@cat-factory/contracts 0.53.0 → 0.55.0

package/dist/runners.d.ts

@@ -339,13 +339,24 @@ export declare const runnerPoolManifestSchema: v.ObjectSchema<{
     }, undefined>;
 }, undefined>;
 export type RunnerPoolManifest = v.InferOutput<typeof runnerPoolManifestSchema>;
+/** Built-in runner backend kinds the contract knows by name. */
+export declare const RESERVED_RUNNER_BACKEND_KINDS: readonly ['manifest', 'kubernetes'];
+/**
+ * The `kind` slug of a CUSTOM (third-party, programmatically-registered) runner backend:
+ * any lower-kebab slug that isn't a reserved built-in. A custom runner backend rides the
+ * generic `runnerPoolManifestSchema` body — its scheduler endpoints/secret refs live there
+ * exactly like the manifest built-in — and the registered `RunnerBackendProvider` (resolved
+ * by `kind`) builds the real transport. The reserved-kind guard stops a wrong-shaped
+ * built-in payload from silently matching this generic member instead of failing.
+ */
+export declare const customRunnerBackendKindSchema: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
 /**
  * An "agent runner backend" config, discriminated by `kind`. This is the universal
- * abstraction over WHERE repo-operating coding jobs run: today `manifest` (the BYO
- * HTTP scheduler pool) and `kubernetes` (native per-run pods); future kinds
- * (`nomad`, `eks`, …) add a member here + a provider in `@cat-factory/integrations`
- * — no new table/service/controller/UI window. The provider-registry seam keys on
- * `kind`.
+ * abstraction over WHERE repo-operating coding jobs run: the built-ins `manifest` (the BYO
+ * HTTP scheduler pool) and `kubernetes` (native per-run pods), plus any CUSTOM kind a
+ * deployment registers programmatically via `registerRunnerBackend` (it rides the generic
+ * manifest member — NO new variant needed). Mirrors `environmentBackendConfigSchema`; the
+ * provider-registry seam keys on `kind`.
  */
 export declare const runnerBackendConfigSchema: v.VariantSchema<"kind", [v.ObjectSchema<{
     readonly kind: v.LiteralSchema<"manifest", undefined>;
@@ -544,6 +555,155 @@ export declare const runnerBackendConfigSchema: v.VariantSchema<"kind", [v.Objec
         /** Extra pod metadata annotations. */
         readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
     }, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
+    readonly manifest: v.ObjectSchema<{
+        readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+        /** Scheduler API root; dispatch/poll/release paths are appended to it. */
+        readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+        readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"none", undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"api_key", undefined>;
+            readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            readonly secretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+            readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"bearer", undefined>;
+            readonly secretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"basic", undefined>;
+            readonly usernameSecretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+            readonly passwordSecretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+            readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly clientIdSecretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+            readonly clientSecretSecretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+            readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"custom_headers", undefined>;
+            readonly headers: v.ArraySchema<v.ObjectSchema<{
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>], undefined>;
+        /** Starts a job on the pool (analogous to the harness `POST /run`). */
+        readonly dispatch: v.ObjectSchema<{
+            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly key: v.StringSchema<undefined>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+        }, undefined>;
+        /** Reads a job's status (analogous to the harness `GET /jobs/{id}`). */
+        readonly poll: v.ObjectSchema<{
+            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly key: v.StringSchema<undefined>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+        }, undefined>;
+        /** Optional: frees the runner/job once the worker is done with it. */
+        readonly release: v.OptionalSchema<v.ObjectSchema<{
+            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly key: v.StringSchema<undefined>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+        }, undefined>, undefined>;
+        readonly response: v.ObjectSchema<{
+            /** Dot-path to the scheduler's status string (e.g. `state`, `data.phase`). */
+            readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Translate scheduler status strings → harness states. */
+            readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly from: v.StringSchema<undefined>;
+                readonly to: v.PicklistSchema<["running", "done", "failed"], undefined>;
+            }, undefined>, undefined>, undefined>;
+            /** Dot-paths to live subtask counts, surfaced as "N/M done" progress. */
+            readonly progressCompletedPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly progressInProgressPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly progressTotalPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Dot-paths to the finished work product. */
+            readonly prUrlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly branchPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly summaryPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /**
+             * Dot-path to the WHOLE structured result object the harness records (the
+             * harness `result`: `{ prUrl, branch, summary, service, spec, assessment, report,
+             * defaultBranch, pushed, resolved, usage }`). A pool that proxies the cat-factory
+             * executor-harness verbatim should set this so EVERY structured product — the
+             * blueprint tree, the spec doc, the merge assessment, the test report, the bootstrap
+             * default branch — is forwarded, not just the PR url/branch/summary scalars. Known
+             * fields are coerced by type; unknown ones are ignored. The individual scalar paths
+             * above still apply (and override) for schedulers that surface them out-of-envelope.
