@claudexor/cli 3.1.2 → 3.2.0

package/dist/control-services.d.ts

@@ -1,54 +1,151 @@
 import { type OperatorDecisionRecord, JournalManager, InteractionRegistry, ProjectPartitions, ProjectStore, ResourceStore, QuotaRegistry } from "@claudexor/daemon";
 import { listTrustService, updateTrustService } from "./trust-services.js";
-import { type ResourceAttachmentRef } from "@claudexor/schema";
+import { type ResourceAttachmentRef, type ControlRunStartRequest } from "@claudexor/schema";
 import { AuthReadinessService } from "@claudexor/gateway";
+import { type HarnessListInput } from "./accounts-services.js";
 import { createSetupJobManager } from "./setup-jobs.js";
 import { SetupJobStore } from "./setup-job-store.js";
 import { SetupLifecycleBinding } from "./setup-lifecycle-binding.js";
 import { type ThreadApplyOptions } from "./thread-delivery.js";
 type SetupJobManager = ReturnType<typeof createSetupJobManager>;
 type SetupBinding = SetupLifecycleBinding<SetupJobStore, SetupJobManager>;
-type HarnessListInput = {
-    fresh?: boolean;
-    includeFakes?: boolean;
-    harnessIds?: string[];
-};
 export declare function controlServices(interactions: InteractionRegistry, projects: () => ProjectStore, threads: ProjectPartitions, setupBinding: SetupBinding, journalManager: JournalManager, authReadiness: AuthReadinessService, resources: ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs: () => Promise<Array<{
     runId?: string;
     state: string;
     finishedAt?: string;
     params?: unknown;
 }>>): {
-    preflightRunRequirements: (request: import("@claudexor/schema").ControlRunStartRequest) => Promise<void>;
+    listDirectory?: (path?: string) => Promise<import("@claudexor/schema").ControlDirectoryListing>;
+    fetchProjectFile?: (projectId: string, path: string) => Promise<import("./remote-filesystem.js").ScopedProjectFile>;
+    threadDetail: (id: string) => Promise<{
+        thread: unknown;
+        sessions: unknown[];
+        turns: unknown[];
+    }>;
+    createThreadTurn: (id: string, prompt: string, options: {
+        kind?: unknown;
+        parentRunId?: string | null;
+        planRunId?: string | null;
+        planHash?: string | null;
+        planOverridden?: boolean;
+        attachments?: ResourceAttachmentRef[];
+        idempotency?: {
+            key: string;
+            client: string;
+            request: unknown;
+        };
+    }) => Promise<{
+        id: string;
+        thread_id: string;
+        run_id: string | null;
+        parent_run_id: string | null;
+        plan_run_id: string | null;
+        plan_hash: string | null;
+        plan_readiness_overridden: boolean;
+        kind: "decision" | "followup" | "initial";
+        prompt: string;
+        attachments: {
+            resource_id: string;
+            kind: "file" | "image";
+            mime: string;
+            name: string;
+            sha256: string;
+            size_bytes: number;
+            path: string;
+        }[];
+        enqueue_error: {
+            message: string;
+            code: string | null;
+            retryable: boolean;
+            required_actions: string[];
+            context: Record<string, unknown>;
+            failed_at: string;
+        } | null;
+        continuity: {
+            kind: "fresh" | "native_resume" | "packet";
+            packet_turns: number;
+            summarized: boolean;
+            lane_switched_from: {
+                harness_id: string;
+                profile_id: string | null;
+            } | null;
+        } | null;
+        created_at: string;
+    }>;
+    findThreadTurnByIdempotency: (id: string, idempotency: {
+        key: string;
+        client: string;
+        request: unknown;
+    }) => Promise<{
+        id: string;
+        thread_id: string;
+        run_id: string | null;
+        parent_run_id: string | null;
+        plan_run_id: string | null;
+        plan_hash: string | null;
+        plan_readiness_overridden: boolean;
+        kind: "decision" | "followup" | "initial";
+        prompt: string;
+        attachments: {
+            resource_id: string;
+            kind: "file" | "image";
+            mime: string;
+            name: string;
+            sha256: string;
+            size_bytes: number;
+            path: string;
+        }[];
+        enqueue_error: {
+            message: string;
+            code: string | null;
+            retryable: boolean;
+            required_actions: string[];
+            context: Record<string, unknown>;
+            failed_at: string;
+        } | null;
+        continuity: {
+            kind: "fresh" | "native_resume" | "packet";
+            packet_turns: number;
+            summarized: boolean;
+            lane_switched_from: {
+                harness_id: string;
+                profile_id: string | null;
+            } | null;
+        } | null;
+        created_at: string;
+    } | null>;
+    setTurnEnqueueError: (turnId: string, problem: import("@claudexor/schema").TurnEnqueueProblem) => void;
+    preflightRunRequirements: (request: ControlRunStartRequest) => Promise<void>;
+    preflightThreadRunRequirements: (request: ControlRunStartRequest) => Promise<void>;
     createUpload: (input: unknown, idempotencyKey: string) => Promise<{
-        state: "cancelled" | "open" | "uploading" | "uploaded";
         uploadId: string;
+        state: "cancelled" | "open" | "uploaded" | "uploading";
         receivedBytes: number;
         expectedBytes: number;
     }>;
     writeUpload: (uploadId: string, chunks: AsyncIterable<Uint8Array>) => Promise<{
-        state: "cancelled" | "open" | "uploading" | "uploaded";
         uploadId: string;
+        state: "cancelled" | "open" | "uploaded" | "uploading";
         receivedBytes: number;
         expectedBytes: number;
     }>;
     uploadStatus: (uploadId: string) => Promise<{
-        state: "cancelled" | "open" | "uploading" | "uploaded";
         uploadId: string;
+        state: "cancelled" | "open" | "uploaded" | "uploading";
         receivedBytes: number;
         expectedBytes: number;
     }>;
     cancelUpload: (uploadId: string) => Promise<{
-        state: "cancelled" | "open" | "uploading" | "uploaded";
         uploadId: string;
+        state: "cancelled" | "open" | "uploaded" | "uploading";
         receivedBytes: number;
         expectedBytes: number;
     }>;
     finalizeUpload: (uploadId: string, expectedSha256: string | undefined, idempotencyKey: string) => Promise<{
-        kind: "file" | "image";
-        name: string;
         resourceId: string;
+        kind: "file" | "image";
         mime: string;
+        name: string;
         sha256: string;
         sizeBytes: number;
         createdAt: string;
@@ -60,32 +157,32 @@ export declare function controlServices(interactions: InteractionRegistry, proje
         projects: unknown[];
     }>;
     registerProject: (input: Parameters<ProjectStore["register"]>[0]) => Promise<{
+        schema_version: 2;
+        id: string;
+        root: string;
+        created_at: string;
+        updated_at: string;
         nesting: {
             relation: "inside" | "contains";
             root: string;
             projectId: string;
         }[];
-        created_at: string;
+    }>;
+    relinkProject: (id: string, root: string) => Promise<{
         schema_version: 2;
         id: string;
-        updated_at: string;
         root: string;
-    }>;
-    relinkProject: (id: string, root: string) => Promise<{
+        created_at: string;
+        updated_at: string;
         nesting: {
             relation: "inside" | "contains";
             root: string;
             projectId: string;
         }[];
-        created_at: string;
-        schema_version: 2;
-        id: string;
-        updated_at: string;
-        root: string;
     }>;
     removeProject: (id: string) => Promise<{
-        root: string;
         projectId: string;
+        root: string;
         registryRemoved: true;
         journalPartitionArchived: boolean;
         archivedPartitionPath: string | null;
@@ -93,30 +190,30 @@ export declare function controlServices(interactions: InteractionRegistry, proje
         activeRunCheck: "snapshot";
     }>;
     createThread: (input: unknown) => Promise<{
-        state: "active" | "closed" | "trashed" | "purged";
-        created_at: string;
-        workspace: {
-            mode: "in_place" | "isolated";
-            worktree_path: string | null;
-            base_sha: string | null;
-            delivered_through_run_id: string | null;
-        };
-        mode: "ask" | "plan" | "agent";
         schema_version: 2;
         id: string;
-        access: "readonly" | "workspace_write" | "full" | "external_sandbox_full" | "inherit_native" | null;
-        auth_preference: "auto" | "subscription" | "api_key";
-        credential_profile_id: string | null;
-        title: string | null;
+        created_at: string;
         updated_at: string;
         repo: {
             root: string;
             base_ref: string;
         } | null;
+        title: string | null;
+        mode: "agent" | "ask" | "plan";
+        auth_preference: "api_key" | "auto" | "subscription";
+        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
+        credential_profile_id: string | null;
         primary_harness: string | null;
         eligible_harnesses: string[];
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
         run_ids: string[];
         head_run_id: string | null;
+        state: "active" | "closed" | "purged" | "trashed";
         trashed_at: string | null;
         purge_after: string | null;
         pre_trash_state: "active" | "closed" | null;
@@ -125,59 +222,6 @@ export declare function controlServices(interactions: InteractionRegistry, proje
         threads: unknown[];
         problems: unknown[];
     }>;
-    threadDetail: (id: string) => Promise<{
-        thread: unknown;
-        sessions: unknown[];
-        turns: unknown[];
-    }>;
-    createThreadTurn: (id: string, prompt: string, opts: {
-        kind?: unknown;
-        parentRunId?: string | null;
-        planRunId?: string | null;
-        planHash?: string | null;
-        planOverridden?: boolean;
-        attachments?: ResourceAttachmentRef[];
-        idempotency?: {
-            key: string;
-            client: string;
-            request: unknown;
-        };
-    }) => Promise<{
-        created_at: string;
-        kind: "initial" | "followup" | "decision";
-        id: string;
-        prompt: string;
-        attachments: {
-            path: string;
-            kind: "file" | "image";
-            name: string;
-            resource_id: string;
-            mime: string;
-            sha256: string;
-            size_bytes: number;
-        }[];
-        thread_id: string;
-        run_id: string | null;
-        parent_run_id: string | null;
-        plan_run_id: string | null;
-        plan_hash: string | null;
-        plan_readiness_overridden: boolean;
-        enqueue_error: {
-            code: string | null;
-            message: string;
-            retryable: boolean;
-            failed_at: string;
-        } | null;
-        continuity: {
-            kind: "fresh" | "native_resume" | "packet";
-            packet_turns: number;
-            summarized: boolean;
-            lane_switched_from: {
-                profile_id: string | null;
-                harness_id: string;
-            } | null;
-        } | null;
-    }>;
     updateThread: (id: string, patch: {
         title?: string;
         state?: string;
@@ -186,117 +230,117 @@ export declare function controlServices(interactions: InteractionRegistry, proje
         eligibleHarnesses?: string[];
         access?: string | null;
     }) => Promise<{
-        state: "active" | "closed" | "trashed" | "purged";
-        created_at: string;
-        workspace: {
-            mode: "in_place" | "isolated";
-            worktree_path: string | null;
-            base_sha: string | null;
-            delivered_through_run_id: string | null;
-        };
-        mode: "ask" | "plan" | "agent";
         schema_version: 2;
         id: string;
-        access: "readonly" | "workspace_write" | "full" | "external_sandbox_full" | "inherit_native" | null;
-        auth_preference: "auto" | "subscription" | "api_key";
-        credential_profile_id: string | null;
-        title: string | null;
+        created_at: string;
         updated_at: string;
         repo: {
             root: string;
             base_ref: string;
         } | null;
+        title: string | null;
+        mode: "agent" | "ask" | "plan";
+        auth_preference: "api_key" | "auto" | "subscription";
+        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
+        credential_profile_id: string | null;
         primary_harness: string | null;
         eligible_harnesses: string[];
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
         run_ids: string[];
         head_run_id: string | null;
+        state: "active" | "closed" | "purged" | "trashed";
         trashed_at: string | null;
         purge_after: string | null;
         pre_trash_state: "active" | "closed" | null;
     }>;
     trashThread: (id: string) => Promise<{
-        state: "active" | "closed" | "trashed" | "purged";
-        created_at: string;
-        workspace: {
-            mode: "in_place" | "isolated";
-            worktree_path: string | null;
-            base_sha: string | null;
-            delivered_through_run_id: string | null;
-        };
-        mode: "ask" | "plan" | "agent";
         schema_version: 2;
         id: string;
-        access: "readonly" | "workspace_write" | "full" | "external_sandbox_full" | "inherit_native" | null;
-        auth_preference: "auto" | "subscription" | "api_key";
-        credential_profile_id: string | null;
-        title: string | null;
+        created_at: string;
         updated_at: string;
         repo: {
             root: string;
             base_ref: string;
         } | null;
+        title: string | null;
+        mode: "agent" | "ask" | "plan";
+        auth_preference: "api_key" | "auto" | "subscription";
+        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
+        credential_profile_id: string | null;
         primary_harness: string | null;
         eligible_harnesses: string[];
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
         run_ids: string[];
         head_run_id: string | null;
+        state: "active" | "closed" | "purged" | "trashed";
         trashed_at: string | null;
         purge_after: string | null;
         pre_trash_state: "active" | "closed" | null;
     }>;
     restoreThread: (id: string) => Promise<{
-        state: "active" | "closed" | "trashed" | "purged";
-        created_at: string;
-        workspace: {
-            mode: "in_place" | "isolated";
-            worktree_path: string | null;
-            base_sha: string | null;
-            delivered_through_run_id: string | null;
-        };
-        mode: "ask" | "plan" | "agent";
         schema_version: 2;
         id: string;
-        access: "readonly" | "workspace_write" | "full" | "external_sandbox_full" | "inherit_native" | null;
-        auth_preference: "auto" | "subscription" | "api_key";
-        credential_profile_id: string | null;
-        title: string | null;
+        created_at: string;
         updated_at: string;
         repo: {
             root: string;
             base_ref: string;
