@claudexor/schema 3.2.0 → 3.3.7-rc.0

package/generated/ControlRunDetail.schema.json

@@ -159,9 +159,13 @@
                             "unknown_paid_in_flight",
                             "budget_overshoot",
                             "cost_unverifiable",
-                            "delegation_child_drain_timeout"
+                            "delegation_child_drain_timeout",
+                            "subscription_window_exhausted",
+                            "delegated_home_unavailable",
+                            "delegated_confinement_unavailable",
+                            "delegated_evidence_incomplete"
                           ],
-                          "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons and Delegate child-drain timeout)."
+                          "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
                         },
                         {
                           "type": "null"
@@ -222,6 +226,19 @@
                       "default": null,
                       "description": "Run artifact directory."
                     },
+                    "resetsAt": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "format": "date-time"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "default": null,
+                      "description": "When the refused window reopens (a spent subscription quota window), or null when the failure has no such time. Callers schedule a retry off this field, never off safeMessage."
+                    },
                     "nextActions": {
                       "type": "array",
                       "items": {
@@ -2518,7 +2535,7 @@
               "allow_text": {
                 "type": "boolean",
                 "default": false,
-                "description": "True when a free-text answer is accepted (text questions)."
+                "description": "True when free text is accepted as a complete answer, including as an alternative to single/multi options."
               }
             },
             "required": [
@@ -3112,6 +3129,53 @@
                 ],
                 "default": null,
                 "description": "This candidate's ranking-scorecard axis values (from decision.ranking_scorecard); null when no arbitration ran."
+              },
+              "confinement": {
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "proven": {
+                        "type": "boolean",
+                        "description": "Whether a boundary was actually enforced for this attempt: a named mechanism AND the path it was proven to deny. The only field a consumer should branch on."
+                      },
+                      "mechanism": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "description": "Opaque label of the enforcing mechanism; null when no boundary was applied."
+                      },
+                      "verifiedDeniedPath": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "description": "Path proven unreadable under the applied policy before the harness was spawned."
+                      },
+                      "unavailableReason": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "description": "Why this attempt ran with NO boundary; null when one was applied. Present exactly when proven is false for a run that asked for a boundary."
+                      }
+                    },
+                    "required": [
+                      "proven",
+                      "mechanism",
+                      "verifiedDeniedPath",
+                      "unavailableReason"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Applied OS filesystem boundary for one attempt, or the stated reason there was none."
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Applied OS boundary for this attempt; null when the run never asked for one (every non-delegated run).",
+                "default": null
               }
             },
             "required": [

package/generated/ControlRunListResponse.schema.json

@@ -161,9 +161,13 @@
                               "unknown_paid_in_flight",
                               "budget_overshoot",
                               "cost_unverifiable",
-                              "delegation_child_drain_timeout"
+                              "delegation_child_drain_timeout",
+                              "subscription_window_exhausted",
+                              "delegated_home_unavailable",
+                              "delegated_confinement_unavailable",
+                              "delegated_evidence_incomplete"
                             ],
-                            "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons and Delegate child-drain timeout)."
+                            "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
                           },
                           {
                             "type": "null"
@@ -224,6 +228,19 @@
                         "default": null,
                         "description": "Run artifact directory."
                       },
+                      "resetsAt": {
+                        "anyOf": [
+                          {
+                            "type": "string",
+                            "format": "date-time"
+                          },
+                          {
+                            "type": "null"
+                          }
+                        ],
+                        "default": null,
+                        "description": "When the refused window reopens (a spent subscription quota window), or null when the failure has no such time. Callers schedule a retry off this field, never off safeMessage."
+                      },
                       "nextActions": {
                         "type": "array",
                         "items": {

