@claudexor/schema 3.8.0 → 3.8.1

package/dist/task.d.ts

@@ -24,7 +24,38 @@ export declare const TestCommandGrant: z.ZodObject<{
     executableDigest: z.ZodString;
     scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+    accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native"]>;
+}, "strict", z.ZodTypeAny, {
+    projectDigest: string;
+    configDigest: string;
+    commandDigest: string;
+    executablePath: string;
+    executableDigest: string;
+    scriptPath: string | null;
+    scriptDigest: string | null;
+    accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+}, {
+    projectDigest: string;
+    configDigest: string;
+    commandDigest: string;
+    executablePath: string;
+    executableDigest: string;
+    scriptPath?: string | null | undefined;
+    scriptDigest?: string | null | undefined;
+    accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+}>;
+export type TestCommandGrant = z.infer<typeof TestCommandGrant>;
+/** Historical counterpart used only inside immutable TaskContracts. */
+export declare const RecordedTestCommandGrant: z.ZodObject<{
+    projectDigest: z.ZodString;
+    configDigest: z.ZodString;
+    commandDigest: z.ZodString;
+    executablePath: z.ZodString;
+    executableDigest: z.ZodString;
+    scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+} & {
+    accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
 }, "strict", z.ZodTypeAny, {
     projectDigest: string;
     configDigest: string;
@@ -44,7 +75,7 @@ export declare const TestCommandGrant: z.ZodObject<{
     scriptDigest?: string | null | undefined;
     accessProfile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
 }>;
-export type TestCommandGrant = z.infer<typeof TestCommandGrant>;
+export type RecordedTestCommandGrant = z.infer<typeof RecordedTestCommandGrant>;
 export declare const TestCommand: z.ZodObject<{
     program: z.ZodString;
     args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
@@ -62,7 +93,84 @@ export declare const TestCommand: z.ZodObject<{
         executableDigest: z.ZodString;
         scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+        accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native"]>;
+    }, "strict", z.ZodTypeAny, {
+        projectDigest: string;
+        configDigest: string;
+        commandDigest: string;
+        executablePath: string;
+        executableDigest: string;
+        scriptPath: string | null;
+        scriptDigest: string | null;
+        accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+    }, {
+        projectDigest: string;
+        configDigest: string;
+        commandDigest: string;
+        executablePath: string;
+        executableDigest: string;
+        scriptPath?: string | null | undefined;
+        scriptDigest?: string | null | undefined;
+        accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+    }>>>;
+}, "strict", z.ZodTypeAny, {
+    program: string;
+    args: string[];
+    cwd?: string | undefined;
+    envAllowlist: string[];
+    id: string;
+    required: boolean;
+    trust_required: boolean;
+    trust_grant: {
+        projectDigest: string;
+        configDigest: string;
+        commandDigest: string;
+        executablePath: string;
+        executableDigest: string;
+        scriptPath: string | null;
+        scriptDigest: string | null;
+        accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+    } | null;
+}, {
+    program: string;
+    args?: string[] | undefined;
+    cwd?: string | undefined;
+    envAllowlist?: string[] | undefined;
+    id: string;
+    required?: boolean | undefined;
+    trust_required?: boolean | undefined;
+    trust_grant?: {
+        projectDigest: string;
+        configDigest: string;
+        commandDigest: string;
+        executablePath: string;
+        executableDigest: string;
+        scriptPath?: string | null | undefined;
+        scriptDigest?: string | null | undefined;
+        accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+    } | null | undefined;
+}>;
+export type TestCommand = z.infer<typeof TestCommand>;
+/** Historical counterpart used only inside immutable TaskContracts. */
+export declare const RecordedTestCommand: z.ZodObject<{
+    program: z.ZodString;
+    args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    cwd: z.ZodOptional<z.ZodString>;
+    envAllowlist: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+} & {
+    id: z.ZodString;
+    required: z.ZodDefault<z.ZodBoolean>;
+    trust_required: z.ZodDefault<z.ZodBoolean>;
+    trust_grant: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        projectDigest: z.ZodString;
+        configDigest: z.ZodString;
+        commandDigest: z.ZodString;
