@claudexor/schema 3.2.0 → 3.3.7-rc.0

package/dist/control-run-failure.d.ts

@@ -0,0 +1,57 @@
+import { z } from "zod/v3";
+/**
+ * The typed run-failure contract, split out of `control.ts` for the reason the
+ * complexity ratchet exists (INV-124): `control.ts` is the file every new
+ * control-surface field lands in, and this family — the failure sub-code plus
+ * the `RunFailure` record that carries it — is a self-contained unit with its
+ * own consumers (budget classifier, quota refusal, CLI/MCP projections).
+ * Re-exported through `index.ts` like the other `control-*` splits, so every
+ * caller keeps importing it from `@claudexor/schema`.
+ */
+export declare const RunFailureCode: z.ZodEnum<["finite_zero", "hard_cap", "estimate_headroom", "unknown_paid_in_flight", "budget_overshoot", "cost_unverifiable", "delegation_child_drain_timeout", "subscription_window_exhausted", "delegated_home_unavailable", "delegated_confinement_unavailable", "delegated_evidence_incomplete"]>;
+export type RunFailureCode = z.infer<typeof RunFailureCode>;
+export declare const RunFailure: z.ZodObject<{
+    phase: z.ZodDefault<z.ZodString>;
+    category: z.ZodDefault<z.ZodEnum<["validation", "project", "auth", "harness_unavailable", "harness_error", "config_error", "budget", "policy", "cancelled", "internal", "unknown"]>>;
+    code: z.ZodDefault<z.ZodNullable<z.ZodEnum<["finite_zero", "hard_cap", "estimate_headroom", "unknown_paid_in_flight", "budget_overshoot", "cost_unverifiable", "delegation_child_drain_timeout", "subscription_window_exhausted", "delegated_home_unavailable", "delegated_confinement_unavailable", "delegated_evidence_incomplete"]>>>;
+    harnessId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    attemptId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    safeMessage: z.ZodString;
+    rawDetailRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    logRefs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    eventRefs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    runDir: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    /** STRUCTURAL reset time. A refusal that only says "resets 2026-08-02T…"
+     * inside safeMessage forces every caller to parse prose to decide when to
+     * come back — the thing typed contracts exist to prevent. */
+    resetsAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    nextActions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    phase: string;
+    category: "auth" | "budget" | "cancelled" | "config_error" | "harness_error" | "harness_unavailable" | "internal" | "policy" | "project" | "unknown" | "validation";
+    code: "budget_overshoot" | "cost_unverifiable" | "delegated_confinement_unavailable" | "delegated_evidence_incomplete" | "delegated_home_unavailable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "subscription_window_exhausted" | "unknown_paid_in_flight" | null;
+    harnessId: string | null;
+    attemptId: string | null;
+    safeMessage: string;
+    rawDetailRef: string | null;
+    logRefs: string[];
+    eventRefs: string[];
+    runDir: string | null;
+    resetsAt: string | null;
+    nextActions: string[];
+}, {
+    phase?: string | undefined;
+    category?: "auth" | "budget" | "cancelled" | "config_error" | "harness_error" | "harness_unavailable" | "internal" | "policy" | "project" | "unknown" | "validation" | undefined;
+    code?: "budget_overshoot" | "cost_unverifiable" | "delegated_confinement_unavailable" | "delegated_evidence_incomplete" | "delegated_home_unavailable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "subscription_window_exhausted" | "unknown_paid_in_flight" | null | undefined;
+    harnessId?: string | null | undefined;
+    attemptId?: string | null | undefined;
+    safeMessage: string;
+    rawDetailRef?: string | null | undefined;
+    logRefs?: string[] | undefined;
+    eventRefs?: string[] | undefined;
+    runDir?: string | null | undefined;
+    resetsAt?: string | null | undefined;
+    nextActions?: string[] | undefined;
+}>;
+export type RunFailure = z.infer<typeof RunFailure>;
+//# sourceMappingURL=control-run-failure.d.ts.map

package/dist/control-run-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-run-failure.d.ts","sourceRoot":"","sources":["../src/control-run-failure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,uSAoBxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,UAAU;;;;;;;;;;;IAmDnB;;iEAE6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAa9D,CAAC;AACJ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/dist/control-run-failure.js

@@ -0,0 +1,89 @@
+import { z } from "zod/v3";
+/**
+ * The typed run-failure contract, split out of `control.ts` for the reason the
+ * complexity ratchet exists (INV-124): `control.ts` is the file every new
+ * control-surface field lands in, and this family — the failure sub-code plus
+ * the `RunFailure` record that carries it — is a self-contained unit with its
+ * own consumers (budget classifier, quota refusal, CLI/MCP projections).
