@claudexor/schema 5.0.2 → 6.0.0

package/generated/ControlRunListResponse.schema.json

@@ -124,13 +124,14 @@
                           "transport",
                           "permission_denied",
                           "context_exhausted",
+                          "turn_limit",
                           "wall_clock",
                           "cancelled",
                           "host_restart",
                           "input_required",
                           "other"
                         ],
-                        "description": "Typed reason the previous process stopped: a vendor limit (next account eligible), the whole pool spent, a pinned account's limit, a transport death (crash, timeout, watchdog), a confirmed native tool permission refusal, context exhaustion, the wall-clock deadline, a cancel, a daemon/host restart, a model that asked for input, or another typed cause."
+                        "description": "Typed reason the previous process stopped: a vendor limit (next account eligible), the whole pool spent, a pinned account's limit, an error without a typed cause (`transport`: a crash, an inactivity timeout or a harness-reported error; not proof that a process died or the network failed), a confirmed native tool permission refusal, context exhaustion, the run's max-turns cap, the wall-clock deadline, a cancel, a daemon/host restart, a model that asked for input, or another typed cause."
                       },
                       "resetsAt": {
                         "type": [
@@ -520,6 +521,17 @@
                   {
                     "type": "object",
                     "properties": {
+                      "lastVendorError": {
+                        "anyOf": [
+                          {
+                            "type": "string",
+                            "maxLength": 1000
+                          },
+                          {
+                            "type": "null"
+                          }
+                        ]
+                      },
                       "requestRefusal": {
                         "anyOf": [
                           {
@@ -658,9 +670,41 @@
                               "reported_source"
                             ],
                             "additionalProperties": false
+                          },
+                          {
+                            "type": "object",
+                            "properties": {
+                              "kind": {
+                                "type": "string",
+                                "const": "vendor_not_retryable"
+                              },
+                              "source": {
+                                "type": "string",
+                                "const": "agy_stderr"
+                              },
+                              "error_id": {
+                                "anyOf": [
+                                  {
+                                    "type": "string",
+                                    "minLength": 1,
+                                    "maxLength": 128
+                                  },
+                                  {
+                                    "type": "null"
+                                  }
+                                ],
+                                "description": "The vendor's own error id from the same record, verbatim; null when absent."
+                              }
+                            },
+                            "required": [
+                              "kind",
+                              "source",
+                              "error_id"
+                            ],
+                            "additionalProperties": false
                           }
                         ],
-                        "description": "Vendor-attested request refusal that stops retries and account rotation on its harness; input, executable and credential-source causes carry their own evidence."
+                        "description": "Vendor-attested request refusal that stops retries and account rotation on its harness; input, executable and credential-source causes and an explicit vendor not-retryable verdict carry their own evidence."
                       },
                       "rawContextShortfall": {
                         "type": "object",
@@ -911,8 +955,20 @@
                               "raw_context_mandatory_unavailable",
                               "raw_context_exceeds_window",
                               "model_catalog_unavailable",
+                              "model_selection_required",
+                              "raw_patch_requires_isolation",
+                              "raw_patch_missing_evidence",
+                              "raw_patch_digest_mismatch",
+                              "raw_patch_base_mismatch",
+                              "raw_patch_path_traversal",
+                              "raw_patch_outside_scope",
+                              "raw_patch_stale_preimage",
+                              "raw_patch_binary_unsupported",
+                              "raw_patch_truncated",
+                              "raw_patch_apply_failed",
                               "vendor_cli_too_old",
                               "credential_source_unconfirmed",
+                              "vendor_not_retryable",
                               "delegated_home_unavailable",
                               "delegated_confinement_unavailable",
                               "delegated_evidence_incomplete",
@@ -1041,7 +1097,7 @@
                           "threshold"
                         ],
                         "additionalProperties": false,
-                        "description": "Present when quota admission refused the account (code subscription_window_exhausted): separates the owner's saved reserve from provider exhaustion. Absent on other failures and on records written before this field existed."
+                        "description": "Present when quota admission or a typed provider limit refused the account: with code subscription_window_exhausted it separates the owner's saved reserve from provider exhaustion; with a null code the provider refused usage and no reopening time is known, so no timer is implied. Absent on other failures and on records written before this field existed."
                       },
                       "vendorFailure": {
                         "anyOf": [
@@ -1100,6 +1156,11 @@
                         "items": {
                           "type": "object",
                           "properties": {
+                            "lastVendorError": {
+                              "type": "string",
+                              "maxLength": 1000,
+                              "description": "Last vendor diagnostic line, bounded and redacted; never classified."
+                            },
                             "harnessId": {
                               "type": "string",
                               "minLength": 1,
@@ -1687,7 +1748,7 @@
               },
               "effectiveAccess": {
                 "$ref": "#/definitions/ControlRunListResponse/properties/runs/items/properties/access",
-                "description": "Access profile actually enforced by the engine."
+                "description": "Access profile the engine resolved and passed to its routes; routeControls names each route's native setting."
