@deepnoodle/mobius 0.0.40 → 0.0.41

package/dist/api/schema.d.ts

@@ -1165,6 +1165,8 @@ export interface paths {
         /**
          * Cancel the session's active turn
          * @description Cancels whichever turn is currently active in the session. Queued and running turns for the session are marked cancelled and a terminal `turn.cancelled` event is emitted. Returns the updated session. Requires the `mobius.agent.invoke` permission (or the agent's own backing principal).
+         *
+         *     By default loop-owned turns are left to the loop engine and skipped. Set `force=true` to also cancel loop-owned turns — the recovery path for a session wedged on a turn whose run is dead or stuck. Forcing may leave that run inconsistent, so use it only to unlock an otherwise stuck session, not as a routine stop.
          */
         post: operations["cancelSession"];
         delete?: never;
@@ -1345,6 +1347,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/projects/{project_handle}/runs/{resource_id}/resume": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Resume failed run
+         * @description Resumes a failed run in place from the last durable checkpoint. The run must still reference the current runnable loop version. Guardrail failures require a higher limit in the request body before the run can continue.
+         */
+        post: operations["resumeRun"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/projects/{project_handle}/runs/{resource_id}/retry": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Retry failed run
+         * @description Resumes a failed run in place from the last durable checkpoint. This is equivalent to resume, but records the operator intent as a retry in the run event log.
+         */
+        post: operations["retryRun"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/projects/{project_handle}/runs/{resource_id}/steps": {
         parameters: {
             query?: never;
@@ -1921,7 +1963,7 @@ export interface components {
              * @description Server timestamp when this live preview frame was emitted.
              */
             emitted_at?: string | null;
-            /** @description Token preview payload, usually `{ "text": "..." }`. */
+            /** @description Token preview payload. Normal answer text arrives as `{ "text": "..." }`; summarized reasoning/thinking arrives as `{ "type": "thinking", "thinking": "..." }`. */
             delta: {
                 [key: string]: unknown;
             };
@@ -2145,163 +2187,533 @@ export interface components {
             items: components["schemas"]["Agent"][];
         };
         /**
-         * @description Stored API credential metadata for loop and service access. The raw secret is never returned here; use this object to list, audit, expire, or identify keys by prefix without exposing tokens.
+         * @description Step type: `agent`, `action`, `sleep`, `wait_for_event`, `interaction`, `loop`, `check`, or system-materialized `cleanup`. `cleanup` appears in run step listings for terminal cleanup work but cannot be authored in a `LoopSpec`.
+         * @enum {string}
+         */
+        LoopRunStepKind: "agent" | "action" | "sleep" | "wait_for_event" | "interaction" | "loop" | "check" | "cleanup";
+        /**
+         * @description Step lifecycle state: `pending`, `running`, `suspended`, `completed`, `failed`, `skipped`, or `cancelled`.
+         * @enum {string}
+         */
+        LoopRunStepStatus: "pending" | "running" | "suspended" | "completed" | "failed" | "skipped" | "cancelled";
+        /**
+         * @description One execution step inside a loop run.
          * @example {
-         *       "id": "cred_1jz8q2m7xp9vn4kt",
-         *       "name": "CI worker",
-         *       "key_prefix": "mbx_7q2v",
-         *       "principal_id": "svc_7q2v9x6m3n8p5r4t",
-         *       "tags": {
-         *         "owner": "product"
+         *       "id": "run_8q5m2x9v7p3n4r6t:review",
+         *       "run_id": "run_8q5m2x9v7p3n4r6t",
+         *       "step_key": "review",
+         *       "step_name": "Review pull requests",
+         *       "kind": "agent",
+         *       "status": "running",
+         *       "seq": 0,
+         *       "attempt": 1,
+         *       "inputs": {
+         *         "repository": "deepnoodle-ai/mobius-cloud"
          *       },
          *       "created_at": "2026-06-15T14:30:00Z",
-         *       "updated_at": "2026-06-15T14:30:00Z"
+         *       "updated_at": "2026-06-15T14:31:00Z"
          *     }
          */
-        APIKey: {
-            /** @description Unique identifier for this API key. */
+        LoopRunStep: {
+            /** @description Stable step identifier. */
             id: string;
-            /** @description Human-readable label, unique within the project. */
-            name: string;
-            /** @description First 8 characters of the key, used to identify it without exposing the secret. */
-            key_prefix: string;
-            /** @description Principal this key authenticates as. */
-            principal_id: string;
-            /** @description Optional role whose permissions cap this key below its principal's full grants. */
-            scope_role_id?: string;
-            /** @description For organization-level keys, the system role the key acts as org-wide (e.g. `Admin`). Absent for project-scoped keys. */
-            org_role?: string;
-            /**
-             * Format: date-time
-             * @description Hard expiry timestamp. Requests using an expired key receive 401.
-             */
-            expires_at?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp of the most recent authenticated request using this key.
-             */
-            last_used_at?: string;
-            /** @description Free-form labels used for filtering, ownership, or rotation policy. */
-            tags?: components["schemas"]["TagMap"];
+            /** @description Run this step belongs to. */
+            run_id: string;
+            /** @description Stable key for this step within its loop version. */
+            step_key: string;
+            /** @description Display name from the authored spec, when present. */
+            step_name?: string;
+            /** @description Step kind copied from the authored spec or system cleanup step. */
+            kind: components["schemas"]["LoopRunStepKind"];
+            /** @description Current lifecycle state of this run step. */
+            status: components["schemas"]["LoopRunStepStatus"];
             /**
-             * Format: date-time
-             * @description Timestamp when this key was created.
+             * Format: int64
+             * @description Zero-indexed ordinal of this step within its run.
              */
-            created_at: string;
+            seq: number;
+            /** @description Number of times this step has been attempted. */
+            attempt: number;
+            /** @description Resolved inputs passed into the step, after template rendering. */
+            inputs?: {
+                [key: string]: unknown;
+            };
+            /** @description Authored step parameters, before template rendering. */
+            parameters?: {
+                [key: string]: unknown;
+            };
+            /** @description Step output (shape varies by kind); absent until completion. Downstream step templates reach this value at `${{ steps.<id>.output }}` or `${{ steps[0].output }}`. */
+            result?: unknown;
+            /** @description Worker job that executed this step, when applicable. */
+            job_id?: string | null;
+            /** @description Wait record this step is suspended on, when applicable. */
+            wait_id?: string | null;
+            /** @description Session the agent ran in, for `agent`-kind steps. Present once the step has started a turn; links the step to its conversation so the UI can open the transcript with this step's messages highlighted. */
+            session_id?: string;
+            /** @description Agent that executed this step, for `agent`-kind steps. */
+            agent_id?: string;
+            /** @description Most recent AgentTurn this step ran (its latest attempt), for `agent`-kind steps. Resolves to the step's messages within the session via their `turn_id`. */
+            agent_turn_id?: string;
+            /** @description Machine-readable error code populated on failure. */
+            error_type?: string;
+            /** @description Human-readable error message populated on failure. */
+            error_message?: string;
             /**
-             * Format: date-time
-             * @description Timestamp when this key was last updated.