+ * Re-exported through `index.ts` like the other `control-*` splits, so every
+ * caller keeps importing it from `@claudexor/schema`.
+ */
+export const RunFailureCode = z
+    .enum([
+    "finite_zero",
+    "hard_cap",
+    "estimate_headroom",
+    "unknown_paid_in_flight",
+    "budget_overshoot",
+    "cost_unverifiable",
+    "delegation_child_drain_timeout",
+    "subscription_window_exhausted",
+    /* A delegated run's confinement preconditions. Each is thrown as a typed
+     * error deep in the attempt loop, so it must be listed here or
+     * `declaredFailure` drops it to `code: null` and the terminal states less
+     * than the thrower knew. See docs/DELEGATED_CONFINEMENT.md. */
+    "delegated_home_unavailable",
+    "delegated_confinement_unavailable",
+    "delegated_evidence_incomplete",
+])
+    .describe("Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence).");
+export const RunFailure = z
+    .object({
+    phase: z.string().default("unknown").describe("Pipeline phase where the failure happened."),
+    category: z
+        .enum([
+        "validation",
+        "project",
+        "auth",
+        "harness_unavailable",
+        "harness_error",
+        "config_error",
+        "budget",
+        "policy",
+        "cancelled",
+        "internal",
+        "unknown",
+    ])
+        .default("unknown")
+        .describe("Typed failure category (validation, project, auth, harness, config, budget, policy, cancelled, internal, unknown). config_error is a settings/routing misconfiguration (e.g. quality routing with no comparable tier), corrected by changing configuration, not by re-auth or waiting for a harness."),
+    code: RunFailureCode.nullable()
+        .default(null)
+        .describe("Machine-readable failure sub-code within the category; null when the category alone is sufficient. Surfaces choose remediation from this, never by parsing safeMessage."),
+    harnessId: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Harness involved in the failure, when known."),
+    attemptId: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Attempt involved in the failure, when known."),
+    safeMessage: z.string().describe("Redacted human-readable failure message."),
+    rawDetailRef: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Artifact path holding the raw (redacted) failure detail."),
+    logRefs: z
+        .array(z.string())
+        .default([])
+        .describe("Log artifact paths relevant to the failure."),
+    eventRefs: z
+        .array(z.string())
+        .default([])
+        .describe("Event references relevant to the failure."),
+    runDir: z.string().nullable().default(null).describe("Run artifact directory."),
+    /** STRUCTURAL reset time. A refusal that only says "resets 2026-08-02T…"
+     * inside safeMessage forces every caller to parse prose to decide when to
+     * come back — the thing typed contracts exist to prevent. */
+    resetsAt: z
+        .string()
+        .datetime({ offset: true })
+        .nullable()
+        .default(null)
+        .describe("When the refused window reopens (a spent subscription quota window), or null when the failure has no such time. Callers schedule a retry off this field, never off safeMessage."),
+    nextActions: z.array(z.string()).default([]).describe("Suggested operator next actions."),
+})
+    .describe("Typed failure record for a run: phase, category, evidence references, and suggested next actions.");
+//# sourceMappingURL=control-run-failure.js.map

package/dist/control-run-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-run-failure.js","sourceRoot":"","sources":["../src/control-run-failure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,IAAI,CAAC;IACJ,aAAa;IACb,UAAU;IACV,mBAAmB;IACnB,wBAAwB;IACxB,kBAAkB;IAClB,mBAAmB;IACnB,gCAAgC;IAChC,+BAA+B;IAC/B;;;mEAG+D;IAC/D,4BAA4B;IAC5B,mCAAmC;IACnC,+BAA+B;CAChC,CAAC;KACD,QAAQ,CACP,uUAAuU,CACxU,CAAC;AAGJ,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC3F,QAAQ,EAAE,CAAC;SACR,IAAI,CAAC;QACJ,YAAY;QACZ,SAAS;QACT,MAAM;QACN,qBAAqB;QACrB,eAAe;QACf,cAAc;QACd,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,UAAU;QACV,SAAS;KACV,CAAC;SACD,OAAO,CAAC,SAAS,CAAC;SAClB,QAAQ,CACP,sSAAsS,CACvS;IACH,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;SAC5B,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,yKAAyK,CAC1K;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAC5E,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,0DAA0D,CAAC;IACvE,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,2CAA2C,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IAC/E;;iEAE6D;IAC7D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC1B,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,iLAAiL,CAClL;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;CAC1F,CAAC;KACD,QAAQ,CACP,mGAAmG,CACpG,CAAC"}

