@chipschat/protocol 0.0.0-stage → 1.0.1

package/generated/types.ts

@@ -0,0 +1,4178 @@
+// Generated by `pnpm gen:protocol`. Do not edit by hand.
+//
+// TypeScript types for every Agent Connect event, with no dependency on zod. Import the
+// schemas from `@chipschat/protocol` when you need to validate; import these when you only
+// need the shape.
+
+export const PROTOCOL_VERSION = 1;
+
+/** `session.started` — A visit to a space began: a terminal opened, a process attached. The space outlives it. */
+export interface SessionStarted {
+  /** Protocol major version. */
+  v: 1;
+  type: "session.started";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The harness's own name for one visit, prefixed by the kind of harness. */
+  session_ref: string;
+  /** Why the visit began, in the harness's own word: `startup`, `resume`, `fork`. */
+  started_reason?: string;
+  /** Where it is running, for a person to read: "mbp · ~/Work/Chips". */
+  where?: string;
+  /** The harness's own transcript of this visit, so a person can jump to it. */
+  transcript_ref?: string;
+}
+
+/** `session.ended` — The visit is over. The space, its history and anything still waiting all stay. */
+export interface SessionEnded {
+  /** Protocol major version. */
+  v: 1;
+  type: "session.ended";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The harness's own name for one visit, prefixed by the kind of harness. */
+  session_ref: string;
+  /** Why it ended, in the harness's own word: `clear`, `logout`, `other`. */
+  ended_reason?: string;
+}
+
+/** `session.renamed` — What a visit is called, in the harness's own words (ADR 0040). */
+export interface SessionRenamed {
+  /** Protocol major version. */
+  v: 1;
+  type: "session.renamed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The harness's own name for one visit, prefixed by the kind of harness. */
+  session_ref: string;
+  /** What to call this visit on screen. A harness that names its sessions sends this when the name changes and not otherwise; a visit with no name is shown by where it is running instead. */
+  title: string;
+}
+
+/** `run.started` — A harness has begun a unit of work, optionally with the plan it intends to follow. */
+export interface RunStarted {
+  /** Protocol major version. */
+  v: 1;
+  type: "run.started";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** What the run is for, in the person's words where possible. */
+  goal: string;
+  /** The steps the harness expects to take. The run panel draws one hollow dot each. */
+  plan?: {
+    /** Stable for the life of the run, so updates land on the right row. */
+    step_id: string;
+    /** What this step will do. */
+    title: string;
+  }[];
+  /** The visit this run belongs to, so two terminals in one space are told apart. */
+  session_ref?: string;
+  /** Where the goal came from. `harness`: a person asked for it at the harness's own surface — a terminal, a chat the harness already had — so Chips shows it as their message, because otherwise the room holds only the answers. `chips`: it arrived as a message here and is already on screen. Either way the room's header and the run panel leave the goal out, because the room shows it. Omit when the goal was not a person's words at all; the header and the run panel then say it. */
+  goal_from?: "harness" | "chips";
+}
+
+/** `run.status` — What the harness is doing right now. This is the harness's typing indicator. */
+export interface RunStatus {
+  /** Protocol major version. */
+  v: 1;
+  type: "run.status";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A short machine-ish label, for example `reading`. */
+  phase: string;
+  /** What to show under the harness's name, for example "Reading PO #4471…". */
+  verb_phrase: string;
+  /** Fraction complete, when the harness knows. */
+  progress?: number;
+  /** Seconds remaining, when the harness knows. */
+  estimate_seconds?: number;
+}
+
+/** `run.plan` — The plan changed. Replaces the steps not yet done; the ones already done or failed keep their place. */
+export interface RunPlan {
+  /** Protocol major version. */
+  v: 1;
+  type: "run.plan";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The steps still to come, in order. Steps already done or failed stay ahead of these; a step still to do that is not here is dropped. */
+  plan: {
+    /** Stable for the life of the run, so updates land on the right row. */
+    step_id: string;
+    /** What this step will do. */
+    title: string;
+  }[];
+  /** Why the plan changed, in a sentence: a steer, a surprise, a shortcut. */
+  reason?: string;
+}
+
+/** `step.log` — One tool call or reasoning step, for the receipt and the run timeline. */
+export interface StepLog {
+  /** Protocol major version. */
+  v: 1;
+  type: "step.log";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Stable across the started and done events for one step. */
+  step_id: string;
+  /** Where this step got to. */
+  status: "started" | "done" | "failed";
+  /** What the step is, when it was not in the plan. */
+  title?: string;
+  /** The tool called, for example `drive.read`. */
+  tool?: string;
+  /** What kind of call the tool is, when the harness knows: the apps draw a step by it where they do not know the tool by its name. */
+  kind?: "search" | "web" | "shell" | "image" | "memory" | "edit" | "file" | "mail" | "handoff" | "other";
+  /** One line for the receipt. */
+  summary?: string;
+  /** Where the information came from. */
+  sources?: {
+    /** Whether the source is outside the workspace. */
+    kind: "external" | "internal";
+    /** What to show in the receipt, for example `vendor website`. */
+    label: string;
+    /** Where to look, when there is somewhere to look. */
+    url?: string;
+  }[];
+  /** How long the step took. */
+  duration_ms?: number;
+  /** Why it failed, when it did. */
+  error?: string;
+}
+
+/** `message.post` — A harness says something in a space, with any attachments. */
+export interface MessagePost {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.post";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Markdown, with mentions. */
+  text: string;
+  /** Photos, video, voice notes, files, as the upload described them. */
+  attachments?: {
+    /** A attachment identifier: `att_` followed by a ULID. */
+    attachment_id: string;
+    /** The name to show. Never trusted for its type. */
+    filename: string;
+    /** Sniffed from the bytes on upload, not taken from the client. */
+    mime_type: string;
+    /** Size in bytes. */
+    byte_size: number;
+    /** Lowercase hex digest. The store is content-addressed. */
+    sha256: string;
+    /** Pixels, for images and video. */
+    width?: number;
+    /** Pixels, for images and video. */
+    height?: number;
+    /** Milliseconds, for audio and video. */
+    duration_ms?: number;
+    /** What was said, for a voice note the server transcribed when it arrived (ADR 0054). Machine-heard: the person's words as best the server could make them out. */
+    transcript?: string;
+    /** The version of the room's file of this name that this one was made from (ADR 0099), from the post's `replaces`. Filled in by Chips; a value the sender writes is replaced. */
+    replaces?: string;
+  }[];
+  /** Uploads to attach, by the id `POST /v1/uploads` gave. Chips fills in `attachments` from what it stored. */
+  upload_ids?: string[];
+  /** Which version of the room's file each file here was made from (ADR 0099): an upload's or attachment's id, to the `attachment_id` of the version it changes, as `context.files` listed it. Each key is one of this post's `upload_ids` or `attachments`. A post made from a version that is no longer current is refused, `stale_file`, saying which file and who changed it; nothing of it is taken. A version of another name, or of another room, is no version of this file: Chips leaves it out. Chips copies each onto its attachment as `replaces`, and does not keep the map. */
+  replaces?: {
+  };
+  /** The commit the turn's push left the room's project at (ADR 0222): the room shows the change with this message. Chips keeps it only when the commit is on the room's `main` and is this agent's own; otherwise the message is kept without it. */
+  change?: string;
+  /** The message being answered, when it is a reply: one said in the same room, or the post is refused (ADR 0219). A person's reply to an agent's message is for that agent, unless an @ or `to` says otherwise; a harness's reply to an agent's message is for that agent too (ADR 0081), so a harness sets it only when it means to address them. */
+  reply_to?: string;
+  /** The visit this message is for, when the sender means one of several (ADR 0040). Chips checks it names a session of this space and carries it to the harness; a harness that works by visits delivers there rather than choosing, and one that does not ignores it. */
+  session_ref?: string;
+  /** The participants the text's @handles name, as ids. Filled in by Chips against the space's members; a value the sender writes is replaced. */
+  mentions?: string[];
+  /** Who the sender chose, without typing an @: agent ids and people's, or `all` for every agent in the space (ADR 0081, ADR 0087, ADR 0204). A harness's id names its one agent in the space. Chips keeps only the members. People picked are who a person's message is for besides its agents (`addressed_people`); no agent takes a turn for them. An @ in the text decides before it. */
+  to?: "all" | string[];
+  /** The agent wrote this on its own, on its heartbeat, with nobody asking (ADR 0143): the apps mark it so. Only a harness, or one of its agents, sends it; a check with nothing to say posts nothing. */
+  heartbeat?: true;
+  /** The agents this message is for, and so the agents that take a turn on it (ADR 0081, ADR 0087). Filled in by Chips from the @s, `to`, the reply and the space; a value the sender writes is replaced. A message logged without it was for every harness in the space. */
+  addressed_to?: string[];
+  /** Filled in by Chips on a person's message (ADR 0204): the people it is for, those its @s name, or else those the sender picked in `to`. They are pushed as an @ pushes them; no agent takes a turn for them. Absent for none; a value the sender writes is replaced. */
+  addressed_people?: string[];
+  /** Filled in by Chips when the message is for every harness in the space, whoever is there: `@all`, a `to` of `all`, or a person's default of everyone (ADR 0081). That person's next message that names nobody goes to every harness there is then, one added since included. */
+  addressed_to_all?: true;
+  /** Filled in by Chips when harnesses have addressed each other four times since a person last spoke there: the message is posted and shown, and addressed to nobody (ADR 0081). */
+  held?: true;
+  /** Written by Chips for words the agent said while in no room (ADR 0087, rule 6): when it said them. Posted here as it was attached. */
+  held_since?: string;
+  /** Written by Chips: the `message.held` these words were kept as. */
+  from_held?: string;
+}
+
+/** `message.heard` — A turn working in a room heard a message said there, as it worked. */
+export interface MessageHeard {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.heard";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The message, as `message.overheard` or `message.new` named it. */
+  message_id: string;
+}
+
+/** `approval.request` — The thing a group chat cannot do: an action, a preview, a risk class, who may answer, and an audit record. */
+export interface ApprovalRequest {
+  /** Protocol major version. */
+  v: 1;
+  type: "approval.request";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Minted by the harness, so a retry after a reconnect is the same ask. */
+  approval_id: string;
+  /** The plan step this ask belongs to. */
+  step_id?: string;
+  /** An action a harness proposes to take. */
+  action: {
+    /** A dotted verb, for example `email.send` or `payment.transfer`. Policy rules glob on it. */
+    kind: string;
+    /** The arguments, shaped by the tool being called. */
+    input?: unknown;
+    /** True when the action leaves the workspace. */
+    external?: boolean;
+    /** True when the action cannot be undone. */
+    irreversible?: boolean;
+    /** Amount at stake, in US dollars. */
+    money_usd?: number;
+  };
+  /** The question the person answers yes or no, as one sentence in plain words: `Turn off the Robinhood connector?`. The card leads with it. Without it the card is headed by the preview's title, else the action's kind (ADR 0142). */
+  question?: string;
+  /** What a yes does, in a sentence or two: `Its 73 tools disappear from every Space.` Drawn under the question. */
+  effect?: string;
+  /** How long a yes keeps working: `once` for this action alone, `standing` for a grant that holds until it is taken back, such as a folder an agent may keep working in. The card says which. */
+  lasts?: "once" | "standing";
+  /** What the approver sees. Omit only when the action speaks for itself. */
+  preview?: {
+    /** How to render the body. */
+    format: "markdown" | "plain" | "diff" | "json" | "table";
+    /** The rendered preview. */
+    body: string;
+    /** A heading for the card. */
+    title?: string;
+  };
+  /** Risk classes. The policy engine matches rules against these. */
+  risk: "external" | "external_communication" | "irreversible" | "destructive" | "financial" | "credential" | "privacy" | "legal"[];
+  /** Where the harness got what it is about to act on. */
+  sources?: {
+    /** Whether the source is outside the workspace. */
+    kind: "external" | "internal";
+    /** What to show in the receipt, for example `vendor website`. */
+    label: string;
+    /** Where to look, when there is somewhere to look. */
+    url?: string;
+  }[];
+  /** Seconds until the approval expires. Every approval has an expiry and a fallback. */
+  expires_in: number;
+  /** What happens on expiry. Denying is the default, and the safe one. */
+  fallback?: "deny" | "allow";
+  /** Who may answer, as the harness asks it: `owner`, `any` (the room, but its guests), `role:<name>` (a standing in the space or in the workspace), or a person id. `lead` (the lane's lead, when the run is a lane's) is a policy rule's to name, never a harness's, and never for an ask that matters — money, a deletion, an external action reach a person. Chips resolves them — policy's own list when a rule names one — to ids before the event is stored, and only those may decide it; a person may hand it on with `approval.routed`. */
+  approvers?: string[];
+  /** Whether the approver may change the input before allowing. */
+  editable?: boolean;
+  /** Lets a paused command-line run continue hours later. Approvals outlive processes. */
+  resume_token?: string;
+}
+
+/** `question.ask` — One to four questions with tappable options, a default, and a timeout. */
+export interface QuestionAsk {
+  /** Protocol major version. */
+  v: 1;
+  type: "question.ask";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Minted by the harness, so a retry is the same ask. */
+  ask_id: string;
+  /** One to four questions. */
+  questions: {
+    /** Stable, so answers land on the right question. */
+    question_id: string;
+    /** What is being asked. */
+    prompt: string;
+    /** Two to four options. */
+    options: {