+             */
+            readonly resultPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /**
+             * Dot-path to the array of forward-looking follow-up / question items the Coder streamed
+             * since the last poll (the harness `followUps` drain-on-read channel). A pool that proxies
+             * the cat-factory executor-harness verbatim should set this to `followUps` so the
+             * Follow-up companion lights up live on a pool-backed coder run too (otherwise it simply
+             * never streams — the engine still gates on whatever items did arrive). Each entry is
+             * coerced to `{ kind, title, detail?, suggestedAction? }`.
+             */
+            readonly followUpsPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Dot-path to a job-level error message (a failed job, or a structured error). */
+            readonly errorPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /**
+             * Dot-path to the harness's STRUCTURED failure cause on a failed job (the harness
+             * `failureCause`: `inactivity-timeout` | `max-duration` | `agent` | `git` | `api` |
+             * `no-usable-output` | `no-changes`). A pool that proxies the cat-factory executor-harness
+             * verbatim should set this to `failureCause` so the engine classifies the failure WITHOUT
+             * regex-matching the error string — exactly like a Cloudflare container. Absent ⇒ the engine
+             * falls back to the (still-stable) error-string regex.
+             */
+            readonly failureCausePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /**
+             * Dot-path to the harness's extended, redacted failure `detail` (phase-timing breakdown,
+             * last-tool breadcrumb) on a failed job, distinct from the one-line error. Surfaced as the
+             * failure detail on the board. A verbatim-proxy pool should set this to `detail`.
+             */
+            readonly detailPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>;
+    }, undefined>;
 }, undefined>], undefined>;
 export type RunnerBackendConfig = v.InferOutput<typeof runnerBackendConfigSchema>;
 export type RunnerBackendKind = RunnerBackendConfig['kind'];
@@ -759,20 +919,8 @@ export declare const runnerPoolConnectionSchema: v.ObjectSchema<{
             /** Extra pod metadata annotations. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
         }, undefined>;
-    }, undefined>], undefined>, undefined>;
-}, undefined>;
-export type RunnerPoolConnection = v.InferOutput<typeof runnerPoolConnectionSchema>;
-/**
- * Register (or replace) a workspace's runner backend. `config` is the discriminated
- * backend config (manifest pool or Kubernetes); the org supplies the actual
- * per-tenant secret values here (write-only) — a manifest's scheduler-API
- * credentials, or a Kubernetes ServiceAccount token (`apiToken`). Secrets are
- * encrypted at rest and never returned. Every secret key the chosen backend
- * references must have a matching entry in `secrets`.
- */
-export declare const registerRunnerPoolSchema: v.ObjectSchema<{
-    readonly config: v.VariantSchema<"kind", [v.ObjectSchema<{
-        readonly kind: v.LiteralSchema<"manifest", undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
         readonly manifest: v.ObjectSchema<{
             readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
             readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
@@ -920,69 +1068,19 @@ export declare const registerRunnerPoolSchema: v.ObjectSchema<{
                 readonly detailPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
             }, undefined>;
         }, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
-        readonly kubernetes: v.ObjectSchema<{
-            /** Human label for the connection (shown in the UI). */
-            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
-            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            /** Namespace the per-run pods are created in. */
-            readonly namespace: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a valid Kubernetes namespace">]>;
-            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
-            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
-            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-            /** The executor-harness image the pod runs (the `default` image variant). */
-            readonly image: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-            /** The heavier UI-tester image (Playwright), used for `image:'ui'` dispatches. */
-            readonly imageUi: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Container port the harness HTTP server listens on (default 8080). */
-            readonly harnessPort: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
-            /** Name of an `imagePullSecrets` entry for a private registry. */
-            readonly imagePullSecretName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** ServiceAccount the pod runs as (NOT the token used to call the apiserver). */
-            readonly serviceAccountName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Default pod resource requests/limits applied to every run pod. */
-            readonly resources: v.OptionalSchema<v.ObjectSchema<{
-                readonly requests: v.OptionalSchema<v.ObjectSchema<{
-                    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                }, undefined>, undefined>;
-                readonly limits: v.OptionalSchema<v.ObjectSchema<{
-                    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                }, undefined>, undefined>;
-            }, undefined>, undefined>;