         } | null;
+        title: string | null;
+        mode: "agent" | "ask" | "plan";
+        auth_preference: "api_key" | "auto" | "subscription";
+        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
+        credential_profile_id: string | null;
         primary_harness: string | null;
         eligible_harnesses: string[];
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
         run_ids: string[];
         head_run_id: string | null;
+        state: "active" | "closed" | "purged" | "trashed";
         trashed_at: string | null;
         purge_after: string | null;
         pre_trash_state: "active" | "closed" | null;
     }>;
     purgeThread: (id: string) => Promise<{
-        state: "active" | "closed" | "trashed" | "purged";
-        created_at: string;
-        workspace: {
-            mode: "in_place" | "isolated";
-            worktree_path: string | null;
-            base_sha: string | null;
-            delivered_through_run_id: string | null;
-        };
-        mode: "ask" | "plan" | "agent";
         schema_version: 2;
         id: string;
-        access: "readonly" | "workspace_write" | "full" | "external_sandbox_full" | "inherit_native" | null;
-        auth_preference: "auto" | "subscription" | "api_key";
-        credential_profile_id: string | null;
-        title: string | null;
+        created_at: string;
         updated_at: string;
         repo: {
             root: string;
             base_ref: string;
         } | null;
+        title: string | null;
+        mode: "agent" | "ask" | "plan";
+        auth_preference: "api_key" | "auto" | "subscription";
+        access: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write" | null;
+        credential_profile_id: string | null;
         primary_harness: string | null;
         eligible_harnesses: string[];
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
         run_ids: string[];
         head_run_id: string | null;
+        state: "active" | "closed" | "purged" | "trashed";
         trashed_at: string | null;
         purge_after: string | null;
         pre_trash_state: "active" | "closed" | null;
@@ -308,25 +352,24 @@ export declare function controlServices(interactions: InteractionRegistry, proje
         detail: string | null;
         delivery: import("@claudexor/schema").ControlDeliveryResponse | null;
     }>;
-    setTurnEnqueueError: (turnId: string, message: string, code: string | null, retryable?: boolean) => void;
     listTrust: typeof listTrustService;
     updateTrust: typeof updateTrustService;
     pendingInteractions: (runId: string) => {
-        harnessId: string | null;
+        interactionId: string;
+        runId: string;
         attemptId: string | null;
+        harnessId: string | null;
+        sourceTool: string | null;
         questions: {
+            id: string;
+            question: string;
+            header: string | null;
             options: {
                 label: string;
                 description: string | null;
             }[];
-            id: string;
-            question: string;
-            header: string | null;
             multi_select: boolean;
         }[];
-        runId: string;
-        interactionId: string;
-        sourceTool: string | null;
         requestedAt: string;
         timeoutAt: string | null;
     }[];
@@ -335,37 +378,60 @@ export declare function controlServices(interactions: InteractionRegistry, proje
         message?: string;
     };
     operatorDecision: (runId: string, params: unknown) => OperatorDecisionRecord | null;
+    findOperatorDecisionByIdempotency: (runId: string, params: unknown, idempotency: {
+        key: string;
+        client: string;
+        request: unknown;
+    }) => OperatorDecisionRecord | null;
     recordOperatorDecision: (runId: string, params: unknown, decision: Omit<OperatorDecisionRecord, "runId">, idempotency?: {
         key: string;
         client: string;
         request: unknown;
-    }) => OperatorDecisionRecord;
+    }) => import("@claudexor/daemon").RecordedOperatorDecision;
     beginDelivery: (params: unknown, input: {
         key: string;
         client: string;
         operation: string;
         request: unknown;
     }) => Promise<{
-        reused: boolean;
         id: string;
-        state: "failed" | "succeeded" | "running" | "queued" | "cancelled" | "interrupted";
+        state: "cancelled" | "failed" | "interrupted" | "queued" | "running" | "succeeded";
         params: unknown;
         result?: unknown;
         error?: string;
         errorCode?: string;
         errorStatus?: number;
         errorRetryable?: boolean;
+        errorRequiredActions?: string[];
+        errorContext?: Record<string, unknown>;
         createdAt: string;
         runId?: string;
         taskId?: string;
         runDir?: string;
         startedAt?: string;
         finishedAt?: string;
+        reused: boolean;
     }>;
     completeDelivery: (id: string, result: unknown) => Promise<void>;
     failDelivery: (id: string, error: unknown) => Promise<void>;
     harnesses: (input?: HarnessListInput) => Promise<{
+        git: {
+            status: "available" | "developer_tools_stub" | "failed" | "missing";
+            version: string | null;
+            detail: string | null;
+            remediation: string | null;
+        };
         harnesses: {
+            id: string;
+            available: boolean;
+            status: "ok" | "degraded" | "unavailable";
+            manifest: import("@claudexor/schema").HarnessManifest | null;
+            enabledIntents: import("@claudexor/schema").Intent[];
+            routableIntents: import("@claudexor/schema").Intent[];
+            disabledIntents: import("@claudexor/schema").Intent[];
+            checks: import("@claudexor/schema").ConformanceCheck[];
+            reasons: string[];
+            authSources: import("@claudexor/schema").AuthSourceReadiness[];
             configuredModel: string | null;
             configuredModelCheck: {
                 status: "ok" | "rejected";
@@ -373,163 +439,200 @@ export declare function controlServices(interactions: InteractionRegistry, proje
             } | null;
             delegation: {
                 available: boolean;
-                reason: "ready" | "runtime_unavailable" | "manifest_unsupported";
+                reason: "manifest_unsupported" | "ready" | "runtime_unavailable";
                 remediation: string | null;
                 requiresFullAccess: boolean;
             };
             readiness: {
-                status: "pass" | "fail" | "skip";
-                detail: string | null;
-                kind: "binary" | "auth" | "model" | "smoke" | "probe";
                 id: string;
+                kind: "auth" | "binary" | "model" | "probe" | "smoke";
                 title: string;
+                status: "fail" | "pass" | "skip";
+                detail: string | null;
             }[];
-            id: string;
-            available: boolean;
-            status: "ok" | "degraded" | "unavailable";
-            manifest: import("@claudexor/schema").HarnessManifest | null;
-            enabledIntents: import("@claudexor/schema").Intent[];
-            routableIntents: import("@claudexor/schema").Intent[];
-            disabledIntents: import("@claudexor/schema").Intent[];
-            checks: import("@claudexor/schema").ConformanceCheck[];
-            reasons: string[];
-            authSources: import("@claudexor/schema").AuthSourceReadiness[];
         }[];
     }>;
     harnessModels: (input: {
         harnessId: string;
         route?: "local_session" | "api_key";
     }) => Promise<{
-        source: "none" | "api" | "manifest";
         harnessId: string;
-        verifiedAgainst: string | null;
         models: {
             id: string;
             label: string | null;
-            routes: ("api_key" | "local_session")[] | null;
             context_window: number | null;
+            routes: ("api_key" | "local_session")[] | null;
         }[];
+        source: "api" | "manifest" | "none";
+        verifiedAgainst: string | null;
     }>;
     authReadiness: (input: {
         harnessId: string;
         request: unknown;
     }) => Promise<{
-        authRequest: "auto" | "subscription" | "api_key";
         harnessId: string;
-        requestedSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        authRequest: "api_key" | "auto" | "subscription";
+        requestedSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
         observedAt: string;
         readiness: {
-            source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-            availability: "unknown" | "available" | "unavailable";
-            verification: "passed" | "failed" | "not_run";
+            source: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+            availability: "available" | "unavailable" | "unknown";
+            verification: "failed" | "not_run" | "passed";
             detail?: string | undefined;
         };
     }>;
     agentCapabilities: () => Promise<{
-        generatedAt: string;
         ok: true;
         version: string;
-        mutability: {
-            readOnlyModes: ("ask" | "plan" | "agent")[];
-            writeModes: ("ask" | "plan" | "agent")[];
-            isolationKinds: ("live" | "envelope")[];
-            workspaceModes: ("in_place" | "isolated")[];
-            accessProfiles: ("readonly" | "workspace_write" | "full" | "external_sandbox_full" | "inherit_native")[];
-            applyModes: ("apply" | "commit" | "branch" | "pr")[];
+        generatedAt: string;
+        git: {
+            status: "available" | "developer_tools_stub" | "failed" | "missing";
+            version: string | null;
+            detail: string | null;
+            remediation: string | null;
         };
         harnesses: {
-            status: "unavailable" | "ok" | "degraded";
+            id: string;
             enabled: boolean;
             displayName: string;
-            id: string;
-            reasons: string[];
-            providerFamily: "openai" | "anthropic" | "google" | "cursor" | "opencode" | "xai" | "local" | "unknown";
+            status: "degraded" | "ok" | "unavailable";
+            providerFamily: "anthropic" | "cursor" | "google" | "local" | "openai" | "opencode" | "unknown" | "xai";
             enabledIntents: string[];
             disabledIntents: string[];
+            reasons: string[];
             configuredModel: string | null;
             configuredModelValid: boolean | null;
             models: {
-                source: "none" | "api" | "manifest";
+                source: "api" | "manifest" | "none";
                 count: number;
                 verifiedAgainst: string | null;
             };
-            webPolicy: "none" | "native" | "tools" | "uncontrolled";
+            webPolicy: "native" | "none" | "tools" | "uncontrolled";
             attachmentInputs: {
                 kind: "file" | "image";
                 mime_types: string[];
                 max_bytes: number;
                 max_count: number;
-                transport: "file_path" | "base64_stream" | "base64_inline" | "text_inline";
+                transport: "base64_inline" | "base64_stream" | "file_path" | "text_inline";
             }[];
             effortLevels: string[];
-            accessProfilesSupported: ("readonly" | "workspace_write" | "full" | "external_sandbox_full" | "inherit_native")[];
-            readonlyMechanism: "none" | "fs_sandbox" | "permission_deny" | "tool_allowlist";
+            accessProfilesSupported: ("external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write")[];
+            readonlyMechanism: "fs_sandbox" | "none" | "permission_deny" | "tool_allowlist";
             delegation: {
                 available: boolean;
-                reason: "ready" | "runtime_unavailable" | "manifest_unsupported";
+                reason: "manifest_unsupported" | "ready" | "runtime_unavailable";
                 remediation: string | null;
                 requiresFullAccess: boolean;
             };
         }[];
         availableHarnesses: string[];
-        modes: ("ask" | "plan" | "agent")[];
+        modes: ("agent" | "ask" | "plan")[];
         runControlKeys: string[];
         outputSchemaDialects: {
             dialect: "draft-07" | "draft-2020-12";
             uri: string;
             defaultWhenOmitted: boolean;
         }[];
+        mutability: {
+            readOnlyModes: ("agent" | "ask" | "plan")[];
+            writeModes: ("agent" | "ask" | "plan")[];
+            isolationKinds: ("envelope" | "live")[];
+            workspaceModes: ("in_place" | "isolated")[];
+            accessProfiles: ("external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write")[];
+            applyModes: ("apply" | "branch" | "commit" | "pr")[];
+        };
         cliCommands: {
             id: string;
-            mutability: "read" | "write" | "delivery" | "ops";
-            stability: "stable" | "experimental";
+            mutability: "delivery" | "ops" | "read" | "write";
+            stability: "experimental" | "stable";
             recovery: boolean;
         }[];
         mcpTools: string[];
         runApplyStates: string[];
     }>;
+    runApplicability: (input: {
+        repoRoot: string;
+    }) => Promise<{
+        repoRoot: string;
+        git: {
+            status: "available" | "developer_tools_stub" | "failed" | "missing";
+            version: string | null;
+            detail: string | null;
+            remediation: string | null;
+        };
+        matrix: {
+            in_place: {
+                read_only: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
+                };
+                agent_convergence: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
+                };
+                agent_other: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
+                };
+            };
+            isolated: {
+                read_only: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
+                };
+                agent_convergence: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
+                };
+                agent_other: {
+                    applicable: boolean;
+                    requiresGit: boolean;
+                    code: "git_developer_tools_stub" | "git_failed" | "git_missing" | null;
+                    reason: string | null;
+                    remediation: string | null;
+                };
+            };
+        };
+    }>;
     createSetupJob: (input: {
         request: unknown;
         idempotencyKey: string;
         clientId: string;
     }) => Promise<{
-        message: string;
-        harness: "cursor" | "codex" | "claude";
-        startedAt: string | null;
-        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "succeeded" | "queued" | "timed_out" | "waiting_for_input" | "not_supported";
-        profileId: string | null;
-        command: string | null;
-        createdAt: string;
         jobId: string;
-        phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
-        finishedAt: string | null;
+        harness: "claude" | "codex" | "cursor";
         action: "login";
-        guideUrl: string | null;
-        execution?: {
-            observedAt: string;
-            commandDigest: string;
-            executionId: string;
-            manifestDigest: string;