package/generated/ControlRunStartRequest.schema.json

@@ -62,6 +62,11 @@
                   ],
                   "description": "Project context depth; auto is the only mode.",
                   "default": "auto"
+                },
+                "ephemeral": {
+                  "type": "boolean",
+                  "default": false,
+                  "description": "Declare the root one-shot: it anchors this run only, is never entered into the durable project registry, and its commands/run events live in the global no-project partition."
                 }
               },
               "required": [
@@ -102,10 +107,15 @@
               ],
               "default": "envelope",
               "description": "Run isolation: envelope (isolated worktree in the external per-project runtime namespace, the default) or live (the project tree itself)."
+            },
+            "delegated": {
+              "type": "boolean",
+              "default": false,
+              "description": "Marks a run driven by an EXTERNAL orchestrator that owns the workspace, not by the operator at a surface. Such a run is confined to a scoped harness HOME even under isolation='live' (an in-place delegated attempt therefore cannot resume a native vendor session stored under the real HOME). Unrelated to the `delegate` belt flag and to `delegatedFromRunId` (belt-child provenance)."
             }
           },
           "additionalProperties": false,
-          "description": "Execution isolation settings for a run.",
+          "description": "Execution isolation and delegation settings for a run.",
           "default": {
             "isolation": "envelope"
           }

package/generated/ControlRunSummary.schema.json

@@ -156,9 +156,13 @@
                         "unknown_paid_in_flight",
                         "budget_overshoot",
                         "cost_unverifiable",
-                        "delegation_child_drain_timeout"
+                        "delegation_child_drain_timeout",
+                        "subscription_window_exhausted",
+                        "delegated_home_unavailable",
+                        "delegated_confinement_unavailable",
+                        "delegated_evidence_incomplete"
                       ],
-                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons and Delegate child-drain timeout)."
+                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
                     },
                     {
                       "type": "null"
@@ -219,6 +223,19 @@
                   "default": null,
                   "description": "Run artifact directory."
                 },
+                "resetsAt": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ],
+                  "default": null,
+                  "description": "When the refused window reopens (a spent subscription quota window), or null when the failure has no such time. Callers schedule a retry off this field, never off safeMessage."
+                },
                 "nextActions": {
                   "type": "array",
                   "items": {

package/generated/ControlThreadCreateRequest.schema.json

@@ -28,6 +28,11 @@
                   ],
                   "description": "Project context depth; auto is the only mode.",
                   "default": "auto"
+                },
+                "ephemeral": {
+                  "type": "boolean",
+                  "default": false,
+                  "description": "Declare the root one-shot: it anchors this run only, is never entered into the durable project registry, and its commands/run events live in the global no-project partition."
                 }
               },
               "required": [

package/generated/ControlThreadDetail.schema.json

@@ -284,6 +284,18 @@
                 "description": "Run this turn follows up on, when any.",
                 "default": null
               },
+              "answersPlanRunId": {
+                "anyOf": [
+                  {
+                    "$ref": "#/definitions/ControlThreadDetail/properties/thread/properties/credentialProfileId/anyOf/0"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Plan run whose open questions this follow-up turn answers.",
+                "default": null
+              },
               "planRunId": {
                 "anyOf": [
                   {

package/generated/ControlThreadTurnRequest.schema.json

@@ -390,6 +390,10 @@
           "exclusiveMinimum": 0,
           "description": "Per-run turn cap (beats per-harness settings)."
         },
+        "answersPlanRunId": {
+          "$ref": "#/definitions/ControlThreadTurnRequest/properties/planRunId",
+          "description": "Plan run whose open questions this follow-up turn answers."
+        },
         "overridePlanReadiness": {
           "type": "boolean",
           "description": "Implement a not-ready plan anyway; recorded on the turn."