package/dist/control-run-scope.d.ts

@@ -6,14 +6,24 @@ export declare const RunScope: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
     kind: z.ZodLiteral<"project">;
     root: z.ZodString;
     context: z.ZodDefault<z.ZodEnum<["auto"]>>;
+    /** ONE-SHOT root (INV-035). A caller that hands Claudexor a disposable
+     * tree per run (a delegating host's per-subagent worktrees) would
+     * otherwise fill the durable registry with entries that are dead on
+     * arrival — and then have them quarantined as ghosts. Declaring the root
+     * ephemeral keeps it out of the registry entirely, so "no-project state
+     * remains global" applies: its commands and run events live in the
+     * global partition, and nothing registered ever names it. */
+    ephemeral: z.ZodDefault<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
     kind: "project";
     root: string;
     context: "auto";
+    ephemeral: boolean;
 }, {
     kind: "project";
     root: string;
     context?: "auto" | undefined;
+    ephemeral?: boolean | undefined;
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"none">;
 }, "strict", z.ZodTypeAny, {
@@ -22,4 +32,11 @@ export declare const RunScope: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
     kind: "none";
 }>]>;
 export type RunScope = z.infer<typeof RunScope>;
+/**
+ * Whether a run request declares a ONE-SHOT project root. Reads the raw request
+ * shape (not a parsed RunScope) so the daemon's partition router — which routes
+ * `unknown` params before any typed parse — and typed callers share ONE
+ * definition of "ephemeral" instead of each re-deriving it.
+ */
+export declare function isEphemeralRunScope(scope: unknown): boolean;
 //# sourceMappingURL=control-run-scope.d.ts.map

package/dist/control-run-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-run-scope.d.ts","sourceRoot":"","sources":["../src/control-run-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,gFAAgF;AAChF,eAAO,MAAM,eAAe,qBAEgC,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;IAeqD,CAAC;AAC3E,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"control-run-scope.d.ts","sourceRoot":"","sources":["../src/control-run-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,gFAAgF;AAChF,eAAO,MAAM,eAAe,qBAEgC,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,QAAQ;;;;IAOb;;;;;;iEAM6D;;;;;;;;;;;;;;;;;;IAeK,CAAC;AAC3E,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG3D"}

package/dist/control-run-scope.js

@@ -10,6 +10,17 @@ export const RunScope = z
         kind: z.literal("project"),
         root: z.string().describe("Absolute path of the project root."),
         context: RunScopeContext.default("auto"),
+        /** ONE-SHOT root (INV-035). A caller that hands Claudexor a disposable
+         * tree per run (a delegating host's per-subagent worktrees) would
+         * otherwise fill the durable registry with entries that are dead on
+         * arrival — and then have them quarantined as ghosts. Declaring the root
+         * ephemeral keeps it out of the registry entirely, so "no-project state
+         * remains global" applies: its commands and run events live in the
+         * global partition, and nothing registered ever names it. */
+        ephemeral: z
+            .boolean()
+            .default(false)
+            .describe("Declare the root one-shot: it anchors this run only, is never entered into the durable project registry, and its commands/run events live in the global no-project partition."),
     })
         .strict()
         .describe("Run anchored to a project."),
@@ -19,4 +30,14 @@ export const RunScope = z
         .describe("Run with no project (pure ask)."),
 ])
     .describe("What the run operates on: a project (with root) or nothing.");
+/**
+ * Whether a run request declares a ONE-SHOT project root. Reads the raw request
+ * shape (not a parsed RunScope) so the daemon's partition router — which routes
+ * `unknown` params before any typed parse — and typed callers share ONE
+ * definition of "ephemeral" instead of each re-deriving it.