+             * @description Check outcome for `check`-kind steps: `pass` or `fail`; absent on every other kind. A failed check routed `on_fail: continue` completes the step with `verdict: fail` — status and verdict are separate axes (the step did its job: it checked).
+             * @enum {string}
              */
-            updated_at: string;
-        };
-        /**
-         * @description Returned only on key creation. Contains the raw `key` value which is not retrievable after this response.
-         * @example {
-         *       "id": "cred_1jz8q2m7xp9vn4kt",
-         *       "name": "CI worker",
-         *       "key_prefix": "mbx_7q2v",
-         *       "principal_id": "svc_7q2v9x6m3n8p5r4t",
-         *       "tags": {
-         *         "owner": "product"
-         *       },
-         *       "created_at": "2026-06-15T14:30:00Z",
-         *       "updated_at": "2026-06-15T14:30:00Z",
-         *       "key": "mbx_7q2v9k1m_redacted"
-         *     }
-         */
-        APIKeyCreateResult: {
-            /** @description Unique identifier for the created API key. */
-            id: string;
-            /** @description Human-readable name for the key. */
-            name: string;
-            /** @description First 8 characters of the key for identification. */
-            key_prefix: string;
-            /** @description Principal this key authenticates as. */
-            principal_id: string;
-            /** @description Optional role whose permissions cap this key below its principal's full grants. */
-            scope_role_id?: string;
-            /** @description For organization-level keys, the system role the key acts as org-wide (e.g. `Admin`). Absent for project-scoped keys. */
-            org_role?: string;
+            verdict?: "pass" | "fail";
+            /** @description Verdict document for `check`-kind steps: `verdict`, `on_fail`, `checks` (per-assertion results — name, kind, pass, expr or judge reason, judge identity, evidence refs), `failed` (red assertion names), and `overridden_by` / `gate` records when an approval gate resolved the verdict. */
+            verdict_detail?: {
+                [key: string]: unknown;
+            };
             /**
              * Format: date-time
-             * @description Timestamp when this key expires. Omitted if it does not expire.
+             * @description Time the step entered `running`; null until the step starts.
              */
-            expires_at?: string;
+            started_at?: string | null;
             /**
              * Format: date-time
-             * @description Timestamp of the most recent authenticated request using this key.
+             * @description Time the step reached a terminal status; null until the step completes.
              */
-            last_used_at?: string;
-            /** @description Labels applied to the newly created key. */
-            tags?: components["schemas"]["TagMap"];
+            completed_at?: string | null;
             /**
              * Format: date-time
-             * @description Timestamp when this key was created.
+             * @description Record creation timestamp.
              */
             created_at: string;
             /**
              * Format: date-time
-             * @description Timestamp when this key was last updated.
+             * @description Last update timestamp.
              */
             updated_at: string;
-            /** @description The raw API key. Returned only once at creation — store it securely immediately. */
-            key: string;
         };
-        /**
-         * @example {
-         *       "items": [
-         *         {
-         *           "id": "cred_1jz8q2m7xp9vn4kt",
-         *           "name": "CI worker",
-         *           "key_prefix": "mbx_7q2v",
-         *           "principal_id": "svc_7q2v9x6m3n8p5r4t",
-         *           "tags": {
-         *             "owner": "product"
-         *           },
-         *           "created_at": "2026-06-15T14:30:00Z",
-         *           "updated_at": "2026-06-15T14:30:00Z"
-         *         }
-         *       ],
-         *       "has_more": false
-         *     }
-         */
-        APIKeyListResponse: {
-            /** @description The list of results for this page. */
-            items: components["schemas"]["APIKey"][];
-            /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
-            next_cursor?: string;
-            /** @description Whether additional pages are available. */
-            has_more: boolean;
+        RunStartedPayload: {
+            loop_id?: string;
+            loop_version_id?: string;
+            source_event_id?: string;
+            trigger_id?: string;
+        } & {
+            [key: string]: unknown;
         };
-        /**
-         * @description Request shape for creating a project API key bound to a machine principal. The key authenticates as that principal; permissions are managed by assigning roles to the principal, not by granting permissions to the key.
-         * @example {
-         *       "name": "CI worker",
-         *       "principal_id": "svc_7q2v9x6m3n8p5r4t",
-         *       "tags": {
-         *         "owner": "product"
-         *       }
-         *     }
-         */
-        CreateAPIKeyRequest: {
-            /** @description Human-readable label, unique within the project. */
-            name: string;
-            /** @description Principal this key authenticates as. */
-            principal_id: string;
-            /** @description Optional role whose permissions cap this key below its principal's full grants. */
-            scope_role_id?: string;
+        WaitPayload: {
+            step?: string;
+            /** @description Source event type or pattern this wait is listening for. */
+            event_type?: string;
+            /** @description Optional source identifier that scopes event matching. */
+            source_id?: string;
+            /** @description Optional matcher fields required on the source event. */
+            match?: {
+                [key: string]: unknown;
+            };
+            wait_id?: string;
+            wait_kind?: string;
             /**
              * Format: date-time
-             * @description Optional hard expiry. Omit for a non-expiring key.
+             * @description Wall-clock expiry for the wait, when bounded.
              */
             expires_at?: string;
-            /** @description Labels to apply to the new API key. */
-            tags?: components["schemas"]["TagMap"];
-        };
-        /**
-         * @description Request shape for creating an organization-level API key. The key authenticates as the organization's system principal and acts with the chosen `role` applied org-wide across every project.
-         * @example {
-         *       "name": "Org automation",
+            /** Format: date-time */
+            deadline?: string;
+            subject?: {
+                [key: string]: unknown;
+            };
+        } & {
+            [key: string]: unknown;
+        };
+        RunResumedPayload: {
+            step?: string;
+            reason?: string;
+            /** @enum {string} */
+            recovery_action?: "resume" | "retry";
+            attempt?: number;
+        } & {
+            [key: string]: unknown;
+        };
+        RunCompletedPayload: {
+            output?: {
+                [key: string]: unknown;
+            };
+        } & {
+            [key: string]: unknown;
+        };
+        RunFailedPayload: {
+            error?: string;
+            error_type?: string;
+            step?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        RunCancelledPayload: {
+            reason?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        StepStartedPayload: {
+            step?: string;
+            kind?: string;
+            agent_id?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        StepCompletedPayload: {
+            step?: string;
+            output?: {
+                [key: string]: unknown;
+            };
+        } & {
+            [key: string]: unknown;
+        };
+        StepFailedPayload: {
+            step?: string;
+            error?: string;
+            error_type?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        StepRetriedPayload: {
+            step?: string;
+            kind?: string;
+            attempt?: number;
+            max_attempts?: number;
+            /**
+             * @description Retry source. `step_policy` means the authored step retry policy was consumed, `transient` means Mobius retried a transient provider failure before spending step retry budget, and `run_recovery` means an operator resumed or retried a failed run in place.