+        executablePath: z.ZodString;
+        executableDigest: z.ZodString;
+        scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    } & {
+        accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
     }, "strict", z.ZodTypeAny, {
         projectDigest: string;
         configDigest: string;
@@ -119,7 +227,7 @@ export declare const TestCommand: z.ZodObject<{
         accessProfile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
     } | null | undefined;
 }>;
-export type TestCommand = z.infer<typeof TestCommand>;
+export type RecordedTestCommand = z.infer<typeof RecordedTestCommand>;
 export declare const ProtectedPathApproval: z.ZodObject<{
     /** Glob approved by the operator/user for this run; consumed only by the
      * auto-protected gate/test path policy, not by built-in critical-path gates. */
@@ -349,7 +457,8 @@ export declare const TaskContract: z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -448,9 +557,9 @@ export declare const TaskContract: z.ZodObject<{
         }[] | undefined;
     }>>;
     access: z.ZodDefault<z.ZodObject<{
-        requested_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>>;
+        requested_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>>;
         /** Profile actually enforced by the engine (mode/trust clamps applied; never client-supplied). */
-        effective_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>>;
+        effective_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>>;
     }, "strip", z.ZodTypeAny, {
         requested_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
         effective_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
@@ -738,6 +847,509 @@ export declare const TaskContract: z.ZodObject<{
     } | undefined;
 }>;
 export type TaskContract = z.infer<typeof TaskContract>;
+/** Writer/runtime contract for a new run. Historical decoding uses TaskContract
+ * below, but no active builder can produce a retired access value. */
+export declare const ActiveTaskContract: z.ZodObject<{
+    schema_version: z.ZodLiteral<2>;
+    task_id: z.ZodString;
+    created_at: z.ZodString;
+    repo: z.ZodObject<{
+        root: z.ZodString;
+        base_ref: z.ZodString;
+        base_sha: z.ZodOptional<z.ZodString>;
+        dirty_policy: z.ZodDefault<z.ZodEnum<["refuse", "snapshot"]>>;
+    }, "strip", z.ZodTypeAny, {
+        root: string;
+        base_ref: string;
+        base_sha?: string | undefined;
+        dirty_policy: "refuse" | "snapshot";
+    }, {
+        root: string;
+        base_ref: string;
+        base_sha?: string | undefined;
+        dirty_policy?: "refuse" | "snapshot" | undefined;
+    }>;
+    mode: z.ZodObject<{
+        kind: z.ZodEnum<["ask", "plan", "agent"]>;
+    }, "strip", z.ZodTypeAny, {
+        kind: "agent" | "ask" | "plan";
+    }, {
+        kind: "agent" | "ask" | "plan";
+    }>;
+    delegation_requested: z.ZodDefault<z.ZodBoolean>;
+    run_lineage: z.ZodDefault<z.ZodObject<{
+        parent_run_id: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        delegated_from_run_id: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        parent_run_id: string | null;
+        delegated_from_run_id: string | null;
+    }, {
+        parent_run_id?: string | null | undefined;
+        delegated_from_run_id?: string | null | undefined;
+    }>>;
+    user_intent: z.ZodObject<{
+        raw: z.ZodString;
+        normalized: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        raw: string;
+        normalized?: string | undefined;
+    }, {
+        raw: string;
+        normalized?: string | undefined;
+    }>;
+    instructions: z.ZodOptional<z.ZodString>;
+    output_schema: z.ZodDefault<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    auth_preference: z.ZodDefault<z.ZodEnum<["subscription", "api_key", "auto"]>>;
+    credential_profile_id: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    max_turns: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    constraints: z.ZodDefault<z.ZodObject<{
+        /** Globs whose changes escalate risk to a human-approval gate (wired into
+         * classifyRisk/requireHuman). These are project-config-owned, cover every
+         * touched path (create/modify/delete/both rename sides), and cannot be
+         * suppressed by per-run protected-path approvals. */
+        protected_paths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Per-run globs no candidate may touch AT ALL (create, modify, delete, or
+         * rename). Unlike protected_paths, these produce a deny-path violation;
+         * both still require an explicit human decision before delivery. Enforced
+         * by the engine's post-diff policy gate on envelope runs;