+      /** What comes back in `question.answered`. */
+      value: string;
+      /** What the person taps. */
+      label: string;
+      /** What choosing it means. */
+      description?: string;
+    }[];
+    /** Whether more than one option may be chosen. */
+    multi_select?: boolean;
+    /** Whether the person may type instead. */
+    allow_free_text?: boolean;
+    /** What the harness will take if nobody answers. Its presence lowers the notification tier. */
+    default_value?: string;
+  }[];
+  /** How long to wait for an answer. */
+  timeout_seconds?: number;
+  /** What the harness will do if the timeout passes. */
+  on_no_answer?: "use_default" | "cancel" | "continue";
+}
+
+/** `artifact.create` — A file, document, code, image or table the harness produced, with a version. */
+export interface ArtifactCreate {
+  /** Protocol major version. */
+  v: 1;
+  type: "artifact.create";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Content-addressed, like every attachment. */
+  artifact_id: string;
+  /** How to render it. */
+  kind: "file" | "document" | "code" | "image" | "table";
+  /** What to call it. */
+  title: string;
+  /** Bumped when the harness revises it. */
+  version?: number;
+  /** The bytes, when the artifact is a file. */
+  attachment?: {
+    /** A attachment identifier: `att_` followed by a ULID. */
+    attachment_id: string;
+    /** The name to show. Never trusted for its type. */
+    filename: string;
+    /** Sniffed from the bytes on upload, not taken from the client. */
+    mime_type: string;
+    /** Size in bytes. */
+    byte_size: number;
+    /** Lowercase hex digest. The store is content-addressed. */
+    sha256: string;
+    /** Pixels, for images and video. */
+    width?: number;
+    /** Pixels, for images and video. */
+    height?: number;
+    /** Milliseconds, for audio and video. */
+    duration_ms?: number;
+    /** What was said, for a voice note the server transcribed when it arrived (ADR 0054). Machine-heard: the person's words as best the server could make them out. */
+    transcript?: string;
+    /** The version of the room's file of this name that this one was made from (ADR 0099), from the post's `replaces`. Filled in by Chips; a value the sender writes is replaced. */
+    replaces?: string;
+  };
+  /** The content, when the artifact is text. */
+  body?: string;
+  /** For code, the language to highlight. */
+  language?: string;
+}
+
+/** `checkpoint` — A milestone reached and what is next. Compaction is a checkpoint. FYI tier. */
+export interface Checkpoint {
+  /** Protocol major version. */
+  v: 1;
+  type: "checkpoint";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The milestone reached. */
+  label: string;
+  /** What the harness will do next. */
+  next?: string;
+  /** True when the harness just compacted its context. */
+  compacted?: boolean;
+}
+
+/** `handoff` — Passing work to a person or another harness, with a context summary and what is still open. */
+export interface Handoff {
+  /** Protocol major version. */
+  v: 1;
+  type: "handoff";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The participant id receiving the work. */
+  to: string;
+  /** What the recipient needs to know. */
+  context_summary: string;
+  /** What is still undone. */
+  open_items?: string[];
+  /** Why the work is moving. */
+  reason?: string;
+}
+
+/** `task` — Route work to another harness. From a lead this becomes a lane: one object, two views, never a copy. */
+export interface Task {
+  /** Protocol major version. */
+  v: 1;
+  type: "task";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The lane this task opens. */
+  task_id: string;
+  /** The specialist's participant id; a label for an ephemeral child; or the lead's own id, for a lane between two of its spaces — a specialist of its own in another of its rooms, a subagent in a worktree — which `home` then names. */
+  to: string;
+  /** Names an ephemeral child, which inherits owner, autonomy and budget from the lead. */
+  child?: {
+    /** A name for a transient participant Chips will mint. */
+    label: string;
+  };
+  /** The person the work is ultimately for: the lead's own owner, or a person in the space the task is sent from. A task on behalf of anyone else is kept in the lead's run. */
+  on_behalf_of: string;
+  /** The message that caused this routing. */
+  origin?: string;
+  /** What the specialist is being asked to do. */
+  goal: string;
+  /** Bounds on how to do it. */
+  constraints?: string[];
+  /** When it is needed by. */
+  deadline?: string;
+  /** The level for this lane. Never above the lead's own. */
+  autonomy?: 0 | 1 | 2 | 3;
+  /** Anything the specialist needs. */
+  attachments?: {
+    /** A attachment identifier: `att_` followed by a ULID. */
+    attachment_id: string;
+    /** The name to show. Never trusted for its type. */
+    filename: string;
+    /** Sniffed from the bytes on upload, not taken from the client. */
+    mime_type: string;
+    /** Size in bytes. */
+    byte_size: number;
+    /** Lowercase hex digest. The store is content-addressed. */
+    sha256: string;
+    /** Pixels, for images and video. */
+    width?: number;
+    /** Pixels, for images and video. */
+    height?: number;
+    /** Milliseconds, for audio and video. */
+    duration_ms?: number;
+    /** What was said, for a voice note the server transcribed when it arrived (ADR 0054). Machine-heard: the person's words as best the server could make them out. */
+    transcript?: string;
+    /** The version of the room's file of this name that this one was made from (ADR 0099), from the post's `replaces`. Filled in by Chips; a value the sender writes is replaced. */
+    replaces?: string;
+  }[];
+  /** A lead space to link the lane into, besides the one the task is sent from: where the route card appears and the lane's news lands. It must be a space the lead is in; one it is not in is ignored. */
+  link_to?: string;
+  /** Where the lane lives, when the lead already has the room: one of its own spaces, for a lane between two spaces of one harness. The lead and the specialist must both be in it. Absent, the specialist's direct space with the person, opened if it has none. */
+  home?: string;
+  /** What to call the specialist on this lane when its participant name is not the right one: a Space's name, a subagent's type. Shown on the route card and the task card. */
+  label?: string;
+}
+
+/** `usage` — Tokens and cost for a step, a run or a lane. Cost rolls up the trail and is always an estimate. */
+export interface Usage {
+  /** Protocol major version. */
+  v: 1;
+  type: "usage";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** What the numbers cover. */
+  scope: "step" | "run" | "lane";
+  /** The model that did the work. */
+  model: string;
+  /** Tokens in: every token the model read, fresh, read from its prompt cache and written to it. Leave it out when the harness cannot say: the tokens out are still counted, and Chips puts no price on a report it cannot count whole. */
+  input_tokens?: number;
+  /** Of the tokens in, how many the model read from its prompt cache. Leave it out when the harness cannot say or the model keeps no cache. */
+  cache_read_tokens?: number;
+  /** Of the tokens in, how many the model wrote to its prompt cache. Leave it out when the harness cannot say or the model keeps no cache. */
+  cache_write_tokens?: number;
+  /** Tokens out. Leave it out when the harness cannot say, and send the cost: Chips prices only a report whose tokens it has whole. */
+  output_tokens?: number;
+  /** The estimated cost, when the harness can compute one. */
+  cost?: {
+    /** An estimate, in US dollars. */
+    usd: number;
+    /** Always true. Cost is never presented as exact. */
+    estimated: true;
+  };
+}
+
+/** `context.usage` — How full the harness's context is. Drives the context ring; context stays per harness, never rolled up. */
+export interface ContextUsage {
+  /** Protocol major version. */
+  v: 1;
+  type: "context.usage";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Tokens currently held. */
+  used_tokens: number;
+  /** The window size. */
+  limit_tokens: number;
+  /** The model whose window this is. */
+  model: string;
+  /** True when the harness just compacted. */
+  compacted?: boolean;
+}
+
+/** `approval.executed` — What happened after a yes. The card changes from `approved` to `sent`, or to `failed`. */
+export interface ApprovalExecuted {
+  /** Protocol major version. */
+  v: 1;
+  type: "approval.executed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A approval identifier: `apr_` followed by a ULID. */
+  approval_id: string;
+  /** Whether the action actually happened. */
+  outcome: "executed" | "failed" | "skipped";
+  /** What was sent, or why it failed. */
+  detail?: string;
+  /** Who could answer it, as ids, as they stood when it was decided. Written by Chips from the approval so that somebody named outside the room sees what came of their decision (ADR 0042); a value the sender writes is replaced. */
+  approvers?: string[];
+}
+
+/** `run.completed` — The run is done. Posts a summary card and moves the status pill to Done. */
+export interface RunCompleted {
+  /** Protocol major version. */
+  v: 1;
+  type: "run.completed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The outcome, in the product voice. */
+  summary: string;
+  /** What changed in the world. */
+  changed?: string[];
+  /** What is worth doing next. */
+  follow_ups?: string[];
+  /** The run's estimated cost. */
+  cost?: {
+    /** An estimate, in US dollars. */
+    usd: number;
+    /** Always true. Cost is never presented as exact. */
+    estimated: true;
+  };
+}
+
+/** `run.failed` — The run stopped without finishing. Says what was left undone, so a person can pick it up. */
+export interface RunFailed {
+  /** Protocol major version. */
+  v: 1;
+  type: "run.failed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** What went wrong. */
+  error: string;
+  /** What did not get done. */
+  left_undone?: string[];
+  /** Whether running it again might work. */
+  retryable?: boolean;
+  /** What was spent before it failed. */
+  cost?: {
+    /** An estimate, in US dollars. */
+    usd: number;
+    /** Always true. Cost is never presented as exact. */
+    estimated: true;
+  };
+}
+
+/** `hello` — The server's half of the handshake: the protocol range it speaks, and who this connection is. */
+export interface Hello {
+  /** Protocol major version. */
+  v: 1;
+  type: "hello";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The negotiated range. A client picks a version inside it or is refused. */
+  protocol: {
+    /** Oldest major version the server accepts. */
+    min: number;
+    /** Newest major version the server speaks. */
+    max: number;
+  };
+  /** Who the client is talking to. */
+  server: {
+    /** Usually `chipsd`. */
+    name: string;
+    /** The server's own version. */
+    version: string;
+  };
+  /** The harness the token belongs to, and only that one. One connection speaks for all of the harness's agents (ADR 0087), which `agents` lists. A harness running inside another is a lane, not a duplicate. */
+  harnesses: {
+    /** A harness identifier: `hrn_` followed by a ULID. */
+    harness_id: string;
+    /** The harness's name in the workspace. */
+    display_name: string;
+    /** The person accountable for this harness. */
+    owner_id: string;
+    /** What the harness can do. */
+    capabilities?: string[];
+    /** True for a transient child minted for one lane, which inherits its lead's settings. */
+    ephemeral?: boolean;
+  }[];
+  /** The harness this connection is: `harnesses[0]`, said once. Read this rather than the list. */
+  harness?: {
+    /** A harness identifier: `hrn_` followed by a ULID. */
+    harness_id: string;
+    /** The harness's name in the workspace. */
+    display_name: string;
+    /** The person accountable for this harness. */
+    owner_id: string;
+    /** What the harness can do. */
+    capabilities?: string[];
+    /** True for a transient child minted for one lane, which inherits its lead's settings. */
+    ephemeral?: boolean;
+  };
+  /** The harness's agents, each with its rooms (ADR 0087). Everything the connection sends names one of them as `actor`; a harness's own id is read as its one agent in the room. Sent only to a harness that declares `agents`. */
+  agents?: {
+    /** A agent identifier: `agt_` followed by a ULID. */
+    agent_id: string;
+    /** The harness's own name for it. */
+    key: string;
+    /** What it is called, and so its @handle. */
+    name: string;
+    /** Whether it is the harness's Main agent. */
+    lead: boolean;
+    /** Archived when its thing was put away. */
+    state: "active" | "archived";
+    /** The rooms it is in. One at most, once one room per agent is the rule. */
+    spaces: string[];
+    /** The open room it is in (ADR 0087: one at a time), or `null` while it is free. What it says while free is held. */
+    room?: string | null;
+    /** How many of its words Chips is holding, said while it was in no room. */
+    held?: number;
+  }[];
+  /** The level in force for this connection. */
+  autonomy: 0 | 1 | 2 | 3;
+  /** The rules that fill in the details. */
+  policy?: {
+    /** 0 observe, 1 ask first, 2 ask when it matters, 3 autonomous and report back. Presets that expand to rules. */
+    autonomy: 0 | 1 | 2 | 3;
+    /** Evaluated in order; the workspace cap always wins. */
+    rules: {
+      /** A glob over action kinds, for example `payment.*`. */
+      match: string;
+      /** Extra conditions on the action's flags, and for a command, how its parts start. */
+      when?: {
+        external?: boolean;
+        irreversible?: boolean;
+        money_usd_over?: number;
+        risk?: "external" | "external_communication" | "irreversible" | "destructive" | "financial" | "credential" | "privacy" | "legal"[];
+        /** For an action that carries a command (ADR 0239): the words a part of it starts with. A command goes ahead on such rules only when every part starts with one that allows it. */
+        starts_with?: string[];
+      };
+      /** What to do when the rule matches. */
+      decision: "allow" | "ask" | "deny";
+      /** Who may answer, when the decision is `ask`. */
+      approvers?: string[];
+      /** Shown to the harness, and recorded in the audit log. */
+      reason?: string;
+      /** Turned off by a person (ADR 0195): kept in the list to turn back on, and skipped by the policy engine until then. */
+      off?: boolean;
+      /** Who made it by answering an ask with Always (ADR 0195). Filled in by Chips. */
+      made_by?: string;
+      /** When a person's answer made it (ADR 0195): Always, or This session. Filled in by Chips. A rule a person's answer made never allows an action that matters. */
+      made_at?: string;
+    }[];
+  };
+  /** The ceiling, and what has been spent. */
+  budget?: {
+    /** The ceiling for this harness. */
+    limit_usd: number;
+    /** Spent so far, estimated. */
+    spent_usd: number;
+  };
+  /** The spaces this credential is a member of as it connects. A client that kept a cache drops what is not here: a membership it lost while away is the one event a replay can never bring it, because it is no longer in the space that event belongs to. */