-            processGroup: {
-                schemaVersion: 1;
-                pgid: number;
-                leader: {
-                    status: "known";
-                    source: "procfs_stat" | "proc_pidinfo";
-                    pid: number;
-                    platform: "linux" | "darwin";
-                    startToken: string;
-                    processGroupId: number;
-                };
-            };
-            permitIssuedAt?: string | undefined;
-        } | undefined;
+        transport: "client_pty" | "daemon";
+        profileId: string | null;
+        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+        phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+        deadlineAt?: string | undefined;
         outcome?: {
-            reason: "completed" | "interrupted_unknown" | "interrupted" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "termination_unconfirmed";
-            signal?: string | null | undefined;
+            reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
             exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
         } | undefined;
-        deadlineAt?: string | undefined;
+        command: string | null;
+        guideUrl: string | null;
+        message: string;
+        createdAt: string;
+        startedAt: string | null;
+        finishedAt: string | null;
         authCapability?: {
             attemptId: string;
             challengeDigest: string;
@@ -538,69 +641,70 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "disclosed";
         } | {
             attemptId: string;
-            startedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "running";
+            startedAt: string;
         } | {
             attemptId: string;
-            startedAt: string;
-            completedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "completed";
+            startedAt: string;
+            completedAt: string;
             receipt: {
-                availability: "unknown" | "available" | "unavailable";
-                verification: "passed" | "failed" | "not_run";
-                harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
                 receiptId: string;
                 attemptId: string;
-                effective: "local" | "vendor_native" | "managed_api_key" | null;
-                effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
-                selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
-                costKnowledge: "exact" | "unknown" | "estimated";
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                effective: "local" | "managed_api_key" | "vendor_native" | null;
+                effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                availability: "available" | "unavailable" | "unknown";
+                verification: "failed" | "not_run" | "passed";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                costKnowledge: "estimated" | "exact" | "unknown";
+                costUsd?: number | undefined;
                 startedAt: string;
                 completedAt: string;
                 challengeDigest: string;
@@ -610,7 +714,6 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 scratchBeforeDigest: string;
                 scratchAfterDigest: string;
                 stream: {
-                    aborted: boolean;
                     startedEvents: number;
                     completedEvents: number;
                     errorEvents: number;
@@ -618,55 +721,74 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                     interactionEvents: number;
                     sessionMismatchEvents: number;
                     eventsAfterCompleted: number;
+                    aborted: boolean;
                 };
                 evidenceRefs: string[];
-                costUsd?: number | undefined;
             };
         } | {
             attemptId: string;
-            startedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "interrupted_unknown";
+            startedAt: string;
             interruptedAt: string;
         } | undefined;
-        authorization?: {
-            args: string[];
-            commandDigest: string;
+        execution?: {
             executionId: string;
+            commandDigest: string;
             manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    pid: number;
+                    platform: "darwin" | "linux";
+                    source: "proc_pidinfo" | "procfs_stat";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            observedAt: string;
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        authorization?: {
+            executionId: string;
             executable: {
-                sha256: string;
-                mode: number;
                 realpath: string;
+                sha256: string;
                 size: number;
+                mode: number;
                 device: string;
                 inode: string;
             };
+            args: string[];
+            commandDigest: string;
+            manifestDigest: string;
         } | undefined;
         nativeCommand?: {
-            commandDigest: string;
-            finishedAt: string;
-            signal: string | null;
             executionId: string;
+            commandDigest: string;
             manifestDigest: string;
             permitIssuedAt: string | null;
             commandStarted: boolean;
             exitCode: number | null;
-            errorCode?: "permit_timeout" | "spawn_failed" | "device_auth_unsupported" | undefined;
+            signal: string | null;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+            finishedAt: string;
         } | undefined;
         terminationReconciliation?: {
             status: "empty";
@@ -675,43 +797,25 @@ export declare function controlServices(interactions: InteractionRegistry, proje
     }>;
     listSetupJobs: (input?: unknown) => Promise<{
         jobs: {
-            message: string;
-            harness: "cursor" | "codex" | "claude";
-            startedAt: string | null;
-            state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "succeeded" | "queued" | "timed_out" | "waiting_for_input" | "not_supported";
-            profileId: string | null;
-            command: string | null;
-            createdAt: string;
             jobId: string;
-            phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
-            finishedAt: string | null;
+            harness: "claude" | "codex" | "cursor";
             action: "login";
-            guideUrl: string | null;
-            execution?: {
-                observedAt: string;
-                commandDigest: string;
-                executionId: string;
-                manifestDigest: string;
-                processGroup: {
-                    schemaVersion: 1;
-                    pgid: number;
-                    leader: {
-                        status: "known";
-                        source: "procfs_stat" | "proc_pidinfo";
-                        pid: number;
-                        platform: "linux" | "darwin";
-                        startToken: string;
-                        processGroupId: number;
-                    };
-                };
-                permitIssuedAt?: string | undefined;
-            } | undefined;
+            transport: "client_pty" | "daemon";
+            profileId: string | null;
+            state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+            phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+            deadlineAt?: string | undefined;
             outcome?: {
-                reason: "completed" | "interrupted_unknown" | "interrupted" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "termination_unconfirmed";
-                signal?: string | null | undefined;
+                reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
                 exitCode?: number | null | undefined;
+                signal?: string | null | undefined;
             } | undefined;
-            deadlineAt?: string | undefined;
+            command: string | null;
+            guideUrl: string | null;
+            message: string;
+            createdAt: string;
+            startedAt: string | null;
+            finishedAt: string | null;
             authCapability?: {
                 attemptId: string;
                 challengeDigest: string;
@@ -720,69 +824,622 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "disclosed";
             } | {
                 attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "running";
+                startedAt: string;
+            } | {
+                attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "completed";
+                startedAt: string;
+                completedAt: string;
+                receipt: {
+                    receiptId: string;
+                    attemptId: string;
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    effective: "local" | "managed_api_key" | "vendor_native" | null;
+                    effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                    selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                    availability: "available" | "unavailable" | "unknown";
+                    verification: "failed" | "not_run" | "passed";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    costKnowledge: "estimated" | "exact" | "unknown";
+                    costUsd?: number | undefined;
+                    startedAt: string;
+                    completedAt: string;
+                    challengeDigest: string;
+                    requestDigest: string;
+                    responseDigest: string;
+                    streamDigest: string;
+                    scratchBeforeDigest: string;
+                    scratchAfterDigest: string;
+                    stream: {
+                        startedEvents: number;
+                        completedEvents: number;
+                        errorEvents: number;
+                        unexpectedToolEvents: number;
+                        interactionEvents: number;
+                        sessionMismatchEvents: number;
+                        eventsAfterCompleted: number;
+                        aborted: boolean;
+                    };
+                    evidenceRefs: string[];
+                };
+            } | {
+                attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "interrupted_unknown";
                 startedAt: string;
+                interruptedAt: string;
+            } | undefined;
+            execution?: {
+                executionId: string;
+                commandDigest: string;
+                manifestDigest: string;
+                processGroup: {
+                    schemaVersion: 1;
+                    pgid: number;
+                    leader: {
+                        status: "known";
+                        pid: number;
+                        platform: "darwin" | "linux";
+                        source: "proc_pidinfo" | "procfs_stat";
+                        startToken: string;
+                        processGroupId: number;
+                    };
+                };
+                observedAt: string;
+                permitIssuedAt?: string | undefined;
+            } | undefined;
+            authorization?: {
+                executionId: string;
+                executable: {
+                    realpath: string;
+                    sha256: string;
+                    size: number;
+                    mode: number;
+                    device: string;
+                    inode: string;
+                };
+                args: string[];
+                commandDigest: string;
+                manifestDigest: string;
+            } | undefined;
+            nativeCommand?: {
+                executionId: string;
+                commandDigest: string;
+                manifestDigest: string;
+                permitIssuedAt: string | null;
+                commandStarted: boolean;
+                exitCode: number | null;
+                signal: string | null;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                finishedAt: string;
+            } | undefined;
+            terminationReconciliation?: {
+                status: "empty";
+                observedAt: string;
+            } | undefined;
+        }[];
+    }>;
+    setupJobStatus: (input: unknown) => Promise<{
+        jobId: string;
+        harness: "claude" | "codex" | "cursor";
+        action: "login";
+        transport: "client_pty" | "daemon";
+        profileId: string | null;
+        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+        phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+        deadlineAt?: string | undefined;
+        outcome?: {
+            reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
+            exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
+        } | undefined;
+        command: string | null;
+        guideUrl: string | null;
+        message: string;
+        createdAt: string;
+        startedAt: string | null;
+        finishedAt: string | null;
+        authCapability?: {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "disclosed";
+        } | {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "running";
+            startedAt: string;
+        } | {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "completed";
+            startedAt: string;
+            completedAt: string;
+            receipt: {
+                receiptId: string;
+                attemptId: string;
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                effective: "local" | "managed_api_key" | "vendor_native" | null;
+                effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                availability: "available" | "unavailable" | "unknown";
+                verification: "failed" | "not_run" | "passed";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                costKnowledge: "estimated" | "exact" | "unknown";
+                costUsd?: number | undefined;
+                startedAt: string;
+                completedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                responseDigest: string;
+                streamDigest: string;
+                scratchBeforeDigest: string;
+                scratchAfterDigest: string;
+                stream: {
+                    startedEvents: number;
+                    completedEvents: number;
+                    errorEvents: number;
+                    unexpectedToolEvents: number;
+                    interactionEvents: number;
+                    sessionMismatchEvents: number;
+                    eventsAfterCompleted: number;
+                    aborted: boolean;
+                };
+                evidenceRefs: string[];
+            };
+        } | {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "interrupted_unknown";
+            startedAt: string;
+            interruptedAt: string;
+        } | undefined;
+        execution?: {
+            executionId: string;
+            commandDigest: string;
+            manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    pid: number;
+                    platform: "darwin" | "linux";
+                    source: "proc_pidinfo" | "procfs_stat";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            observedAt: string;