+             * @enum {string}
+             */
+            retry_scope?: "step_policy" | "transient" | "run_recovery";
+            /**
+             * @description Operator intent for a `run_recovery` retry. Named consistently with `RunResumedPayload.recovery_action`.
+             * @enum {string}
+             */
+            recovery_action?: "resume" | "retry";
+            error_type?: string;
+            error?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        StepResumedPayload: {
+            step?: string;
+            kind?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        StepSkippedPayload: {
+            step?: string;
+            kind?: string;
+            reason?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        ActionCalledPayload: {
+            action?: string;
+            step?: string;
+            parameters?: {
+                [key: string]: unknown;
+            };
+        } & {
+            [key: string]: unknown;
+        };
+        ActionCompletedPayload: {
+            action?: string;
+            step?: string;
+            result?: {
+                [key: string]: unknown;
+            };
+        } & {
+            [key: string]: unknown;
+        };
+        ActionFailedPayload: {
+            action?: string;
+            step?: string;
+            error?: string;
+            error_type?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        ActionRetriedPayload: {
+            action?: string;
+            attempt?: number;
+            max_attempts?: number;
+        } & {
+            [key: string]: unknown;
+        };
+        ActionResultPayload: {
+            action?: string;
+            result?: {
+                [key: string]: unknown;
+            };
+        } & {
+            [key: string]: unknown;
+        };
+        CheckVerdictPayload: {
+            step?: string;
+            verdict?: string;
+            on_fail?: string;
+            failed?: string[];
+        } & {
+            [key: string]: unknown;
+        };
+        InteractionRespondedPayload: {
+            interaction_id?: string;
+            response?: {
+                [key: string]: unknown;
+            };
+            responder?: {
+                [key: string]: unknown;
+            };
+        } & {
+            [key: string]: unknown;
+        };
+        WaitResumedPayload: {
+            step?: string;
+            wait_id?: string;
+            payload?: {
+                [key: string]: unknown;
+            };
+        } & {
+            [key: string]: unknown;
+        };
+        WaitTimedOutPayload: {
+            step?: string;
+            wait_id?: string;
+            reason?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        BudgetExceededPayload: {
+            step?: string;
+            credit_spent?: number;
+            credit_budget?: number;
+            percent_used?: number;
+        } & {
+            [key: string]: unknown;
+        };
+        ProgressStalledPayload: {
+            step?: string;
+            tool?: string;
+            duplicate_calls?: number;
+            limit?: number;
+        } & {
+            [key: string]: unknown;
+        };
+        LimitReachedPayload: {
+            step?: string;
+            limit_kind?: string;
+            used?: number;
+            limit?: number;
+        } & {
+            [key: string]: unknown;
+        };
+        ArtifactCreatedPayload: {
+            artifact_id?: string;
+            name?: string;
+            content_type?: string;
+            step?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        /** @description Typed payloads for common durable run event types. The containing `LoopRunEvent.event_type` selects the payload shape; payload objects do not duplicate that discriminator because some payloads use fields such as `event_type` for their own lifecycle data (for example, the external matcher recorded by `wait.opened`). */
+        RunEventPayload: components["schemas"]["RunStartedPayload"] | components["schemas"]["WaitPayload"] | components["schemas"]["RunResumedPayload"] | components["schemas"]["RunCompletedPayload"] | components["schemas"]["RunFailedPayload"] | components["schemas"]["RunCancelledPayload"] | components["schemas"]["StepStartedPayload"] | components["schemas"]["StepCompletedPayload"] | components["schemas"]["StepFailedPayload"] | components["schemas"]["StepRetriedPayload"] | components["schemas"]["StepResumedPayload"] | components["schemas"]["StepSkippedPayload"] | components["schemas"]["ActionCalledPayload"] | components["schemas"]["ActionCompletedPayload"] | components["schemas"]["ActionFailedPayload"] | components["schemas"]["ActionRetriedPayload"] | components["schemas"]["ActionResultPayload"] | components["schemas"]["CheckVerdictPayload"] | components["schemas"]["InteractionRespondedPayload"] | components["schemas"]["WaitResumedPayload"] | components["schemas"]["WaitTimedOutPayload"] | components["schemas"]["BudgetExceededPayload"] | components["schemas"]["ProgressStalledPayload"] | components["schemas"]["LimitReachedPayload"] | components["schemas"]["ArtifactCreatedPayload"] | components["schemas"]["GenericEventPayload"];
+        /**
+         * @description One durable event emitted while a loop run progresses.
+         * @example {
+         *       "id": "run_8q5m2x9v7p3n4r6t:evt:000001",
+         *       "run_id": "run_8q5m2x9v7p3n4r6t",
+         *       "sequence": 1,
+         *       "event_type": "step.started",
+         *       "step_id": "run_8q5m2x9v7p3n4r6t:review",
+         *       "step_key": "review",
+         *       "payload": {
+         *         "agent_id": "agent_5n8p2q7m4x9r3v6t"
+         *       },
+         *       "created_at": "2026-06-15T14:30:10Z"
+         *     }
+         */
+        LoopRunEvent: {
+            /** @description Stable event identifier. */
+            id: string;
+            /** @description Run this event belongs to. */
+            run_id: string;
+            /**
+             * Format: int64
+             * @description Monotonic per-run sequence number used for ordering and resume.
+             */
+            sequence: number;
+            /**
+             * @description Event type from the run-stream taxonomy (e.g. `run.started`, `step.completed`, `wait.opened`, `action.called`, `action.completed`, `action.failed`, `artifact.created`, `limit.reached`).
+             *
+             *     Guardrail events: `run.budget_exceeded` fires when the budget halts the run at a checkpoint (payload: `credit_budget`, `credit_spent`, `percent_used`, plus the `step` it halted before). Metered spend is recorded in the billing ledger and denormalized onto the run's `credit_spent`; it is not represented as a timeline event.
+             */
+            event_type: string;
+            /** @description ID of the step this event belongs to, when applicable. */
+            step_id?: string | null;
+            /** @description Legacy alias for the loop step ID this event belongs to, when applicable. */
+            step_key?: string | null;
+            payload?: components["schemas"]["RunEventPayload"];
+            /**
+             * Format: date-time
+             * @description Server timestamp when the event was recorded.
+             */
+            created_at: string;
+        };
+        /**
+         * @description Stored API credential metadata for loop and service access. The raw secret is never returned here; use this object to list, audit, expire, or identify keys by prefix without exposing tokens.
+         * @example {
+         *       "id": "cred_1jz8q2m7xp9vn4kt",
+         *       "name": "CI worker",
+         *       "key_prefix": "mbx_7q2v",
+         *       "principal_id": "svc_7q2v9x6m3n8p5r4t",
+         *       "tags": {
+         *         "owner": "product"
+         *       },
+         *       "created_at": "2026-06-15T14:30:00Z",
+         *       "updated_at": "2026-06-15T14:30:00Z"
+         *     }
+         */
+        APIKey: {
+            /** @description Unique identifier for this API key. */
+            id: string;
+            /** @description Human-readable label, unique within the project. */
+            name: string;
+            /** @description First 8 characters of the key, used to identify it without exposing the secret. */
+            key_prefix: string;
+            /** @description Principal this key authenticates as. */
+            principal_id: string;
+            /** @description Optional role whose permissions cap this key below its principal's full grants. */
+            scope_role_id?: string;
+            /** @description For organization-level keys, the system role the key acts as org-wide (e.g. `Admin`). Absent for project-scoped keys. */
+            org_role?: string;
+            /**
+             * Format: date-time
+             * @description Hard expiry timestamp. Requests using an expired key receive 401.