+ */
+export function isEphemeralRunScope(scope) {
+    const value = scope && typeof scope === "object" ? scope : null;
+    return value?.["kind"] === "project" && value["ephemeral"] === true;
+}
 //# sourceMappingURL=control-run-scope.js.map

package/dist/control-run-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-run-scope.js","sourceRoot":"","sources":["../src/control-run-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;KACd,QAAQ,CAAC,+CAA+C,CAAC,CAAC;AAG7D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,kBAAkB,CAAC,MAAM,EAAE;IAC1B,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QAC/D,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;KACzC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,CAAC,4BAA4B,CAAC;IACzC,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;SACnC,MAAM,EAAE;SACR,QAAQ,CAAC,iCAAiC,CAAC;CAC/C,CAAC;KACD,QAAQ,CAAC,6DAA6D,CAAC,CAAC"}
+{"version":3,"file":"control-run-scope.js","sourceRoot":"","sources":["../src/control-run-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;KACd,QAAQ,CAAC,+CAA+C,CAAC,CAAC;AAG7D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,kBAAkB,CAAC,MAAM,EAAE;IAC1B,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QAC/D,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;QACxC;;;;;;qEAM6D;QAC7D,SAAS,EAAE,CAAC;aACT,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,+KAA+K,CAChL;KACJ,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,CAAC,4BAA4B,CAAC;IACzC,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;SACnC,MAAM,EAAE;SACR,QAAQ,CAAC,iCAAiC,CAAC;CAC/C,CAAC;KACD,QAAQ,CAAC,6DAA6D,CAAC,CAAC;AAG3E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,KAAK,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,OAAO,KAAK,EAAE,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;AACtE,CAAC"}

package/dist/control.d.ts

@@ -2,10 +2,13 @@ import { z } from "zod/v3";
 export { ControlQuotaResponse } from "./quota.js";
 export declare const RunExecution: z.ZodObject<{
     isolation: z.ZodDefault<z.ZodEnum<["envelope", "live"]>>;
+    delegated: z.ZodDefault<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
     isolation: "envelope" | "live";
+    delegated: boolean;
 }, {
     isolation?: "envelope" | "live" | undefined;
+    delegated?: boolean | undefined;
 }>;
 export type RunExecution = z.infer<typeof RunExecution>;
 export declare const ControlReviewerPanelEntry: z.ZodObject<{
@@ -46,14 +49,17 @@ export declare const ControlRunStartRequest: z.ZodObject<{
         kind: z.ZodLiteral<"project">;
         root: z.ZodString;
         context: z.ZodDefault<z.ZodEnum<["auto"]>>;
+        ephemeral: z.ZodDefault<z.ZodBoolean>;
     }, "strict", z.ZodTypeAny, {
         kind: "project";
         root: string;
         context: "auto";
+        ephemeral: boolean;
     }, {
         kind: "project";
         root: string;
         context?: "auto" | undefined;
+        ephemeral?: boolean | undefined;
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"none">;
     }, "strict", z.ZodTypeAny, {
@@ -63,10 +69,13 @@ export declare const ControlRunStartRequest: z.ZodObject<{
     }>]>>;
     execution: z.ZodDefault<z.ZodObject<{
         isolation: z.ZodDefault<z.ZodEnum<["envelope", "live"]>>;
+        delegated: z.ZodDefault<z.ZodBoolean>;
     }, "strict", z.ZodTypeAny, {
         isolation: "envelope" | "live";
+        delegated: boolean;
     }, {
         isolation?: "envelope" | "live" | undefined;
+        delegated?: boolean | undefined;
     }>>;
     harnesses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     primaryHarness: z.ZodOptional<z.ZodString>;
@@ -257,11 +266,13 @@ export declare const ControlRunStartRequest: z.ZodObject<{
         kind: "project";
         root: string;
         context: "auto";
+        ephemeral: boolean;
     } | {
         kind: "none";
     };
     execution: {
         isolation: "envelope" | "live";
+        delegated: boolean;
     };
     harnesses?: string[] | undefined;
     primaryHarness?: string | undefined;
@@ -333,11 +344,13 @@ export declare const ControlRunStartRequest: z.ZodObject<{
         kind: "project";
         root: string;
         context?: "auto" | undefined;