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        authorization?: {
+            executionId: string;
+            executable: {
+                realpath: string;
+                sha256: string;
+                size: number;
+                mode: number;
+                device: string;
+                inode: string;
+            };
+            args: string[];
+            commandDigest: string;
+            manifestDigest: string;
+        } | undefined;
+        nativeCommand?: {
+            executionId: string;
+            commandDigest: string;
+            manifestDigest: string;
+            permitIssuedAt: string | null;
+            commandStarted: boolean;
+            exitCode: number | null;
+            signal: string | null;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+            finishedAt: string;
+        } | undefined;
+        terminationReconciliation?: {
+            status: "empty";
+            observedAt: string;
+        } | undefined;
+    }>;
+    setupJobSnapshot: (input: unknown) => Promise<{
+        deviceCode?: undefined;
+        job: {
+            jobId: string;
+            harness: "claude" | "codex" | "cursor";
+            action: "login";
+            transport: "client_pty" | "daemon";
+            profileId: string | null;
+            state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+            phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+            deadlineAt?: string | undefined;
+            outcome?: {
+                reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
+                exitCode?: number | null | undefined;
+                signal?: string | null | undefined;
+            } | undefined;
+            command: string | null;
+            guideUrl: string | null;
+            message: string;
+            createdAt: string;
+            startedAt: string | null;
+            finishedAt: string | null;
+            authCapability?: {
+                attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "disclosed";
+            } | {
+                attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "running";
+                startedAt: string;
+            } | {
+                attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "completed";
+                startedAt: string;
+                completedAt: string;
+                receipt: {
+                    receiptId: string;
+                    attemptId: string;
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    effective: "local" | "managed_api_key" | "vendor_native" | null;
+                    effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                    selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                    availability: "available" | "unavailable" | "unknown";
+                    verification: "failed" | "not_run" | "passed";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    costKnowledge: "estimated" | "exact" | "unknown";
+                    costUsd?: number | undefined;
+                    startedAt: string;
+                    completedAt: string;
+                    challengeDigest: string;
+                    requestDigest: string;
+                    responseDigest: string;
+                    streamDigest: string;
+                    scratchBeforeDigest: string;
+                    scratchAfterDigest: string;
+                    stream: {
+                        startedEvents: number;
+                        completedEvents: number;
+                        errorEvents: number;
+                        unexpectedToolEvents: number;
+                        interactionEvents: number;
+                        sessionMismatchEvents: number;
+                        eventsAfterCompleted: number;
+                        aborted: boolean;
+                    };
+                    evidenceRefs: string[];
+                };
+            } | {
+                attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "interrupted_unknown";
+                startedAt: string;
+                interruptedAt: string;
+            } | undefined;
+            execution?: {
+                executionId: string;
+                commandDigest: string;
+                manifestDigest: string;
+                processGroup: {
+                    schemaVersion: 1;
+                    pgid: number;
+                    leader: {
+                        status: "known";
+                        pid: number;
+                        platform: "darwin" | "linux";
+                        source: "proc_pidinfo" | "procfs_stat";
+                        startToken: string;
+                        processGroupId: number;
+                    };
+                };
+                observedAt: string;
+                permitIssuedAt?: string | undefined;
+            } | undefined;
+            authorization?: {
+                executionId: string;
+                executable: {
+                    realpath: string;
+                    sha256: string;
+                    size: number;
+                    mode: number;
+                    device: string;
+                    inode: string;
+                };
+                args: string[];
+                commandDigest: string;
+                manifestDigest: string;
+            } | undefined;
+            nativeCommand?: {
+                executionId: string;
+                commandDigest: string;
+                manifestDigest: string;
+                permitIssuedAt: string | null;
+                commandStarted: boolean;
+                exitCode: number | null;
+                signal: string | null;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                finishedAt: string;
+            } | undefined;
+            terminationReconciliation?: {
+                status: "empty";
+                observedAt: string;
+            } | undefined;
+        };
+        cursor: string;
+        sequence: number;
+    } | {
+        job: {
+            jobId: string;
+            harness: "claude" | "codex" | "cursor";
+            action: "login";
+            transport: "client_pty" | "daemon";
+            profileId: string | null;
+            state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+            phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+            deadlineAt?: string | undefined;
+            outcome?: {
+                reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
+                exitCode?: number | null | undefined;
+                signal?: string | null | undefined;
+            } | undefined;
+            command: string | null;
+            guideUrl: string | null;
+            message: string;
+            createdAt: string;
+            startedAt: string | null;
+            finishedAt: string | null;
+            authCapability?: {
+                attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "disclosed";
+            } | {
+                attemptId: string;
                 challengeDigest: string;
                 requestDigest: string;
                 disclosure: {
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "running";
+                startedAt: string;
             } | {
                 attemptId: string;
-                startedAt: string;
-                completedAt: string;
                 challengeDigest: string;
                 requestDigest: string;
                 disclosure: {
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "completed";
+                startedAt: string;
+                completedAt: string;
                 receipt: {
-                    availability: "unknown" | "available" | "unavailable";
-                    verification: "passed" | "failed" | "not_run";
-                    harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
                     receiptId: string;
                     attemptId: string;
-                    effective: "local" | "vendor_native" | "managed_api_key" | null;
-                    effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
-                    selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
-                    costKnowledge: "exact" | "unknown" | "estimated";
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    effective: "local" | "managed_api_key" | "vendor_native" | null;
+                    effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                    selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                    availability: "available" | "unavailable" | "unknown";
+                    verification: "failed" | "not_run" | "passed";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    costKnowledge: "estimated" | "exact" | "unknown";
+                    costUsd?: number | undefined;
                     startedAt: string;
                     completedAt: string;
                     challengeDigest: string;
@@ -792,7 +1449,6 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                     scratchBeforeDigest: string;
                     scratchAfterDigest: string;
                     stream: {
-                        aborted: boolean;
                         startedEvents: number;
                         completedEvents: number;
                         errorEvents: number;
@@ -800,284 +1456,118 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                         interactionEvents: number;
                         sessionMismatchEvents: number;
                         eventsAfterCompleted: number;
+                        aborted: boolean;
                     };
                     evidenceRefs: string[];
-                    costUsd?: number | undefined;
                 };
             } | {
                 attemptId: string;
-                startedAt: string;
                 challengeDigest: string;
                 requestDigest: string;
                 disclosure: {
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "interrupted_unknown";
+                startedAt: string;
                 interruptedAt: string;
             } | undefined;
-            authorization?: {
-                args: string[];
-                commandDigest: string;
+            execution?: {
                 executionId: string;
+                commandDigest: string;
                 manifestDigest: string;
+                processGroup: {
+                    schemaVersion: 1;
+                    pgid: number;
+                    leader: {
+                        status: "known";
+                        pid: number;
+                        platform: "darwin" | "linux";
+                        source: "proc_pidinfo" | "procfs_stat";
+                        startToken: string;
+                        processGroupId: number;
+                    };
+                };
+                observedAt: string;
+                permitIssuedAt?: string | undefined;
+            } | undefined;
+            authorization?: {
+                executionId: string;
                 executable: {
-                    sha256: string;
-                    mode: number;
                     realpath: string;
+                    sha256: string;
                     size: number;
+                    mode: number;
                     device: string;
                     inode: string;
                 };
+                args: string[];
+                commandDigest: string;
+                manifestDigest: string;
             } | undefined;
             nativeCommand?: {
-                commandDigest: string;
-                finishedAt: string;
-                signal: string | null;
                 executionId: string;
+                commandDigest: string;
                 manifestDigest: string;
                 permitIssuedAt: string | null;
                 commandStarted: boolean;
                 exitCode: number | null;
-                errorCode?: "permit_timeout" | "spawn_failed" | "device_auth_unsupported" | undefined;
+                signal: string | null;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
                 status: "empty";
                 observedAt: string;
             } | undefined;
-        }[];
+        };
+        cursor: string;
+        sequence: number;
+        deviceCode: {
+            flow: "chatgpt" | "chatgptDeviceCode";
+            verificationUrl: string;
+            userCode: string;
+        };
     }>;
-    setupJobStatus: (input: unknown) => Promise<{
-        message: string;
-        harness: "cursor" | "codex" | "claude";
-        startedAt: string | null;
-        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "succeeded" | "queued" | "timed_out" | "waiting_for_input" | "not_supported";
-        profileId: string | null;
-        command: string | null;
-        createdAt: string;
+    setupJobEvents: (input: unknown) => Promise<({
+        deviceCode?: undefined;
         jobId: string;
-        phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
-        finishedAt: string | null;
-        action: "login";
-        guideUrl: string | null;
-        execution?: {
-            observedAt: string;
-            commandDigest: string;
-            executionId: string;
-            manifestDigest: string;
-            processGroup: {
-                schemaVersion: 1;
-                pgid: number;
-                leader: {
-                    status: "known";
-                    source: "procfs_stat" | "proc_pidinfo";
-                    pid: number;
-                    platform: "linux" | "darwin";
-                    startToken: string;
-                    processGroupId: number;
-                };
-            };
-            permitIssuedAt?: string | undefined;
-        } | undefined;
-        outcome?: {
-            reason: "completed" | "interrupted_unknown" | "interrupted" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "termination_unconfirmed";
-            signal?: string | null | undefined;
-            exitCode?: number | null | undefined;
-        } | undefined;
-        deadlineAt?: string | undefined;
-        authCapability?: {
-            attemptId: string;
-            challengeDigest: string;
-            requestDigest: string;
-            disclosure: {
-                schemaVersion: 1;
-                protocolVersion: 1;
-                harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
-                mayConsumeQuota: boolean;
-                generatedAt: string;
-            };
-            state: "disclosed";
-        } | {
-            attemptId: string;
-            startedAt: string;
-            challengeDigest: string;
-            requestDigest: string;
-            disclosure: {
-                schemaVersion: 1;
-                protocolVersion: 1;
-                harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
-                mayConsumeQuota: boolean;
-                generatedAt: string;
-            };
-            state: "running";
-        } | {
-            attemptId: string;
-            startedAt: string;
-            completedAt: string;
-            challengeDigest: string;
-            requestDigest: string;
-            disclosure: {
-                schemaVersion: 1;
-                protocolVersion: 1;
-                harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
-                mayConsumeQuota: boolean;
-                generatedAt: string;
-            };
-            state: "completed";