+             */
+            expires_at?: string;
+            /**
+             * Format: date-time
+             * @description Timestamp of the most recent authenticated request using this key.
+             */
+            last_used_at?: string;
+            /** @description Free-form labels used for filtering, ownership, or rotation policy. */
+            tags?: components["schemas"]["TagMap"];
+            /**
+             * Format: date-time
+             * @description Timestamp when this key was created.
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when this key was last updated.
+             */
+            updated_at: string;
+        };
+        /**
+         * @description Returned only on key creation. Contains the raw `key` value which is not retrievable after this response.
+         * @example {
+         *       "id": "cred_1jz8q2m7xp9vn4kt",
+         *       "name": "CI worker",
+         *       "key_prefix": "mbx_7q2v",
+         *       "principal_id": "svc_7q2v9x6m3n8p5r4t",
+         *       "tags": {
+         *         "owner": "product"
+         *       },
+         *       "created_at": "2026-06-15T14:30:00Z",
+         *       "updated_at": "2026-06-15T14:30:00Z",
+         *       "key": "mbx_7q2v9k1m_redacted"
+         *     }
+         */
+        APIKeyCreateResult: {
+            /** @description Unique identifier for the created API key. */
+            id: string;
+            /** @description Human-readable name for the key. */
+            name: string;
+            /** @description First 8 characters of the key for identification. */
+            key_prefix: string;
+            /** @description Principal this key authenticates as. */
+            principal_id: string;
+            /** @description Optional role whose permissions cap this key below its principal's full grants. */
+            scope_role_id?: string;
+            /** @description For organization-level keys, the system role the key acts as org-wide (e.g. `Admin`). Absent for project-scoped keys. */
+            org_role?: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when this key expires. Omitted if it does not expire.
+             */
+            expires_at?: string;
+            /**
+             * Format: date-time
+             * @description Timestamp of the most recent authenticated request using this key.
+             */
+            last_used_at?: string;
+            /** @description Labels applied to the newly created key. */
+            tags?: components["schemas"]["TagMap"];
+            /**
+             * Format: date-time
+             * @description Timestamp when this key was created.
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when this key was last updated.
+             */
+            updated_at: string;
+            /** @description The raw API key. Returned only once at creation — store it securely immediately. */
+            key: string;
+        };
+        /**
+         * @example {
+         *       "items": [
+         *         {
+         *           "id": "cred_1jz8q2m7xp9vn4kt",
+         *           "name": "CI worker",
+         *           "key_prefix": "mbx_7q2v",
+         *           "principal_id": "svc_7q2v9x6m3n8p5r4t",
+         *           "tags": {
+         *             "owner": "product"
+         *           },
+         *           "created_at": "2026-06-15T14:30:00Z",
+         *           "updated_at": "2026-06-15T14:30:00Z"
+         *         }
+         *       ],
+         *       "has_more": false
+         *     }
+         */
+        APIKeyListResponse: {
+            /** @description The list of results for this page. */
+            items: components["schemas"]["APIKey"][];
+            /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
+            next_cursor?: string;
+            /** @description Whether additional pages are available. */
+            has_more: boolean;
+        };
+        /**
+         * @description Request shape for creating a project API key bound to a machine principal. The key authenticates as that principal; permissions are managed by assigning roles to the principal, not by granting permissions to the key.
+         * @example {
+         *       "name": "CI worker",
+         *       "principal_id": "svc_7q2v9x6m3n8p5r4t",
+         *       "tags": {
+         *         "owner": "product"
+         *       }
+         *     }
+         */
+        CreateAPIKeyRequest: {
+            /** @description Human-readable label, unique within the project. */
+            name: string;
+            /** @description Principal this key authenticates as. */
+            principal_id: string;
+            /** @description Optional role whose permissions cap this key below its principal's full grants. */
+            scope_role_id?: string;
+            /**
+             * Format: date-time
+             * @description Optional hard expiry. Omit for a non-expiring key.
+             */
+            expires_at?: string;
+            /** @description Labels to apply to the new API key. */
+            tags?: components["schemas"]["TagMap"];
+        };
+        /**
+         * @description Request shape for creating an organization-level API key. The key authenticates as the organization's system principal and acts with the chosen `role` applied org-wide across every project.
+         * @example {
+         *       "name": "Org automation",
          *       "role": "Admin",
          *       "tags": {
          *         "owner": "platform"
@@ -5690,120 +6102,24 @@ export interface components {
         /** @description Free-form JSON object delivered to the HTTP trigger. The payload is recorded on the source event and forwarded to the run as the event. */
         HTTPTriggerDeliveryRequest: {
             [key: string]: unknown;
-        };
-        /** @description Synchronous receipt for an inbound HTTP-trigger delivery. The trigger dispatch and run start happen asynchronously after this response. Clients can poll via `GET /v1/projects/{project_handle}/runs?source_event_id=<source_event_id>` to discover the run once the source-event processor reserves it. */
-        HTTPTriggerDeliveryResult: {
-            /** @description Durable source-event id (also the `dedup_key` seed). Stable across retries with the same `Idempotency-Key`. */
-            source_event_id: string;
-            /**
-             * @description Acceptance status of the source-event row. The only synchronous success value is `accepted`; processing happens asynchronously after the source event is durable.
-             * @enum {string}
-             */
-            status: "accepted";
-            /** @description True when an existing source-event row was returned for the same idempotency key. */
-            deduped?: boolean;
-        };
-        /**
-         * @description Body for `POST /v1/projects/{project_handle}/loops/{resource_id}/runs`. All fields are optional; an empty body starts a run with an empty event/config envelope and no attribution.
