@claudexor/schema 5.0.1 → 5.1.0

package/generated/ControlRunSummary.schema.json

@@ -119,13 +119,14 @@
                     "transport",
                     "permission_denied",
                     "context_exhausted",
+                    "turn_limit",
                     "wall_clock",
                     "cancelled",
                     "host_restart",
                     "input_required",
                     "other"
                   ],
-                  "description": "Typed reason the previous process stopped: a vendor limit (next account eligible), the whole pool spent, a pinned account's limit, a transport death (crash, timeout, watchdog), a confirmed native tool permission refusal, context exhaustion, the wall-clock deadline, a cancel, a daemon/host restart, a model that asked for input, or another typed cause."
+                  "description": "Typed reason the previous process stopped: a vendor limit (next account eligible), the whole pool spent, a pinned account's limit, an error without a typed cause (`transport`: a crash, an inactivity timeout or a harness-reported error; not proof that a process died or the network failed), a confirmed native tool permission refusal, context exhaustion, the run's max-turns cap, the wall-clock deadline, a cancel, a daemon/host restart, a model that asked for input, or another typed cause."
                 },
                 "resetsAt": {
                   "type": [
@@ -653,9 +654,41 @@
                         "reported_source"
                       ],
                       "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "kind": {
+                          "type": "string",
+                          "const": "vendor_not_retryable"
+                        },
+                        "source": {
+                          "type": "string",
+                          "const": "agy_stderr"
+                        },
+                        "error_id": {
+                          "anyOf": [
+                            {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 128
+                            },
+                            {
+                              "type": "null"
+                            }
+                          ],
+                          "description": "The vendor's own error id from the same record, verbatim; null when absent."
+                        }
+                      },
+                      "required": [
+                        "kind",
+                        "source",
+                        "error_id"
+                      ],
+                      "additionalProperties": false
                     }
                   ],
-                  "description": "Vendor-attested request refusal that stops retries and account rotation on its harness; input, executable and credential-source causes carry their own evidence."
+                  "description": "Vendor-attested request refusal that stops retries and account rotation on its harness; input, executable and credential-source causes and an explicit vendor not-retryable verdict carry their own evidence."
                 },
                 "rawContextShortfall": {
                   "type": "object",
@@ -906,8 +939,20 @@
                         "raw_context_mandatory_unavailable",
                         "raw_context_exceeds_window",
                         "model_catalog_unavailable",
+                        "model_selection_required",
+                        "raw_patch_requires_isolation",
+                        "raw_patch_missing_evidence",
+                        "raw_patch_digest_mismatch",
+                        "raw_patch_base_mismatch",
+                        "raw_patch_path_traversal",
+                        "raw_patch_outside_scope",
+                        "raw_patch_stale_preimage",
+                        "raw_patch_binary_unsupported",
+                        "raw_patch_truncated",
+                        "raw_patch_apply_failed",
                         "vendor_cli_too_old",
                         "credential_source_unconfirmed",
+                        "vendor_not_retryable",
                         "delegated_home_unavailable",
                         "delegated_confinement_unavailable",
                         "delegated_evidence_incomplete",
@@ -1036,7 +1081,7 @@
                     "threshold"
                   ],
                   "additionalProperties": false,
-                  "description": "Present when quota admission refused the account (code subscription_window_exhausted): separates the owner's saved reserve from provider exhaustion. Absent on other failures and on records written before this field existed."
+                  "description": "Present when quota admission or a typed provider limit refused the account: with code subscription_window_exhausted it separates the owner's saved reserve from provider exhaustion; with a null code the provider refused usage and no reopening time is known, so no timer is implied. Absent on other failures and on records written before this field existed."
                 },
                 "vendorFailure": {
                   "anyOf": [
@@ -1682,7 +1727,7 @@
         },
         "effectiveAccess": {
           "$ref": "#/definitions/ControlRunSummary/properties/access",
-          "description": "Access profile actually enforced by the engine."
+          "description": "Access profile the engine resolved and passed to its routes; routeControls names each route's native setting."
         },
         "externalContextPolicy": {
           "type": "string",
@@ -1700,7 +1745,7 @@
         },
         "webMode": {
           "$ref": "#/definitions/ControlRunSummary/properties/externalContextPolicy",
-          "description": "Web policy actually executed by the selected route."
+          "description": "Web policy given to the selected route, after disclosed upgrades; not proof that a native session ran."
         },
         "webEvidence": {
           "type": "object",
@@ -1718,12 +1763,12 @@