+        ephemeral?: boolean | undefined;
     } | {
         kind: "none";
     } | undefined;
     execution?: {
         isolation?: "envelope" | "live" | undefined;
+        delegated?: boolean | undefined;
     } | undefined;
     harnesses?: string[] | undefined;
     primaryHarness?: string | undefined;
@@ -458,14 +471,17 @@ export declare const ControlRunAgainDraft: z.ZodObject<{
             kind: z.ZodLiteral<"project">;
             root: z.ZodString;
             context: z.ZodDefault<z.ZodEnum<["auto"]>>;
+            ephemeral: z.ZodDefault<z.ZodBoolean>;
         }, "strict", z.ZodTypeAny, {
             kind: "project";
             root: string;
             context: "auto";
+            ephemeral: boolean;
         }, {
             kind: "project";
             root: string;
             context?: "auto" | undefined;
+            ephemeral?: boolean | undefined;
         }>, z.ZodObject<{
             kind: z.ZodLiteral<"none">;
         }, "strict", z.ZodTypeAny, {
@@ -475,10 +491,13 @@ export declare const ControlRunAgainDraft: z.ZodObject<{
         }>]>>;
         execution: z.ZodDefault<z.ZodObject<{
             isolation: z.ZodDefault<z.ZodEnum<["envelope", "live"]>>;
+            delegated: z.ZodDefault<z.ZodBoolean>;
         }, "strict", z.ZodTypeAny, {
             isolation: "envelope" | "live";
+            delegated: boolean;
         }, {
             isolation?: "envelope" | "live" | undefined;
+            delegated?: boolean | undefined;
         }>>;
         harnesses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         primaryHarness: z.ZodOptional<z.ZodString>;
@@ -669,11 +688,13 @@ export declare const ControlRunAgainDraft: z.ZodObject<{
             kind: "project";
             root: string;
             context: "auto";
+            ephemeral: boolean;
         } | {
             kind: "none";
         };
         execution: {
             isolation: "envelope" | "live";
+            delegated: boolean;
         };
         harnesses?: string[] | undefined;
         primaryHarness?: string | undefined;
@@ -745,11 +766,13 @@ export declare const ControlRunAgainDraft: z.ZodObject<{
             kind: "project";
             root: string;
             context?: "auto" | undefined;
+            ephemeral?: boolean | undefined;
         } | {
             kind: "none";
         } | undefined;
         execution?: {
             isolation?: "envelope" | "live" | undefined;
+            delegated?: boolean | undefined;
         } | undefined;
         harnesses?: string[] | undefined;
         primaryHarness?: string | undefined;
@@ -837,11 +860,13 @@ export declare const ControlRunAgainDraft: z.ZodObject<{
             kind: "project";
             root: string;
             context: "auto";
+            ephemeral: boolean;
         } | {
             kind: "none";
         };
         execution: {
             isolation: "envelope" | "live";
+            delegated: boolean;
         };
         harnesses?: string[] | undefined;
         primaryHarness?: string | undefined;
@@ -921,11 +946,13 @@ export declare const ControlRunAgainDraft: z.ZodObject<{
             kind: "project";
             root: string;
             context?: "auto" | undefined;
+            ephemeral?: boolean | undefined;
         } | {
             kind: "none";
         } | undefined;
         execution?: {
             isolation?: "envelope" | "live" | undefined;
+            delegated?: boolean | undefined;
         } | undefined;
         harnesses?: string[] | undefined;
         primaryHarness?: string | undefined;
@@ -1009,46 +1036,6 @@ export declare const ControlQueuedRunInfo: z.ZodObject<{
     error?: string | undefined;
 }>;
 export type ControlQueuedRunInfo = z.infer<typeof ControlQueuedRunInfo>;
-export declare const RunFailureCode: z.ZodEnum<["finite_zero", "hard_cap", "estimate_headroom", "unknown_paid_in_flight", "budget_overshoot", "cost_unverifiable", "delegation_child_drain_timeout"]>;
-export type RunFailureCode = z.infer<typeof RunFailureCode>;
-export declare const RunFailure: z.ZodObject<{
-    phase: z.ZodDefault<z.ZodString>;