+         * an in-place run with deny_paths is refused at preflight. An operator
+         * accept_risk decision MAY still deliver a violating patch (INV-111: the
+         * human is the final authority). */
+        deny_paths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Engine-derived gate/test path protections. Per-run approvals can narrow
+         * only this auto-protected set, never project-config-owned protected_paths. */
+        auto_protected_paths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Per-run typed approvals for protected gate/test path changes. These are
+         * produced by explicit surfaces (CLI/control/IDE), then consumed by policy. */
+        protected_path_approvals: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            /** Glob approved by the operator/user for this run; consumed only by the
+             * auto-protected gate/test path policy, not by built-in critical-path gates. */
+            path: z.ZodString;
+            reason: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            path: string;
+            reason?: string | undefined;
+        }, {
+            path: string;
+            reason?: string | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        protected_paths: string[];
+        deny_paths: string[];
+        auto_protected_paths: string[];
+        protected_path_approvals: {
+            path: string;
+            reason?: string | undefined;
+        }[];
+    }, {
+        protected_paths?: string[] | undefined;
+        deny_paths?: string[] | undefined;
+        auto_protected_paths?: string[] | undefined;
+        protected_path_approvals?: {
+            path: string;
+            reason?: string | undefined;
+        }[] | undefined;
+    }>>;
+    external_context: z.ZodDefault<z.ZodObject<{
+        policy: z.ZodDefault<z.ZodEnum<["off", "auto", "cached", "live"]>>;
+        web_required: z.ZodDefault<z.ZodBoolean>;
+        /** Mode the selected route actually executes (disclosed upgrades, e.g. claude cached->live). */
+        effective_mode: z.ZodDefault<z.ZodEnum<["off", "auto", "cached", "live"]>>;
+    }, "strip", z.ZodTypeAny, {
+        policy: "auto" | "cached" | "live" | "off";
+        web_required: boolean;
+        effective_mode: "auto" | "cached" | "live" | "off";
+    }, {
+        policy?: "auto" | "cached" | "live" | "off" | undefined;
+        web_required?: boolean | undefined;
+        effective_mode?: "auto" | "cached" | "live" | "off" | undefined;
+    }>>;
+    tool_permission_policy: z.ZodDefault<z.ZodObject<{
+        web: z.ZodDefault<z.ZodEnum<["off", "auto", "cached", "live"]>>;
+        allow: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        deny: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        web: "auto" | "cached" | "live" | "off";
+        allow: string[];
+        deny: string[];
+    }, {
+        web?: "auto" | "cached" | "live" | "off" | undefined;
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+    }>>;
+    budget: z.ZodDefault<z.ZodObject<{
+        routing_goal: z.ZodDefault<z.ZodEnum<["auto", "quality", "economy"]>>;
+        paid_budget: z.ZodDefault<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"unlimited">;
+        }, "strict", z.ZodTypeAny, {
+            kind: "unlimited";
+        }, {
+            kind: "unlimited";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"finite">;
+            maxUsd: z.ZodNumber;
+        }, "strict", z.ZodTypeAny, {
+            kind: "finite";
+            maxUsd: number;
+        }, {
+            kind: "finite";
+            maxUsd: number;
+        }>]>>;
+    }, "strip", z.ZodTypeAny, {
+        routing_goal: "auto" | "economy" | "quality";
+        paid_budget: {
+            kind: "unlimited";
+        } | {
+            kind: "finite";
+            maxUsd: number;
+        };
+    }, {
+        routing_goal?: "auto" | "economy" | "quality" | undefined;
+        paid_budget?: {
+            kind: "unlimited";
+        } | {
+            kind: "finite";
+            maxUsd: number;
+        } | undefined;
+    }>>;
+    routing_models: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    routing_efforts: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    convergence: z.ZodDefault<z.ZodObject<{
+        require_tests_pass: z.ZodDefault<z.ZodBoolean>;
+        require_no_accepted_block_open: z.ZodDefault<z.ZodBoolean>;
+        require_no_accepted_fix_first_open: z.ZodDefault<z.ZodBoolean>;
+        require_final_cross_family_clean_review: z.ZodDefault<z.ZodBoolean>;
+        require_final_diff_stable_after_review: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Block convergence while an accepted NEEDS_HUMAN escalation is still open.