-         * @example {
-         *       "event": {
-         *         "issue_id": "42",
-         *         "repository": "deepnoodle-ai/mobius-cloud"
-         *       },
-         *       "config": {
-         *         "priority": "normal"
-         *       },
-         *       "source": {
-         *         "type": "api",
-         *         "id": "review-service",
-         *         "label": "review-service"
-         *       },
-         *       "idempotency_key": "review-service:issue-42",
-         *       "credit_budget": 1000
-         *     }
-         */
-        StartLoopRunRequest: {
-            /** @description Exact event object that starts the run. Manual/API starts use this object the same way integration, HTTP, and schedule triggers do. Templates reference it via `${{ event.<key> }}`. */
-            event?: {
-                [key: string]: unknown;
-            };
-            /** @description Optional event metadata supplied by the caller. Mobius also adds provenance such as run, loop, source, trigger, and source-event ids. */
-            meta?: {
-                [key: string]: unknown;
-            };
-            /** @description Optional static or caller-provided configuration for handling the event. Templates reference it via `config.*`. */
-            config?: {
-                [key: string]: unknown;
-            };
-            /** @description Attribution for the call that starts the run. */
-            source?: components["schemas"]["LoopRunSource"];
-            /** @description Caller-supplied idempotency key, scoped to (org, project). Repeat calls with the same `idempotency_key` while the prior run is still non-terminal return the existing run (same `id`). A repeat after the prior run terminated returns `409 Conflict` with code `idempotency_key_conflict` and details containing the existing run id and its terminal status. */
-            idempotency_key?: string;
-            /**
-             * Format: double
-             * @description Per-run budget override in US dollars (1 credit = $0.01). Overrides the loop spec's `limits` budget for this run only. Mutually exclusive with `credit_budget` — setting both is a `400`. Values finer than 0.001 credit ($0.00001) are rejected. The run halts at the next checkpoint (step boundary or agent tool iteration) once spend reaches the budget; enforcement granularity is one model call or metered action.
-             */
-            budget_usd?: number;
-            /**
-             * Format: int64
-             * @description Per-run budget override in whole credits (1 credit = $0.01). Same ceiling semantics as `budget_usd`; set exactly one.
-             */
-            credit_budget?: number;
-        };
-        /**
-         * @description Body for the cancellation endpoint. All fields optional.
-         * @example {
-         *       "reason": "superseded by manual remediation"
-         *     }
-         */
-        CancelLoopRunRequest: {
-            /** @description Human-readable cancellation reason recorded on the run. */
-            reason?: string;
-        };
-        /**
-         * @description Body for resuming a suspended loop step.
-         * @example {
-         *       "step_key": "wait_for_external_result",
-         *       "result": {
-         *         "status": "complete",
-         *         "source": "ci"
-         *       }
-         *     }
-         */
-        SignalLoopRunRequest: {
-            /** @description Step key currently in `suspended` state that should resume. Must match a step declared in the run's loop version spec. */
-            step_key: string;
-            /** @description Free-form payload saved as the resumed step's output. */
-            result?: {
-                [key: string]: unknown;
-            };
-        };
-        /** @description Optional attribution for the call that started this run. Triggers and HTTP trigger dispatch populate `trigger_id` and `trigger_fire_id`. API callers usually only set `type` and `id`. */
-        LoopRunSource: {
+        };
+        /** @description Synchronous receipt for an inbound HTTP-trigger delivery. The trigger dispatch and run start happen asynchronously after this response. Clients can poll via `GET /v1/projects/{project_handle}/runs?source_event_id=<source_event_id>` to discover the run once the source-event processor reserves it. */
+        HTTPTriggerDeliveryResult: {
+            /** @description Durable source-event id (also the `dedup_key` seed). Stable across retries with the same `Idempotency-Key`. */
+            source_event_id: string;
             /**
-             * @description Source category for the run start: `api`, `trigger`, `manual`, or `signal`.
+             * @description Acceptance status of the source-event row. The only synchronous success value is `accepted`; processing happens asynchronously after the source event is durable.
              * @enum {string}
              */
-            type?: "api" | "trigger" | "manual" | "signal";
-            /** @description Identifier within the source type's namespace. */
-            id?: string;
-            /** @description Display label. */
-            label?: string;
-            /** @description Trigger that fired this run, if any. */
-            readonly trigger_id?: string;
+            status: "accepted";
+            /** @description True when an existing source-event row was returned for the same idempotency key. */
+            deduped?: boolean;
         };
         /**
-         * @description One loop run record.
+         * @description Body for `POST /v1/projects/{project_handle}/loops/{resource_id}/runs`. All fields are optional; an empty body starts a run with an empty event/config envelope and no attribution.
          * @example {
-         *       "id": "run_8q5m2x9v7p3n4r6t",
-         *       "loop_id": "loop_9q2m7x5v3p8n4r6t",
-         *       "loop_name": "Daily security check",
-         *       "loop_version_id": "lver_4v9n2q7m5x8p3r6t",
-         *       "loop_version": 3,
-         *       "status": "running",
-         *       "credit_budget": 1000,
-         *       "credit_spent": 12.5,
          *       "event": {
+         *         "issue_id": "42",
          *         "repository": "deepnoodle-ai/mobius-cloud"
          *       },
          *       "config": {
@@ -5814,506 +6130,273 @@ export interface components {
          *         "id": "review-service",
          *         "label": "review-service"
          *       },
-         *       "created_at": "2026-06-15T14:30:00Z",
-         *       "updated_at": "2026-06-15T14:31:00Z"
+         *       "idempotency_key": "review-service:issue-42",
+         *       "credit_budget": 1000
          *     }
          */
-        LoopRun: {
-            /** @description Stable run identifier. */
-            id: string;
-            /** @description Loop this run belongs to. */
-            loop_id: string;
-            /** @description Human-readable name of the loop this run belongs to. */
-            loop_name?: string;
-            /** @description LoopVersion record this run is executing. */
-            loop_version_id: string;
-            /** @description Version number of the LoopVersion this run is executing. */
-            loop_version: number;
-            /** @description Current lifecycle state of this run. */
-            status: components["schemas"]["LoopRunStatus"];
-            /** @description Gate that placed this run in the durable queue. Present only while `status` is `queued`. */
-            queue_reason?: components["schemas"]["LoopRunQueueReason"];
-            /** @description Org-wide concurrent-run ceiling stamped at run start. Present when the run was evaluated against a plan concurrency limit. */
-            plan_concurrency_limit?: number;
-            /** @description Terminal reason recorded when the run stops. */
-            stop_reason?: components["schemas"]["LoopRunStopReason"];
-            /**
-             * Format: double
-             * @description The run's budget ceiling in credits (1 credit = $0.01), with up to 3 decimal places. Resolved at run start from the StartRun override, the loop spec's `limits` block, or the trial-plan default, in that order. Absent when the run is unbounded.
-             */
-            credit_budget?: number;
-            /**
-             * Format: double
-             * @description Metered spend attributed to this run so far, in credits (up to 3 decimal places). Incremented atomically with each usage-ledger insert that carries this run's id. Counts all metered work regardless of credential source (BYOK calls count at their rate-card equivalent even though they bill zero credits).
