readonly imagePullSecretName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        /** ServiceAccount the pod runs as (NOT the token used to call the apiserver). */
+        readonly serviceAccountName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        /** Default pod resource requests/limits applied to every run pod. */
+        readonly resources: v.OptionalSchema<v.ObjectSchema<{
+            readonly requests: v.OptionalSchema<v.ObjectSchema<{
+                readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+            readonly limits: v.OptionalSchema<v.ObjectSchema<{
+                readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>, undefined>;
+        /** Per-instance-size limit overrides (t-shirt InstanceSize → cpu/memory). */
+        readonly resourcesBySize: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
+            readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, undefined>, undefined>;
+        /** Pod `nodeSelector`. */
+        readonly nodeSelector: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        /** Pod tolerations (passed through to the pod spec verbatim). */
+        readonly tolerations: v.OptionalSchema<v.ArraySchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>, undefined>;
+        /** Extra pod metadata labels. */
+        readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        /** Extra pod metadata annotations. */
+        readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    }, undefined>;
+}, undefined>], undefined>;
+export type RunnerBackendConfig = v.InferOutput<typeof runnerBackendConfigSchema>;
+export type RunnerBackendKind = RunnerBackendConfig['kind'];
+/** A workspace's runner-backend binding, as exposed to clients (never secret values). */
+export declare const runnerPoolConnectionSchema: v.ObjectSchema<{
+    /** Which backend kind is configured (`manifest` | `kubernetes` | …). */
+    readonly kind: v.StringSchema<undefined>;
+    readonly providerId: v.StringSchema<undefined>;
+    readonly label: v.StringSchema<undefined>;
+    readonly baseUrl: v.StringSchema<undefined>;
+    readonly connectedAt: v.NumberSchema<undefined>;
+    /** Which secret keys are set (names only), so the UI can show completeness. */
+    readonly secretKeys: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+    /**
+     * The stored discriminated backend config, sans secrets (those live in the
+     * write-only secret bundle), so the connect form can prefill its non-secret fields
+     * on edit instead of forcing a full re-entry. Omitted only for a legacy/unparsable row.
+     */
+    readonly config: v.OptionalSchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"manifest", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Scheduler API root; dispatch/poll/release paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Starts a job on the pool (analogous to the harness `POST /run`). */
+            readonly dispatch: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Reads a job's status (analogous to the harness `GET /jobs/{id}`). */
+            readonly poll: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: frees the runner/job once the worker is done with it. */
+            readonly release: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                /** Dot-path to the scheduler's status string (e.g. `state`, `data.phase`). */
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Translate scheduler status strings → harness states. */
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["running", "done", "failed"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                /** Dot-paths to live subtask counts, surfaced as "N/M done" progress. */
+                readonly progressCompletedPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressInProgressPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressTotalPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-paths to the finished work product. */
+                readonly prUrlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly branchPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly summaryPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the WHOLE structured result object the harness records (the
+                 * harness `result`: `{ prUrl, branch, summary, service, spec, assessment, report,
+                 * defaultBranch, pushed, resolved, usage }`). A pool that proxies the cat-factory
+                 * executor-harness verbatim should set this so EVERY structured product — the
+                 * blueprint tree, the spec doc, the merge assessment, the test report, the bootstrap
+                 * default branch — is forwarded, not just the PR url/branch/summary scalars. Known
+                 * fields are coerced by type; unknown ones are ignored. The individual scalar paths
+                 * above still apply (and override) for schedulers that surface them out-of-envelope.
+                 */
+                readonly resultPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the array of forward-looking follow-up / question items the Coder streamed
+                 * since the last poll (the harness `followUps` drain-on-read channel). A pool that proxies
+                 * the cat-factory executor-harness verbatim should set this to `followUps` so the
+                 * Follow-up companion lights up live on a pool-backed coder run too (otherwise it simply
+                 * never streams — the engine still gates on whatever items did arrive). Each entry is
+                 * coerced to `{ kind, title, detail?, suggestedAction? }`.