             "effectiveMode": {
               "$ref": "#/definitions/ControlRunSummary/properties/externalContextPolicy",
               "default": "auto",
-              "description": "Policy the selected route actually executed (disclosed upgrades, e.g. cached to live)."
+              "description": "Policy given to the selected route, after disclosed upgrades (e.g. cached to live); not proof that a native session ran."
             },
             "attempted": {
               "type": "boolean",
               "default": false,
-              "description": "Whether any web activity was attempted."
+              "description": "Whether a web tool call or engine Browser call was observed; not a network measurement."
             },
             "satisfied": {
               "type": "boolean",
@@ -1742,6 +1787,62 @@
               "default": "none",
               "description": "Observed web status; satisfied does not prove retrieved content was verified."
             },
+            "verification": {
+              "type": "string",
+              "enum": [
+                "verified",
+                "dispatched",
+                "none"
+              ],
+              "default": "none",
+              "description": "Retrieval-proof strength: verified when a typed result shows a retrieval (verifiedContent says of what); dispatched when a web call completed without one; none when no search or page retrieval was observed, though a Browser action may have completed."
+            },
+            "verifiedContent": {
+              "anyOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "page",
+                    "search_results"
+                  ]
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null,
+              "description": "What the verified retrieval returned: page (a fetched or loaded page) or search_results (a web search's results, not a fetched page); null when nothing was verified or the engine did not record it."
+            },
+            "observation": {
+              "anyOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "evidence": {
+                      "type": "string",
+                      "const": "tool_calls",
+                      "description": "Web evidence comes from typed web tool calls and engine Browser MCP calls."
+                    },
+                    "network": {
+                      "type": "string",
+                      "const": "not_measured",
+                      "description": "Process network traffic is not measured: vendor API traffic, shell commands and other tools can use the network without appearing here."
+                    }
+                  },
+                  "required": [
+                    "evidence",
+                    "network"
+                  ],
+                  "additionalProperties": false,
+                  "description": "Scope of the web evidence: observed tool calls only, never a network measurement."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "What the evidence covers (tool calls; network not measured); null when no telemetry was recorded.",
+              "default": null
+            },
             "tool": {
               "type": [
                 "string",
@@ -1784,6 +1885,141 @@
           "description": "Web evidence projected onto a run summary from the telemetry artifact.",
           "default": {}
         },
+        "routeControls": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "harnessId": {
+                "type": "string",
+                "description": "Harness of the route."
+              },
+              "webMode": {
+                "type": "string",
+                "enum": [
+                  "off",
+                  "auto",
+                  "cached",
+                  "live"
+                ],
+                "description": "Web policy given to the route."
+              },
+              "webMechanism": {
+                "type": "string",
+                "enum": [
+                  "native",
+                  "tools",
+                  "uncontrolled",
+                  "none"
+                ],
+                "description": "How the route's own web tools are switched."
+              },
+              "browser": {
+                "type": "boolean",
+                "description": "Whether the engine Browser MCP was handed to the route (prepared; not a connection)."
+              },
+              "browserStartup": {
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "status": {
+                        "type": "string",
+                        "enum": [
+                          "ready",
+                          "failed",
+                          "cancelled",
+                          "starting",
+                          "not_observed"
+                        ],
+                        "description": "Startup state when the first model request was allowed: ready (Codex reported the server started), failed, cancelled, starting (still starting when the hold ended: Codex's 90 s limit plus a 5 s grace for its status), or not_observed (no startup status at all)."
+                      },
+                      "waitedMs": {
+                        "type": "integer",
+                        "minimum": 0,
+                        "description": "How long the first model request was held for this outcome."
+                      },
+                      "error": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "description": "The vendor's own reason for a failed or cancelled startup, masked."
+                      }
+                    },
+                    "required": [
+                      "status",
+                      "waitedMs",
+                      "error"
+                    ],
+                    "additionalProperties": false,
+                    "description": "The selected Browser's reported startup outcome on one route (#215)."
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The Browser's startup as the route reported it before the first model request; null when it reported none, so an armed Browser was only prepared.",