-             */
-            credit_spent?: number;
-            /** @description Run-wide cap on agent turns across all steps, from the loop spec's `limits.max_agent_turns`. Absent when unbounded. */
-            max_agent_turns?: number;
-            /** @description Number of agent turns started for this run so far. Compared against `max_agent_turns` when that cap is set. */
-            agent_turns_used?: number;
-            /** @description Exact safe/canonical event object that started the run, reachable in templates at `event.*`. */
+        StartLoopRunRequest: {
+            /** @description Exact event object that starts the run. Manual/API starts use this object the same way integration, HTTP, and schedule triggers do. Templates reference it via `${{ event.<key> }}`. */
             event?: {
                 [key: string]: unknown;
             };
-            /** @description Run and trigger metadata envelope, reachable in templates at `${{ meta.* }}`: `run_id`, `loop_id`, `source`, `trigger`, plus trigger-supplied facts such as `event_type`, `source_event_id`, and `scheduled_at`. */
+            /** @description Optional event metadata supplied by the caller. Mobius also adds provenance such as run, loop, source, trigger, and source-event ids. */
             meta?: {
                 [key: string]: unknown;
             };
-            /** @description Optional static or caller-provided configuration resolved when the run started, reachable in templates at `config.*`. */
+            /** @description Optional static or caller-provided configuration for handling the event. Templates reference it via `config.*`. */
             config?: {
                 [key: string]: unknown;
             };
-            /** @description Final result payload. When the loop declares an `output:` block this is that block rendered at completion; otherwise it is the run's accumulated step outputs, keyed by step id. Absent until the run terminates successfully. */
-            result?: {
-                [key: string]: unknown;
-            };
-            /** @description Source that started this run. */
+            /** @description Attribution for the call that starts the run. */
             source?: components["schemas"]["LoopRunSource"];
-            /** @description Run that triggered this run via an `loop` step. Present only on child runs; absent for top-level runs. */
-            parent_run_id?: string;
-            /** @description Loop that triggered this run via an `loop` step. Present only on child runs. */
-            parent_loop_id?: string;
-            /** @description Step key within the parent run's loop that triggered this run. Present only on child runs. */
-            parent_step_key?: string;
-            /** @description Human-readable failure summary; populated on `failed` runs. */
-            error_message?: string;
-            /** @description Machine-readable failure classification when available. */
-            error_type?: string;
-            /**
-             * Format: date-time
-             * @description Scheduled wake time for a suspended run.
-             */
-            wake_at?: string;
-            /**
-             * Format: date-time
-             * @description Deadline after which the loop reaper fails the run.
-             */
-            wall_clock_deadline_at?: string;
-            /**
-             * Format: date-time
-             * @description Time the engine moved the run to `running`.
-             */
-            started_at?: string;
-            /**
-             * Format: date-time
-             * @description Time the run reached a terminal status.
-             */
-            completed_at?: string;
-            /**
-             * Format: date-time
-             * @description Record creation timestamp.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Last update timestamp.
-             */
-            updated_at: string;
-        };
-        /**
-         * @description Run lifecycle state: `queued`, `running`, `suspended`, `completed`, `failed`, or `cancelled`.
-         * @enum {string}
-         */
-        LoopRunStatus: "queued" | "running" | "suspended" | "completed" | "failed" | "cancelled";
-        /**
-         * @description Why a run is waiting in the queue. `plan_concurrency` means the organization's current plan has no active-run capacity available. `loop_policy` and `trigger_concurrency` mean authored concurrency policy deferred the run.
-         * @enum {string}
-         */
-        LoopRunQueueReason: "plan_concurrency" | "loop_policy" | "trigger_concurrency";
-        /**
-         * @description Why a run stopped. Set exactly once when the run reaches a terminal status; absent on non-terminal runs. `status` carries the lifecycle state and `error_type` classifies the error when one occurred; `stop_reason` classifies the stop itself.
-         *
-         *     Grouping: `completed` is the success terminal. `step_failed`, `check_failed`, and `gate_rejected` mean the work failed (an error, a failed verification, or a human rejection at a gate). `budget_exceeded`, `turn_limit_reached`, `wall_clock_exceeded`, `step_limit_reached`, and `progress_stalled` mean a configured guardrail halted the run — the limit worked; the loop did not break. `cancelled` and `replaced` mean somebody (or a concurrency policy) chose to stop it.
-         * @enum {string}
-         */
-        LoopRunStopReason: "completed" | "step_failed" | "check_failed" | "gate_rejected" | "cancelled" | "replaced" | "wall_clock_exceeded" | "budget_exceeded" | "turn_limit_reached" | "progress_stalled" | "step_limit_reached";
-        /**
-         * @example {
-         *       "items": [
-         *         {
-         *           "id": "run_8q5m2x9v7p3n4r6t",
-         *           "loop_id": "loop_9q2m7x5v3p8n4r6t",
-         *           "loop_version_id": "lver_4v9n2q7m5x8p3r6t",
-         *           "loop_version": 3,
-         *           "status": "running",
-         *           "created_at": "2026-06-15T14:30:00Z",
-         *           "updated_at": "2026-06-15T14:31:00Z"
-         *         }
-         *       ],
-         *       "has_more": false
-         *     }
-         */
-        LoopRunListResponse: {
-            /** @description The list of results for this page. */
-            items: components["schemas"]["LoopRun"][];
-            /** @description Opaque cursor for the next page; absent when no more results. */
-            next_cursor?: string;
-            /** @description True when more items exist after this page. */
-            has_more?: boolean;
-        };
-        /**
-         * @description Step type: `agent`, `action`, `sleep`, `wait_for_event`, `interaction`, `loop`, `check`, or system-materialized `cleanup`. `cleanup` appears in run step listings for terminal cleanup work but cannot be authored in a `LoopSpec`.
-         * @enum {string}
-         */
-        LoopRunStepKind: "agent" | "action" | "sleep" | "wait_for_event" | "interaction" | "loop" | "check" | "cleanup";
-        /**
-         * @description Step lifecycle state: `pending`, `running`, `suspended`, `completed`, `failed`, `skipped`, or `cancelled`.
-         * @enum {string}
-         */
-        LoopRunStepStatus: "pending" | "running" | "suspended" | "completed" | "failed" | "skipped" | "cancelled";
-        /**
-         * @description One execution step inside a loop run.
-         * @example {
-         *       "id": "run_8q5m2x9v7p3n4r6t:review",
-         *       "run_id": "run_8q5m2x9v7p3n4r6t",
-         *       "step_key": "review",
-         *       "step_name": "Review pull requests",
-         *       "kind": "agent",
-         *       "status": "running",
-         *       "seq": 0,
-         *       "attempt": 1,
-         *       "inputs": {
-         *         "repository": "deepnoodle-ai/mobius-cloud"
-         *       },
-         *       "created_at": "2026-06-15T14:30:00Z",
-         *       "updated_at": "2026-06-15T14:31:00Z"
-         *     }
-         */
-        LoopRunStep: {
-            /** @description Stable step identifier. */
-            id: string;
-            /** @description Run this step belongs to. */
-            run_id: string;
-            /** @description Stable key for this step within its loop version. */
-            step_key: string;
-            /** @description Display name from the authored spec, when present. */
-            step_name?: string;
-            /** @description Step kind copied from the authored spec or system cleanup step. */
-            kind: components["schemas"]["LoopRunStepKind"];
-            /** @description Current lifecycle state of this run step. */
-            status: components["schemas"]["LoopRunStepStatus"];
-            /**
-             * Format: int64
-             * @description Zero-indexed ordinal of this step within its run.