+                 */
+                readonly followUpsPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-path to a job-level error message (a failed job, or a structured error). */
+                readonly errorPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection (shown in the UI). */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** Namespace the per-run pods are created in. */
+            readonly namespace: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a valid Kubernetes namespace">]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /** The executor-harness image the pod runs (the `default` image variant). */
+            readonly image: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            /** The heavier UI-tester image (Playwright), used for `image:'ui'` dispatches. */
+            readonly imageUi: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Container port the harness HTTP server listens on (default 8080). */
+            readonly harnessPort: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+            /** Name of an `imagePullSecrets` entry for a private registry. */
+            readonly imagePullSecretName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** ServiceAccount the pod runs as (NOT the token used to call the apiserver). */
+            readonly serviceAccountName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Default pod resource requests/limits applied to every run pod. */
+            readonly resources: v.OptionalSchema<v.ObjectSchema<{
+                readonly requests: v.OptionalSchema<v.ObjectSchema<{
+                    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+                readonly limits: v.OptionalSchema<v.ObjectSchema<{
+                    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>, undefined>;
+            /** Per-instance-size limit overrides (t-shirt InstanceSize → cpu/memory). */
+            readonly resourcesBySize: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
+                readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+            /** Pod `nodeSelector`. */
+            readonly nodeSelector: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Pod tolerations (passed through to the pod spec verbatim). */
+            readonly tolerations: v.OptionalSchema<v.ArraySchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>, undefined>;
+            /** Extra pod metadata labels. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra pod metadata annotations. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>], undefined>, undefined>;
+}, undefined>;
+export type RunnerPoolConnection = v.InferOutput<typeof runnerPoolConnectionSchema>;
+/**
+ * Register (or replace) a workspace's runner backend. `config` is the discriminated
+ * backend config (manifest pool or Kubernetes); the org supplies the actual
+ * per-tenant secret values here (write-only) — a manifest's scheduler-API
+ * credentials, or a Kubernetes ServiceAccount token (`apiToken`). Secrets are
+ * encrypted at rest and never returned. Every secret key the chosen backend
+ * references must have a matching entry in `secrets`.
+ */
+export declare const registerRunnerPoolSchema: v.ObjectSchema<{
+    readonly config: v.VariantSchema<"kind", [v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"manifest", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Scheduler API root; dispatch/poll/release paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Starts a job on the pool (analogous to the harness `POST /run`). */
+            readonly dispatch: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Reads a job's status (analogous to the harness `GET /jobs/{id}`). */
+            readonly poll: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: frees the runner/job once the worker is done with it. */
+            readonly release: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                /** Dot-path to the scheduler's status string (e.g. `state`, `data.phase`). */
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Translate scheduler status strings → harness states. */
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["running", "done", "failed"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                /** Dot-paths to live subtask counts, surfaced as "N/M done" progress. */
+                readonly progressCompletedPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressInProgressPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressTotalPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-paths to the finished work product. */
+                readonly prUrlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly branchPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly summaryPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the WHOLE structured result object the harness records (the
+                 * harness `result`: `{ prUrl, branch, summary, service, spec, assessment, report,
+                 * defaultBranch, pushed, resolved, usage }`). A pool that proxies the cat-factory
+                 * executor-harness verbatim should set this so EVERY structured product — the
+                 * blueprint tree, the spec doc, the merge assessment, the test report, the bootstrap
+                 * default branch — is forwarded, not just the PR url/branch/summary scalars. Known
+                 * fields are coerced by type; unknown ones are ignored. The individual scalar paths
+                 * above still apply (and override) for schedulers that surface them out-of-envelope.
+                 */
+                readonly resultPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the array of forward-looking follow-up / question items the Coder streamed
+                 * since the last poll (the harness `followUps` drain-on-read channel). A pool that proxies
+                 * the cat-factory executor-harness verbatim should set this to `followUps` so the
+                 * Follow-up companion lights up live on a pool-backed coder run too (otherwise it simply
+                 * never streams — the engine still gates on whatever items did arrive). Each entry is
+                 * coerced to `{ kind, title, detail?, suggestedAction? }`.