-            receipt: {
-                availability: "unknown" | "available" | "unavailable";
-                verification: "passed" | "failed" | "not_run";
-                harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                receiptId: string;
-                attemptId: string;
-                effective: "local" | "vendor_native" | "managed_api_key" | null;
-                effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
-                selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
-                costKnowledge: "exact" | "unknown" | "estimated";
-                startedAt: string;
-                completedAt: string;
-                challengeDigest: string;
-                requestDigest: string;
-                responseDigest: string;
-                streamDigest: string;
-                scratchBeforeDigest: string;
-                scratchAfterDigest: string;
-                stream: {
-                    aborted: boolean;
-                    startedEvents: number;
-                    completedEvents: number;
-                    errorEvents: number;
-                    unexpectedToolEvents: number;
-                    interactionEvents: number;
-                    sessionMismatchEvents: number;
-                    eventsAfterCompleted: number;
-                };
-                evidenceRefs: string[];
-                costUsd?: number | undefined;
-            };
-        } | {
-            attemptId: string;
-            startedAt: string;
-            challengeDigest: string;
-            requestDigest: string;
-            disclosure: {
-                schemaVersion: 1;
-                protocolVersion: 1;
-                harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
-                mayConsumeQuota: boolean;
-                generatedAt: string;
-            };
-            state: "interrupted_unknown";
-            interruptedAt: string;
-        } | undefined;
-        authorization?: {
-            args: string[];
-            commandDigest: string;
-            executionId: string;
-            manifestDigest: string;
-            executable: {
-                sha256: string;
-                mode: number;
-                realpath: string;
-                size: number;
-                device: string;
-                inode: string;
-            };
-        } | undefined;
-        nativeCommand?: {
-            commandDigest: string;
-            finishedAt: string;
-            signal: string | null;
-            executionId: string;
-            manifestDigest: string;
-            permitIssuedAt: string | null;
-            commandStarted: boolean;
-            exitCode: number | null;
-            errorCode?: "permit_timeout" | "spawn_failed" | "device_auth_unsupported" | undefined;
-        } | undefined;
-        terminationReconciliation?: {
-            status: "empty";
-            observedAt: string;
-        } | undefined;
-    }>;
-    setupJobSnapshot: (input: unknown) => Promise<{
         cursor: string;
+        previousCursor: string | null;
         sequence: number;
+        time: string;
+        kind: "status";
+        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+        message: string;
         job: {
-            message: string;
-            harness: "cursor" | "codex" | "claude";
-            startedAt: string | null;
-            state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "succeeded" | "queued" | "timed_out" | "waiting_for_input" | "not_supported";
-            profileId: string | null;
-            command: string | null;
-            createdAt: string;
             jobId: string;
-            phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
-            finishedAt: string | null;
+            harness: "claude" | "codex" | "cursor";
             action: "login";
-            guideUrl: string | null;
-            execution?: {
-                observedAt: string;
-                commandDigest: string;
-                executionId: string;
-                manifestDigest: string;
-                processGroup: {
-                    schemaVersion: 1;
-                    pgid: number;
-                    leader: {
-                        status: "known";
-                        source: "procfs_stat" | "proc_pidinfo";
-                        pid: number;
-                        platform: "linux" | "darwin";
-                        startToken: string;
-                        processGroupId: number;
-                    };
-                };
-                permitIssuedAt?: string | undefined;
-            } | undefined;
+            transport: "client_pty" | "daemon";
+            profileId: string | null;
+            state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+            phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+            deadlineAt?: string | undefined;
             outcome?: {
-                reason: "completed" | "interrupted_unknown" | "interrupted" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "termination_unconfirmed";
-                signal?: string | null | undefined;
+                reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
                 exitCode?: number | null | undefined;
+                signal?: string | null | undefined;
             } | undefined;
-            deadlineAt?: string | undefined;
+            command: string | null;
+            guideUrl: string | null;
+            message: string;
+            createdAt: string;
+            startedAt: string | null;
+            finishedAt: string | null;
             authCapability?: {
                 attemptId: string;
                 challengeDigest: string;
@@ -1086,69 +1576,70 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "disclosed";
             } | {
                 attemptId: string;
-                startedAt: string;
                 challengeDigest: string;
                 requestDigest: string;
                 disclosure: {
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "running";
+                startedAt: string;
             } | {
                 attemptId: string;
-                startedAt: string;
-                completedAt: string;
                 challengeDigest: string;
                 requestDigest: string;
                 disclosure: {
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "completed";
+                startedAt: string;
+                completedAt: string;
                 receipt: {
-                    availability: "unknown" | "available" | "unavailable";
-                    verification: "passed" | "failed" | "not_run";
-                    harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
                     receiptId: string;
                     attemptId: string;
-                    effective: "local" | "vendor_native" | "managed_api_key" | null;
-                    effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
-                    selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
-                    costKnowledge: "exact" | "unknown" | "estimated";
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    effective: "local" | "managed_api_key" | "vendor_native" | null;
+                    effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                    selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                    availability: "available" | "unavailable" | "unknown";
+                    verification: "failed" | "not_run" | "passed";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    costKnowledge: "estimated" | "exact" | "unknown";
+                    costUsd?: number | undefined;
                     startedAt: string;
                     completedAt: string;
                     challengeDigest: string;
@@ -1158,7 +1649,6 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                     scratchBeforeDigest: string;
                     scratchAfterDigest: string;
                     stream: {
-                        aborted: boolean;
                         startedEvents: number;
                         completedEvents: number;
                         errorEvents: number;
@@ -1166,114 +1656,109 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                         interactionEvents: number;
                         sessionMismatchEvents: number;
                         eventsAfterCompleted: number;
+                        aborted: boolean;
                     };
                     evidenceRefs: string[];
-                    costUsd?: number | undefined;
                 };
             } | {
                 attemptId: string;
-                startedAt: string;
                 challengeDigest: string;
                 requestDigest: string;
                 disclosure: {
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
-                state: "interrupted_unknown";
-                interruptedAt: string;
+                state: "interrupted_unknown";
+                startedAt: string;
+                interruptedAt: string;
+            } | undefined;
+            execution?: {
+                executionId: string;
+                commandDigest: string;
+                manifestDigest: string;
+                processGroup: {
+                    schemaVersion: 1;
+                    pgid: number;
+                    leader: {
+                        status: "known";
+                        pid: number;
+                        platform: "darwin" | "linux";
+                        source: "proc_pidinfo" | "procfs_stat";
+                        startToken: string;
+                        processGroupId: number;
+                    };
+                };
+                observedAt: string;
+                permitIssuedAt?: string | undefined;
             } | undefined;
             authorization?: {
-                args: string[];
-                commandDigest: string;
                 executionId: string;
-                manifestDigest: string;
                 executable: {
-                    sha256: string;
-                    mode: number;
                     realpath: string;
+                    sha256: string;
                     size: number;
+                    mode: number;
                     device: string;
                     inode: string;
                 };
+                args: string[];
+                commandDigest: string;
+                manifestDigest: string;
             } | undefined;
             nativeCommand?: {
-                commandDigest: string;
-                finishedAt: string;
-                signal: string | null;
                 executionId: string;
+                commandDigest: string;
                 manifestDigest: string;
                 permitIssuedAt: string | null;
                 commandStarted: boolean;
                 exitCode: number | null;
-                errorCode?: "permit_timeout" | "spawn_failed" | "device_auth_unsupported" | undefined;
+                signal: string | null;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
                 status: "empty";
                 observedAt: string;
             } | undefined;
         };
-        deviceCode?: {
-            flow: "chatgptDeviceCode" | "chatgpt";
-            verificationUrl: string;
-            userCode: string;
-        } | undefined;
-    }>;
-    setupJobEvents: (input: unknown) => Promise<{
-        message: string;
-        cursor: string;
-        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "succeeded" | "queued" | "timed_out" | "waiting_for_input" | "not_supported";
-        kind: "status";
-        time: string;
+    } | {
         jobId: string;
+        cursor: string;
         previousCursor: string | null;
         sequence: number;
+        time: string;
+        kind: "status";
+        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+        message: string;
         job: {
-            message: string;
-            harness: "cursor" | "codex" | "claude";
-            startedAt: string | null;
-            state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "succeeded" | "queued" | "timed_out" | "waiting_for_input" | "not_supported";
-            profileId: string | null;
-            command: string | null;
-            createdAt: string;
             jobId: string;
-            phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
-            finishedAt: string | null;
+            harness: "claude" | "codex" | "cursor";
             action: "login";
-            guideUrl: string | null;
-            execution?: {
-                observedAt: string;
-                commandDigest: string;
-                executionId: string;
-                manifestDigest: string;
-                processGroup: {
-                    schemaVersion: 1;
-                    pgid: number;
-                    leader: {
-                        status: "known";
-                        source: "procfs_stat" | "proc_pidinfo";
-                        pid: number;
-                        platform: "linux" | "darwin";
-                        startToken: string;
-                        processGroupId: number;
-                    };
-                };
-                permitIssuedAt?: string | undefined;
-            } | undefined;
+            transport: "client_pty" | "daemon";
+            profileId: string | null;
+            state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+            phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+            deadlineAt?: string | undefined;
             outcome?: {
-                reason: "completed" | "interrupted_unknown" | "interrupted" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "termination_unconfirmed";
-                signal?: string | null | undefined;
+                reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
                 exitCode?: number | null | undefined;
+                signal?: string | null | undefined;
             } | undefined;
-            deadlineAt?: string | undefined;
+            command: string | null;
+            guideUrl: string | null;
+            message: string;
+            createdAt: string;
+            startedAt: string | null;
+            finishedAt: string | null;
             authCapability?: {
                 attemptId: string;
                 challengeDigest: string;
@@ -1282,69 +1767,70 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "disclosed";
             } | {
                 attemptId: string;
-                startedAt: string;
                 challengeDigest: string;
                 requestDigest: string;
                 disclosure: {
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "running";
+                startedAt: string;
             } | {
                 attemptId: string;
-                startedAt: string;
-                completedAt: string;
                 challengeDigest: string;
                 requestDigest: string;
                 disclosure: {
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "completed";
+                startedAt: string;
+                completedAt: string;
                 receipt: {
-                    availability: "unknown" | "available" | "unavailable";
-                    verification: "passed" | "failed" | "not_run";
-                    harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