               },
               "externalContextPolicy": {
                 "type": "string",
@@ -1705,7 +1766,7 @@
               },
               "webMode": {
                 "$ref": "#/definitions/ControlRunListResponse/properties/runs/items/properties/externalContextPolicy",
-                "description": "Web policy actually executed by the selected route."
+                "description": "Web policy given to the selected route, after disclosed upgrades; not proof that a native session ran."
               },
               "webEvidence": {
                 "type": "object",
@@ -1723,12 +1784,12 @@
                   "effectiveMode": {
                     "$ref": "#/definitions/ControlRunListResponse/properties/runs/items/properties/externalContextPolicy",
                     "default": "auto",
-                    "description": "Policy the selected route actually executed (disclosed upgrades, e.g. cached to live)."
+                    "description": "Policy given to the selected route, after disclosed upgrades (e.g. cached to live); not proof that a native session ran."
                   },
                   "attempted": {
                     "type": "boolean",
                     "default": false,
-                    "description": "Whether any web activity was attempted."
+                    "description": "Whether a web tool call or engine Browser call was observed; not a network measurement."
                   },
                   "satisfied": {
                     "type": "boolean",
@@ -1747,6 +1808,62 @@
                     "default": "none",
                     "description": "Observed web status; satisfied does not prove retrieved content was verified."
                   },
+                  "verification": {
+                    "type": "string",
+                    "enum": [
+                      "verified",
+                      "dispatched",
+                      "none"
+                    ],
+                    "default": "none",
+                    "description": "Retrieval-proof strength: verified when a typed result shows a retrieval (verifiedContent says of what); dispatched when a web call completed without one; none when no search or page retrieval was observed, though a Browser action may have completed."
+                  },
+                  "verifiedContent": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "page",
+                          "search_results"
+                        ]
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "default": null,
+                    "description": "What the verified retrieval returned: page (a fetched or loaded page) or search_results (a web search's results, not a fetched page); null when nothing was verified or the engine did not record it."
+                  },
+                  "observation": {
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "evidence": {
+                            "type": "string",
+                            "const": "tool_calls",
+                            "description": "Web evidence comes from typed web tool calls and engine Browser MCP calls."
+                          },
+                          "network": {
+                            "type": "string",
+                            "const": "not_measured",
+                            "description": "Process network traffic is not measured: vendor API traffic, shell commands and other tools can use the network without appearing here."
+                          }
+                        },
+                        "required": [
+                          "evidence",
+                          "network"
+                        ],
+                        "additionalProperties": false,
+                        "description": "Scope of the web evidence: observed tool calls only, never a network measurement."
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "What the evidence covers (tool calls; network not measured); null when no telemetry was recorded.",
+                    "default": null
+                  },
                   "tool": {
                     "type": [
                       "string",
@@ -1789,6 +1906,141 @@
                 "description": "Web evidence projected onto a run summary from the telemetry artifact.",
                 "default": {}
               },
+              "routeControls": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "harnessId": {
+                      "type": "string",
+                      "description": "Harness of the route."
+                    },
+                    "webMode": {
+                      "type": "string",
+                      "enum": [
+                        "off",
+                        "auto",
+                        "cached",
+                        "live"
+                      ],
+                      "description": "Web policy given to the route."
+                    },
+                    "webMechanism": {
+                      "type": "string",
+                      "enum": [
+                        "native",
+                        "tools",
+                        "uncontrolled",
+                        "none"
+                      ],
+                      "description": "How the route's own web tools are switched."
+                    },
+                    "browser": {
+                      "type": "boolean",
+                      "description": "Whether the engine Browser MCP was handed to the route (prepared; not a connection)."
+                    },
+                    "browserStartup": {
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "status": {
+                              "type": "string",
+                              "enum": [
+                                "ready",
+                                "failed",
+                                "cancelled",
+                                "starting",
+                                "not_observed"
+                              ],
+                              "description": "Startup state when the first model request was allowed: ready (Codex reported the server started), failed, cancelled, starting (still starting when the hold ended: Codex's 90 s limit plus a 5 s grace for its status), or not_observed (no startup status at all)."
+                            },
+                            "waitedMs": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "description": "How long the first model request was held for this outcome."
+                            },
+                            "error": {
+                              "type": [
+                                "string",
+                                "null"
+                              ],
+                              "description": "The vendor's own reason for a failed or cancelled startup, masked."
+                            }
+                          },
+                          "required": [
+                            "status",
+                            "waitedMs",
+                            "error"
+                          ],
+                          "additionalProperties": false,
+                          "description": "The selected Browser's reported startup outcome on one route (#215)."
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "The Browser's startup as the route reported it before the first model request; null when it reported none, so an armed Browser was only prepared.",