+  spaces?: string[];
+  /** The workspace as it is called now. A device keeps the name it was told when it paired and takes this one when they differ, so a workspace renamed since is called by its new name without pairing again. Absent when the workspace has no name. */
+  workspace?: {
+    name: string;
+  };
+}
+
+/** `message.new` — Someone said something, with any attachments as signed URLs the harness can fetch. */
+export interface MessageNew {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.new";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A message identifier: `msg_` followed by a ULID. */
+  message_id: string;
+  /** Who sent it, and whether they are the owner, a member or a guest. */
+  from: {
+    /** The stable id of the sender. */
+    participant_id: string;
+    /** Whether the sender is a person or an agent (ADR 0087); `harness` for a harness written before agents, and for any agent as a harness that has not declared `agents` is told it. */
+    kind: "person" | "harness" | "agent";
+    /** The name to show. */
+    display_name: string;
+    /** The sender's standing in this space. Multi-user is Chips' job, not the harness's. */
+    role: "owner" | "member" | "guest";
+    /** A person's standing in the workspace (SEC-15): what a model should weigh the words by, since a guest's read as the owner's otherwise. `promptFor` says it after the name. Absent for an agent or a harness, and from a Chips before it said. */
+    workspace_role?: "owner" | "admin" | "member" | "guest";
+  };
+  /** Markdown, with mentions resolved to participant ids. */
+  text: string;
+  /** URLs expire in ten minutes. */
+  attachments?: {
+    /** A attachment identifier: `att_` followed by a ULID. */
+    attachment_id: string;
+    /** The name to show. Never trusted for its type. */
+    filename: string;
+    /** Sniffed from the bytes on upload, not taken from the client. */
+    mime_type: string;
+    /** Size in bytes. */
+    byte_size: number;
+    /** Lowercase hex digest. The store is content-addressed. */
+    sha256: string;
+    /** Pixels, for images and video. */
+    width?: number;
+    /** Pixels, for images and video. */
+    height?: number;
+    /** Milliseconds, for audio and video. */
+    duration_ms?: number;
+    /** What was said, for a voice note the server transcribed when it arrived (ADR 0054). Machine-heard: the person's words as best the server could make them out. */
+    transcript?: string;
+    /** The version of the room's file of this name that this one was made from (ADR 0099), from the post's `replaces`. Filled in by Chips; a value the sender writes is replaced. */
+    replaces?: string;
+    /** A signed URL, bound to the requesting token: fetch it with that token as the bearer, since the URL alone is refused. */
+    url: string;
+    /** Ten minutes from issue, by default (decision 10). */
+    url_expires_at: string;
+  }[];
+  /** Participant ids mentioned in the text. */
+  mentions?: string[];
+  /** The message this answers. */
+  reply_to?: string;
+  /** The message `reply_to` names, as the room reads it now (ADR 0219): who said it, when, its words and its files, and with a turn, when it is older than `context`, the lines said just before it. Put it in the turn ahead of the words; the SDK's `promptFor` does. Absent on a message that answers none, or one no longer in the room. */
+  replying_to?: {
+    /** Where in the log it happened. */
+    seq: number;
+    /** When. */
+    at: string;
+    kind: "said";
+    /** Who: the one who said it, came, went or took the new name; for the room's own lines, who retitled, archived or unarchived it. */
+    from: {
+      /** Their participant id, or `system`. */
+      id: string;
+      kind: "person" | "harness" | "agent" | "system";
+      /** What they go by now. */
+      name: string;
+      /** Their standing in this room, when they are in it (SEC-15). */
+      role?: "owner" | "member" | "guest";
+      /** A person's standing in the workspace (SEC-15): the plain form says it after the name, so a guest's line reads as a guest's. Absent for an agent or a harness. */
+      workspace_role?: "owner" | "admin" | "member" | "guest";
+    };
+    /** The message the reply answers: its `reply_to`. */
+    message_id: string;
+    /** On `said`: the words as they read now, so an edited message reads edited; a deleted one is not a line. Cut with an ellipsis when the one line is longer than the whole budget. */
+    text?: string;
+    /** On `said`: what a voice note said, as the server heard it (ADR 0054). */
+    transcript?: string;
+    /** On `said`: the names of the files it carried. */
+    files?: string[];
+    /** On `said`: the agents it was for (ADR 0081, ADR 0087), so a harness can leave out a line one of its agents already took a turn on. Absent on a message from before Chips said so. */
+    addressed_to?: string[];
+    /** On `said`: the guard held it (ADR 0081), so it was for nobody. */
+    held?: true;
+    /** On `renamed`, for a participant: the name they took. */
+    name?: string;
+    /** On `renamed`, for a participant: the name they went by until then. */
+    previous?: string;
+    /** On `renamed`, for the room: its new title. */
+    title?: string;
+    /** Its author changed its words since: `text` is how it reads now. */
+    edited?: true;
+    /** Taken back since it was answered: no words, no files, only who and when. */
+    deleted?: true;
+    /** Up to three lines said just before it, oldest first, so the turn has what it was about. Only with a turn, and only when the message is older than the lines `context` hands over. */
+    before?: {
+      /** Where in the log it happened. */
+      seq: number;
+      /** When. */
+      at: string;
+      /** `said`: a message, addressed to this harness or not. `joined` and `left`: somebody came into the room or went. `renamed`: somebody took a new name, or the room a new title. `archived` and `unarchived`: the room was put away or brought back. */
+      kind: "said" | "joined" | "left" | "renamed" | "archived" | "unarchived";
+      /** Who: the one who said it, came, went or took the new name; for the room's own lines, who retitled, archived or unarchived it. */
+      from: {
+        /** Their participant id, or `system`. */
+        id: string;
+        kind: "person" | "harness" | "agent" | "system";
+        /** What they go by now. */
+        name: string;
+        /** Their standing in this room, when they are in it (SEC-15). */
+        role?: "owner" | "member" | "guest";
+        /** A person's standing in the workspace (SEC-15): the plain form says it after the name, so a guest's line reads as a guest's. Absent for an agent or a harness. */
+        workspace_role?: "owner" | "admin" | "member" | "guest";
+      };
+      /** On `said`: the message. */
+      message_id?: string;
+      /** On `said`: the words as they read now, so an edited message reads edited; a deleted one is not a line. Cut with an ellipsis when the one line is longer than the whole budget. */
+      text?: string;
+      /** On `said`: what a voice note said, as the server heard it (ADR 0054). */
+      transcript?: string;
+      /** On `said`: the names of the files it carried. */
+      files?: string[];
+      /** On `said`: the agents it was for (ADR 0081, ADR 0087), so a harness can leave out a line one of its agents already took a turn on. Absent on a message from before Chips said so. */
+      addressed_to?: string[];
+      /** On `said`: the guard held it (ADR 0081), so it was for nobody. */
+      held?: true;
+      /** On `renamed`, for a participant: the name they took. */
+      name?: string;
+      /** On `renamed`, for a participant: the name they went by until then. */
+      previous?: string;
+      /** On `renamed`, for the room: its new title. */
+      title?: string;
+    }[];
+    /** Its files, as the message's own are sent: URLs expire in ten minutes. */
+    attachments?: {
+      /** A attachment identifier: `att_` followed by a ULID. */
+      attachment_id: string;
+      /** The name to show. Never trusted for its type. */
+      filename: string;
+      /** Sniffed from the bytes on upload, not taken from the client. */
+      mime_type: string;
+      /** Size in bytes. */
+      byte_size: number;
+      /** Lowercase hex digest. The store is content-addressed. */
+      sha256: string;
+      /** Pixels, for images and video. */
+      width?: number;
+      /** Pixels, for images and video. */
+      height?: number;
+      /** Milliseconds, for audio and video. */
+      duration_ms?: number;
+      /** What was said, for a voice note the server transcribed when it arrived (ADR 0054). Machine-heard: the person's words as best the server could make them out. */
+      transcript?: string;
+      /** The version of the room's file of this name that this one was made from (ADR 0099), from the post's `replaces`. Filled in by Chips; a value the sender writes is replaced. */
+      replaces?: string;
+      /** A signed URL, bound to the requesting token: fetch it with that token as the bearer, since the URL alone is refused. */
+      url: string;
+      /** Ten minutes from issue, by default (decision 10). */
+      url_expires_at: string;
+    }[];
+  };
+  /** The visit the sender meant, when they named one (ADR 0040). A harness that works by visits delivers to it rather than choosing, and says so rather than delivering elsewhere when it cannot. */
+  session_ref?: string;
+  /** The agents the message is for, as Chips decided them (ADR 0081, ADR 0087). Absent on a message from before Chips said so, which was for every agent in the space. */
+  addressed_to?: string[];
+  /** Who of this connection takes a turn: its own among `addressed_to` (ADR 0087). Each is one of its agents, or the harness's own id where the harness itself is the member addressed: a room asked of it from the +, until it claims the room. Never empty on a `message.new`, and always empty on a `message.overheard`. Sent only to a harness that declares `agents`; one that has not is told its agents are itself. */
+  for?: string[];
+  /** This connection's agents with a turn going in the room, other than the one who said it and those it is for (ADR 0106). Hand the words to each of those turns at its next step, as said to somebody else, and start no turn on them; post `message.heard` on the run once a turn has them, and the room shows it heard. A turn that ends first hears nothing, and is handed the words with its agent's next turn (ADR 0105). Absent when there are none. */
+  working_turns?: {
+    /** One of this connection's agents. */
+    agent_id: string;
+    /** Its turn going in the room. */
+    run_id: string;
+  }[];
+  /** What was said in the room since this harness last spoke there, or since it joined when it has not, up to this message and without it (ADR 0088). From when the turn that said its last words began, so what was said while it worked is here, and its own words are not (ADR 0105). Worked out from the log, so a replay hands over the same lines. As many as the budget the harness gave in its `hello`: 40 lines and 16,000 characters when it gave none, and none when it asked for 0. When older lines were left out, the taker's room note says so. */
+  context?: {
+    /** Oldest first, the newest that fit the budget. */
+    lines: {
+      /** Where in the log it happened. */
+      seq: number;
+      /** When. */
+      at: string;
+      /** `said`: a message, addressed to this harness or not. `joined` and `left`: somebody came into the room or went. `renamed`: somebody took a new name, or the room a new title. `archived` and `unarchived`: the room was put away or brought back. */
+      kind: "said" | "joined" | "left" | "renamed" | "archived" | "unarchived";
+      /** Who: the one who said it, came, went or took the new name; for the room's own lines, who retitled, archived or unarchived it. */
+      from: {
+        /** Their participant id, or `system`. */
+        id: string;
+        kind: "person" | "harness" | "agent" | "system";
+        /** What they go by now. */
+        name: string;
+        /** Their standing in this room, when they are in it (SEC-15). */
+        role?: "owner" | "member" | "guest";
+        /** A person's standing in the workspace (SEC-15): the plain form says it after the name, so a guest's line reads as a guest's. Absent for an agent or a harness. */
+        workspace_role?: "owner" | "admin" | "member" | "guest";
+      };
+      /** On `said`: the message. */
+      message_id?: string;
+      /** On `said`: the words as they read now, so an edited message reads edited; a deleted one is not a line. Cut with an ellipsis when the one line is longer than the whole budget. */
+      text?: string;
+      /** On `said`: what a voice note said, as the server heard it (ADR 0054). */
+      transcript?: string;
+      /** On `said`: the names of the files it carried. */
+      files?: string[];
+      /** On `said`: the agents it was for (ADR 0081, ADR 0087), so a harness can leave out a line one of its agents already took a turn on. Absent on a message from before Chips said so. */
+      addressed_to?: string[];
+      /** On `said`: the guard held it (ADR 0081), so it was for nobody. */
+      held?: true;
+      /** On `renamed`, for a participant: the name they took. */
+      name?: string;
+      /** On `renamed`, for a participant: the name they went by until then. */
+      previous?: string;
+      /** On `renamed`, for the room: its new title. */
+      title?: string;
+    }[];
+    /** Where they start: after this `seq`. With a message, where the turn that said the harness's own last message in the room began (ADR 0105), else its joining; from the pull route, 0. */
+    since_seq: number;
+    /** Whether older lines after `since_seq` were left out to fit the budget. */
+    truncated: boolean;
+    /** A cursor: `GET /v1/spaces/:id/context?before=` this reads what came before these lines. */
+    before: number;
+    /** The room's files at their current version, newest first, the 20 newest (ADR 0099): with a message, as of it, its own files included; from the pull route, as of now. Each with a URL for this harness. Absent from a Chips before files, and when the room has none. */
+    files?: {
+      /** The file's name, which its versions share. */
+      name: string;
+      /** Which version this is: 1 for the first, counting each change of its bytes. */
+      version: number;
+      /** The attachment that is this version: what a post names in `replaces` when it changes it. */
+      attachment_id: string;
+      /** Lowercase hex digest of this version's bytes. */
+      sha256: string;
+      /** Size in bytes. */
+      byte_size: number;
+      /** Sniffed from the bytes on upload. */
+      mime_type: string;
+      /** Who posted this version, as a line's `from` says it. */
+      by: {
+        /** Their participant id. */
+        id: string;
+        kind: "person" | "harness" | "agent" | "system";
+        /** What they go by now. */
+        name: string;
+      };
+      /** When this version was posted. */
+      at: string;
+      /** The message that posted this version. */
+      message_id?: string;
+      /** Pixels, for a photo or a video. */
+      width?: number;
+      /** Pixels, for a photo or a video. */
+      height?: number;