-            /** Per-instance-size limit overrides (t-shirt InstanceSize → cpu/memory). */
-            readonly resourcesBySize: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
-                readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            }, undefined>, undefined>, undefined>;
-            /** Pod `nodeSelector`. */
-            readonly nodeSelector: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Pod tolerations (passed through to the pod spec verbatim). */
-            readonly tolerations: v.OptionalSchema<v.ArraySchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>, undefined>;
-            /** Extra pod metadata labels. */
-            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Extra pod metadata annotations. */
-            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-        }, undefined>;
-    }, undefined>], undefined>;
-    readonly secrets: v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>;
-}, undefined>;
-export type RegisterRunnerPoolInput = v.InferOutput<typeof registerRunnerPoolSchema>;
-/** Rotate/replace the per-tenant secret bundle without re-sending the manifest. */
-export declare const updateRunnerPoolSecretsSchema: v.ObjectSchema<{
-    readonly secrets: v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>;
+    }, undefined>], undefined>, undefined>;
 }, undefined>;
-export type UpdateRunnerPoolSecretsInput = v.InferOutput<typeof updateRunnerPoolSecretsSchema>;
+export type RunnerPoolConnection = v.InferOutput<typeof runnerPoolConnectionSchema>;
 /**
- * Test (probe) a runner-backend connection before saving: supply the candidate
- * discriminated `config` + its `secrets`. Nothing is persisted by a test.
+ * Register (or replace) a workspace's runner backend. `config` is the discriminated
+ * backend config (manifest pool or Kubernetes); the org supplies the actual
+ * per-tenant secret values here (write-only) — a manifest's scheduler-API
+ * credentials, or a Kubernetes ServiceAccount token (`apiToken`). Secrets are
+ * encrypted at rest and never returned. Every secret key the chosen backend
+ * references must have a matching entry in `secrets`.
  */
-export declare const testRunnerPoolConnectionSchema: v.ObjectSchema<{
-    readonly config: v.OptionalSchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+export declare const registerRunnerPoolSchema: v.ObjectSchema<{
+    readonly config: v.VariantSchema<"kind", [v.ObjectSchema<{
         readonly kind: v.LiteralSchema<"manifest", undefined>;
         readonly manifest: v.ObjectSchema<{
             readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
@@ -1179,6 +1277,515 @@ export declare const testRunnerPoolConnectionSchema: v.ObjectSchema<{
             /** Extra pod metadata annotations. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
         }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Scheduler API root; dispatch/poll/release paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Starts a job on the pool (analogous to the harness `POST /run`). */
+            readonly dispatch: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Reads a job's status (analogous to the harness `GET /jobs/{id}`). */
+            readonly poll: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: frees the runner/job once the worker is done with it. */
+            readonly release: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                /** Dot-path to the scheduler's status string (e.g. `state`, `data.phase`). */
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Translate scheduler status strings → harness states. */
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["running", "done", "failed"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                /** Dot-paths to live subtask counts, surfaced as "N/M done" progress. */
+                readonly progressCompletedPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressInProgressPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressTotalPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-paths to the finished work product. */
+                readonly prUrlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly branchPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly summaryPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the WHOLE structured result object the harness records (the
+                 * harness `result`: `{ prUrl, branch, summary, service, spec, assessment, report,
+                 * defaultBranch, pushed, resolved, usage }`). A pool that proxies the cat-factory
+                 * executor-harness verbatim should set this so EVERY structured product — the
+                 * blueprint tree, the spec doc, the merge assessment, the test report, the bootstrap
+                 * default branch — is forwarded, not just the PR url/branch/summary scalars. Known
+                 * fields are coerced by type; unknown ones are ignored. The individual scalar paths
+                 * above still apply (and override) for schedulers that surface them out-of-envelope.
+                 */
+                readonly resultPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the array of forward-looking follow-up / question items the Coder streamed
+                 * since the last poll (the harness `followUps` drain-on-read channel). A pool that proxies
+                 * the cat-factory executor-harness verbatim should set this to `followUps` so the
+                 * Follow-up companion lights up live on a pool-backed coder run too (otherwise it simply
+                 * never streams — the engine still gates on whatever items did arrive). Each entry is
+                 * coerced to `{ kind, title, detail?, suggestedAction? }`.