+                      "default": null
+                    },
+                    "access": {
+                      "type": "string",
+                      "enum": [
+                        "readonly",
+                        "workspace_write",
+                        "full",
+                        "inherit_native"
+                      ],
+                      "description": "Access profile handed to the route."
+                    },
+                    "nativeAccess": {
+                      "type": [
+                        "string",
+                        "null"
+                      ],
+                      "description": "The vendor access setting prepared for the route; null when none or undisclosed."
+                    },
+                    "accessMechanism": {
+                      "type": "string",
+                      "enum": [
+                        "fs_sandbox",
+                        "permission_deny",
+                        "tool_allowlist",
+                        "tool_policy",
+                        "native_settings",
+                        "none"
+                      ],
+                      "description": "How the route's access profile reaches the harness: fs_sandbox (the vendor's own file-system sandbox, as the vendor applies it), permission_deny, tool_allowlist or tool_policy (vendor tool permissions; the manifest declares no OS file boundary), native_settings (inherit_native: Claudexor passes no access profile, so the harness's own configuration decides and what it confines is unknown here), or none (full access, or a route that declares no control)."
+                    },
+                    "nativeSessionStarted": {
+                      "type": "boolean",
+                      "description": "Whether an adapter reported a native session started under these controls. False means none was observed (refused before launch, or stopped or ended before a start was reported); it does not prove that no process ran."
+                    },
+                    "homeScoped": {
+                      "type": [
+                        "boolean",
+                        "null"
+                      ],
+                      "description": "Applied HOME fact: true when the engine assigned the child a Claudexor-owned HOME, false when the engine did not replace HOME, so the child inherits the engine's own environment; null when the route recorded none."
+                    }
+                  },
+                  "required": [
+                    "harnessId",
+                    "webMode",
+                    "webMechanism",
+                    "browser",
+                    "access",
+                    "nativeAccess",
+                    "accessMechanism",
+                    "nativeSessionStarted",
+                    "homeScoped"
+                  ],
+                  "additionalProperties": false,
+                  "description": "Native web and access controls prepared for one route of the run; Claudexor adds no outer boundary."
+                },
+                "default": [],
+                "description": "Distinct routes of the run: the native web/access controls prepared for each and whether a native session was reported started."
+              },
               "requestRequirements": {
                 "type": "array",
                 "items": {
@@ -2053,6 +2305,7 @@
                               "input_required",
                               "work_incomplete",
                               "context_capacity_exhausted",
+                              "turn_limit_reached",
                               "work_report_contract"
                             ],
                             "description": "Typed reason qualifying a non-clean terminal; null on a clean success."
@@ -2172,6 +2425,11 @@
                 "default": false,
                 "description": "True while at least one interactive question awaits answer, timeout, run-terminal, or interruption release."
               },
+              "asyncQuestionsOnly": {
+                "type": "boolean",
+                "default": false,
+                "description": "True while questions are pending and every one is async: the agent keeps working and the questions are attention only. False when none is pending or any pending question is blocking."
+              },
               "processScope": {
                 "anyOf": [
                   {
@@ -2234,6 +2492,58 @@
                 "description": "Compact process-scope outcome from final/process_scope.yaml (settled, coverage, completeness, survivors, unreadable, census). Always present in this engine's responses: null means unknown (the run is live, or the record is missing, unreadable or invalid), never clean. Engines that predate the field omit the key, which is equally unknown.",
                 "default": null
               },
+              "processScopeLater": {
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "settled": {
+                        "$ref": "#/definitions/ControlRunListResponse/properties/runs/items/properties/processScope/anyOf/0/properties/settled"
+                      },
+                      "coverage": {
+                        "$ref": "#/definitions/ControlRunListResponse/properties/runs/items/properties/processScope/anyOf/0/properties/coverage"
+                      },
+                      "completeness": {
+                        "$ref": "#/definitions/ControlRunListResponse/properties/runs/items/properties/processScope/anyOf/0/properties/completeness"
+                      },
+                      "census": {
+                        "$ref": "#/definitions/ControlRunListResponse/properties/runs/items/properties/processScope/anyOf/0/properties/census"
+                      },
+                      "survivors": {
+                        "$ref": "#/definitions/ControlRunListResponse/properties/runs/items/properties/processScope/anyOf/0/properties/survivors"
+                      },
+                      "unreadable": {
+                        "$ref": "#/definitions/ControlRunListResponse/properties/runs/items/properties/processScope/anyOf/0/properties/unreadable"
+                      },
+                      "attempt": {
+                        "type": "integer",
+                        "exclusiveMinimum": 0
+                      },
+                      "at": {
+                        "type": "string",
+                        "minLength": 1
+                      }
+                    },
+                    "required": [
+                      "settled",
+                      "coverage",
+                      "completeness",
+                      "census",
+                      "survivors",
+                      "unreadable",
+                      "attempt",
+                      "at"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Compact process-scope outcome of a terminal run (full artifact: final/process_scope.yaml)."
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Latest later, separately bounded settlement attempt of this finished run's scope (final/process_scope_later.yaml), beside the unchanged terminal processScope. Null when none ran or it is unreadable: unknown, never clean.",
+                "default": null
+              },
               "route": {
                 "anyOf": [
                   {