+                "default": null
+              },
+              "access": {
+                "type": "string",
+                "enum": [
+                  "readonly",
+                  "workspace_write",
+                  "full",
+                  "inherit_native"
+                ],
+                "description": "Access profile handed to the route."
+              },
+              "nativeAccess": {
+                "type": [
+                  "string",
+                  "null"
+                ],
+                "description": "The vendor access setting prepared for the route; null when none or undisclosed."
+              },
+              "accessMechanism": {
+                "type": "string",
+                "enum": [
+                  "fs_sandbox",
+                  "permission_deny",
+                  "tool_allowlist",
+                  "tool_policy",
+                  "native_settings",
+                  "none"
+                ],
+                "description": "How the route's access profile reaches the harness: fs_sandbox (the vendor's own file-system sandbox, as the vendor applies it), permission_deny, tool_allowlist or tool_policy (vendor tool permissions; the manifest declares no OS file boundary), native_settings (inherit_native: Claudexor passes no access profile, so the harness's own configuration decides and what it confines is unknown here), or none (full access, or a route that declares no control)."
+              },
+              "nativeSessionStarted": {
+                "type": "boolean",
+                "description": "Whether an adapter reported a native session started under these controls. False means none was observed (refused before launch, or stopped or ended before a start was reported); it does not prove that no process ran."
+              },
+              "homeScoped": {
+                "type": [
+                  "boolean",
+                  "null"
+                ],
+                "description": "Applied HOME fact: true when the engine assigned the child a Claudexor-owned HOME, false when the engine did not replace HOME, so the child inherits the engine's own environment; null when the route recorded none."
+              }
+            },
+            "required": [
+              "harnessId",
+              "webMode",
+              "webMechanism",
+              "browser",
+              "access",
+              "nativeAccess",
+              "accessMechanism",
+              "nativeSessionStarted",
+              "homeScoped"
+            ],
+            "additionalProperties": false,
+            "description": "Native web and access controls prepared for one route of the run; Claudexor adds no outer boundary."
+          },
+          "default": [],
+          "description": "Distinct routes of the run: the native web/access controls prepared for each and whether a native session was reported started."
+        },
         "requestRequirements": {
           "type": "array",
           "items": {
@@ -2048,6 +2284,7 @@
                         "input_required",
                         "work_incomplete",
                         "context_capacity_exhausted",
+                        "turn_limit_reached",
                         "work_report_contract"
                       ],
                       "description": "Typed reason qualifying a non-clean terminal; null on a clean success."
@@ -2229,6 +2466,58 @@
           "description": "Compact process-scope outcome from final/process_scope.yaml (settled, coverage, completeness, survivors, unreadable, census). Always present in this engine's responses: null means unknown (the run is live, or the record is missing, unreadable or invalid), never clean. Engines that predate the field omit the key, which is equally unknown.",
           "default": null
         },
+        "processScopeLater": {
+          "anyOf": [
+            {
+              "type": "object",
+              "properties": {
+                "settled": {
+                  "$ref": "#/definitions/ControlRunSummary/properties/processScope/anyOf/0/properties/settled"
+                },
+                "coverage": {
+                  "$ref": "#/definitions/ControlRunSummary/properties/processScope/anyOf/0/properties/coverage"
+                },
+                "completeness": {
+                  "$ref": "#/definitions/ControlRunSummary/properties/processScope/anyOf/0/properties/completeness"
+                },
+                "census": {
+                  "$ref": "#/definitions/ControlRunSummary/properties/processScope/anyOf/0/properties/census"
+                },
+                "survivors": {
+                  "$ref": "#/definitions/ControlRunSummary/properties/processScope/anyOf/0/properties/survivors"
+                },
+                "unreadable": {
+                  "$ref": "#/definitions/ControlRunSummary/properties/processScope/anyOf/0/properties/unreadable"
+                },
+                "attempt": {
+                  "type": "integer",
+                  "exclusiveMinimum": 0
+                },
+                "at": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              },
+              "required": [
+                "settled",
+                "coverage",
+                "completeness",
+                "census",
+                "survivors",
+                "unreadable",
+                "attempt",
+                "at"
+              ],
+              "additionalProperties": false,
+              "description": "Compact process-scope outcome of a terminal run (full artifact: final/process_scope.yaml)."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Latest later, separately bounded settlement attempt of this finished run's scope (final/process_scope_later.yaml), beside the unchanged terminal processScope. Null when none ran or it is unreadable: unknown, never clean.",
+          "default": null
+        },
         "route": {
           "anyOf": [
             {