                     receiptId: string;
                     attemptId: string;
-                    effective: "local" | "vendor_native" | "managed_api_key" | null;
-                    effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
-                    selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
-                    costKnowledge: "exact" | "unknown" | "estimated";
+                    harness: string;
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                    effective: "local" | "managed_api_key" | "vendor_native" | null;
+                    effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                    selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                    availability: "available" | "unavailable" | "unknown";
+                    verification: "failed" | "not_run" | "passed";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    costKnowledge: "estimated" | "exact" | "unknown";
+                    costUsd?: number | undefined;
                     startedAt: string;
                     completedAt: string;
                     challengeDigest: string;
@@ -1354,7 +1840,6 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                     scratchBeforeDigest: string;
                     scratchAfterDigest: string;
                     stream: {
-                        aborted: boolean;
                         startedEvents: number;
                         completedEvents: number;
                         errorEvents: number;
@@ -1362,105 +1847,106 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                         interactionEvents: number;
                         sessionMismatchEvents: number;
                         eventsAfterCompleted: number;
+                        aborted: boolean;
                     };
                     evidenceRefs: string[];
-                    costUsd?: number | undefined;
                 };
             } | {
                 attemptId: string;
-                startedAt: string;
                 challengeDigest: string;
                 requestDigest: string;
                 disclosure: {
                     schemaVersion: 1;
                     protocolVersion: 1;
                     harness: string;
-                    requested: "auto" | "subscription" | "api_key";
-                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    requested: "api_key" | "auto" | "subscription";
+                    requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                    requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                     networkScope: "selected_harness_only";
-                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                    incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                     mayConsumeQuota: boolean;
                     generatedAt: string;
                 };
                 state: "interrupted_unknown";
+                startedAt: string;
                 interruptedAt: string;
             } | undefined;
-            authorization?: {
-                args: string[];
-                commandDigest: string;
+            execution?: {
                 executionId: string;
+                commandDigest: string;
                 manifestDigest: string;
+                processGroup: {
+                    schemaVersion: 1;
+                    pgid: number;
+                    leader: {
+                        status: "known";
+                        pid: number;
+                        platform: "darwin" | "linux";
+                        source: "proc_pidinfo" | "procfs_stat";
+                        startToken: string;
+                        processGroupId: number;
+                    };
+                };
+                observedAt: string;
+                permitIssuedAt?: string | undefined;
+            } | undefined;
+            authorization?: {
+                executionId: string;
                 executable: {
-                    sha256: string;
-                    mode: number;
                     realpath: string;
+                    sha256: string;
                     size: number;
+                    mode: number;
                     device: string;
                     inode: string;
                 };
+                args: string[];
+                commandDigest: string;
+                manifestDigest: string;
             } | undefined;
             nativeCommand?: {
-                commandDigest: string;
-                finishedAt: string;
-                signal: string | null;
                 executionId: string;
+                commandDigest: string;
                 manifestDigest: string;
                 permitIssuedAt: string | null;
                 commandStarted: boolean;
                 exitCode: number | null;
-                errorCode?: "permit_timeout" | "spawn_failed" | "device_auth_unsupported" | undefined;
+                signal: string | null;
+                errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+                finishedAt: string;
             } | undefined;
             terminationReconciliation?: {
                 status: "empty";
                 observedAt: string;
             } | undefined;
         };
-        deviceCode?: {
-            flow: "chatgptDeviceCode" | "chatgpt";
+        deviceCode: {
+            flow: "chatgpt" | "chatgptDeviceCode";
             verificationUrl: string;
             userCode: string;
-        } | undefined;
-    }[]>;
+        };
+    })[]>;
     cancelSetupJob: (input: unknown) => Promise<{
-        message: string;
-        harness: "cursor" | "codex" | "claude";
-        startedAt: string | null;
-        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "succeeded" | "queued" | "timed_out" | "waiting_for_input" | "not_supported";
-        profileId: string | null;
-        command: string | null;
-        createdAt: string;
         jobId: string;
-        phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
-        finishedAt: string | null;
+        harness: "claude" | "codex" | "cursor";
         action: "login";
-        guideUrl: string | null;
-        execution?: {
-            observedAt: string;
-            commandDigest: string;
-            executionId: string;
-            manifestDigest: string;
-            processGroup: {
-                schemaVersion: 1;
-                pgid: number;
-                leader: {
-                    status: "known";
-                    source: "procfs_stat" | "proc_pidinfo";
-                    pid: number;
-                    platform: "linux" | "darwin";
-                    startToken: string;
-                    processGroupId: number;
-                };
-            };
-            permitIssuedAt?: string | undefined;
-        } | undefined;
+        transport: "client_pty" | "daemon";
+        profileId: string | null;
+        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+        phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+        deadlineAt?: string | undefined;
         outcome?: {
-            reason: "completed" | "interrupted_unknown" | "interrupted" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "termination_unconfirmed";
-            signal?: string | null | undefined;
+            reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
             exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
         } | undefined;
-        deadlineAt?: string | undefined;
+        command: string | null;
+        guideUrl: string | null;
+        message: string;
+        createdAt: string;
+        startedAt: string | null;
+        finishedAt: string | null;
         authCapability?: {
             attemptId: string;
             challengeDigest: string;
@@ -1469,69 +1955,70 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "disclosed";
         } | {
             attemptId: string;
-            startedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "running";
+            startedAt: string;
         } | {
             attemptId: string;
-            startedAt: string;
-            completedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "completed";
+            startedAt: string;
+            completedAt: string;
             receipt: {
-                availability: "unknown" | "available" | "unavailable";
-                verification: "passed" | "failed" | "not_run";
-                harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
                 receiptId: string;
                 attemptId: string;
-                effective: "local" | "vendor_native" | "managed_api_key" | null;
-                effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
-                selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
-                costKnowledge: "exact" | "unknown" | "estimated";
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                effective: "local" | "managed_api_key" | "vendor_native" | null;
+                effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                availability: "available" | "unavailable" | "unknown";
+                verification: "failed" | "not_run" | "passed";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                costKnowledge: "estimated" | "exact" | "unknown";
+                costUsd?: number | undefined;
                 startedAt: string;
                 completedAt: string;
                 challengeDigest: string;
@@ -1541,7 +2028,6 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 scratchBeforeDigest: string;
                 scratchAfterDigest: string;
                 stream: {
-                    aborted: boolean;
                     startedEvents: number;
                     completedEvents: number;
                     errorEvents: number;
@@ -1549,55 +2035,74 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                     interactionEvents: number;
                     sessionMismatchEvents: number;
                     eventsAfterCompleted: number;
+                    aborted: boolean;
                 };
                 evidenceRefs: string[];
-                costUsd?: number | undefined;
             };
         } | {
             attemptId: string;
-            startedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "interrupted_unknown";
+            startedAt: string;
             interruptedAt: string;
         } | undefined;
-        authorization?: {
-            args: string[];
-            commandDigest: string;
+        execution?: {
             executionId: string;
+            commandDigest: string;
             manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    pid: number;
+                    platform: "darwin" | "linux";
+                    source: "proc_pidinfo" | "procfs_stat";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            observedAt: string;
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        authorization?: {
+            executionId: string;
             executable: {
-                sha256: string;
-                mode: number;
                 realpath: string;
+                sha256: string;
                 size: number;
+                mode: number;
                 device: string;
                 inode: string;
             };
+            args: string[];
+            commandDigest: string;
+            manifestDigest: string;
         } | undefined;
         nativeCommand?: {
-            commandDigest: string;
-            finishedAt: string;
-            signal: string | null;
             executionId: string;
+            commandDigest: string;
             manifestDigest: string;
             permitIssuedAt: string | null;
             commandStarted: boolean;
             exitCode: number | null;
-            errorCode?: "permit_timeout" | "spawn_failed" | "device_auth_unsupported" | undefined;
+            signal: string | null;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+            finishedAt: string;
         } | undefined;
         terminationReconciliation?: {
             status: "empty";
@@ -1605,43 +2110,25 @@ export declare function controlServices(interactions: InteractionRegistry, proje
         } | undefined;
     }>;
     reconcileSetupJob: (input: unknown) => Promise<{
-        message: string;
-        harness: "cursor" | "codex" | "claude";
-        startedAt: string | null;
-        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "succeeded" | "queued" | "timed_out" | "waiting_for_input" | "not_supported";
-        profileId: string | null;
-        command: string | null;
-        createdAt: string;
         jobId: string;
-        phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
-        finishedAt: string | null;
+        harness: "claude" | "codex" | "cursor";
         action: "login";
-        guideUrl: string | null;
-        execution?: {
-            observedAt: string;
-            commandDigest: string;
-            executionId: string;
-            manifestDigest: string;
-            processGroup: {
-                schemaVersion: 1;
-                pgid: number;
-                leader: {
-                    status: "known";
-                    source: "procfs_stat" | "proc_pidinfo";
-                    pid: number;
-                    platform: "linux" | "darwin";
-                    startToken: string;
-                    processGroupId: number;
-                };
-            };
-            permitIssuedAt?: string | undefined;
-        } | undefined;
+        transport: "client_pty" | "daemon";
+        profileId: string | null;
+        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+        phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+        deadlineAt?: string | undefined;
         outcome?: {
-            reason: "completed" | "interrupted_unknown" | "interrupted" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "termination_unconfirmed";
-            signal?: string | null | undefined;
+            reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
             exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
         } | undefined;
-        deadlineAt?: string | undefined;
+        command: string | null;
+        guideUrl: string | null;
+        message: string;
+        createdAt: string;
+        startedAt: string | null;
+        finishedAt: string | null;
         authCapability?: {
             attemptId: string;
             challengeDigest: string;
@@ -1650,69 +2137,70 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "disclosed";
         } | {
             attemptId: string;
-            startedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "running";
+            startedAt: string;
         } | {
             attemptId: string;
-            startedAt: string;
-            completedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "completed";
+            startedAt: string;
+            completedAt: string;
             receipt: {
-                availability: "unknown" | "available" | "unavailable";
-                verification: "passed" | "failed" | "not_run";
-                harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
                 receiptId: string;
                 attemptId: string;
-                effective: "local" | "vendor_native" | "managed_api_key" | null;
-                effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