-    category: z.ZodDefault<z.ZodEnum<["validation", "project", "auth", "harness_unavailable", "harness_error", "config_error", "budget", "policy", "cancelled", "internal", "unknown"]>>;
-    code: z.ZodDefault<z.ZodNullable<z.ZodEnum<["finite_zero", "hard_cap", "estimate_headroom", "unknown_paid_in_flight", "budget_overshoot", "cost_unverifiable", "delegation_child_drain_timeout"]>>>;
-    harnessId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    attemptId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    safeMessage: z.ZodString;
-    rawDetailRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    logRefs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    eventRefs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    runDir: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    nextActions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-}, "strip", z.ZodTypeAny, {
-    phase: string;
-    category: "auth" | "budget" | "cancelled" | "config_error" | "harness_error" | "harness_unavailable" | "internal" | "policy" | "project" | "unknown" | "validation";
-    code: "budget_overshoot" | "cost_unverifiable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "unknown_paid_in_flight" | null;
-    harnessId: string | null;
-    attemptId: string | null;
-    safeMessage: string;
-    rawDetailRef: string | null;
-    logRefs: string[];
-    eventRefs: string[];
-    runDir: string | null;
-    nextActions: string[];
-}, {
-    phase?: string | undefined;
-    category?: "auth" | "budget" | "cancelled" | "config_error" | "harness_error" | "harness_unavailable" | "internal" | "policy" | "project" | "unknown" | "validation" | undefined;
-    code?: "budget_overshoot" | "cost_unverifiable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "unknown_paid_in_flight" | null | undefined;
-    harnessId?: string | null | undefined;
-    attemptId?: string | null | undefined;
-    safeMessage: string;
-    rawDetailRef?: string | null | undefined;
-    logRefs?: string[] | undefined;
-    eventRefs?: string[] | undefined;
-    runDir?: string | null | undefined;
-    nextActions?: string[] | undefined;
-}>;
-export type RunFailure = z.infer<typeof RunFailure>;
 export declare const ControlProjectMetadata: z.ZodObject<{
     kind: z.ZodDefault<z.ZodEnum<["project", "none"]>>;
     root: z.ZodDefault<z.ZodNullable<z.ZodString>>;
@@ -1264,7 +1251,7 @@ export declare const ControlRunSummary: z.ZodObject<{
     failure: z.ZodDefault<z.ZodNullable<z.ZodObject<{
         phase: z.ZodDefault<z.ZodString>;
         category: z.ZodDefault<z.ZodEnum<["validation", "project", "auth", "harness_unavailable", "harness_error", "config_error", "budget", "policy", "cancelled", "internal", "unknown"]>>;
-        code: z.ZodDefault<z.ZodNullable<z.ZodEnum<["finite_zero", "hard_cap", "estimate_headroom", "unknown_paid_in_flight", "budget_overshoot", "cost_unverifiable", "delegation_child_drain_timeout"]>>>;
+        code: z.ZodDefault<z.ZodNullable<z.ZodEnum<["finite_zero", "hard_cap", "estimate_headroom", "unknown_paid_in_flight", "budget_overshoot", "cost_unverifiable", "delegation_child_drain_timeout", "subscription_window_exhausted", "delegated_home_unavailable", "delegated_confinement_unavailable", "delegated_evidence_incomplete"]>>>;
         harnessId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         attemptId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         safeMessage: z.ZodString;
@@ -1272,11 +1259,12 @@ export declare const ControlRunSummary: z.ZodObject<{
         logRefs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         eventRefs: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
         runDir: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        resetsAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         nextActions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
         phase: string;
         category: "auth" | "budget" | "cancelled" | "config_error" | "harness_error" | "harness_unavailable" | "internal" | "policy" | "project" | "unknown" | "validation";
-        code: "budget_overshoot" | "cost_unverifiable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "unknown_paid_in_flight" | null;