package/generated/ControlRunMessageResponse.schema.json

@@ -35,7 +35,7 @@
             "transport_lost",
             "response_timeout"
           ],
-          "description": "Why the outcome is not delivered: no_active_turn (the harness has no active native turn), run_terminal, attempt_mismatch (expectedAttemptId is not the live attempt), no_live_session (no registered live attempt, no adapter channel, or no native session yet), multi_attempt (several live attempts and no expectedAttemptId), thread_bound (thread turns are not steerable in v1), interaction_pending (a question is open; the message was not sent), rpc_refused (the vendor refused the steer on a still-active turn), admission_persist_failed (the daemon could not journal admission; nothing was sent), transport_lost, response_timeout."
+          "description": "Why the outcome is not delivered: no_active_turn (the harness has no active native turn), run_terminal, attempt_mismatch (expectedAttemptId is not the live attempt), no_live_session (no registered live attempt, no adapter channel, or no native session yet), multi_attempt (several live attempts and no expectedAttemptId), thread_bound (thread turns are not steerable in v1), interaction_pending (a blocking question is open; the message was not sent), rpc_refused (the vendor refused the steer on a still-active turn), admission_persist_failed (the daemon could not journal admission; nothing was sent), transport_lost, response_timeout."
         },
         "runId": {
           "type": "string",

package/generated/ControlRunRetryResponse.schema.json

@@ -12,7 +12,7 @@
         "storeId": {
           "type": "string",
           "minLength": 1,
-          "description": "Identity of the durable engine store that accepted this group member, stable across restarts."
+          "description": "Identity of the durable engine store that accepted this command, stable across restarts. A group member always carries it; an ordinary receipt carries it only for a request sending `X-Claudexor-Store-Identity: 1`, and it stays absent, meaning unknown, when the store has no identity to give."
         },
         "retryOf": {
           "type": "string",

package/generated/ControlRunStartInfo.schema.json

@@ -12,7 +12,7 @@
         "storeId": {
           "type": "string",
           "minLength": 1,
-          "description": "Identity of the durable engine store that accepted this group member, stable across restarts."
+          "description": "Identity of the durable engine store that accepted this command, stable across restarts. A group member always carries it; an ordinary receipt carries it only for a request sending `X-Claudexor-Store-Identity: 1`, and it stays absent, meaning unknown, when the store has no identity to give."
         },
         "jobId": {
           "type": "string",

package/generated/ControlRunStartResponse.schema.json

@@ -14,7 +14,7 @@
             "storeId": {
               "type": "string",
               "minLength": 1,
-              "description": "Identity of the durable engine store that accepted this group member, stable across restarts."
+              "description": "Identity of the durable engine store that accepted this command, stable across restarts. A group member always carries it; an ordinary receipt carries it only for a request sending `X-Claudexor-Store-Identity: 1`, and it stays absent, meaning unknown, when the store has no identity to give."
             },
             "jobId": {
               "type": "string",
@@ -49,7 +49,7 @@
             },
             "storeId": {
               "$ref": "#/definitions/ControlRunStartResponse/anyOf/0/properties/storeId",
-              "description": "Identity of the durable engine store that accepted this group member, stable across restarts."
+              "description": "Identity of the durable engine store that accepted this command, stable across restarts. A group member always carries it; an ordinary receipt carries it only for a request sending `X-Claudexor-Store-Identity: 1`, and it stays absent, meaning unknown, when the store has no identity to give."
             },
             "jobId": {
               "type": "string",