-                selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
-                costKnowledge: "exact" | "unknown" | "estimated";
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                effective: "local" | "managed_api_key" | "vendor_native" | null;
+                effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                availability: "available" | "unavailable" | "unknown";
+                verification: "failed" | "not_run" | "passed";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                costKnowledge: "estimated" | "exact" | "unknown";
+                costUsd?: number | undefined;
                 startedAt: string;
                 completedAt: string;
                 challengeDigest: string;
@@ -1722,7 +2210,6 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 scratchBeforeDigest: string;
                 scratchAfterDigest: string;
                 stream: {
-                    aborted: boolean;
                     startedEvents: number;
                     completedEvents: number;
                     errorEvents: number;
@@ -1730,55 +2217,74 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                     interactionEvents: number;
                     sessionMismatchEvents: number;
                     eventsAfterCompleted: number;
+                    aborted: boolean;
                 };
                 evidenceRefs: string[];
-                costUsd?: number | undefined;
             };
         } | {
             attemptId: string;
-            startedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "interrupted_unknown";
+            startedAt: string;
             interruptedAt: string;
         } | undefined;
-        authorization?: {
-            args: string[];
-            commandDigest: string;
+        execution?: {
             executionId: string;
+            commandDigest: string;
             manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    pid: number;
+                    platform: "darwin" | "linux";
+                    source: "proc_pidinfo" | "procfs_stat";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            observedAt: string;
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        authorization?: {
+            executionId: string;
             executable: {
-                sha256: string;
-                mode: number;
                 realpath: string;
+                sha256: string;
                 size: number;
+                mode: number;
                 device: string;
                 inode: string;
             };
+            args: string[];
+            commandDigest: string;
+            manifestDigest: string;
         } | undefined;
         nativeCommand?: {
-            commandDigest: string;
-            finishedAt: string;
-            signal: string | null;
             executionId: string;
+            commandDigest: string;
             manifestDigest: string;
             permitIssuedAt: string | null;
             commandStarted: boolean;
             exitCode: number | null;
-            errorCode?: "permit_timeout" | "spawn_failed" | "device_auth_unsupported" | undefined;
+            signal: string | null;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+            finishedAt: string;
         } | undefined;
         terminationReconciliation?: {
             status: "empty";
@@ -1786,43 +2292,25 @@ export declare function controlServices(interactions: InteractionRegistry, proje
         } | undefined;
     }>;
     extendSetupJob: (input: unknown) => Promise<{
-        message: string;
-        harness: "cursor" | "codex" | "claude";
-        startedAt: string | null;
-        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "succeeded" | "queued" | "timed_out" | "waiting_for_input" | "not_supported";
-        profileId: string | null;
-        command: string | null;
-        createdAt: string;
         jobId: string;
-        phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
-        finishedAt: string | null;
+        harness: "claude" | "codex" | "cursor";
         action: "login";
-        guideUrl: string | null;
-        execution?: {
-            observedAt: string;
-            commandDigest: string;
-            executionId: string;
-            manifestDigest: string;
-            processGroup: {
-                schemaVersion: 1;
-                pgid: number;
-                leader: {
-                    status: "known";
-                    source: "procfs_stat" | "proc_pidinfo";
-                    pid: number;
-                    platform: "linux" | "darwin";
-                    startToken: string;
-                    processGroupId: number;
-                };
-            };
-            permitIssuedAt?: string | undefined;
-        } | undefined;
+        transport: "client_pty" | "daemon";
+        profileId: string | null;
+        state: "cancelled" | "failed" | "interrupted_unknown" | "not_supported" | "queued" | "running" | "succeeded" | "timed_out" | "waiting_for_input";
+        phase: "awaiting_user" | "cancelling" | "completed" | "launching" | "preparing" | "verifying";
+        deadlineAt?: string | undefined;
         outcome?: {
-            reason: "completed" | "interrupted_unknown" | "interrupted" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "termination_unconfirmed";
-            signal?: string | null | undefined;
+            reason: "auth_not_ready" | "cancelled_by_user" | "cancelled_on_restart" | "capability_verification_failed" | "command_failed" | "completed" | "credential_route_mismatch" | "interrupted" | "interrupted_unknown" | "launch_failed" | "not_supported" | "termination_unconfirmed" | "timed_out";
             exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
         } | undefined;
-        deadlineAt?: string | undefined;
+        command: string | null;
+        guideUrl: string | null;
+        message: string;
+        createdAt: string;
+        startedAt: string | null;
+        finishedAt: string | null;
         authCapability?: {
             attemptId: string;
             challengeDigest: string;
@@ -1831,69 +2319,70 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "disclosed";
         } | {
             attemptId: string;
-            startedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "running";
+            startedAt: string;
         } | {
             attemptId: string;
-            startedAt: string;
-            completedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "completed";
+            startedAt: string;
+            completedAt: string;
             receipt: {
-                availability: "unknown" | "available" | "unavailable";
-                verification: "passed" | "failed" | "not_run";
-                harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
                 receiptId: string;
                 attemptId: string;
-                effective: "local" | "vendor_native" | "managed_api_key" | null;
-                effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
-                selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
-                costKnowledge: "exact" | "unknown" | "estimated";
+                harness: string;
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
+                effective: "local" | "managed_api_key" | "vendor_native" | null;
+                effectiveSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file" | null;
+                selectionReason: "adapter_error" | "adapter_identity_mismatch" | "adapter_unavailable" | "cancelled" | "exact_requested_route" | "harness_error" | "missing_completion" | "protocol_violation" | "request_mismatch" | "response_mismatch" | "route_mismatch" | "route_missing" | "scratch_mutated" | "source_mismatch" | "source_missing";
+                availability: "available" | "unavailable" | "unknown";
+                verification: "failed" | "not_run" | "passed";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                costKnowledge: "estimated" | "exact" | "unknown";
+                costUsd?: number | undefined;
                 startedAt: string;
                 completedAt: string;
                 challengeDigest: string;
@@ -1903,7 +2392,6 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 scratchBeforeDigest: string;
                 scratchAfterDigest: string;
                 stream: {
-                    aborted: boolean;
                     startedEvents: number;
                     completedEvents: number;
                     errorEvents: number;
@@ -1911,55 +2399,74 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                     interactionEvents: number;
                     sessionMismatchEvents: number;
                     eventsAfterCompleted: number;
+                    aborted: boolean;
                 };
                 evidenceRefs: string[];
-                costUsd?: number | undefined;
             };
         } | {
             attemptId: string;
-            startedAt: string;
             challengeDigest: string;
             requestDigest: string;
             disclosure: {
                 schemaVersion: 1;
                 protocolVersion: 1;
                 harness: string;
-                requested: "auto" | "subscription" | "api_key";
-                requiredRoute: "local" | "vendor_native" | "managed_api_key";
-                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                requested: "api_key" | "auto" | "subscription";
+                requiredRoute: "local" | "managed_api_key" | "vendor_native";
+                requiredSource: "api_key_env" | "api_key_flag" | "native_session" | "none" | "oauth_token_env" | "provider_auth_file";
                 networkScope: "selected_harness_only";
-                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
-                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                billingKnowledge: "metered" | "proven_zero" | "subscription_entitlement" | "unknown";
+                incrementalCostKnowledge: "estimated" | "exact" | "unknown";
                 mayConsumeQuota: boolean;
                 generatedAt: string;
             };
             state: "interrupted_unknown";
+            startedAt: string;
             interruptedAt: string;
         } | undefined;
-        authorization?: {
-            args: string[];
-            commandDigest: string;
+        execution?: {
             executionId: string;
+            commandDigest: string;
             manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    pid: number;
+                    platform: "darwin" | "linux";
+                    source: "proc_pidinfo" | "procfs_stat";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            observedAt: string;
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        authorization?: {
+            executionId: string;
             executable: {
-                sha256: string;
-                mode: number;
                 realpath: string;
+                sha256: string;
                 size: number;
+                mode: number;
                 device: string;
                 inode: string;
             };
+            args: string[];
+            commandDigest: string;
+            manifestDigest: string;
         } | undefined;
         nativeCommand?: {
-            commandDigest: string;
-            finishedAt: string;
-            signal: string | null;
             executionId: string;
+            commandDigest: string;
             manifestDigest: string;
             permitIssuedAt: string | null;
             commandStarted: boolean;
             exitCode: number | null;
-            errorCode?: "permit_timeout" | "spawn_failed" | "device_auth_unsupported" | undefined;
+            signal: string | null;
+            errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+            finishedAt: string;
         } | undefined;
         terminationReconciliation?: {
             status: "empty";
@@ -1967,98 +2474,98 @@ export declare function controlServices(interactions: InteractionRegistry, proje
         } | undefined;
     }>;
     journalEvents: (partition: string, afterCursor?: string) => Promise<{
-        type: string;
-        cursor: string;
-        observedAt: string;
         schemaVersion: 1;
+        cursor: string;
         partition: string;
+        type: string;
+        observedAt: string;
         payload?: unknown;
     }[]>;
     recoveryInspectPartition: (partition: string) => Promise<{
-        status: "ready" | "recovery_required";
-        observedAt: string;
         schemaVersion: 1;
-        evidenceRefs: string[];
+        partition: string;
+        generation: number;
+        status: "ready" | "recovery_required";
         recovery: {
             status: "ready";
             discardedTailBytes: number;
         } | {
             status: "recovery_required";
-            reason: string;
             location: {
                 kind: "byte";
                 byteOffset: number;
             } | {
                 kind: "cursor";
-                seq: number;
                 epoch: string;
+                seq: number;
             };
+            reason: string;
             discardedTailBytes: number;
         };
-        partition: string;
-        generation: number;
         fingerprint: string;
+        observedAt: string;
+        evidenceRefs: string[];
     }>;
     recoveryValidatePartition: (partition: string) => Promise<{
-        status: "ready" | "recovery_required";
-        observedAt: string;
         schemaVersion: 1;
-        evidenceRefs: string[];
+        partition: string;
+        generation: number;
+        status: "ready" | "recovery_required";
         recovery: {
             status: "ready";
             discardedTailBytes: number;
         } | {
             status: "recovery_required";
-            reason: string;
             location: {
                 kind: "byte";
                 byteOffset: number;
             } | {
                 kind: "cursor";
-                seq: number;
                 epoch: string;
+                seq: number;
             };
+            reason: string;
             discardedTailBytes: number;
         };
-        partition: string;
-        generation: number;
         fingerprint: string;
+        observedAt: string;
+        evidenceRefs: string[];
         projectionStatus: {
-            status: "valid" | "invalid";
-            detail: string | null;
             name: string;
+            status: "invalid" | "valid";
+            detail: string | null;
         }[];
     }>;
     recoveryExportPartition: (partition: string) => Promise<{
         schemaVersion: 1;
-        createdAt: string;
+        exportId: string;
         partition: string;
         fingerprint: string;
-        exportId: string;
         bundlePath: string;
         manifestSha256: string;
+        createdAt: string;
     }>;
     recoveryQuarantinePartition: (partition: string, input: unknown) => Promise<{
         schemaVersion: 1;
-        completedAt: string;
-        partition: string;
         operationId: string;
+        partition: string;
         previousFingerprint: string;
         quarantineArtifactId: string;
         quarantinePath: string;
         newEpoch: string;
+        completedAt: string;
     } | null>;
     settings: () => Promise<{
         sources: string[];