+        code: "budget_overshoot" | "cost_unverifiable" | "delegated_confinement_unavailable" | "delegated_evidence_incomplete" | "delegated_home_unavailable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "subscription_window_exhausted" | "unknown_paid_in_flight" | null;
         harnessId: string | null;
         attemptId: string | null;
         safeMessage: string;
@@ -1284,11 +1272,12 @@ export declare const ControlRunSummary: z.ZodObject<{
         logRefs: string[];
         eventRefs: string[];
         runDir: string | null;
+        resetsAt: string | null;
         nextActions: string[];
     }, {
         phase?: string | undefined;
         category?: "auth" | "budget" | "cancelled" | "config_error" | "harness_error" | "harness_unavailable" | "internal" | "policy" | "project" | "unknown" | "validation" | undefined;
-        code?: "budget_overshoot" | "cost_unverifiable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "unknown_paid_in_flight" | null | undefined;
+        code?: "budget_overshoot" | "cost_unverifiable" | "delegated_confinement_unavailable" | "delegated_evidence_incomplete" | "delegated_home_unavailable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "subscription_window_exhausted" | "unknown_paid_in_flight" | null | undefined;
         harnessId?: string | null | undefined;
         attemptId?: string | null | undefined;
         safeMessage: string;
@@ -1296,6 +1285,7 @@ export declare const ControlRunSummary: z.ZodObject<{
         logRefs?: string[] | undefined;
         eventRefs?: string[] | undefined;
         runDir?: string | null | undefined;
+        resetsAt?: string | null | undefined;
         nextActions?: string[] | undefined;
     }>>>;
     project: z.ZodDefault<z.ZodObject<{
@@ -1740,7 +1730,7 @@ export declare const ControlRunSummary: z.ZodObject<{
     failure: {
         phase: string;
         category: "auth" | "budget" | "cancelled" | "config_error" | "harness_error" | "harness_unavailable" | "internal" | "policy" | "project" | "unknown" | "validation";
-        code: "budget_overshoot" | "cost_unverifiable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "unknown_paid_in_flight" | null;
+        code: "budget_overshoot" | "cost_unverifiable" | "delegated_confinement_unavailable" | "delegated_evidence_incomplete" | "delegated_home_unavailable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "subscription_window_exhausted" | "unknown_paid_in_flight" | null;
         harnessId: string | null;
         attemptId: string | null;
         safeMessage: string;
@@ -1748,6 +1738,7 @@ export declare const ControlRunSummary: z.ZodObject<{
         logRefs: string[];
         eventRefs: string[];
         runDir: string | null;
+        resetsAt: string | null;
         nextActions: string[];
     } | null;
     project: {
@@ -1908,7 +1899,7 @@ export declare const ControlRunSummary: z.ZodObject<{
     failure?: {
         phase?: string | undefined;
         category?: "auth" | "budget" | "cancelled" | "config_error" | "harness_error" | "harness_unavailable" | "internal" | "policy" | "project" | "unknown" | "validation" | undefined;
-        code?: "budget_overshoot" | "cost_unverifiable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "unknown_paid_in_flight" | null | undefined;
+        code?: "budget_overshoot" | "cost_unverifiable" | "delegated_confinement_unavailable" | "delegated_evidence_incomplete" | "delegated_home_unavailable" | "delegation_child_drain_timeout" | "estimate_headroom" | "finite_zero" | "hard_cap" | "subscription_window_exhausted" | "unknown_paid_in_flight" | null | undefined;
         harnessId?: string | null | undefined;
         attemptId?: string | null | undefined;
         safeMessage: string;
@@ -1916,6 +1907,7 @@ export declare const ControlRunSummary: z.ZodObject<{
         logRefs?: string[] | undefined;
         eventRefs?: string[] | undefined;
         runDir?: string | null | undefined;
+        resetsAt?: string | null | undefined;
         nextActions?: string[] | undefined;
     } | null | undefined;
     project?: {
@@ -2953,6 +2945,7 @@ export declare const ControlThreadTurn: z.ZodObject<{
     threadId: z.ZodString;