+      /** Milliseconds, for a sound or a video. */
+      duration_ms?: number;
+      /** In one name's versions (`?name=`): the version this one was made from, as its post said (`message.post.replaces`). Absent where the post said nothing, or named no version of this file. */
+      replaces?: string;
+      /** For a harness: a signed URL for this version, bound to its token, as a message's attachments are. Absent for a person, who fetches it by id. */
+      url?: string;
+      /** When `url` stops working. */
+      url_expires_at?: string;
+    }[];
+    /** What the room's job has spent, as of the message (for one Chips held, as of its hand-over, when a new job began), against what the room allows a job (ADR 0117). With a message only; the room note says it in words. Absent from a Chips before it. */
+    spend?: {
+      /** What the room allows a job, in US dollars: its own ceiling, or the default (3) when nobody has set one. */
+      ceiling_usd: number;
+      /** What the room's runs reported costing since the job began, in US dollars, every harness's together. */
+      spent_usd: number;
+      /** Where the job began: the `seq` of the last thing a person did in the room, or of the last brief handed into it, whichever is later; 0 when neither has happened. */
+      since_seq: number;
+      /** How many of the job's runs reported no cost, and so count nothing. */
+      uncounted_runs: number;
+    };
+  };
+  /** Who is in the room, with the handle that reaches each, and a note for each who takes the turn saying so and what an @ does (ADR 0092). A harness puts `notes[<taker>]` at the top of that turn. Absent on a message in no room. */
+  room?: {
+    /** The room's people, then its agents, each by name, anybody removed left out. */
+    members: {
+      participant_id: string;
+      /** A person, or an agent: one of a harness's, or a harness in the room in its own right, as in a room asked of it it has not claimed. A harness that has not declared `agents` is shown each agent as `harness`, as everywhere else. */
+      kind: "person" | "agent" | "harness";
+      name: string;
+      /** For an agent, the name of the harness it runs on: `Scout`; for a harness waiting in a room asked of it, listed by the first name the room holds for its agent (ADR 0150), its own name. Absent for a person, any other harness in the room in its own right, and an agent named as its harness is. */
+      harness?: string;
+      /** What reaches them, with its @: `@Scout2`. Their whole name with its spaces left out, or their first word where only that is a handle. Absent for a name no handle reaches, such as one letter. */
+      handle?: string;
+      /** The room's lead (ADR 0104): it hands out the work, and Chips hands it what was nobody's turn once the room goes still. */
+      lead?: true;
+      /** For a person, the IANA zone of the phone they registered last (ADR 0157): what "at 10am" means to them, which the note says as their time now. Absent when Chips knows none. */
+      time_zone?: string;
+    }[];
+    /** The note for each who takes the turn (`for`), by their id: who is here, with handles, and that only those @-mentioned act. A harness puts it at the top of the turn. */
+    notes: {
+    };
+    /** How the space works, for each who takes the turn, by their id: the words its note ends with (ADR 0250), that everyone here reads what it writes and, beside other agents, what an @ does and when to answer NO_REPLY. They stay the same while the space's agents do, so a harness whose session keeps its earlier turns may say them once, and the note without them after. */
+    rules?: {
+    };
+    /** The room's agents with a turn going as Chips sends this one (ADR 0104), the takers' own included. A turn nothing has been heard from for ten minutes is not counted. */
+    working?: {
+      participant_id: string;
+      /** How long its turn has been going, in whole minutes. */
+      minutes: number;
+      /** The last step its turn said it was on, when its harness says its steps. */
+      step?: string;
+    }[];
+    /** The room's other agents that have had a turn here: how long since the last one ended (ADR 0104). */
+    idle?: {
+      participant_id: string;
+      /** How long since its last turn here ended, in whole minutes. */
+      minutes: number;
+    }[];
+  };
+  /** How the agents' talk in the room stands, once it is worth a word (ADR 0097): from eight messages between agents since a person last acted or an agent last made something new. A harness puts `note` at the top of the turn, as Chips's, ahead of the room's note. Absent below that, and worked out from the log, so a replay hands over the same facts. */
+  exchange?: {
+    /** Messages agents have sent agents in the room since the reset, this one included. */
+    count: number;
+    /** The last reset of the count. */
+    since: {
+      /** `person`: somebody did something in the room. `work`: an agent made something new — a file new to the room, a question to a person, an approval request. `start`: nothing since the room began. */
+      kind: "person" | "work" | "start";
+      /** Where the count starts from, after this. */
+      seq: number;
+      /** When. Absent at the start. */
+      at?: string;
+      /** Who: the person, or the agent that made it. */
+      by?: string;
+      /** For `work`: what the agent made. */
+      made?: "file" | "question" | "approval";
+      /** For a file: its name. */
+      file?: string;
+    };
+    /** Since the reset. */
+    minutes: number;
+    /** Whether somebody has the room open: a person not behind it by a message older than a minute. `null` when Chips cannot say. */
+    person_looking: unknown;
+    /** Who to tell what is done and what is blocked: the person who last acted here. */
+    person?: string;
+    /** Which of the messages repeat, newest last. */
+    repeats: {
+      message_id: string;
+      by: string;
+      /** `file`: it carried a file already in the room. `words`: its words are much the same as words its sender already sent since the reset. */
+      kind: "file" | "words";
+      file?: string;
+    }[];
+    /** The same two or three agents taking turns with nothing new: two rounds with a repeat among them. */
+    circling: boolean;
+    /** Who else this message is for, besides whoever it is delivered to. */
+    also_for: string[];
+    /** `quiet` under the nudge; `nudge` from it (half the workspace's stop, or 8); `warning` on a circle or from the stop; `held` at the hold or while a person has paused the agents. The stop, the hold and whether circles count are the workspace's (ADR 0187): 16, 48 and yes unless an owner or an admin changed them. */
+    stage: "quiet" | "nudge" | "warning" | "held";
+    /** After how many messages between agents Chips holds them: the workspace's hold (ADR 0187). Absent when it holds them only on a pause. */
+    allowance?: number;
+    /** A person paused the agents, or Chips did at the room's spend ceiling (ADR 0118), and nobody has acted since. */
+    paused: boolean;
+    /** The facts in plain words, for the top of the turn. */
+    note: string;
+  };
+  /** Chips held this message when it was said and hands it over now a person has acted (ADR 0097): the newest of an agent's held messages, once; or, with `lead`, hands it to the room's lead. Its seq and id are the hand-over's, its `message_id` the message's own. */
+  handed?: true;
+  /** Handed to the agent taking the turn as the room's lead (ADR 0104): the message was nobody's turn, and the room went still. Its note says so at the top, and `handed` is set too. */
+  lead?: true;
+}
+
+/** `message.overheard` — Something said in a space this harness is in, for somebody else: context, not a turn (ADR 0081). A harness with a turn going in the space hands it to that turn at its next step (ADR 0105). */
+export interface MessageOverheard {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.overheard";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A message identifier: `msg_` followed by a ULID. */
+  message_id: string;
+  /** Who sent it, and whether they are the owner, a member or a guest. */
+  from: {
+    /** The stable id of the sender. */
+    participant_id: string;
+    /** Whether the sender is a person or an agent (ADR 0087); `harness` for a harness written before agents, and for any agent as a harness that has not declared `agents` is told it. */
+    kind: "person" | "harness" | "agent";
+    /** The name to show. */
+    display_name: string;
+    /** The sender's standing in this space. Multi-user is Chips' job, not the harness's. */
+    role: "owner" | "member" | "guest";
+    /** A person's standing in the workspace (SEC-15): what a model should weigh the words by, since a guest's read as the owner's otherwise. `promptFor` says it after the name. Absent for an agent or a harness, and from a Chips before it said. */
+    workspace_role?: "owner" | "admin" | "member" | "guest";
+  };
+  /** Markdown, with mentions resolved to participant ids. */
+  text: string;
+  /** URLs expire in ten minutes. */
+  attachments?: {
+    /** A attachment identifier: `att_` followed by a ULID. */
+    attachment_id: string;
+    /** The name to show. Never trusted for its type. */
+    filename: string;
+    /** Sniffed from the bytes on upload, not taken from the client. */
+    mime_type: string;
+    /** Size in bytes. */
+    byte_size: number;
+    /** Lowercase hex digest. The store is content-addressed. */
+    sha256: string;
+    /** Pixels, for images and video. */
+    width?: number;
+    /** Pixels, for images and video. */
+    height?: number;
+    /** Milliseconds, for audio and video. */
+    duration_ms?: number;
+    /** What was said, for a voice note the server transcribed when it arrived (ADR 0054). Machine-heard: the person's words as best the server could make them out. */
+    transcript?: string;
+    /** The version of the room's file of this name that this one was made from (ADR 0099), from the post's `replaces`. Filled in by Chips; a value the sender writes is replaced. */
+    replaces?: string;
+    /** A signed URL, bound to the requesting token: fetch it with that token as the bearer, since the URL alone is refused. */
+    url: string;
+    /** Ten minutes from issue, by default (decision 10). */
+    url_expires_at: string;
+  }[];
+  /** Participant ids mentioned in the text. */
+  mentions?: string[];
+  /** The message this answers. */
+  reply_to?: string;
+  /** The message `reply_to` names, as the room reads it now (ADR 0219): who said it, when, its words and its files, and with a turn, when it is older than `context`, the lines said just before it. Put it in the turn ahead of the words; the SDK's `promptFor` does. Absent on a message that answers none, or one no longer in the room. */
+  replying_to?: {
+    /** Where in the log it happened. */
+    seq: number;
+    /** When. */
+    at: string;
+    kind: "said";
+    /** Who: the one who said it, came, went or took the new name; for the room's own lines, who retitled, archived or unarchived it. */
+    from: {
+      /** Their participant id, or `system`. */
+      id: string;
+      kind: "person" | "harness" | "agent" | "system";
+      /** What they go by now. */
+      name: string;
+      /** Their standing in this room, when they are in it (SEC-15). */
+      role?: "owner" | "member" | "guest";
+      /** A person's standing in the workspace (SEC-15): the plain form says it after the name, so a guest's line reads as a guest's. Absent for an agent or a harness. */
+      workspace_role?: "owner" | "admin" | "member" | "guest";
+    };
+    /** The message the reply answers: its `reply_to`. */
+    message_id: string;
+    /** On `said`: the words as they read now, so an edited message reads edited; a deleted one is not a line. Cut with an ellipsis when the one line is longer than the whole budget. */
+    text?: string;
+    /** On `said`: what a voice note said, as the server heard it (ADR 0054). */
+    transcript?: string;
+    /** On `said`: the names of the files it carried. */
+    files?: string[];
+    /** On `said`: the agents it was for (ADR 0081, ADR 0087), so a harness can leave out a line one of its agents already took a turn on. Absent on a message from before Chips said so. */
+    addressed_to?: string[];
+    /** On `said`: the guard held it (ADR 0081), so it was for nobody. */
+    held?: true;
+    /** On `renamed`, for a participant: the name they took. */
+    name?: string;
+    /** On `renamed`, for a participant: the name they went by until then. */
+    previous?: string;
+    /** On `renamed`, for the room: its new title. */
+    title?: string;
+    /** Its author changed its words since: `text` is how it reads now. */
+    edited?: true;
+    /** Taken back since it was answered: no words, no files, only who and when. */
+    deleted?: true;
+    /** Up to three lines said just before it, oldest first, so the turn has what it was about. Only with a turn, and only when the message is older than the lines `context` hands over. */
+    before?: {
+      /** Where in the log it happened. */
+      seq: number;
+      /** When. */
+      at: string;
+      /** `said`: a message, addressed to this harness or not. `joined` and `left`: somebody came into the room or went. `renamed`: somebody took a new name, or the room a new title. `archived` and `unarchived`: the room was put away or brought back. */
+      kind: "said" | "joined" | "left" | "renamed" | "archived" | "unarchived";
+      /** Who: the one who said it, came, went or took the new name; for the room's own lines, who retitled, archived or unarchived it. */
+      from: {
+        /** Their participant id, or `system`. */
+        id: string;
+        kind: "person" | "harness" | "agent" | "system";
+        /** What they go by now. */
+        name: string;
+        /** Their standing in this room, when they are in it (SEC-15). */
+        role?: "owner" | "member" | "guest";
+        /** A person's standing in the workspace (SEC-15): the plain form says it after the name, so a guest's line reads as a guest's. Absent for an agent or a harness. */
+        workspace_role?: "owner" | "admin" | "member" | "guest";
+      };
+      /** On `said`: the message. */
+      message_id?: string;
+      /** On `said`: the words as they read now, so an edited message reads edited; a deleted one is not a line. Cut with an ellipsis when the one line is longer than the whole budget. */
+      text?: string;
+      /** On `said`: what a voice note said, as the server heard it (ADR 0054). */
+      transcript?: string;
+      /** On `said`: the names of the files it carried. */
+      files?: string[];
+      /** On `said`: the agents it was for (ADR 0081, ADR 0087), so a harness can leave out a line one of its agents already took a turn on. Absent on a message from before Chips said so. */
+      addressed_to?: string[];
+      /** On `said`: the guard held it (ADR 0081), so it was for nobody. */
+      held?: true;
+      /** On `renamed`, for a participant: the name they took. */
+      name?: string;
+      /** On `renamed`, for a participant: the name they went by until then. */
+      previous?: string;
+      /** On `renamed`, for the room: its new title. */
+      title?: string;
+    }[];
+    /** Its files, as the message's own are sent: URLs expire in ten minutes. */