+                 */
+                readonly followUpsPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-path to a job-level error message (a failed job, or a structured error). */
+                readonly errorPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the harness's STRUCTURED failure cause on a failed job (the harness
+                 * `failureCause`: `inactivity-timeout` | `max-duration` | `agent` | `git` | `api` |
+                 * `no-usable-output` | `no-changes`). A pool that proxies the cat-factory executor-harness
+                 * verbatim should set this to `failureCause` so the engine classifies the failure WITHOUT
+                 * regex-matching the error string — exactly like a Cloudflare container. Absent ⇒ the engine
+                 * falls back to the (still-stable) error-string regex.
+                 */
+                readonly failureCausePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the harness's extended, redacted failure `detail` (phase-timing breakdown,
+                 * last-tool breadcrumb) on a failed job, distinct from the one-line error. Surfaced as the
+                 * failure detail on the board. A verbatim-proxy pool should set this to `detail`.
+                 */
+                readonly detailPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+    }, undefined>], undefined>;
+    readonly secrets: v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type RegisterRunnerPoolInput = v.InferOutput<typeof registerRunnerPoolSchema>;
+/** Rotate/replace the per-tenant secret bundle without re-sending the manifest. */
+export declare const updateRunnerPoolSecretsSchema: v.ObjectSchema<{
+    readonly secrets: v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type UpdateRunnerPoolSecretsInput = v.InferOutput<typeof updateRunnerPoolSecretsSchema>;
+/**
+ * Test (probe) a runner-backend connection before saving: supply the candidate
+ * discriminated `config` + its `secrets`. Nothing is persisted by a test.
+ */
+export declare const testRunnerPoolConnectionSchema: v.ObjectSchema<{
+    readonly config: v.OptionalSchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"manifest", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Scheduler API root; dispatch/poll/release paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Starts a job on the pool (analogous to the harness `POST /run`). */
+            readonly dispatch: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Reads a job's status (analogous to the harness `GET /jobs/{id}`). */
+            readonly poll: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: frees the runner/job once the worker is done with it. */
+            readonly release: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                /** Dot-path to the scheduler's status string (e.g. `state`, `data.phase`). */
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Translate scheduler status strings → harness states. */
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["running", "done", "failed"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                /** Dot-paths to live subtask counts, surfaced as "N/M done" progress. */
+                readonly progressCompletedPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressInProgressPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressTotalPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-paths to the finished work product. */
+                readonly prUrlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly branchPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly summaryPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the WHOLE structured result object the harness records (the
+                 * harness `result`: `{ prUrl, branch, summary, service, spec, assessment, report,
+                 * defaultBranch, pushed, resolved, usage }`). A pool that proxies the cat-factory
+                 * executor-harness verbatim should set this so EVERY structured product — the
+                 * blueprint tree, the spec doc, the merge assessment, the test report, the bootstrap
+                 * default branch — is forwarded, not just the PR url/branch/summary scalars. Known
+                 * fields are coerced by type; unknown ones are ignored. The individual scalar paths
+                 * above still apply (and override) for schedulers that surface them out-of-envelope.
+                 */
+                readonly resultPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the array of forward-looking follow-up / question items the Coder streamed
+                 * since the last poll (the harness `followUps` drain-on-read channel). A pool that proxies
+                 * the cat-factory executor-harness verbatim should set this to `followUps` so the
+                 * Follow-up companion lights up live on a pool-backed coder run too (otherwise it simply
+                 * never streams — the engine still gates on whatever items did arrive). Each entry is
+                 * coerced to `{ kind, title, detail?, suggestedAction? }`.
+                 */
+                readonly followUpsPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-path to a job-level error message (a failed job, or a structured error). */
+                readonly errorPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the harness's STRUCTURED failure cause on a failed job (the harness
+                 * `failureCause`: `inactivity-timeout` | `max-duration` | `agent` | `git` | `api` |
+                 * `no-usable-output` | `no-changes`). A pool that proxies the cat-factory executor-harness
+                 * verbatim should set this to `failureCause` so the engine classifies the failure WITHOUT
+                 * regex-matching the error string — exactly like a Cloudflare container. Absent ⇒ the engine
+                 * falls back to the (still-stable) error-string regex.
+                 */
+                readonly failureCausePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the harness's extended, redacted failure `detail` (phase-timing breakdown,
+                 * last-tool breadcrumb) on a failed job, distinct from the one-line error. Surfaced as the
+                 * failure detail on the board. A verbatim-proxy pool should set this to `detail`.