+         * Closes the v0.8 hole where, with cross-family clean review disabled, a run
+         * could converge to success with an open NEEDS_HUMAN finding.
+         */
+        require_no_accepted_needs_human_open: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        require_tests_pass: boolean;
+        require_no_accepted_block_open: boolean;
+        require_no_accepted_fix_first_open: boolean;
+        require_final_cross_family_clean_review: boolean;
+        require_final_diff_stable_after_review: boolean;
+        require_no_accepted_needs_human_open: boolean;
+    }, {
+        require_tests_pass?: boolean | undefined;
+        require_no_accepted_block_open?: boolean | undefined;
+        require_no_accepted_fix_first_open?: boolean | undefined;
+        require_final_cross_family_clean_review?: boolean | undefined;
+        require_final_diff_stable_after_review?: boolean | undefined;
+        require_no_accepted_needs_human_open?: boolean | undefined;
+    }>>;
+} & {
+    tests: z.ZodDefault<z.ZodObject<{
+        commands: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            program: z.ZodString;
+            args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            cwd: z.ZodOptional<z.ZodString>;
+            envAllowlist: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        } & {
+            id: z.ZodString;
+            required: z.ZodDefault<z.ZodBoolean>;
+            trust_required: z.ZodDefault<z.ZodBoolean>;
+            trust_grant: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+                projectDigest: z.ZodString;
+                configDigest: z.ZodString;
+                commandDigest: z.ZodString;
+                executablePath: z.ZodString;
+                executableDigest: z.ZodString;
+                scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native"]>;
+            }, "strict", z.ZodTypeAny, {
+                projectDigest: string;
+                configDigest: string;
+                commandDigest: string;
+                executablePath: string;
+                executableDigest: string;
+                scriptPath: string | null;
+                scriptDigest: string | null;
+                accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+            }, {
+                projectDigest: string;
+                configDigest: string;
+                commandDigest: string;
+                executablePath: string;
+                executableDigest: string;
+                scriptPath?: string | null | undefined;
+                scriptDigest?: string | null | undefined;
+                accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+            }>>>;
+        }, "strict", z.ZodTypeAny, {
+            program: string;
+            args: string[];
+            cwd?: string | undefined;
+            envAllowlist: string[];
+            id: string;
+            required: boolean;
+            trust_required: boolean;
+            trust_grant: {
+                projectDigest: string;
+                configDigest: string;
+                commandDigest: string;
+                executablePath: string;
+                executableDigest: string;
+                scriptPath: string | null;
+                scriptDigest: string | null;
+                accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+            } | null;
+        }, {
+            program: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            envAllowlist?: string[] | undefined;
+            id: string;
+            required?: boolean | undefined;
+            trust_required?: boolean | undefined;
+            trust_grant?: {
+                projectDigest: string;
+                configDigest: string;
+                commandDigest: string;
+                executablePath: string;
+                executableDigest: string;
+                scriptPath?: string | null | undefined;
+                scriptDigest?: string | null | undefined;
+                accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+            } | null | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        commands: {
+            program: string;
+            args: string[];
+            cwd?: string | undefined;
+            envAllowlist: string[];
+            id: string;
+            required: boolean;
+            trust_required: boolean;
+            trust_grant: {
+                projectDigest: string;
+                configDigest: string;
+                commandDigest: string;
+                executablePath: string;
+                executableDigest: string;
+                scriptPath: string | null;
+                scriptDigest: string | null;
+                accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+            } | null;
+        }[];
+    }, {
+        commands?: {
+            program: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            envAllowlist?: string[] | undefined;