+    attachments?: {
+      /** A attachment identifier: `att_` followed by a ULID. */
+      attachment_id: string;
+      /** The name to show. Never trusted for its type. */
+      filename: string;
+      /** Sniffed from the bytes on upload, not taken from the client. */
+      mime_type: string;
+      /** Size in bytes. */
+      byte_size: number;
+      /** Lowercase hex digest. The store is content-addressed. */
+      sha256: string;
+      /** Pixels, for images and video. */
+      width?: number;
+      /** Pixels, for images and video. */
+      height?: number;
+      /** Milliseconds, for audio and video. */
+      duration_ms?: number;
+      /** What was said, for a voice note the server transcribed when it arrived (ADR 0054). Machine-heard: the person's words as best the server could make them out. */
+      transcript?: string;
+      /** The version of the room's file of this name that this one was made from (ADR 0099), from the post's `replaces`. Filled in by Chips; a value the sender writes is replaced. */
+      replaces?: string;
+      /** A signed URL, bound to the requesting token: fetch it with that token as the bearer, since the URL alone is refused. */
+      url: string;
+      /** Ten minutes from issue, by default (decision 10). */
+      url_expires_at: string;
+    }[];
+  };
+  /** The visit the sender meant, when they named one (ADR 0040). A harness that works by visits delivers to it rather than choosing, and says so rather than delivering elsewhere when it cannot. */
+  session_ref?: string;
+  /** The agents the message is for, as Chips decided them (ADR 0081, ADR 0087). Absent on a message from before Chips said so, which was for every agent in the space. */
+  addressed_to?: string[];
+  /** Who of this connection takes a turn: its own among `addressed_to` (ADR 0087). Each is one of its agents, or the harness's own id where the harness itself is the member addressed: a room asked of it from the +, until it claims the room. Never empty on a `message.new`, and always empty on a `message.overheard`. Sent only to a harness that declares `agents`; one that has not is told its agents are itself. */
+  for?: string[];
+  /** This connection's agents with a turn going in the room, other than the one who said it and those it is for (ADR 0106). Hand the words to each of those turns at its next step, as said to somebody else, and start no turn on them; post `message.heard` on the run once a turn has them, and the room shows it heard. A turn that ends first hears nothing, and is handed the words with its agent's next turn (ADR 0105). Absent when there are none. */
+  working_turns?: {
+    /** One of this connection's agents. */
+    agent_id: string;
+    /** Its turn going in the room. */
+    run_id: string;
+  }[];
+  /** The agents had sent each other more messages than Chips lets through without a person, or a person paused them, so Chips held this one from the agents it named (ADR 0097). The newest held message for each agent is handed over when a person acts. */
+  held?: true;
+}
+
+/** `run.requested` — A lane arrived from a lead, with the trail that led to it. */
+export interface RunRequested {
+  /** Protocol major version. */
+  v: 1;
+  type: "run.requested";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A lane identifier: `lane_` followed by a ULID. */
+  lane_id: string;
+  /** What is being asked. */
+  goal: string;
+  /** Bounds on how to do it. */
+  constraints?: string[];
+  /** When it is needed by. */
+  deadline?: string;
+  /** The person the work is ultimately for. */
+  on_behalf_of: string;
+  /** The lead that routed it. */
+  requested_by: string;
+  /** The harness this lane runs on, which the run in the envelope belongs to. A lead may name an ephemeral child, which Chips has minted by the time this arrives. */
+  specialist_id: string;
+  /** The agent of that harness that works the lane (ADR 0087): its one agent in the lane's room, the one the lead named, a lead's hand-off to one of its own, or a child minted for this lane. */
+  agent_id?: string;
+  /** How the work got here. Lanes deeper than three are flattened into steps, not rejected. */
+  trail: {
+    /** Who handled this hop. */
+    participant_id: string;
+    /** The run this hop belongs to. */
+    run_id?: string;
+    /** What was asked at this hop. */
+    goal?: string;
+  }[];
+  /** The level for this lane. */
+  autonomy: 0 | 1 | 2 | 3;
+  /** The lead spaces this lane is linked into, where its route card appears. */
+  link_to?: string[];
+  /** The message that caused the routing, quoted in the specialist's task card. */
+  origin?: string;
+  /** Anything the specialist needs. */
+  attachments?: {
+    /** A attachment identifier: `att_` followed by a ULID. */
+    attachment_id: string;
+    /** The name to show. Never trusted for its type. */
+    filename: string;
+    /** Sniffed from the bytes on upload, not taken from the client. */
+    mime_type: string;
+    /** Size in bytes. */
+    byte_size: number;
+    /** Lowercase hex digest. The store is content-addressed. */
+    sha256: string;
+    /** Pixels, for images and video. */
+    width?: number;
+    /** Pixels, for images and video. */
+    height?: number;
+    /** Milliseconds, for audio and video. */
+    duration_ms?: number;
+    /** What was said, for a voice note the server transcribed when it arrived (ADR 0054). Machine-heard: the person's words as best the server could make them out. */
+    transcript?: string;
+    /** The version of the room's file of this name that this one was made from (ADR 0099), from the post's `replaces`. Filled in by Chips; a value the sender writes is replaced. */
+    replaces?: string;
+    /** A signed URL, bound to the requesting token: fetch it with that token as the bearer, since the URL alone is refused. */
+    url: string;
+    /** Ten minutes from issue, by default (decision 10). */
+    url_expires_at: string;
+  }[];
+  /** What the lead calls the specialist on this lane, when that is not its participant name: a Space's name, a subagent's type. */
+  label?: string;
+}
+
+/** `approval.resolved` — A decision came back. More than yes or no: it carries a scope, optional edited input, and a reason. */
+export interface ApprovalResolved {
+  /** Protocol major version. */
+  v: 1;
+  type: "approval.resolved";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A approval identifier: `apr_` followed by a ULID. */
+  approval_id: string;
+  /** `expired` means nobody answered and the fallback applied. */
+  decision: "approved" | "edited" | "denied" | "expired";
+  /** How far the answer reaches. `always` becomes a policy rule. */
+  scope?: "once" | "session" | "always";
+  /** With `always`: the rule is the harness's in every space, not only this one (ADR 0239). An owner or an admin only. */
+  everywhere?: boolean;
+  /** The edited action input, when the decision is `edited`. */
+  updated_input?: unknown;
+  /** Why. The harness gets to read this. */
+  reason?: string;
+  /** The participant who answered, or `system` on expiry — a harness when it settles its own ask, answered in its own tools. Filled in by Chips from the credential that sent it; a value the sender writes is replaced. */
+  resolved_by: string;
+  /** When it was answered. Stamped by Chips. */
+  resolved_at: string;
+  /** True on the surfaces that did not answer first. First answer wins. */
+  resolved_elsewhere?: boolean;
+  /** Who could answer it, as ids, as they stood when it was decided. Written by Chips from the approval so that somebody named outside the room is sent the decision as well as the ask (ADR 0042); a value the sender writes is replaced. */
+  approvers?: string[];
+}
+
+/** `question.answered` — The chosen options or free text, or a note that the timeout passed. */
+export interface QuestionAnswered {
+  /** Protocol major version. */
+  v: 1;
+  type: "question.answered";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A question identifier: `qst_` followed by a ULID. */
+  ask_id: string;
+  /** One entry per question that was answered. */
+  answers: {
+    question_id: string;
+    /** The chosen option values. */
+    values: string[];
+    /** What the person typed instead. */
+    free_text?: string;
+  }[];
+  /** Who answered, or `system` on a timeout — a harness when it settles its own question, answered in its own tools. Filled in by Chips from the credential that sent it. */
+  answered_by: string;
+  /** When it was answered. Stamped by Chips. */
+  answered_at: string;
+  /** True when the default was taken rather than a choice. */
+  timed_out?: boolean;
+}
+
+/** `run.steer` — A mid-run instruction, with a disposition: steer, follow up, or interrupt. */
+export interface RunSteer {
+  /** Protocol major version. */
+  v: 1;
+  type: "run.steer";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** `steer` redirects, `followup` queues, `interrupt` stops what is happening now. */
+  mode: "steer" | "followup" | "interrupt";
+  /** The instruction. */
+  text: string;
+  /** Who said it. */
+  from: {
+    /** The stable id of the sender. */
+    participant_id: string;
+    /** Whether the sender is a person or an agent (ADR 0087); `harness` for a harness written before agents, and for any agent as a harness that has not declared `agents` is told it. */
+    kind: "person" | "harness" | "agent";
+    /** The name to show. */
+    display_name: string;
+    /** The sender's standing in this space. Multi-user is Chips' job, not the harness's. */
+    role: "owner" | "member" | "guest";
+    /** A person's standing in the workspace (SEC-15): what a model should weigh the words by, since a guest's read as the owner's otherwise. `promptFor` says it after the name. Absent for an agent or a harness, and from a Chips before it said. */
+    workspace_role?: "owner" | "admin" | "member" | "guest";
+  };
+}
+
+/** `run.pause` — Stop where you are and hold. Sent by a person, or by Chips at a budget or context ceiling. */
+export interface RunPause {
+  /** Protocol major version. */
+  v: 1;
+  type: "run.pause";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Why the run is pausing. */
+  reason?: string;
+  /** Who paused it, or `system`. Filled in by Chips from the credential that sent it. */
+  by: string;
+}
+
+/** `run.resume` — Carry on from where you paused. */
+export interface RunResume {
+  /** Protocol major version. */
+  v: 1;
+  type: "run.resume";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Who resumed it. Filled in by Chips from the credential that sent it. */
+  by: string;
+  /** For a run that was paused across processes. */
+  resume_token?: string;
+}
+
+/** `run.cancel` — Stop for good. The run ends as cancelled, and the audit log records who ended it. */
+export interface RunCancel {
+  /** Protocol major version. */
+  v: 1;
+  type: "run.cancel";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Why. */
+  reason?: string;
+  /** Who cancelled it, or `system`. Filled in by Chips from the credential that sent it. */
+  by: string;
+}
+
+/** `policy.updated` — The autonomy level or the rules changed. Takes effect on the next action, not retroactively. */
+export interface PolicyUpdated {
+  /** Protocol major version. */
+  v: 1;
+  type: "policy.updated";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A harness identifier: `hrn_` followed by a ULID. */
+  harness_id: string;
+  /** A harness's autonomy level and the rules that fill in the details. */
+  policy: {
+    /** 0 observe, 1 ask first, 2 ask when it matters, 3 autonomous and report back. Presets that expand to rules. */
+    autonomy: 0 | 1 | 2 | 3;
+    /** Evaluated in order; the workspace cap always wins. */
+    rules: {
+      /** A glob over action kinds, for example `payment.*`. */
+      match: string;
+      /** Extra conditions on the action's flags, and for a command, how its parts start. */
+      when?: {
+        external?: boolean;
+        irreversible?: boolean;
+        money_usd_over?: number;
+        risk?: "external" | "external_communication" | "irreversible" | "destructive" | "financial" | "credential" | "privacy" | "legal"[];
+        /** For an action that carries a command (ADR 0239): the words a part of it starts with. A command goes ahead on such rules only when every part starts with one that allows it. */
+        starts_with?: string[];
+      };
+      /** What to do when the rule matches. */
+      decision: "allow" | "ask" | "deny";
+      /** Who may answer, when the decision is `ask`. */
+      approvers?: string[];
+      /** Shown to the harness, and recorded in the audit log. */
+      reason?: string;
+      /** Turned off by a person (ADR 0195): kept in the list to turn back on, and skipped by the policy engine until then. */
+      off?: boolean;
+      /** Who made it by answering an ask with Always (ADR 0195). Filled in by Chips. */
+      made_by?: string;
+      /** When a person's answer made it (ADR 0195): Always, or This session. Filled in by Chips. A rule a person's answer made never allows an action that matters. */
+      made_at?: string;
+    }[];
+  };
+  /** The workspace cap. It always wins. */
+  workspace_max_autonomy: 0 | 1 | 2 | 3;
+  /** The harness's spending ceiling, in US dollars. Absent leaves it as it was; the harness's spend is what `usage` has added up. */
+  budget_usd?: number;
+  /** Who changed it, or `system` for an earned promotion. Filled in by Chips from the credential that sent it. */
+  changed_by: string;
+  /** Why it changed. */
+  reason?: string;
+}
+
+/** `budget.warning` — Eighty percent spent. At a hundred the run pauses rather than warning again; for a room's job, the room's agents pause. */
+export interface BudgetWarning {
+  /** Protocol major version. */
+  v: 1;
+  type: "budget.warning";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The ceiling and what was spent against it: the harness's budget, or for a job the room's ceiling and the job's spend. */
+  budget: {
+    /** The ceiling for this harness. */
+    limit_usd: number;
+    /** Spent so far, estimated. */
+    spent_usd: number;
+  };
+  /** Which ceiling was crossed, as a percentage. */
+  threshold: 80 | 100;
+  /** `warn` at eighty, `pause` at a hundred. */
+  action: "warn" | "pause";
+  /** Whose ceiling: the harness's own budget (absent says the same), or the job in the room named by `space_id` (ADR 0118). */
+  scope?: "harness" | "job";
+  /** For a job: where it began, as `context.spend.since_seq` says it. A later job in the room is a new allowance. */
+  since_seq?: number;
+}
+
+/** `lane.updated` — A lane you opened has news. Finishing and delivering are different states, and delivery travels with the lane. */
+export interface LaneUpdated {
+  /** Protocol major version. */
+  v: 1;
+  type: "lane.updated";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A lane identifier: `lane_` followed by a ULID. */
+  lane_id: string;
+  /** Where the specialist got to. */
+  state: "queued" | "running" | "waiting" | "completed" | "failed" | "cancelled";
+  /** A lane completes when the specialist posts; the person is told when the lead delivers. */
+  delivery: "pending" | "direct" | "queued_to_lead" | "delivered" | "failed";
+  /** The specialist's result, when there is one. */
+  summary?: string;
+  /** The lane's estimated cost, so the lead's panel can total the chain. Cost rolls up the trail; context does not. */