+                 */
+                readonly detailPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection (shown in the UI). */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** Namespace the per-run pods are created in. */
+            readonly namespace: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a valid Kubernetes namespace">]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /** The executor-harness image the pod runs (the `default` image variant). */
+            readonly image: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            /** The heavier UI-tester image (Playwright), used for `image:'ui'` dispatches. */
+            readonly imageUi: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Container port the harness HTTP server listens on (default 8080). */
+            readonly harnessPort: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+            /** Name of an `imagePullSecrets` entry for a private registry. */
+            readonly imagePullSecretName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** ServiceAccount the pod runs as (NOT the token used to call the apiserver). */
+            readonly serviceAccountName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Default pod resource requests/limits applied to every run pod. */
+            readonly resources: v.OptionalSchema<v.ObjectSchema<{
+                readonly requests: v.OptionalSchema<v.ObjectSchema<{
+                    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+                readonly limits: v.OptionalSchema<v.ObjectSchema<{
+                    readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>, undefined>;
+            /** Per-instance-size limit overrides (t-shirt InstanceSize → cpu/memory). */
+            readonly resourcesBySize: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.ObjectSchema<{
+                readonly cpu: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly memory: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+            /** Pod `nodeSelector`. */
+            readonly nodeSelector: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Pod tolerations (passed through to the pod spec verbatim). */
+            readonly tolerations: v.OptionalSchema<v.ArraySchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>, undefined>;
+            /** Extra pod metadata labels. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra pod metadata annotations. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Scheduler API root; dispatch/poll/release paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Starts a job on the pool (analogous to the harness `POST /run`). */
+            readonly dispatch: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Reads a job's status (analogous to the harness `GET /jobs/{id}`). */
+            readonly poll: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: frees the runner/job once the worker is done with it. */
+            readonly release: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                /** Dot-path to the scheduler's status string (e.g. `state`, `data.phase`). */
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Translate scheduler status strings → harness states. */
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["running", "done", "failed"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                /** Dot-paths to live subtask counts, surfaced as "N/M done" progress. */
+                readonly progressCompletedPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressInProgressPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly progressTotalPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-paths to the finished work product. */
+                readonly prUrlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly branchPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly summaryPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the WHOLE structured result object the harness records (the
+                 * harness `result`: `{ prUrl, branch, summary, service, spec, assessment, report,
+                 * defaultBranch, pushed, resolved, usage }`). A pool that proxies the cat-factory
+                 * executor-harness verbatim should set this so EVERY structured product — the
+                 * blueprint tree, the spec doc, the merge assessment, the test report, the bootstrap
+                 * default branch — is forwarded, not just the PR url/branch/summary scalars. Known
+                 * fields are coerced by type; unknown ones are ignored. The individual scalar paths
+                 * above still apply (and override) for schedulers that surface them out-of-envelope.
+                 */
+                readonly resultPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the array of forward-looking follow-up / question items the Coder streamed
+                 * since the last poll (the harness `followUps` drain-on-read channel). A pool that proxies
+                 * the cat-factory executor-harness verbatim should set this to `followUps` so the
+                 * Follow-up companion lights up live on a pool-backed coder run too (otherwise it simply
+                 * never streams — the engine still gates on whatever items did arrive). Each entry is
+                 * coerced to `{ kind, title, detail?, suggestedAction? }`.
+                 */
+                readonly followUpsPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Dot-path to a job-level error message (a failed job, or a structured error). */
+                readonly errorPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the harness's STRUCTURED failure cause on a failed job (the harness
+                 * `failureCause`: `inactivity-timeout` | `max-duration` | `agent` | `git` | `api` |
+                 * `no-usable-output` | `no-changes`). A pool that proxies the cat-factory executor-harness
+                 * verbatim should set this to `failureCause` so the engine classifies the failure WITHOUT
+                 * regex-matching the error string — exactly like a Cloudflare container. Absent ⇒ the engine
+                 * falls back to the (still-stable) error-string regex.
+                 */
+                readonly failureCausePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /**
+                 * Dot-path to the harness's extended, redacted failure `detail` (phase-timing breakdown,
+                 * last-tool breadcrumb) on a failed job, distinct from the one-line error. Surfaced as the
+                 * failure detail on the board. A verbatim-proxy pool should set this to `detail`.
+                 */
+                readonly detailPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
     }, undefined>], undefined>, undefined>;
     readonly secrets: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;