+            id: string;
+            required?: boolean | undefined;
+            trust_required?: boolean | undefined;
+            trust_grant?: {
+                projectDigest: string;
+                configDigest: string;
+                commandDigest: string;
+                executablePath: string;
+                executableDigest: string;
+                scriptPath?: string | null | undefined;
+                scriptDigest?: string | null | undefined;
+                accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+            } | null | undefined;
+        }[] | undefined;
+    }>>;
+    access: z.ZodDefault<z.ZodObject<{
+        requested_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native"]>>;
+        effective_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native"]>>;
+    }, "strip", z.ZodTypeAny, {
+        requested_profile: "full" | "inherit_native" | "readonly" | "workspace_write";
+        effective_profile: "full" | "inherit_native" | "readonly" | "workspace_write";
+    }, {
+        requested_profile?: "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
+        effective_profile?: "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    schema_version: 2;
+    task_id: string;
+    created_at: string;
+    repo: {
+        root: string;
+        base_ref: string;
+        base_sha?: string | undefined;
+        dirty_policy: "refuse" | "snapshot";
+    };
+    mode: {
+        kind: "agent" | "ask" | "plan";
+    };
+    delegation_requested: boolean;
+    run_lineage: {
+        parent_run_id: string | null;
+        delegated_from_run_id: string | null;
+    };
+    user_intent: {
+        raw: string;
+        normalized?: string | undefined;
+    };
+    instructions?: string | undefined;
+    output_schema: Record<string, unknown> | null;
+    auth_preference: "api_key" | "auto" | "subscription";
+    credential_profile_id: string | null;
+    max_turns: number | null;
+    constraints: {
+        protected_paths: string[];
+        deny_paths: string[];
+        auto_protected_paths: string[];
+        protected_path_approvals: {
+            path: string;
+            reason?: string | undefined;
+        }[];
+    };
+    external_context: {
+        policy: "auto" | "cached" | "live" | "off";
+        web_required: boolean;
+        effective_mode: "auto" | "cached" | "live" | "off";
+    };
+    tool_permission_policy: {
+        web: "auto" | "cached" | "live" | "off";
+        allow: string[];
+        deny: string[];
+    };
+    budget: {
+        routing_goal: "auto" | "economy" | "quality";
+        paid_budget: {
+            kind: "unlimited";
+        } | {
+            kind: "finite";
+            maxUsd: number;
+        };
+    };
+    routing_models: Record<string, string>;
+    routing_efforts: Record<string, string>;
+    convergence: {
+        require_tests_pass: boolean;
+        require_no_accepted_block_open: boolean;
+        require_no_accepted_fix_first_open: boolean;
+        require_final_cross_family_clean_review: boolean;
+        require_final_diff_stable_after_review: boolean;
+        require_no_accepted_needs_human_open: boolean;
+    };
+    tests: {
+        commands: {
+            program: string;
+            args: string[];
+            cwd?: string | undefined;
+            envAllowlist: string[];
+            id: string;
+            required: boolean;
+            trust_required: boolean;
+            trust_grant: {
+                projectDigest: string;
+                configDigest: string;
+                commandDigest: string;
+                executablePath: string;
+                executableDigest: string;
+                scriptPath: string | null;
+                scriptDigest: string | null;
+                accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+            } | null;
+        }[];
+    };
+    access: {
+        requested_profile: "full" | "inherit_native" | "readonly" | "workspace_write";
+        effective_profile: "full" | "inherit_native" | "readonly" | "workspace_write";
+    };
+}, {
+    schema_version: 2;
+    task_id: string;
+    created_at: string;
+    repo: {
+        root: string;
+        base_ref: string;
+        base_sha?: string | undefined;
+        dirty_policy?: "refuse" | "snapshot" | undefined;
+    };
+    mode: {
+        kind: "agent" | "ask" | "plan";
+    };
+    delegation_requested?: boolean | undefined;
+    run_lineage?: {
+        parent_run_id?: string | null | undefined;
+        delegated_from_run_id?: string | null | undefined;
+    } | undefined;
+    user_intent: {
+        raw: string;
+        normalized?: string | undefined;
+    };
+    instructions?: string | undefined;
+    output_schema?: Record<string, unknown> | null | undefined;
+    auth_preference?: "api_key" | "auto" | "subscription" | undefined;