package/generated/ControlThreadDetail.schema.json

@@ -585,6 +585,7 @@
                                       "input_required",
                                       "work_incomplete",
                                       "context_capacity_exhausted",
+                                      "turn_limit_reached",
                                       "work_report_contract"
                                     ],
                                     "description": "Typed reason qualifying a non-clean terminal; null on a clean success."

package/generated/ControlThreadTurnResponse.schema.json

@@ -6,6 +6,11 @@
         {
           "type": "object",
           "properties": {
+            "storeId": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Identity of the durable engine store that accepted this command, stable across restarts. A group member always carries it; an ordinary receipt carries it only for a request sending `X-Claudexor-Store-Identity: 1`, and it stays absent, meaning unknown, when the store has no identity to give."
+            },
             "jobId": {
               "type": "string",
               "description": "Daemon job id backing the run."
@@ -43,6 +48,10 @@
         {
           "type": "object",
           "properties": {
+            "storeId": {
+              "$ref": "#/definitions/ControlThreadTurnResponse/anyOf/0/properties/storeId",
+              "description": "Identity of the durable engine store that accepted this command, stable across restarts. A group member always carries it; an ordinary receipt carries it only for a request sending `X-Claudexor-Store-Identity: 1`, and it stays absent, meaning unknown, when the store has no identity to give."
+            },
             "jobId": {
               "$ref": "#/definitions/ControlThreadTurnResponse/anyOf/0/properties/threadId"
             },

package/generated/ControlTrustListResponse.schema.json

@@ -39,6 +39,14 @@
                 "minimum": 0,
                 "default": 0,
                 "description": "Number of exact external test-command grants for this repo."
+              },
+              "source": {
+                "type": "string",
+                "enum": [
+                  "file",
+                  "default"
+                ],
+                "description": "default only when no trust file exists at this repo's path; file whenever one does, including an empty, comment-only or unreadable file read as the schema default. Omitted by older daemons and by the unscoped list."
               }
             },
             "required": [

package/generated/ControlTrustState.schema.json

@@ -34,6 +34,14 @@
           "minimum": 0,
           "default": 0,
           "description": "Number of exact external test-command grants for this repo."
+        },
+        "source": {
+          "type": "string",
+          "enum": [
+            "file",
+            "default"
+          ],
+          "description": "default only when no trust file exists at this repo's path; file whenever one does, including an empty, comment-only or unreadable file read as the schema default. Omitted by older daemons and by the unscoped list."
         }
       },
       "required": [

package/generated/ControlUploadImport.schema.json

@@ -15,9 +15,10 @@
             "open",
             "uploading",
             "ready",
+            "released",
             "cancelled"
           ],
-          "description": "open: send the bound bytes; uploading: a transfer is in flight; ready: resource is published; cancelled: finished without a resource, a new attempt needs a new key."
+          "description": "open: send the bound bytes; uploading: a transfer is in flight; ready: resource is published; released: the published managed resource was later released by its caller and admits no new reference, a new attachment needs a new key; cancelled: finished without a resource, a new attempt needs a new key."
         },
         "uploadId": {
           "type": "string",
@@ -62,6 +63,11 @@
               "const": "model",
               "description": "Immutable model-operation purpose; absent means a legacy or ordinary attachment."
             },
+            "lifetime": {
+              "type": "string",
+              "const": "managed",
+              "description": "managed: its caller may later release the ID (POST /v2/resources/:id/release), after which no new reference is admitted while already accepted work keeps the bytes. Absent: indefinite reuse."
+            },
             "kind": {
               "type": "string",
               "enum": [
@@ -106,7 +112,11 @@
             "deduplicated"
           ],
           "additionalProperties": false,
-          "description": "The immutable resource, present exactly when state is ready."
+          "description": "The immutable resource, present exactly when state is ready or released."
+        },
+        "releasedAt": {
+          "$ref": "#/definitions/ControlUploadImport/properties/resource/properties/createdAt",
+          "description": "The first release of the resource, present exactly when state is released."
         }
       },
       "required": [