+                 */
+                readonly followUpsPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-path to a job-level error message (a failed job, or a structured error). */
+                readonly errorPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection (shown in the UI). */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** Namespace the per-run pods are created in. */
+            readonly namespace: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a valid Kubernetes namespace">]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /** The executor-harness image the pod runs (the `default` image variant). */
+            readonly image: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            /** The heavier UI-tester image (Playwright), used for `image:'ui'` dispatches. */
+            readonly imageUi: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Container port the harness HTTP server listens on (default 8080). */
+            readonly harnessPort: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+            /** Name of an `imagePullSecrets` entry for a private registry. */
+            readonly imagePullSecretName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** ServiceAccount the pod runs as (NOT the token used to call the apiserver). */
+            readonly serviceAccountName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Default pod resource requests/limits applied to every run pod. */
+            readonly resources: v.OptionalSchema<v.ObjectSchema<{
+                readonly requests: v.OptionalSchema<v.ObjectSchema<{
+                    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+                readonly limits: v.OptionalSchema<v.ObjectSchema<{
+                    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>, undefined>;
+            /** Per-instance-size limit overrides (t-shirt InstanceSize → cpu/memory). */
+            readonly resourcesBySize: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
+                readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+            /** Pod `nodeSelector`. */
+            readonly nodeSelector: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Pod tolerations (passed through to the pod spec verbatim). */
+            readonly tolerations: v.OptionalSchema<v.ArraySchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>, undefined>;
+            /** Extra pod metadata labels. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra pod metadata annotations. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>], undefined>;
     readonly secrets: v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>;
 }, undefined>;
 export type RegisterRunnerPoolInput = v.InferOutput<typeof registerRunnerPoolSchema>;
@@ -414,144 +903,193 @@ export declare const updateRunnerPoolSecretsSchema: v.ObjectSchema<{
 }, undefined>;
 export type UpdateRunnerPoolSecretsInput = v.InferOutput<typeof updateRunnerPoolSecretsSchema>;
 /**
- * Test (probe) a pool connection before saving. A manifest-driven pool supplies
- * the candidate `manifest` + `secrets`; a native pool provider supplies its
- * `config` + `secrets`. Nothing is persisted by a test.
+ * Test (probe) a runner-backend connection before saving: supply the candidate
+ * discriminated `config` + its `secrets`. Nothing is persisted by a test.
  */
 export declare const testRunnerPoolConnectionSchema: v.ObjectSchema<{
-    readonly manifest: v.OptionalSchema<v.ObjectSchema<{
-        readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-        /** Scheduler API root; dispatch/poll/release paths are appended to it. */
-        readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-        readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"none", undefined>;
-        }, undefined>, v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"api_key", undefined>;
-            readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            readonly secretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-            readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        }, undefined>, v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"bearer", undefined>;
-            readonly secretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-        }, undefined>, v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"basic", undefined>;
-            readonly usernameSecretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-            readonly passwordSecretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-        }, undefined>, v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
-            readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            readonly clientIdSecretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-            readonly clientSecretSecretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-            readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        }, undefined>, v.ObjectSchema<{
-            readonly type: v.LiteralSchema<"custom_headers", undefined>;
-            readonly headers: v.ArraySchema<v.ObjectSchema<{
-                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    readonly config: v.OptionalSchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"manifest", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Scheduler API root; dispatch/poll/release paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                 readonly secretRef: v.ObjectSchema<{
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                 }, undefined>;
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Starts a job on the pool (analogous to the harness `POST /run`). */
+            readonly dispatch: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Reads a job's status (analogous to the harness `GET /jobs/{id}`). */
+            readonly poll: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: frees the runner/job once the worker is done with it. */
+            readonly release: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
             }, undefined>, undefined>;
-        }, undefined>], undefined>;
-        /** Starts a job on the pool (analogous to the harness `POST /run`). */
-        readonly dispatch: v.ObjectSchema<{
-            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
-            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly key: v.StringSchema<undefined>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
-        }, undefined>;
-        /** Reads a job's status (analogous to the harness `GET /jobs/{id}`). */
-        readonly poll: v.ObjectSchema<{
-            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
-            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly key: v.StringSchema<undefined>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            readonly response: v.ObjectSchema<{
+                /** Dot-path to the scheduler's status string (e.g. `state`, `data.phase`). */
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Translate scheduler status strings → harness states. */
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["running", "done", "failed"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                /** Dot-paths to live subtask counts, surfaced as "N/M done" progress. */
+                readonly progressCompletedPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressInProgressPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressTotalPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-paths to the finished work product. */
+                readonly prUrlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly branchPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly summaryPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the WHOLE structured result object the harness records (the
+                 * harness `result`: `{ prUrl, branch, summary, service, spec, assessment, report,
+                 * defaultBranch, pushed, resolved, usage }`). A pool that proxies the cat-factory
+                 * executor-harness verbatim should set this so EVERY structured product — the
+                 * blueprint tree, the spec doc, the merge assessment, the test report, the bootstrap
+                 * default branch — is forwarded, not just the PR url/branch/summary scalars. Known
+                 * fields are coerced by type; unknown ones are ignored. The individual scalar paths
+                 * above still apply (and override) for schedulers that surface them out-of-envelope.