+  cost_usd?: number;
+  /** The files the specialist's answer carried, so an answer made of photos is an answer the lead has. Chips reads them off the lane run's own messages; URLs expire in ten minutes. */
+  attachments?: {
+    /** A attachment identifier: `att_` followed by a ULID. */
+    attachment_id: string;
+    /** The name to show. Never trusted for its type. */
+    filename: string;
+    /** Sniffed from the bytes on upload, not taken from the client. */
+    mime_type: string;
+    /** Size in bytes. */
+    byte_size: number;
+    /** Lowercase hex digest. The store is content-addressed. */
+    sha256: string;
+    /** Pixels, for images and video. */
+    width?: number;
+    /** Pixels, for images and video. */
+    height?: number;
+    /** Milliseconds, for audio and video. */
+    duration_ms?: number;
+    /** What was said, for a voice note the server transcribed when it arrived (ADR 0054). Machine-heard: the person's words as best the server could make them out. */
+    transcript?: string;
+    /** The version of the room's file of this name that this one was made from (ADR 0099), from the post's `replaces`. Filled in by Chips; a value the sender writes is replaced. */
+    replaces?: string;
+    /** A signed URL, bound to the requesting token: fetch it with that token as the bearer, since the URL alone is refused. */
+    url: string;
+    /** Ten minutes from issue, by default (decision 10). */
+    url_expires_at: string;
+  }[];
+}
+
+/** `feedback` — A reaction, or a note about what went wrong, on one of the harness's messages. */
+export interface Feedback {
+  /** Protocol major version. */
+  v: 1;
+  type: "feedback";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The message it is about: one a harness said, in the space the event names. */
+  message_id: string;
+  /** A light signal, or a written note. */
+  kind: "reaction" | "correction";
+  /** The emoji, when the kind is `reaction`. Required then. */
+  reaction?: string;
+  /** What went wrong, when the kind is `correction`. Required then. */
+  text?: string;
+  /** Who gave it. Filled in by Chips from the credential and the membership; a value the sender writes is replaced. */
+  from: {
+    /** The stable id of the sender. */
+    participant_id: string;
+    /** Whether the sender is a person or an agent (ADR 0087); `harness` for a harness written before agents, and for any agent as a harness that has not declared `agents` is told it. */
+    kind: "person" | "harness" | "agent";
+    /** The name to show. */
+    display_name: string;
+    /** The sender's standing in this space. Multi-user is Chips' job, not the harness's. */
+    role: "owner" | "member" | "guest";
+    /** A person's standing in the workspace (SEC-15): what a model should weigh the words by, since a guest's read as the owner's otherwise. `promptFor` says it after the name. Absent for an agent or a harness, and from a Chips before it said. */
+    workspace_role?: "owner" | "admin" | "member" | "guest";
+  };
+}
+
+/** `receipt` — What Chips did with a message sent mid-run: queued it, or steered with it. */
+export interface Receipt {
+  /** Protocol major version. */
+  v: 1;
+  type: "receipt";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A message identifier: `msg_` followed by a ULID. */
+  message_id: string;
+  /** Whether the harness will see it now or after the step. */
+  disposition: "queued" | "steered";
+}
+
+/** `space.created` — A space was opened: a direct message, a group, a channel or a thread. */
+export interface SpaceCreated {
+  /** Protocol major version. */
+  v: 1;
+  type: "space.created";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Mixed membership is the norm; the kind is about shape, not about who is in it. */
+  kind: "direct" | "group" | "channel" | "thread";
+  /** What to call it. Direct messages have none. */
+  title?: string;
+  /** The space this is a thread of (M5.4). A thread has no members of its own: whoever is in the parent is in the thread, and leaves it with the parent. */
+  parent_space_id?: string;
+  /** For a thread: the message in the parent it grew from, which is where it is drawn. */
+  root_message_id?: string;
+  /** What this space is in the adapter's own terms — a worktree path, the id of a project or an agent in the harness's own tree — prefixed by the harness. Unique in a workspace, so opening the same thing twice finds the space rather than making another (ADR 0024). */
+  external_key?: string;
+  /** The person this was opened on behalf of, when it was not they who opened it. A harness opens a space for its owner as it finds one (ADR 0024); without this they would not be sent the event that names it, and the space would arrive with no title. */
+  opened_for?: string;
+  /** The harness a person opened this room for, to make something of its own for it: an agent, a session, wherever it keeps such things. Only a person asks, only of a harness that declares `new_spaces`, and never in a thread or a room that already has a key. The harness is sent this event, and answers with `space.claimed`. */
+  asked_of?: string;
+  /** The other harnesses asked with `asked_of`, when a person picked several faces (ADR 0084, ADR 0087's addendum of 30 September). Each is sent this event and answers with a new agent in the room, in its own place; only `asked_of` names the room. */
+  also_asked_of?: string[];
+}
+
+/** `space.updated` — A space was retitled, closed or reopened — by a person in it, or by the harness that opened it — or made a harness's home. The apps call closing a space archiving it. */
+export interface SpaceUpdated {
+  /** Protocol major version. */
+  v: 1;
+  type: "space.updated";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The new title. A harness that learns a better name for a room it opened sends this; a person's rename holds over it afterwards. */
+  title?: string;
+  /** Closed takes the space off the list: the runs going in it are stopped and its agents are released, free to join another room (ADR 0087). Its history and its people stay, and it can be reopened, which brings back each agent that is still free. The apps say archived and unarchived. Whether a person or a harness set it last is kept, and a harness's listing of its spaces reports it as `moved_by` (ADR 0066). */
+  state?: "open" | "closed";
+  /** The harness's home: the room its lead speaks in, which is always there. Nobody archives or erases it; the apps do not offer either. Only the harness that opened the space sends this (ADR 0069). */
+  home?: boolean;
+}
+
+/** `space.claimed` — A harness took a room a person asked it for, under a key of its own: from here the room is the harness's, as if it had opened it. */
+export interface SpaceClaimed {
+  /** Protocol major version. */
+  v: 1;
+  type: "space.claimed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** What the room is in the harness's own terms, prefixed by the harness, as on a `space.created` it opened itself (ADR 0024). Unique in a workspace. Written by Chips from the key the harness gave its door. */
+  external_key: string;
+  /** What the harness calls it. Absent when it named nothing, or when a person had already named the room, whose word holds. */
+  title?: string;
+}
+
+/** `space.erased` — A space was erased from the server by a person: what was said in it, its files and its search entries are gone for everyone. Only this line stays, naming which and by whom. */
+export interface SpaceErased {
+  /** Protocol major version. */
+  v: 1;
+  type: "space.erased";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The space, and every thread of it, in that order. Each device forgets them. */
+  erased: string[];
+  /** What the room cost, per harness, so an erase takes the words and leaves the spend: a budget is not topped up by erasing where it went. Written by Chips. */
+  spent?: {
+    /** Whose account the room's cost was on. */
+    harness_id: string;
+    /** What the room had cost that harness, in US dollars. */
+    usd: number;
+  }[];
+}
+
+/** `membership.added` — A person or an agent joined a space. Shows as a muted centred line. */
+export interface MembershipAdded {
+  /** Protocol major version. */
+  v: 1;
+  type: "membership.added";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Who joined. */
+  participant_id: string;
+  /** A person or an agent (ADR 0087); `harness` for a harness in a room before the upgrade gave it an agent. */
+  participant_kind: "person" | "harness" | "agent";
+  /** Their standing here, which is what every `from` field reports. */
+  role?: "owner" | "member" | "guest";
+  /** Defaults to the event's own timestamp. */
+  joined_at?: string;
+  /** For an agent moved here from another room (ADR 0087): the room it left. Written by Chips. */
+  moved_from?: string;
+  /** For a fork's copy (ADR 0087, Fork): the `agent.fork` it answers, so the room shows the copy joining on the line that asked for it. Written by Chips. */
+  fork_of?: string;
+  /** For a new agent a person asked a harness for (ADR 0108): the `agent.asked` it answers, so the room shows it joining on the line that asked for it. Written by Chips. */
+  made_for?: string;
+  /** For a harness asked for this room from the + (ADR 0150): the first name its agent will have here, held for it until it claims the room or answers in it, and the name the room calls it by meanwhile. A person's device may propose one; Chips keeps it when nobody has it and picks one off its list otherwise. */
+  agent_name?: string;
+  /** For a person who came in by a space's invite link (ADR 0168): the link, so the room says they joined by it. The actor is whoever made the link, who put them here. Written by Chips. */
+  invite_id?: string;
+}
+
+/** `membership.removed` — A person or an agent left a space, or was removed from it. */
+export interface MembershipRemoved {
+  /** Protocol major version. */
+  v: 1;
+  type: "membership.removed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Who left. */
+  participant_id: string;
+  /** Who removed them, if not themselves. */
+  removed_by?: string;
+  /** For an agent (ADR 0087): why it left, as `agent.released` says. For a person, `person_removed`: they were removed from the workspace (ADR 0160); `person_left`: they deleted their account and left it (ADR 0243). Written by Chips; absent, a person took them out or they left the room. */
+  reason?: "archived" | "deleted" | "moved" | "agent_archived" | "removed" | "agent_deleted" | "person_removed" | "person_left";
+  /** For an agent moved away: the room it went to, so this room can say so. */
+  moved_to?: string;
+}
+
+/** `membership.replaced` — An agent took its harness's place in a room: what the harness said there shows as the agent's. */
+export interface MembershipReplaced {
+  /** Protocol major version. */
+  v: 1;
+  type: "membership.replaced";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The member it replaces: the harness, before agents. */
+  from: string;
+  /** The agent in the room from here. */
+  to: string;
+}
+
+/** `agent.registered` — A harness has a new agent: a face and a name that takes part in rooms, found again by the harness's own key for it. */
+export interface AgentRegistered {
+  /** Protocol major version. */
+  v: 1;
+  type: "agent.registered";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The agent. */
+  agent_id: string;
+  /** The harness it belongs to, which speaks for it. */
+  harness_id: string;
+  /** The harness's own name for it, unique among the harness's agents: the id of the thing the agent is, in the harness's own terms. The agent a harness has for a room with no key of its own is keyed by the harness's id, and the harness registers that id to name it: as its Main agent, say (ADR 0183). */
+  key: string;
+  /** What it is called, and so its @handle. */
+  name: string;
+  /** The harness's Main agent (ADR 0087): the one it leads with, in a room of its own. A harness has one at most. */
+  lead?: boolean;
+  /** The agent this one is a copy of, when it was forked. */
+  forked_from?: string;
+}
+
+/** `agent.updated` — An agent was renamed, archived or brought back in its harness, made or no longer its harness's Main agent, or renamed or given a face by a person. What it said stays its, under the new name and face. */
+export interface AgentUpdated {
+  /** Protocol major version. */
+  v: 1;
+  type: "agent.updated";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The agent. */
+  agent_id: string;
+  /** What it is called from here: nobody else's in the workspace, case and spaces aside, so it may be numbered, `Scout 2` (ADR 0091). With a person as the actor, a person named it, and its harness no longer renames it. */
+  name?: string;
+  /** `archived` when the thing it is was put away in its harness (ADR 0087, rule 9), or a person archived it (ADR 0095); `active` when it came back. With a person as the actor, its harness archives or restores its side. */
+  state?: "active" | "archived";
+  /** The face a person chose for it (ADR 0089): a mark from Chips' library and the index of the ground it sits on, one for everybody in the workspace. `null` when the choice was taken back and it wears its initials again. Written by Chips for a person; a harness does not send it. */
+  face?: {
+    icon: string;
+    ground: number;
+    /** One or two letters, or an emoji or two, the face wears on its ground in place of a mark (ADR 0139); the mark is empty beside them. Absent on a face that is a mark, or only a colour. */
+    letters?: string;
+  } | null;
+  /** Whether it is its harness's Main agent from here (ADR 0183): `true` when the harness registered it as Main, `false` when its default agent took Main from it. A harness has one at most. */
+  lead?: boolean;
+}
+
+/** `agent.deleted` — A person deleted an agent: it is gone from Chips for everybody, and its harness deletes its own side. What it said stays, under its name. */
+export interface AgentDeleted {
+  /** Protocol major version. */
+  v: 1;
+  type: "agent.deleted";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The agent deleted. */
+  agent_id: string;
+  /** The harness it belonged to, which deletes its own side. */
+  harness_id: string;
+  /** The harness's own key for it, as `agent.registered` gave it: refused from here. */
+  key: string;
+  /** What it was called when it was deleted, so the audit needs no lookup. */
+  name: string;
+  /** The person who deleted it. */
+  by: string;
+}
+
+/** `agent.lock_set` — An agent's changes were locked, or let go: while locked, no person renames, archives or deletes it. */
+export interface AgentLockSet {
+  /** Protocol major version. */
+  v: 1;
+  type: "agent.lock_set";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The agent whose changes were locked or let go. */
+  agent_id: string;
+  /** Whether the agent's changes are locked now. `false` is how every agent starts, and lets them go again. */
+  locked: boolean;
+}
+
+/** `agent.attached` — An agent was put in a room: added, moved in, or brought back. Its harness is handed the room's last lines with it. */
+export interface AgentAttached {
+  /** Protocol major version. */
+  v: 1;
+  type: "agent.attached";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The agent, in the room this event's `space_id` names. */