+    credential_profile_id?: string | null | undefined;
+    max_turns?: number | null | undefined;
+    constraints?: {
+        protected_paths?: string[] | undefined;
+        deny_paths?: string[] | undefined;
+        auto_protected_paths?: string[] | undefined;
+        protected_path_approvals?: {
+            path: string;
+            reason?: string | undefined;
+        }[] | undefined;
+    } | undefined;
+    external_context?: {
+        policy?: "auto" | "cached" | "live" | "off" | undefined;
+        web_required?: boolean | undefined;
+        effective_mode?: "auto" | "cached" | "live" | "off" | undefined;
+    } | undefined;
+    tool_permission_policy?: {
+        web?: "auto" | "cached" | "live" | "off" | undefined;
+        allow?: string[] | undefined;
+        deny?: string[] | undefined;
+    } | undefined;
+    budget?: {
+        routing_goal?: "auto" | "economy" | "quality" | undefined;
+        paid_budget?: {
+            kind: "unlimited";
+        } | {
+            kind: "finite";
+            maxUsd: number;
+        } | undefined;
+    } | undefined;
+    routing_models?: Record<string, string> | undefined;
+    routing_efforts?: Record<string, string> | undefined;
+    convergence?: {
+        require_tests_pass?: boolean | undefined;
+        require_no_accepted_block_open?: boolean | undefined;
+        require_no_accepted_fix_first_open?: boolean | undefined;
+        require_final_cross_family_clean_review?: boolean | undefined;
+        require_final_diff_stable_after_review?: boolean | undefined;
+        require_no_accepted_needs_human_open?: boolean | undefined;
+    } | undefined;
+    tests?: {
+        commands?: {
+            program: string;
+            args?: string[] | undefined;
+            cwd?: string | undefined;
+            envAllowlist?: string[] | undefined;
+            id: string;
+            required?: boolean | undefined;
+            trust_required?: boolean | undefined;
+            trust_grant?: {
+                projectDigest: string;
+                configDigest: string;
+                commandDigest: string;
+                executablePath: string;
+                executableDigest: string;
+                scriptPath?: string | null | undefined;
+                scriptDigest?: string | null | undefined;
+                accessProfile: "full" | "inherit_native" | "readonly" | "workspace_write";
+            } | null | undefined;
+        }[] | undefined;
+    } | undefined;
+    access?: {
+        requested_profile?: "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
+        effective_profile?: "full" | "inherit_native" | "readonly" | "workspace_write" | undefined;
+    } | undefined;
+}>;
+export type ActiveTaskContract = z.infer<typeof ActiveTaskContract>;
 /**
  * Decoder for the persisted, frozen task artifact used to authorize delivery.
  * Runtime construction keeps TaskContract defaults for callers building a new
@@ -763,7 +1375,8 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -838,7 +1451,8 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -913,7 +1527,8 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -990,7 +1605,8 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -1065,7 +1681,8 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -1140,7 +1757,8 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -1217,7 +1835,8 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -1292,7 +1911,8 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -1367,7 +1987,8 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -1561,7 +2182,8 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
                 executableDigest: z.ZodString;
                 scriptPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 scriptDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>;
+            } & {
+                accessProfile: z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>;
             }, "strict", z.ZodTypeAny, {
                 projectDigest: string;
                 configDigest: string;
@@ -1660,9 +2282,9 @@ export declare const FrozenTaskContractArtifact: z.ZodPipeline<z.ZodObject<{
         }[] | undefined;
     }>>;
     access: z.ZodDefault<z.ZodObject<{
-        requested_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>>;
+        requested_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>>;
         /** Profile actually enforced by the engine (mode/trust clamps applied; never client-supplied). */
-        effective_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "external_sandbox_full", "inherit_native"]>>;
+        effective_profile: z.ZodDefault<z.ZodEnum<["readonly", "workspace_write", "full", "inherit_native", "external_sandbox_full"]>>;
     }, "strip", z.ZodTypeAny, {
         requested_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";
         effective_profile: "external_sandbox_full" | "full" | "inherit_native" | "readonly" | "workspace_write";