package/generated/ControlUploadImportRequest.schema.json

@@ -31,6 +31,11 @@
           "maxLength": 4096,
           "description": "Opaque caller identity of the selected source, such as the absolute path a local client read or a task artifact id. Bound into the key only; the daemon never reads, resolves, stores or returns it."
         },
+        "lifetime": {
+          "type": "string",
+          "const": "managed",
+          "description": "Opt in to a managed resource lifetime (support: the POST /v2/resources/:id/release catalog descriptor). Bound into the key like kind, mime, name and source."
+        },
         "content": {
           "type": "object",
           "properties": {

package/generated/DecisionRecord.schema.json

@@ -86,6 +86,7 @@
                     "input_required",
                     "work_incomplete",
                     "context_capacity_exhausted",
+                    "turn_limit_reached",
                     "work_report_contract"
                   ],
                   "description": "Typed reason qualifying a non-clean terminal; null on a clean success."

package/generated/DeferredMessageDetail.schema.json

@@ -85,7 +85,7 @@
                     "retryable": {
                       "type": "boolean",
                       "default": true,
-                      "description": "True when retry can replay this turn (a job was recorded before the failure); false when no job exists to replay."
+                      "description": "True when retry can replay this turn (a job was recorded before the failure); false when no job exists to replay or a managed resource it names was released."
                     },
                     "required_actions": {
                       "type": "array",
@@ -116,13 +116,51 @@
                 "code"
               ],
               "additionalProperties": false,
-              "description": "Stable hold. Editing, observation and readiness restoration never rearm it; inspect the predecessor result and clear before an ordinary continuation."
+              "description": "Stable hold. Editing, observation and readiness restoration never rearm it; inspect the predecessor result and clear before an ordinary continuation. One exception: an unchanged settlement_unknown draft returns by itself when a later settlement of the predecessor's run, by the live daemon that ran it, proves its processes gone (see resumed); a Stop first keeps it held."
             },
             {
               "type": "null"
             }
           ],
-          "description": "Stable hold. Editing, observation and readiness restoration never rearm it; inspect the predecessor result and clear before an ordinary continuation."
+          "description": "Stable hold. Editing, observation and readiness restoration never rearm it; inspect the predecessor result and clear before an ordinary continuation. One exception: an unchanged settlement_unknown draft returns by itself when a later settlement of the predecessor's run, by the live daemon that ran it, proves its processes gone (see resumed); a Stop first keeps it held."
+        },
+        "resumed": {
+          "type": "object",
+          "properties": {
+            "from": {
+              "type": "object",
+              "properties": {
+                "code": {
+                  "$ref": "#/definitions/DeferredMessageDetail/properties/hold/anyOf/0/properties/code"
+                },
+                "problem": {
+                  "$ref": "#/definitions/DeferredMessageDetail/properties/hold/anyOf/0/properties/problem"
+                }
+              },
+              "required": [
+                "code"
+              ],
+              "additionalProperties": false,
+              "description": "The hold the draft was returned from."
+            },
+            "reason": {
+              "type": "string",
+              "const": "process_scope_settled",
+              "description": "A later settlement of the predecessor's run proved its processes gone; the draft was unchanged, not cleared, replaced or stopped."
+            },
+            "at": {
+              "type": "string",
+              "minLength": 1,
+              "description": "ISO-8601 timestamp string."
+            }
+          },
+          "required": [
+            "from",
+            "reason",
+            "at"
+          ],
+          "additionalProperties": false,
+          "description": "Why this draft left its hold automatically. It then took the existing revision and admission path; any other reason holds it again."
         },
         "dispatchedRevision": {
           "anyOf": [
@@ -777,7 +815,7 @@
                               "null"
                             ],
                             "default": null,
-                            "description": "Per-harness default model; null = the harness's own default."
+                            "description": "Per-harness default model; null = the harness's own default, or no model on a route whose request must name one."
                           },
                           "effort": {
                             "anyOf": [
@@ -882,9 +920,7 @@
         "capturedAt": {
           "anyOf": [
             {
-              "type": "string",
-              "minLength": 1,
-              "description": "ISO-8601 timestamp string."
+              "$ref": "#/definitions/DeferredMessageDetail/properties/resumed/properties/at"
             },
             {
               "type": "null"