+  agent_id: string;
+  /** Who put it there: a person, its harness, or Chips (`system`). */
+  by?: string;
+  /** The room it left for this one, when moved. */
+  moved_from?: string;
+  /** The `agent.fork` this copy answers, when it is a fork's copy (ADR 0087, Fork). */
+  fork_of?: string;
+  /** The `agent.asked` this new agent answers, when a person asked for it (ADR 0108). */
+  made_for?: string;
+  /** The room's last lines before the agent joined, within the budget its harness gave in `hello` (ADR 0088, point 5). Added as it is sent to the harness; the log does not keep it. */
+  catch_up?: {
+    /** Oldest first, the newest that fit the budget. */
+    lines: {
+      /** Where in the log it happened. */
+      seq: number;
+      /** When. */
+      at: string;
+      /** `said`: a message, addressed to this harness or not. `joined` and `left`: somebody came into the room or went. `renamed`: somebody took a new name, or the room a new title. `archived` and `unarchived`: the room was put away or brought back. */
+      kind: "said" | "joined" | "left" | "renamed" | "archived" | "unarchived";
+      /** Who: the one who said it, came, went or took the new name; for the room's own lines, who retitled, archived or unarchived it. */
+      from: {
+        /** Their participant id, or `system`. */
+        id: string;
+        kind: "person" | "harness" | "agent" | "system";
+        /** What they go by now. */
+        name: string;
+        /** Their standing in this room, when they are in it (SEC-15). */
+        role?: "owner" | "member" | "guest";
+        /** A person's standing in the workspace (SEC-15): the plain form says it after the name, so a guest's line reads as a guest's. Absent for an agent or a harness. */
+        workspace_role?: "owner" | "admin" | "member" | "guest";
+      };
+      /** On `said`: the message. */
+      message_id?: string;
+      /** On `said`: the words as they read now, so an edited message reads edited; a deleted one is not a line. Cut with an ellipsis when the one line is longer than the whole budget. */
+      text?: string;
+      /** On `said`: what a voice note said, as the server heard it (ADR 0054). */
+      transcript?: string;
+      /** On `said`: the names of the files it carried. */
+      files?: string[];
+      /** On `said`: the agents it was for (ADR 0081, ADR 0087), so a harness can leave out a line one of its agents already took a turn on. Absent on a message from before Chips said so. */
+      addressed_to?: string[];
+      /** On `said`: the guard held it (ADR 0081), so it was for nobody. */
+      held?: true;
+      /** On `renamed`, for a participant: the name they took. */
+      name?: string;
+      /** On `renamed`, for a participant: the name they went by until then. */
+      previous?: string;
+      /** On `renamed`, for the room: its new title. */
+      title?: string;
+    }[];
+    /** Where they start: after this `seq`. With a message, where the turn that said the harness's own last message in the room began (ADR 0105), else its joining; from the pull route, 0. */
+    since_seq: number;
+    /** Whether older lines after `since_seq` were left out to fit the budget. */
+    truncated: boolean;
+    /** A cursor: `GET /v1/spaces/:id/context?before=` this reads what came before these lines. */
+    before: number;
+    /** The room's files at their current version, newest first, the 20 newest (ADR 0099): with a message, as of it, its own files included; from the pull route, as of now. Each with a URL for this harness. Absent from a Chips before files, and when the room has none. */
+    files?: {
+      /** The file's name, which its versions share. */
+      name: string;
+      /** Which version this is: 1 for the first, counting each change of its bytes. */
+      version: number;
+      /** The attachment that is this version: what a post names in `replaces` when it changes it. */
+      attachment_id: string;
+      /** Lowercase hex digest of this version's bytes. */
+      sha256: string;
+      /** Size in bytes. */
+      byte_size: number;
+      /** Sniffed from the bytes on upload. */
+      mime_type: string;
+      /** Who posted this version, as a line's `from` says it. */
+      by: {
+        /** Their participant id. */
+        id: string;
+        kind: "person" | "harness" | "agent" | "system";
+        /** What they go by now. */
+        name: string;
+      };
+      /** When this version was posted. */
+      at: string;
+      /** The message that posted this version. */
+      message_id?: string;
+      /** Pixels, for a photo or a video. */
+      width?: number;
+      /** Pixels, for a photo or a video. */
+      height?: number;
+      /** Milliseconds, for a sound or a video. */
+      duration_ms?: number;
+      /** In one name's versions (`?name=`): the version this one was made from, as its post said (`message.post.replaces`). Absent where the post said nothing, or named no version of this file. */
+      replaces?: string;
+      /** For a harness: a signed URL for this version, bound to its token, as a message's attachments are. Absent for a person, who fetches it by id. */
+      url?: string;
+      /** When `url` stops working. */
+      url_expires_at?: string;
+    }[];
+    /** What the room's job has spent, as of the message (for one Chips held, as of its hand-over, when a new job began), against what the room allows a job (ADR 0117). With a message only; the room note says it in words. Absent from a Chips before it. */
+    spend?: {
+      /** What the room allows a job, in US dollars: its own ceiling, or the default (3) when nobody has set one. */
+      ceiling_usd: number;
+      /** What the room's runs reported costing since the job began, in US dollars, every harness's together. */
+      spent_usd: number;
+      /** Where the job began: the `seq` of the last thing a person did in the room, or of the last brief handed into it, whichever is later; 0 when neither has happened. */
+      since_seq: number;
+      /** How many of the job's runs reported no cost, and so count nothing. */
+      uncounted_runs: number;
+    };
+  };
+}
+
+/** `agent.released` — An agent was taken out of its room and is free: by an archive, a delete, a move, its harness, or a person. */
+export interface AgentReleased {
+  /** Protocol major version. */
+  v: 1;
+  type: "agent.released";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The agent, out of the room this event's `space_id` names. */
+  agent_id: string;
+  /** Who did it: a person, its harness, or Chips (`system`). */
+  by?: string;
+  /** `archived`: its room was archived. `deleted`: its room was deleted. `moved`: it was moved to another room. `agent_archived`: it was archived, in its harness or by a person (ADR 0095). `removed`: a person took it out. `agent_deleted`: a person deleted it (ADR 0095). */
+  reason: "archived" | "deleted" | "moved" | "agent_archived" | "removed" | "agent_deleted";
+  /** The room it went to, when moved. */
+  moved_to?: string;
+  /** Written before ADR 0095: the room was deleted and the person asked for the agent to go in its harness too (ADR 0087, rule 5). Since ADR 0095 Chips writes `agent.deleted` for that instead; a log may still hold this. */
+  delete?: true;
+}
+
+/** `agent.fork` — A person asked an agent's harness for a copy of it in this room. The copy remembers everything up to now; after that, the two remember separately. */
+export interface AgentFork {
+  /** Protocol major version. */
+  v: 1;
+  type: "agent.fork";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The agent to copy. It stays where it is; the copy is for the room this event's `space_id` names. */
+  agent_id: string;
+  /** The person who asked. */
+  by: string;
+}
+
+/** `agent.asked` — A person asked a harness for a new agent in this room. It starts with the room's last lines, and nothing from elsewhere. */
+export interface AgentAsked {
+  /** Protocol major version. */
+  v: 1;
+  type: "agent.asked";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The harness asked. It makes the agent, and registers it for the room this event's `space_id` names. */
+  harness_id: string;
+  /** What the new agent is to be called: the person's word, or else the next name of its harness's that nobody here answers to. Chips numbers it, as any other, if the name is taken by the time it is registered. */
+  name: string;
+  /** The person who asked. */
+  by: string;
+}
+
+/** `message.held` — An agent in no room said something: it is held, and posted in the next room the agent joins. */
+export interface MessageHeld {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.held";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Who said it. */
+  agent_id: string;
+  /** Markdown, as the harness sent it. */
+  text: string;
+  /** What it attached, as the upload described them. */
+  attachments?: {
+    /** A attachment identifier: `att_` followed by a ULID. */
+    attachment_id: string;
+    /** The name to show. Never trusted for its type. */
+    filename: string;
+    /** Sniffed from the bytes on upload, not taken from the client. */
+    mime_type: string;
+    /** Size in bytes. */
+    byte_size: number;
+    /** Lowercase hex digest. The store is content-addressed. */
+    sha256: string;
+    /** Pixels, for images and video. */
+    width?: number;
+    /** Pixels, for images and video. */
+    height?: number;
+    /** Milliseconds, for audio and video. */
+    duration_ms?: number;
+    /** What was said, for a voice note the server transcribed when it arrived (ADR 0054). Machine-heard: the person's words as best the server could make them out. */
+    transcript?: string;
+    /** The version of the room's file of this name that this one was made from (ADR 0099), from the post's `replaces`. Filled in by Chips; a value the sender writes is replaced. */
+    replaces?: string;
+  }[];
+}
+
+/** `exchange.set` — A person paused the agents in a room, or let them carry on; or Chips paused them at the room's spend ceiling. */
+export interface ExchangeSet {
+  /** Protocol major version. */
+  v: 1;
+  type: "exchange.set";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** `paused`: their messages to each other are held. `going`: they carry on. */
+  state: "paused" | "going";
+  /** Why Chips paused them: `spend`, the room's job reached its ceiling (ADR 0118). Absent when a person did. */
+  why?: "spend";
+  /** For `why: spend`: what the job had spent, against what the room allows a job. */
+  spend?: {
+    /** What the room allows a job, in US dollars: its own ceiling, or the default (3) when nobody has set one. */
+    ceiling_usd: number;
+    /** What the room's runs reported costing since the job began, in US dollars, every harness's together. */
+    spent_usd: number;
+    /** Where the job began: the `seq` of the last thing a person did in the room, or of the last brief handed into it, whichever is later; 0 when neither has happened. */
+    since_seq: number;
+    /** How many of the job's runs reported no cost, and so count nothing. */
+    uncounted_runs: number;
+  };
+}
+
+/** `message.handed` — A held message was handed to an agent it was for, once a person acted; or one that was nobody's turn, to the room's lead. */
+export interface MessageHanded {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.handed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The message, as `message.new` named it. */
+  message_id: string;
+  /** Who it is handed to. */
+  agent_id: string;
+  /** Handed to the room's lead because it was nobody's turn and the room went still (ADR 0104), rather than held by the referee. */
+  lead?: true;
+}
+
+/** `space.lead_set` — A room's lead was chosen, or taken away. */
+export interface SpaceLeadSet {
+  /** Protocol major version. */
+  v: 1;
+  type: "space.lead_set";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The agent that leads the room now, or `null` when nobody does. */
+  agent_id: string | null;
+}
+
+/** `space.spend_ceiling_set` — What a room allows a job to spend was set, or set back to the default. */
+export interface SpaceSpendCeilingSet {
+  /** Protocol major version. */
+  v: 1;
+  type: "space.spend_ceiling_set";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** What the room allows a job now, in US dollars, from 0.25 to 100 in steps of 0.25; `null` for the default (3). */
+  usd: unknown;
+}
+
+/** `space.lock_set` — A room's changes were locked, or let go: while locked, no person renames, archives or deletes it. */
+export interface SpaceLockSet {
+  /** Protocol major version. */
+  v: 1;
+  type: "space.lock_set";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Whether the room's changes are locked now. `false` is how every room starts, and lets them go again. */
+  locked: boolean;
+}
+
+/** `turn.passed` — An agent answered that it had nothing to say: nothing is shown or handed on. */
+export interface TurnPassed {
+  /** Protocol major version. */
+  v: 1;
+  type: "turn.passed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The message it was answering, when its post said. */
+  reply_to?: string;
+}
+
+/** `context.compacted` — An agent's context compacted, as its harness said: one quiet line in its room. */
+export interface ContextCompacted {
+  /** Protocol major version. */
+  v: 1;
+  type: "context.compacted";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The tokens it held before. */
+  from: number;
+  /** The tokens it held after. */
+  to: number;
+  /** Its model's context window, in tokens. */
+  window: number;
+  /** `asked`: a person asked. `itself`: at its limit, or full. */
+  by: "asked" | "itself";
+}
+
+/** `attachment.fetched` — A harness downloaded an attachment. Every fetch is an audit event: “Scout read IMG_2210.jpg”. */
+export interface AttachmentFetched {
+  /** Protocol major version. */
+  v: 1;
+  type: "attachment.fetched";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A attachment identifier: `att_` followed by a ULID. */
+  attachment_id: string;
+  /** What the file was called when it was sent. */
+  filename: string;
+  /** The harness that fetched it. Recorded by Chips. */
+  by: string;
+}
+
+/** `project.changed` — Somebody's push moved the room's project forward: who, which commits, and the files they changed. */
+export interface ProjectChanged {
+  /** Protocol major version. */
+  v: 1;
+  type: "project.changed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Who pushed: the agent a harness named, or the person. Recorded by Chips. */
+  by: string;
+  /** Where `main` was, or `null` for the project's first push. */
+  before: string | null;
+  /** Where `main` is now. */
+  after: string;
+  /** How many commits the push added to `main`. */
+  commits: number;
+  /** The first line of the newest commit's message. */
+  message: string;
+  /** What changed between `before` and `after`, in path order. */
+  files: {
+    /** Its path in the project, with `/` between folders. */
+    path: string;
+    /** Lines added; `null` for a binary file. */
+    added: number | null;
+    /** Lines removed; `null` for a binary file. */
+    removed: number | null;
+  }[];
+  /** How many more files changed than are named. */
+  more_files?: number;
+  /** How many files `main` has now, for the room sheet's Project tile (ADR 0222). */
+  file_count?: number;