-        interactionTimeoutMs: number;
+        interactionTimeoutMs: number | null;
         routing: {
             primaryHarness: string | null;
             eligibleHarnesses: string[];
-            envInheritance: "mirror_native" | "clean";
+            envInheritance: "clean" | "mirror_native";
             authPreference: "api_key" | "auto" | "subscription";
-            goal: "auto" | "quality" | "economy";
-            paidFallback: "never" | "when_unavailable" | "allowed_within_cap";
-            qualityTiers: Partial<Record<"plan" | "review" | "synthesize" | "spec" | "implement" | "create_from_scratch" | "repair" | "verify" | "explain" | "audit", {
+            goal: "auto" | "economy" | "quality";
+            paidFallback: "allowed_within_cap" | "never" | "when_unavailable";
+            qualityTiers: Partial<Record<"audit" | "create_from_scratch" | "explain" | "implement" | "plan" | "repair" | "review" | "spec" | "synthesize" | "verify", {
                 harness: string;
                 model: string;
                 effort: string;
@@ -2092,18 +2599,17 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 toolsAllow: string[];
                 toolsDeny: string[];
                 fallbackModel: string | null;
-                web: "auto" | "off" | "cached" | "live";
+                web: "auto" | "cached" | "live" | "off";
                 authPreference: "api_key" | "auto" | "subscription";
-                profileLimitAction: "fail" | "ask" | "rotate";
+                profileLimitAction: "ask" | "fail" | "rotate";
             };
         };
     }>;
     quota: () => Promise<{
         snapshots: {
-            source: "codex_app_server" | "codex_rollout" | "claude_statusline" | "claude_api_retry" | "claude_oauth_usage";
             subject: {
                 harness: string;
-                credential_route: "local" | "vendor_native" | "managed_api_key";
+                credential_route: "local" | "managed_api_key" | "vendor_native";
                 plan_label: string | null;
                 subject_id: string | null;
             };
@@ -2115,28 +2621,28 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 resets_at: string | null;
                 cooldown_until: string | null;
             }[];
+            source: "claude_api_retry" | "claude_oauth_usage" | "claude_statusline" | "codex_app_server" | "codex_rollout";
             observed_at: string;
-            freshness: "unknown" | "fresh" | "stale";
+            freshness: "fresh" | "stale" | "unknown";
         }[];
         absences: {
-            detail: string | null;
-            reason: "not_logged_in" | "transport_unavailable" | "platform_unsupported" | "refresh_failed" | "no_source";
             subject: {
                 harness: string;
-                credential_route: "local" | "vendor_native" | "managed_api_key";
+                credential_route: "local" | "managed_api_key" | "vendor_native";
                 plan_label: string | null;
                 subject_id: string | null;
             };
+            reason: "no_source" | "not_logged_in" | "platform_unsupported" | "refresh_failed" | "transport_unavailable";
+            detail: string | null;
             observed_at: string;
         }[];
         refreshed_at: string | null;
     }>;
     refreshQuota: () => Promise<{
         snapshots: {
-            source: "codex_app_server" | "codex_rollout" | "claude_statusline" | "claude_api_retry" | "claude_oauth_usage";
             subject: {
                 harness: string;
-                credential_route: "local" | "vendor_native" | "managed_api_key";
+                credential_route: "local" | "managed_api_key" | "vendor_native";
                 plan_label: string | null;
                 subject_id: string | null;
             };
@@ -2148,23 +2654,26 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 resets_at: string | null;
                 cooldown_until: string | null;
             }[];
+            source: "claude_api_retry" | "claude_oauth_usage" | "claude_statusline" | "codex_app_server" | "codex_rollout";
             observed_at: string;
-            freshness: "unknown" | "fresh" | "stale";
+            freshness: "fresh" | "stale" | "unknown";
         }[];
         absences: {
-            detail: string | null;
-            reason: "not_logged_in" | "transport_unavailable" | "platform_unsupported" | "refresh_failed" | "no_source";
             subject: {
                 harness: string;
-                credential_route: "local" | "vendor_native" | "managed_api_key";
+                credential_route: "local" | "managed_api_key" | "vendor_native";
                 plan_label: string | null;
                 subject_id: string | null;
             };
+            reason: "no_source" | "not_logged_in" | "platform_unsupported" | "refresh_failed" | "transport_unavailable";
+            detail: string | null;
             observed_at: string;
         }[];
         refreshed_at: string | null;
     }>;
-    credentialProfiles: () => Promise<{
+    credentialProfiles: (input?: {
+        snapshot?: boolean;
+    }) => Promise<{
         profiles: {
             profile: {
                 profile_id: string;
@@ -2177,16 +2686,16 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 created_at: string | null;
             };
             status: {
-                availability: "unknown" | "available" | "unavailable";
-                verification: "passed" | "failed" | "not_run";
                 profile_id: string;
                 harness_id: string;
-                last_verified_at: string | null;
+                availability: "available" | "unavailable" | "unknown";
+                verification: "failed" | "not_run" | "passed";
                 detail?: string | undefined;
+                last_verified_at: string | null;
             };
             identity: {
-                plan?: string | undefined;
                 email?: string | undefined;
+                plan?: string | undefined;
             } | null;
         }[];
         harnessAccounts: {
@@ -2194,14 +2703,133 @@ export declare function controlServices(interactions: InteractionRegistry, proje
             native_credentials_enabled: boolean;
             native_login_detected: boolean;
             identity: {
+                email?: string | undefined;
+                plan?: string | undefined;
+            } | null;
+            next_up: {
+                kind: "profile";
+                profileId: string;
+            } | {
+                kind: "native";
+                route?: "api_key" | "local_session" | undefined;
+            } | {
+                kind: "none";
+                reason: string;
+            };
+        }[];
+        harnesses: {
+            id: string;
+            available: boolean;
+            status: "ok" | "degraded" | "unavailable";
+            manifest: import("@claudexor/schema").HarnessManifest | null;
+            enabledIntents: import("@claudexor/schema").Intent[];
+            routableIntents: import("@claudexor/schema").Intent[];
+            disabledIntents: import("@claudexor/schema").Intent[];
+            checks: import("@claudexor/schema").ConformanceCheck[];
+            reasons: string[];
+            authSources: import("@claudexor/schema").AuthSourceReadiness[];
+            configuredModel: string | null;
+            configuredModelCheck: {
+                status: "ok" | "rejected";
+                message?: string | null;
+            } | null;
+            delegation: {
+                available: boolean;
+                reason: "manifest_unsupported" | "ready" | "runtime_unavailable";
+                remediation: string | null;
+                requiresFullAccess: boolean;
+            };
+            readiness: {
+                id: string;
+                kind: "auth" | "binary" | "model" | "probe" | "smoke";
+                title: string;
+                status: "fail" | "pass" | "skip";
+                detail: string | null;
+            }[];
+        }[];
+        git: {
+            status: "available" | "developer_tools_stub" | "failed" | "missing";
+            version: string | null;
+            detail: string | null;
+            remediation: string | null;
+        };
+        quota: {
+            snapshots: {
+                subject: {
+                    harness: string;
+                    credential_route: "local" | "managed_api_key" | "vendor_native";
+                    plan_label: string | null;
+                    subject_id: string | null;
+                };
+                constraints: {
+                    id: string;
+                    label: string;
+                    used_ratio: number | null;
+                    window_seconds: number | null;
+                    resets_at: string | null;
+                    cooldown_until: string | null;
+                }[];
+                source: "claude_api_retry" | "claude_oauth_usage" | "claude_statusline" | "codex_app_server" | "codex_rollout";
+                observed_at: string;
+                freshness: "fresh" | "stale" | "unknown";
+            }[];
+            absences: {
+                subject: {
+                    harness: string;
+                    credential_route: "local" | "managed_api_key" | "vendor_native";
+                    plan_label: string | null;
+                    subject_id: string | null;
+                };
+                reason: "no_source" | "not_logged_in" | "platform_unsupported" | "refresh_failed" | "transport_unavailable";
+                detail: string | null;
+                observed_at: string;
+            }[];
+            refreshed_at: string | null;
+        };
+        quotaEventCursor: string;
+    } | {
+        harnesses?: undefined;
+        git?: undefined;
+        quota?: undefined;
+        quotaEventCursor?: undefined;
+        profiles: {
+            profile: {
+                profile_id: string;
+                harness_id: string;
+                display_name: string;
+                credential_kind: "api_key" | "config_dir_login" | "oauth_token";
+                isolation_locator: string | null;
+                secret_ref: string | null;
+                enabled: boolean;
+                created_at: string | null;
+            };
+            status: {
+                profile_id: string;
+                harness_id: string;
+                availability: "available" | "unavailable" | "unknown";
+                verification: "failed" | "not_run" | "passed";
+                detail?: string | undefined;
+                last_verified_at: string | null;
+            };
+            identity: {
+                email?: string | undefined;
                 plan?: string | undefined;
+            } | null;
+        }[];
+        harnessAccounts: {
+            harness_id: string;
+            native_credentials_enabled: boolean;
+            native_login_detected: boolean;
+            identity: {
                 email?: string | undefined;
+                plan?: string | undefined;
             } | null;
             next_up: {
                 kind: "profile";
                 profileId: string;
             } | {
                 kind: "native";
+                route?: "api_key" | "local_session" | undefined;
             } | {
                 kind: "none";
                 reason: string;
@@ -2220,16 +2848,15 @@ export declare function controlServices(interactions: InteractionRegistry, proje
             created_at: string | null;
         };
         status: {
-            availability: "unknown" | "available" | "unavailable";
-            verification: "passed" | "failed" | "not_run";
             profile_id: string;
             harness_id: string;
-            last_verified_at: string | null;
+            availability: "available" | "unavailable" | "unknown";
+            verification: "failed" | "not_run" | "passed";
             detail?: string | undefined;
+            last_verified_at: string | null;
         };
     }>;
     deleteCredentialProfile: (input: unknown) => Promise<{
-        cleanupWarning?: string | undefined;
         profile: {
             profile_id: string;
             harness_id: string;
@@ -2241,7 +2868,8 @@ export declare function controlServices(interactions: InteractionRegistry, proje
             created_at: string | null;
         };
         removed: boolean;
-        credentialCleanup: "none" | "config_dir_removed" | "secret_deleted";
+        credentialCleanup: "config_dir_removed" | "none" | "secret_deleted";
+        cleanupWarning?: string | undefined;
     }>;
     createCredentialProfile: (input: unknown) => Promise<{
         profile: {
@@ -2255,25 +2883,25 @@ export declare function controlServices(interactions: InteractionRegistry, proje
             created_at: string | null;
         };
         status: {
-            availability: "unknown" | "available" | "unavailable";
-            verification: "passed" | "failed" | "not_run";
             profile_id: string;
             harness_id: string;
-            last_verified_at: string | null;
+            availability: "available" | "unavailable" | "unknown";
+            verification: "failed" | "not_run" | "passed";
             detail?: string | undefined;
+            last_verified_at: string | null;
         };
     }>;
     updateSettings: (patch: unknown) => Promise<{
         sources: string[];
-        interactionTimeoutMs: number;
+        interactionTimeoutMs: number | null;
         routing: {
             primaryHarness: string | null;
             eligibleHarnesses: string[];
-            envInheritance: "mirror_native" | "clean";
+            envInheritance: "clean" | "mirror_native";
             authPreference: "api_key" | "auto" | "subscription";
-            goal: "auto" | "quality" | "economy";
-            paidFallback: "never" | "when_unavailable" | "allowed_within_cap";
-            qualityTiers: Partial<Record<"plan" | "review" | "synthesize" | "spec" | "implement" | "create_from_scratch" | "repair" | "verify" | "explain" | "audit", {
+            goal: "auto" | "economy" | "quality";
+            paidFallback: "allowed_within_cap" | "never" | "when_unavailable";
+            qualityTiers: Partial<Record<"audit" | "create_from_scratch" | "explain" | "implement" | "plan" | "repair" | "review" | "spec" | "synthesize" | "verify", {
                 harness: string;
                 model: string;
                 effort: string;
@@ -2307,9 +2935,9 @@ export declare function controlServices(interactions: InteractionRegistry, proje
                 toolsAllow: string[];
                 toolsDeny: string[];
                 fallbackModel: string | null;
-                web: "auto" | "off" | "cached" | "live";
+                web: "auto" | "cached" | "live" | "off";
                 authPreference: "api_key" | "auto" | "subscription";
-                profileLimitAction: "fail" | "ask" | "rotate";
+                profileLimitAction: "ask" | "fail" | "rotate";
             };
         };
     }>;
@@ -2322,10 +2950,10 @@ export declare function controlServices(interactions: InteractionRegistry, proje
         }[];
     }>;
     setSecret: (input: unknown) => Promise<{
-        warning?: string | undefined;
         name: string;
         backend: "file";
         stored: boolean;
+        warning?: string | undefined;
     }>;
     deleteSecret: (name: string) => Promise<{
         name: string;