-             */
-            seq: number;
-            /** @description Number of times this step has been attempted. */
-            attempt: number;
-            /** @description Resolved inputs passed into the step, after template rendering. */
-            inputs?: {
-                [key: string]: unknown;
-            };
-            /** @description Authored step parameters, before template rendering. */
-            parameters?: {
-                [key: string]: unknown;
-            };
-            /** @description Step output (shape varies by kind); absent until completion. Downstream step templates reach this value at `${{ steps.<id>.output }}` or `${{ steps[0].output }}`. */
-            result?: unknown;
-            /** @description Worker job that executed this step, when applicable. */
-            job_id?: string | null;
-            /** @description Wait record this step is suspended on, when applicable. */
-            wait_id?: string | null;
-            /** @description Session the agent ran in, for `agent`-kind steps. Present once the step has started a turn; links the step to its conversation so the UI can open the transcript with this step's messages highlighted. */
-            session_id?: string;
-            /** @description Agent that executed this step, for `agent`-kind steps. */
-            agent_id?: string;
-            /** @description Most recent AgentTurn this step ran (its latest attempt), for `agent`-kind steps. Resolves to the step's messages within the session via their `turn_id`. */
-            agent_turn_id?: string;
-            /** @description Machine-readable error code populated on failure. */
-            error_type?: string;
-            /** @description Human-readable error message populated on failure. */
-            error_message?: string;
-            /**
-             * @description Check outcome for `check`-kind steps: `pass` or `fail`; absent on every other kind. A failed check routed `on_fail: continue` completes the step with `verdict: fail` — status and verdict are separate axes (the step did its job: it checked).
-             * @enum {string}
-             */
-            verdict?: "pass" | "fail";
-            /** @description Verdict document for `check`-kind steps: `verdict`, `on_fail`, `checks` (per-assertion results — name, kind, pass, expr or judge reason, judge identity, evidence refs), `failed` (red assertion names), and `overridden_by` / `gate` records when an approval gate resolved the verdict. */
-            verdict_detail?: {
-                [key: string]: unknown;
-            };
-            /**
-             * Format: date-time
-             * @description Time the step entered `running`; null until the step starts.
-             */
-            started_at?: string | null;
-            /**
-             * Format: date-time
-             * @description Time the step reached a terminal status; null until the step completes.
-             */
-            completed_at?: string | null;
-            /**
-             * Format: date-time
-             * @description Record creation timestamp.
+            /** @description Caller-supplied idempotency key, scoped to (org, project). Repeat calls with the same `idempotency_key` while the prior run is still non-terminal return the existing run (same `id`). A repeat after the prior run terminated returns `409 Conflict` with code `idempotency_key_conflict` and details containing the existing run id and its terminal status. */
+            idempotency_key?: string;
+            /**
+             * Format: double
+             * @description Per-run budget override in US dollars (1 credit = $0.01). Overrides the loop spec's `limits` budget for this run only. Mutually exclusive with `credit_budget` — setting both is a `400`. Values finer than 0.001 credit ($0.00001) are rejected. The run halts at the next checkpoint (step boundary or agent tool iteration) once spend reaches the budget; enforcement granularity is one model call or metered action.
              */
-            created_at: string;
+            budget_usd?: number;
             /**
-             * Format: date-time
-             * @description Last update timestamp.
+             * Format: int64
+             * @description Per-run budget override in whole credits (1 credit = $0.01). Same ceiling semantics as `budget_usd`; set exactly one.
              */
-            updated_at: string;
+            credit_budget?: number;
         };
-        LoopRunStepListResponse: {
-            /** @description Steps for this run in `seq` order. */
-            items: components["schemas"]["LoopRunStep"][];
+        /**
+         * @description Body for the cancellation endpoint. All fields optional.
+         * @example {
+         *       "reason": "superseded by manual remediation"
+         *     }
+         */
+        CancelLoopRunRequest: {
+            /** @description Human-readable cancellation reason recorded on the run. */
+            reason?: string;
         };
         /**
-         * @description One durable event emitted while a loop run progresses.
+         * @description Body for resuming or retrying a failed loop run in place. Limit fields are optional unless the prior failure was caused by that guardrail; in that case the replacement limit must be greater than the amount already consumed by the run.
          * @example {
-         *       "id": "run_8q5m2x9v7p3n4r6t:evt:000001",
-         *       "run_id": "run_8q5m2x9v7p3n4r6t",
-         *       "sequence": 1,
-         *       "event_type": "step.started",
-         *       "step_id": "run_8q5m2x9v7p3n4r6t:review",
-         *       "step_key": "review",
-         *       "payload": {
-         *         "agent_id": "agent_5n8p2q7m4x9r3v6t"
-         *       },
-         *       "created_at": "2026-06-15T14:30:10Z"
+         *       "reason": "transient provider failure cleared"
          *     }
          */
-        LoopRunEvent: {
-            /** @description Stable event identifier. */
-            id: string;
-            /** @description Run this event belongs to. */
-            run_id: string;
-            /**
-             * Format: int64
-             * @description Monotonic per-run sequence number used for ordering and resume.
-             */
-            sequence: number;
+        RecoverLoopRunRequest: {
+            /** @description Human-readable recovery reason recorded on the run event log. */
+            reason?: string;
             /**
-             * @description Event type from the run-stream taxonomy (e.g. `run.started`, `step.completed`, `wait.opened`, `action.called`, `action.completed`, `action.failed`, `artifact.created`, `limit.reached`).
-             *
-             *     Guardrail events: `run.budget_exceeded` fires when the budget halts the run at a checkpoint (payload: `credit_budget`, `credit_spent`, `percent_used`, plus the `step` it halted before). Metered spend is recorded in the billing ledger and denormalized onto the run's `credit_spent`; it is not represented as a timeline event.
+             * Format: double
+             * @description Replacement run budget in US dollars (1 credit = $0.01). Mutually exclusive with `credit_budget`; setting both is a `400`.
              */
-            event_type: string;
-            /** @description ID of the step this event belongs to, when applicable. */
-            step_id?: string | null;
-            /** @description Legacy alias for the loop step ID this event belongs to, when applicable. */
-            step_key?: string | null;
-            payload?: components["schemas"]["RunEventPayload"];
+            budget_usd?: number;
             /**
-             * Format: date-time
-             * @description Server timestamp when the event was recorded.
+             * Format: int64
+             * @description Replacement run budget in whole credits (1 credit = $0.01). Must be greater than `credit_spent`.