     runId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     parentRunId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    answersPlanRunId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     /** Set when this turn implements an approved plan from an earlier run. */
     planRunId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     /** The SHA-256 of the exact plan bytes this Implement turn froze (INV-081),
@@ -3302,6 +3295,7 @@ export declare const ControlThreadTurn: z.ZodObject<{
     threadId: string;
     runId: string | null;
     parentRunId: string | null;
+    answersPlanRunId: string | null;
     planRunId: string | null;
     planHash: string | null;
     planReadinessOverridden: boolean;
@@ -3379,6 +3373,7 @@ export declare const ControlThreadTurn: z.ZodObject<{
     threadId: string;
     runId?: string | null | undefined;
     parentRunId?: string | null | undefined;
+    answersPlanRunId?: string | null | undefined;
     planRunId?: string | null | undefined;
     planHash?: string | null | undefined;
     planReadinessOverridden?: boolean | undefined;
@@ -3459,14 +3454,17 @@ export declare const ControlThreadCreateRequest: z.ZodObject<{
         kind: z.ZodLiteral<"project">;
         root: z.ZodString;
         context: z.ZodDefault<z.ZodEnum<["auto"]>>;
+        ephemeral: z.ZodDefault<z.ZodBoolean>;
     }, "strict", z.ZodTypeAny, {
         kind: "project";
         root: string;
         context: "auto";
+        ephemeral: boolean;
     }, {
         kind: "project";
         root: string;
         context?: "auto" | undefined;
+        ephemeral?: boolean | undefined;
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"none">;
     }, "strict", z.ZodTypeAny, {
@@ -3488,6 +3486,7 @@ export declare const ControlThreadCreateRequest: z.ZodObject<{
         kind: "project";
         root: string;
         context: "auto";
+        ephemeral: boolean;
     } | {
         kind: "none";
     };
@@ -3504,6 +3503,7 @@ export declare const ControlThreadCreateRequest: z.ZodObject<{
         kind: "project";
         root: string;
         context?: "auto" | undefined;
+        ephemeral?: boolean | undefined;
     } | {
         kind: "none";
     } | undefined;
@@ -3796,6 +3796,7 @@ export declare const ControlThreadDetail: z.ZodObject<{
         threadId: z.ZodString;
         runId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         parentRunId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        answersPlanRunId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         /** Set when this turn implements an approved plan from an earlier run. */
         planRunId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         /** The SHA-256 of the exact plan bytes this Implement turn froze (INV-081),
@@ -4145,6 +4146,7 @@ export declare const ControlThreadDetail: z.ZodObject<{
         threadId: string;
         runId: string | null;
         parentRunId: string | null;
+        answersPlanRunId: string | null;
         planRunId: string | null;
         planHash: string | null;
         planReadinessOverridden: boolean;
@@ -4222,6 +4224,7 @@ export declare const ControlThreadDetail: z.ZodObject<{
         threadId: string;
         runId?: string | null | undefined;
         parentRunId?: string | null | undefined;
+        answersPlanRunId?: string | null | undefined;
         planRunId?: string | null | undefined;
         planHash?: string | null | undefined;
         planReadinessOverridden?: boolean | undefined;
@@ -4330,6 +4333,7 @@ export declare const ControlThreadDetail: z.ZodObject<{
         threadId: string;
         runId: string | null;
         parentRunId: string | null;
+        answersPlanRunId: string | null;
         planRunId: string | null;
         planHash: string | null;
         planReadinessOverridden: boolean;
@@ -4438,6 +4442,7 @@ export declare const ControlThreadDetail: z.ZodObject<{
         threadId: string;
         runId?: string | null | undefined;
         parentRunId?: string | null | undefined;
+        answersPlanRunId?: string | null | undefined;
         planRunId?: string | null | undefined;
         planHash?: string | null | undefined;
         planReadinessOverridden?: boolean | undefined;