+                 */
+                readonly resultPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the array of forward-looking follow-up / question items the Coder streamed
+                 * since the last poll (the harness `followUps` drain-on-read channel). A pool that proxies
+                 * the cat-factory executor-harness verbatim should set this to `followUps` so the
+                 * Follow-up companion lights up live on a pool-backed coder run too (otherwise it simply
+                 * never streams — the engine still gates on whatever items did arrive). Each entry is
+                 * coerced to `{ kind, title, detail?, suggestedAction? }`.
+                 */
+                readonly followUpsPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-path to a job-level error message (a failed job, or a structured error). */
+                readonly errorPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>;
         }, undefined>;
-        /** Optional: frees the runner/job once the worker is done with it. */
-        readonly release: v.OptionalSchema<v.ObjectSchema<{
-            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
-            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly key: v.StringSchema<undefined>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                readonly value: v.StringSchema<undefined>;
-            }, undefined>, undefined>, undefined>;
-            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
-        }, undefined>, undefined>;
-        readonly response: v.ObjectSchema<{
-            /** Dot-path to the scheduler's status string (e.g. `state`, `data.phase`). */
-            readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Translate scheduler status strings → harness states. */
-            readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly from: v.StringSchema<undefined>;
-                readonly to: v.PicklistSchema<["running", "done", "failed"], undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection (shown in the UI). */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** Namespace the per-run pods are created in. */
+            readonly namespace: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a valid Kubernetes namespace">]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /** The executor-harness image the pod runs (the `default` image variant). */
+            readonly image: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            /** The heavier UI-tester image (Playwright), used for `image:'ui'` dispatches. */
+            readonly imageUi: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Container port the harness HTTP server listens on (default 8080). */
+            readonly harnessPort: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+            /** Name of an `imagePullSecrets` entry for a private registry. */
+            readonly imagePullSecretName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** ServiceAccount the pod runs as (NOT the token used to call the apiserver). */
+            readonly serviceAccountName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Default pod resource requests/limits applied to every run pod. */
+            readonly resources: v.OptionalSchema<v.ObjectSchema<{
+                readonly requests: v.OptionalSchema<v.ObjectSchema<{
+                    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+                readonly limits: v.OptionalSchema<v.ObjectSchema<{
+                    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>, undefined>;
+            /** Per-instance-size limit overrides (t-shirt InstanceSize → cpu/memory). */
+            readonly resourcesBySize: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
+                readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
             }, undefined>, undefined>, undefined>;
-            /** Dot-paths to live subtask counts, surfaced as "N/M done" progress. */
-            readonly progressCompletedPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly progressInProgressPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly progressTotalPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Dot-paths to the finished work product. */
-            readonly prUrlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly branchPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly summaryPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /**
-             * Dot-path to the WHOLE structured result object the harness records (the
-             * harness `result`: `{ prUrl, branch, summary, service, spec, assessment, report,
-             * defaultBranch, pushed, resolved, usage }`). A pool that proxies the cat-factory
-             * executor-harness verbatim should set this so EVERY structured product — the
-             * blueprint tree, the spec doc, the merge assessment, the test report, the bootstrap
-             * default branch — is forwarded, not just the PR url/branch/summary scalars. Known
-             * fields are coerced by type; unknown ones are ignored. The individual scalar paths
-             * above still apply (and override) for schedulers that surface them out-of-envelope.
-             */
-            readonly resultPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /**
-             * Dot-path to the array of forward-looking follow-up / question items the Coder streamed
-             * since the last poll (the harness `followUps` drain-on-read channel). A pool that proxies
-             * the cat-factory executor-harness verbatim should set this to `followUps` so the
-             * Follow-up companion lights up live on a pool-backed coder run too (otherwise it simply
-             * never streams — the engine still gates on whatever items did arrive). Each entry is
-             * coerced to `{ kind, title, detail?, suggestedAction? }`.
-             */
-            readonly followUpsPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Dot-path to a job-level error message (a failed job, or a structured error). */
-            readonly errorPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Pod `nodeSelector`. */
+            readonly nodeSelector: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Pod tolerations (passed through to the pod spec verbatim). */
+            readonly tolerations: v.OptionalSchema<v.ArraySchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>, undefined>;
+            /** Extra pod metadata labels. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra pod metadata annotations. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
         }, undefined>;
-    }, undefined>, undefined>;
-    readonly config: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    }, undefined>], undefined>, undefined>;
     readonly secrets: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;
 export type TestRunnerPoolConnectionInput = v.InferOutput<typeof testRunnerPoolConnectionSchema>;