+  /** The change this one takes back, when it is a person's Undo, or Put it back's Undo of an Undo (ADR 0222). */
+  undoes?: string;
+}
+
+/** `person.joined` — A person joined the workspace: by an invite, or as its first person. Their role starts here. */
+export interface PersonJoined {
+  /** Protocol major version. */
+  v: 1;
+  type: "person.joined";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Who joined. */
+  participant_id: string;
+  /** Their name, so a screen needs no lookup. */
+  display_name: string;
+  /** Owner, admin, member or guest of the workspace: what a person may do here. */
+  role: "owner" | "admin" | "member" | "guest";
+  /** The invite they redeemed, when they came by one. Never the invite itself. */
+  invite_id?: string;
+  /** Who issued that invite. */
+  invited_by?: string;
+}
+
+/** `person.renamed` — A person changed the name they go by. What they said stays theirs, under the new name; an @ of the old one reaches nobody. */
+export interface PersonRenamed {
+  /** Protocol major version. */
+  v: 1;
+  type: "person.renamed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Who. */
+  participant_id: string;
+  /** What they go by from here. */
+  display_name: string;
+  /** What they went by until now. */
+  previous_name: string;
+}
+
+/** `person.face_set` — A person chose the face they wear beside their name, or went back to their initials. Not sent to a harness. */
+export interface PersonFaceSet {
+  /** Protocol major version. */
+  v: 1;
+  type: "person.face_set";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Who: a person chooses only their own face. */
+  participant_id: string;
+  /** The face they chose: a mark from Chips' library or one or two letters, on the index of a ground. `null` when they took it back and wear their initials again. */
+  face: {
+    icon: string;
+    ground: number;
+    /** One or two letters, or an emoji or two, the face wears on its ground in place of a mark (ADR 0139); the mark is empty beside them. Absent on a face that is a mark, or only a colour. */
+    letters?: string;
+  } | null;
+}
+
+/** `role.changed` — An owner or admin changed a person's role in the workspace. */
+export interface RoleChanged {
+  /** Protocol major version. */
+  v: 1;
+  type: "role.changed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Whose role changed. */
+  participant_id: string;
+  /** What it is now. */
+  role: "owner" | "admin" | "member" | "guest";
+  /** Why, for the audit. */
+  reason?: string;
+}
+
+/** `harness.transferred` — A harness was handed to another person, who is accountable for it from here: its approvals default to them, and its tokens are theirs. */
+export interface HarnessTransferred {
+  /** Protocol major version. */
+  v: 1;
+  type: "harness.transferred";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The harness handed over. */
+  harness_id: string;
+  /** Who owned it until now. */
+  from_owner_id: string;
+  /** Who owns it from here. */
+  to_owner_id: string;
+  /** Why, for the audit. */
+  reason?: string;
+}
+
+/** `harness.removed` — A harness was removed from the workspace by a person: its tokens are withdrawn, and it can no longer connect, be added to a room or be asked for one. What it said stays, under its name. */
+export interface HarnessRemoved {
+  /** Protocol major version. */
+  v: 1;
+  type: "harness.removed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The harness removed. */
+  harness_id: string;
+  /** What it was called when it was removed, so the audit needs no lookup. */
+  display_name: string;
+  /** The rooms that were its homes (ADR 0069), which are not homes from here: they can be archived or deleted like any other room. Written by Chips. */
+  homes?: string[];
+  /** Why, for the audit. */
+  reason?: string;
+}
+
+/** `person.removed` — A person was removed from the workspace, or deleted their account: signed out everywhere, out of every room, and the harnesses they owned handed on. What they said stays, under their name. */
+export interface PersonRemoved {
+  /** Protocol major version. */
+  v: 1;
+  type: "person.removed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Who was removed. */
+  participant_id: string;
+  /** What they were called when they were removed, so the audit needs no lookup. */
+  display_name: string;
+  /** The owner or admin who removed them, or they themselves when they deleted their account (ADR 0243). */
+  removed_by: string;
+  /** The rooms they were taken out of, each with its own `membership.removed`. */
+  spaces?: string[];
+  /** The harnesses they owned, each handed on by `harness.transferred`: to `removed_by`, or, for an account deleted, to an owner. */
+  harnesses?: string[];
+}
+
+/** `join.allowed` — A person let a harness or a device in by a join request, with what they allowed it to do. */
+export interface JoinAllowed {
+  /** Protocol major version. */
+  v: 1;
+  type: "join.allowed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The request. */
+  request_id: string;
+  /** A harness asking for a key; a device asking to be paired; a person joining by an invite, or a device pairing by a code, that waits for whoever handed it out (ADR 0232). */
+  kind: "harness" | "device" | "invite" | "pairing";
+  /** Who started it: the requester, with a code to compare, or a person, with a link that is allowed already. */
+  started_by: "requester" | "person";
+  /** What the requester called itself. */
+  name?: string;
+  /** Its software, as it said. */
+  software?: string;
+  /** Its machine, as it said. */
+  machine?: string;
+  /** The address it asked from. */
+  from_addr?: string;
+  /** Who decided: allowed it, refused it, or made the link. */
+  by: string;
+  /** What the harness may do: what was granted, which may be less than it asked. */
+  capabilities: string[];
+  /** The harness made, when a link was redeemed. A code allowed makes it at its poll. */
+  harness_id?: string;
+  /** The device paired, when it was a link's. */
+  device_id?: string;
+  /** Whom a device is paired as, when an owner chose somebody already here whose phone is new (ADR 0206). */
+  pair_as?: string;
+}
+
+/** `join.denied` — A person refused a join request, or withdrew a link they had made. */
+export interface JoinDenied {
+  /** Protocol major version. */
+  v: 1;
+  type: "join.denied";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The request. */
+  request_id: string;
+  /** A harness asking for a key; a device asking to be paired; a person joining by an invite, or a device pairing by a code, that waits for whoever handed it out (ADR 0232). */
+  kind: "harness" | "device" | "invite" | "pairing";
+  /** Who started it: the requester, with a code to compare, or a person, with a link that is allowed already. */
+  started_by: "requester" | "person";
+  /** What the requester called itself. */
+  name?: string;
+  /** Its software, as it said. */
+  software?: string;
+  /** Its machine, as it said. */
+  machine?: string;
+  /** The address it asked from. */
+  from_addr?: string;
+  /** Who decided: allowed it, refused it, or made the link. */
+  by: string;
+}
+
+/** `message.edited` — A message's author changed its words. The log keeps both; the room shows the latest, marked edited. */
+export interface MessageEdited {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.edited";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The message, which must be the sender's own. */
+  message_id: string;
+  /** The new text, Markdown as before. */
+  text: string;
+}
+
+/** `message.deleted` — A message was taken back: by its author, the space's owner, or an owner or admin of the workspace. The room shows a tombstone; the log keeps the words. */
+export interface MessageDeleted {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.deleted";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A message identifier: `msg_` followed by a ULID. */
+  message_id: string;
+  /** Why, for the audit. */
+  reason?: string;
+}
+
+/** `message.hidden` — A person deleted a message for themselves (ADR 0167). It leaves their own screens, on every device of theirs; nobody else's room changes, and only they are sent the event. */
+export interface MessageHidden {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.hidden";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Any message in the space: the person's own or anyone's. */
+  message_id: string;
+}
+
+/** `message.shown` — A person took back their own deletion of a message (ADR 0167): Undo. The message is on their screens again. Only they are sent the event. */
+export interface MessageShown {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.shown";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A message identifier: `msg_` followed by a ULID. */
+  message_id: string;
+}
+
+/** `message.pinned` — A message was pinned to the top of its space, by somebody in it who is not a guest. */
+export interface MessagePinned {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.pinned";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A message identifier: `msg_` followed by a ULID. */
+  message_id: string;
+}
+
+/** `message.unpinned` — A pinned message was let go. */
+export interface MessageUnpinned {
+  /** Protocol major version. */
+  v: 1;
+  type: "message.unpinned";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A message identifier: `msg_` followed by a ULID. */
+  message_id: string;
+}
+
+/** `approval.routed` — A pending approval handed to somebody else to answer (M5.5): a teammate, a role, or the lane's lead. Chips resolves `to` to ids, as it does on the request. */
+export interface ApprovalRouted {
+  /** Protocol major version. */
+  v: 1;
+  type: "approval.routed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** A approval identifier: `apr_` followed by a ULID. */
+  approval_id: string;
+  /** Who should answer, as the router asks it: `owner`, `any`, `role:<name>`, `lead`, or a person id — the same words as `approvers` on the request. */
+  to: string[];
+  /** Who may answer now, as ids. Filled in by Chips from `to`; a value the sender writes is replaced. */
+  approvers?: string[];
+  /** What the ask is, written by Chips from the approval. Somebody handed an ask in a room they are not in never saw the request that raised it (ADR 0042), and this is what their card is drawn from; whoever is in the room has the request itself and ignores this. */
+  ask?: {
+    /** The harness that asked. */
+    harness_id: string;
+    /** The action as the harness proposed it. */
+    action: {
+      kind: string;
+    };
+    /** The risk classes it declared. */
+    risk?: string[];
+    /** When it expires, if it does. */
+    expires_at?: string;
+  };
+  /** Why it was handed on, for the card and the audit. */
+  reason?: string;
+  /** Who handed it on. Filled in by Chips from the credential. */
+  routed_by?: string;
+  /** When. Filled in by Chips from its clock. */
+  routed_at?: string;
+}
+
+/** `attachment.limits_set` — An owner or an admin capped how big a photo, a video or a file may be here (ADR 0047). Everyone's, and the server refuses an upload over it. */
+export interface AttachmentLimitsSet {
+  /** Protocol major version. */
+  v: 1;
+  type: "attachment.limits_set";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** The most a photo may be, in bytes. `null` leaves it to the server's own limit. */
+  image_bytes: number | null;
+  /** The most a video may be, in bytes, or `null`. */
+  video_bytes: number | null;
+  /** The most anything else may be — a document, an archive, a voice note — or `null`. */
+  file_bytes: number | null;
+}
+
+/** `exchange.limits_set` — An owner or an admin set when Chips tells the agents in any room to stop, when it holds their messages to each other, and whether agents going in circles are told to stop then (ADR 0187). Everyone's, in every room. */
+export interface ExchangeLimitsSet {
+  /** Protocol major version. */
+  v: 1;
+  type: "exchange.limits_set";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** After how many messages between agents, with nobody acting, Chips tells them to stop and tells the room's people. `null`: never, by count. Smaller than `hold` when both are set. */
+  stop: number | null;
+  /** After how many Chips holds their messages to each other until a person acts. `null`: never, by count; a pause still holds them. */
+  hold: number | null;
+  /** Whether agents going in circles (the same two or three taking turns and saying again what they said) are told to stop then, whatever the count. */
+  circles: boolean;
+}
+
+/** `workspace.renamed` — An owner named the workspace again. Every device connected changes its name at once; one that connects later is told by the hello. */
+export interface WorkspaceRenamed {
+  /** Protocol major version. */
+  v: 1;
+  type: "workspace.renamed";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** What the workspace is called from here. */
+  name: string;
+  /** What it was called until now. */
+  previous_name: string;
+}
+
+/** `relay.set` — An owner turned the server's relay off or on. Off, devices away from the server's own network cannot connect until they go direct; every device connected is told first. */
+export interface RelaySet {
+  /** Protocol major version. */
+  v: 1;
+  type: "relay.set";
+  /** The event's own id. Stable across a retry of the same event. */
+  id: string;
+  /** When it happened, by Chips' clock. Stamped on the way in; a value the sender writes is replaced. */
+  ts: string;
+  /** A workspace identifier: `ws_` followed by a ULID. */
+  workspace_id: string;
+  /** The space, when the event belongs to one. */
+  space_id?: string;
+  /** The run, when the event belongs to one. */
+  run_id?: string;
+  /** Assigned by the server on append, monotonic per workspace. Absent on the way in. */
+  seq?: number;
+  /** Required on every client-originated write. Sending the same key twice is a no-op. */
+  idempotency_key?: string;
+  /** The participant an event is attributed to. */
+  actor: {
+    /** Whether a person, a harness, one of a harness's agents or Chips itself acted. */
+    kind: "person" | "harness" | "agent" | "system";
+    /** The participant id, or `system` for Chips. */
+    id: string;
+    /** For an agent: the harness it speaks through, whose budget and runs are the agent's (ADR 0087). Filled in by Chips. */
+    harness_id?: string;
+  };
+  /** Whether the server dials its relay from now. */
+  on: boolean;
+}
+
+/** Any event a harness sends to Chips. */
+export type HarnessToChipsEvent =
+  | SessionStarted
+  | SessionEnded
+  | SessionRenamed
+  | RunStarted
+  | RunStatus
+  | RunPlan
+  | StepLog
+  | MessagePost
+  | MessageHeard
+  | ApprovalRequest
+  | QuestionAsk
+  | ArtifactCreate
+  | Checkpoint
+  | Handoff
+  | Task
+  | Usage
+  | ContextUsage
+  | ApprovalExecuted
+  | RunCompleted
+  | RunFailed;
+
+/** Any event Chips sends to a harness. */
+export type ChipsToHarnessEvent =
+  | Hello
+  | MessageNew
+  | MessageOverheard
+  | RunRequested
+  | ApprovalResolved
+  | QuestionAnswered
+  | RunSteer
+  | RunPause
+  | RunResume
+  | RunCancel
+  | PolicyUpdated
+  | BudgetWarning
+  | LaneUpdated
+  | Feedback
+  | Receipt;
+
+/** Any Agent Connect event. */
+export type AnyEvent = HarnessToChipsEvent | ChipsToHarnessEvent;