package/generated/CredentialProfileStatus.schema.json

@@ -28,6 +28,15 @@
             "not_run"
           ]
         },
+        "verification_source": {
+          "type": "string",
+          "enum": [
+            "local_store",
+            "vendor"
+          ],
+          "default": "local_store",
+          "description": "How the verification verdict was reached: local_store = the profile's credential material is present locally (says nothing about the token being live); vendor = the vendor answered a request made with this profile's own credential."
+        },
         "detail": {
           "type": "string",
           "description": "Redacted human-readable probe evidence."
@@ -43,7 +52,7 @@
               "type": "null"
             }
           ],
-          "description": "When a probe last verified this profile; null = never verified.",
+          "description": "When the verification verdict was established, by the method named in verification_source; null = never verified.",
           "default": null
         }
       },

package/generated/McpRunHandleResult.schema.json

@@ -254,9 +254,13 @@
                         "unknown_paid_in_flight",
                         "budget_overshoot",
                         "cost_unverifiable",
-                        "delegation_child_drain_timeout"
+                        "delegation_child_drain_timeout",
+                        "subscription_window_exhausted",
+                        "delegated_home_unavailable",
+                        "delegated_confinement_unavailable",
+                        "delegated_evidence_incomplete"
                       ],
-                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons and Delegate child-drain timeout)."
+                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
                     },
                     {
                       "type": "null"
@@ -317,6 +321,19 @@
                   "default": null,
                   "description": "Run artifact directory."
                 },
+                "resetsAt": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ],
+                  "default": null,
+                  "description": "When the refused window reopens (a spent subscription quota window), or null when the failure has no such time. Callers schedule a retry off this field, never off safeMessage."
+                },
                 "nextActions": {
                   "type": "array",
                   "items": {

package/generated/McpRunToolResult.schema.json

@@ -230,9 +230,13 @@
                         "unknown_paid_in_flight",
                         "budget_overshoot",
                         "cost_unverifiable",
-                        "delegation_child_drain_timeout"
+                        "delegation_child_drain_timeout",
+                        "subscription_window_exhausted",
+                        "delegated_home_unavailable",
+                        "delegated_confinement_unavailable",
+                        "delegated_evidence_incomplete"
                       ],
-                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons and Delegate child-drain timeout)."
+                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
                     },
                     {
                       "type": "null"
@@ -293,6 +297,19 @@
                   "default": null,
                   "description": "Run artifact directory."
                 },
+                "resetsAt": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ],
+                  "default": null,
+                  "description": "When the refused window reopens (a spent subscription quota window), or null when the failure has no such time. Callers schedule a retry off this field, never off safeMessage."
+                },
                 "nextActions": {
                   "type": "array",
                   "items": {

package/generated/RunFailure.schema.json

@@ -38,9 +38,13 @@
                 "unknown_paid_in_flight",
                 "budget_overshoot",
                 "cost_unverifiable",
-                "delegation_child_drain_timeout"
+                "delegation_child_drain_timeout",
+                "subscription_window_exhausted",
+                "delegated_home_unavailable",
+                "delegated_confinement_unavailable",
+                "delegated_evidence_incomplete"
               ],
-              "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons and Delegate child-drain timeout)."
+              "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
             },
             {
               "type": "null"
@@ -101,6 +105,19 @@
           "default": null,
           "description": "Run artifact directory."
         },
+        "resetsAt": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "date-time"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "description": "When the refused window reopens (a spent subscription quota window), or null when the failure has no such time. Callers schedule a retry off this field, never off safeMessage."
+        },
         "nextActions": {
           "type": "array",
           "items": {

package/generated/ThreadTurn.schema.json

@@ -40,6 +40,18 @@
           "description": "Run this turn follows up on, when any.",
           "default": null
         },
+        "answers_plan_run_id": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ThreadTurn/properties/run_id/anyOf/0"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Plan run whose open questions this follow-up turn answers.",
+          "default": null
+        },
         "plan_run_id": {
           "anyOf": [
             {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudexor/schema",
-  "version": "3.2.0",
+  "version": "3.3.7-rc.0",
   "license": "MIT",
   "description": "Single source of truth for all Claudexor data shapes (Zod + generated JSON Schema).",
   "type": "module",
@@ -20,7 +20,7 @@
   "dependencies": {
     "zod": "^4.4.3",
     "zod-to-json-schema": "^3.24.1",
-    "@claudexor/util": "3.2.0"
+    "@claudexor/util": "3.3.7-rc.0"
   },
   "repository": {
     "type": "git",