              */
-            created_at: string;
-        };
-        /** @description Durable run lifecycle frame. SSE messages carrying this shape include `id: <sequence>`, and that value is the only cursor clients should persist for `after_sequence` or `Last-Event-ID` resume. */
-        LoopRunLifecycleFrame: components["schemas"]["LoopRunEvent"];
-        /** @description JSON payload of a single `data:` line on the run event SSE stream. Run stream frames are lifecycle/observability events and are replayable with an SSE `id:`. Agent transcript content is delivered by the referenced session stream. */
-        LoopRunStreamFrame: components["schemas"]["LoopRunLifecycleFrame"];
-        /** @description Typed payloads for common durable run event types. The containing `LoopRunEvent.event_type` selects the payload shape; payload objects do not duplicate that discriminator because some payloads use fields such as `event_type` for their own lifecycle data (for example, the external matcher recorded by `wait.opened`). */
-        RunEventPayload: components["schemas"]["RunStartedPayload"] | components["schemas"]["WaitPayload"] | components["schemas"]["RunResumedPayload"] | components["schemas"]["RunCompletedPayload"] | components["schemas"]["RunFailedPayload"] | components["schemas"]["RunCancelledPayload"] | components["schemas"]["StepStartedPayload"] | components["schemas"]["StepCompletedPayload"] | components["schemas"]["StepFailedPayload"] | components["schemas"]["StepRetriedPayload"] | components["schemas"]["StepResumedPayload"] | components["schemas"]["StepSkippedPayload"] | components["schemas"]["ActionCalledPayload"] | components["schemas"]["ActionCompletedPayload"] | components["schemas"]["ActionFailedPayload"] | components["schemas"]["ActionRetriedPayload"] | components["schemas"]["ActionResultPayload"] | components["schemas"]["CheckVerdictPayload"] | components["schemas"]["InteractionRespondedPayload"] | components["schemas"]["WaitResumedPayload"] | components["schemas"]["WaitTimedOutPayload"] | components["schemas"]["BudgetExceededPayload"] | components["schemas"]["ProgressStalledPayload"] | components["schemas"]["LimitReachedPayload"] | components["schemas"]["ArtifactCreatedPayload"] | components["schemas"]["GenericEventPayload"];
-        RunStartedPayload: {
-            loop_id?: string;
-            loop_version_id?: string;
-            source_event_id?: string;
-            trigger_id?: string;
-        } & {
-            [key: string]: unknown;
-        };
-        RunResumedPayload: {
-            step?: string;
-            reason?: string;
-        } & {
-            [key: string]: unknown;
-        };
-        RunCompletedPayload: {
-            output?: {
-                [key: string]: unknown;
-            };
-        } & {
-            [key: string]: unknown;
-        };
-        RunFailedPayload: {
-            error?: string;
-            error_type?: string;
-            step?: string;
-        } & {
-            [key: string]: unknown;
-        };
-        RunCancelledPayload: {
-            reason?: string;
-        } & {
-            [key: string]: unknown;
-        };
-        StepStartedPayload: {
-            step?: string;
-            kind?: string;
-            agent_id?: string;
-        } & {
-            [key: string]: unknown;
-        };
-        StepCompletedPayload: {
-            step?: string;
-            output?: {
-                [key: string]: unknown;
-            };
-        } & {
-            [key: string]: unknown;
-        };
-        StepFailedPayload: {
-            step?: string;
-            error?: string;
-            error_type?: string;
-        } & {
-            [key: string]: unknown;
-        };
-        StepRetriedPayload: {
-            step?: string;
-            attempt?: number;
-            max_attempts?: number;
-            error?: string;
-        } & {
-            [key: string]: unknown;
-        };
-        StepResumedPayload: {
-            step?: string;
-            kind?: string;
-        } & {
-            [key: string]: unknown;
-        };
-        StepSkippedPayload: {
-            step?: string;
-            kind?: string;
-            reason?: string;
-        } & {
-            [key: string]: unknown;
-        };
-        ActionCalledPayload: {
-            action?: string;
-            step?: string;
-            parameters?: {
-                [key: string]: unknown;
-            };
-        } & {
-            [key: string]: unknown;
+            credit_budget?: number;
+            /** @description Replacement run-wide agent turn cap. Must be greater than `agent_turns_used`. */
+            max_agent_turns?: number;
+            /** @description Additional wall-clock time, in seconds, granted from the recovery request time. Required when the run stopped on `wall_clock_exceeded`. */
+            wall_clock_extend_seconds?: number;
         };
-        ActionCompletedPayload: {
-            action?: string;
-            step?: string;
+        /**
+         * @description Body for resuming a suspended loop step.
+         * @example {
+         *       "step_key": "wait_for_external_result",
+         *       "result": {
+         *         "status": "complete",
+         *         "source": "ci"
+         *       }
+         *     }
+         */
+        SignalLoopRunRequest: {
+            /** @description Step key currently in `suspended` state that should resume. Must match a step declared in the run's loop version spec. */
+            step_key: string;
+            /** @description Free-form payload saved as the resumed step's output. */
             result?: {
                 [key: string]: unknown;
             };
-        } & {
-            [key: string]: unknown;
         };
-        ActionFailedPayload: {
-            action?: string;
-            step?: string;
-            error?: string;
-            error_type?: string;
-        } & {
-            [key: string]: unknown;
+        /** @description Optional attribution for the call that started this run. Triggers and HTTP trigger dispatch populate `trigger_id` and `trigger_fire_id`. API callers usually only set `type` and `id`. */
+        LoopRunSource: {
+            /**
+             * @description Source category for the run start: `api`, `trigger`, `manual`, or `signal`.
+             * @enum {string}
+             */
+            type?: "api" | "trigger" | "manual" | "signal";
+            /** @description Identifier within the source type's namespace. */
+            id?: string;
+            /** @description Display label. */
+            label?: string;
+            /** @description Trigger that fired this run, if any. */
+            readonly trigger_id?: string;
         };
-        ActionRetriedPayload: {
-            action?: string;
+        /**
+         * @description One loop run record.
+         * @example {
+         *       "id": "run_8q5m2x9v7p3n4r6t",
+         *       "loop_id": "loop_9q2m7x5v3p8n4r6t",
+         *       "loop_name": "Daily security check",
+         *       "loop_version_id": "lver_4v9n2q7m5x8p3r6t",
+         *       "loop_version": 3,
+         *       "status": "running",
+         *       "credit_budget": 1000,
+         *       "credit_spent": 12.5,
+         *       "event": {
+         *         "repository": "deepnoodle-ai/mobius-cloud"
+         *       },
+         *       "config": {
+         *         "priority": "normal"
+         *       },
+         *       "source": {
+         *         "type": "api",
+         *         "id": "review-service",
+         *         "label": "review-service"
+         *       },
+         *       "created_at": "2026-06-15T14:30:00Z",
+         *       "updated_at": "2026-06-15T14:31:00Z"
+         *     }
+         */
+        LoopRun: {
+            /** @description Stable run identifier. */
+            id: string;
+            /** @description Loop this run belongs to. */
+            loop_id: string;
+            /** @description Human-readable name of the loop this run belongs to. */
+            loop_name?: string;
+            /** @description LoopVersion record this run is executing. */
+            loop_version_id: string;
+            /** @description Version number of the LoopVersion this run is executing. */
+            loop_version: number;
+            /** @description Current lifecycle state of this run. */
+            status: components["schemas"]["LoopRunStatus"];
+            /** @description One-based execution attempt for this run. The original run starts at 1 and increments each time the run is resumed or retried in place. */
             attempt?: number;
-            max_attempts?: number;
-        } & {
-            [key: string]: unknown;
-        };
-        ActionResultPayload: {
-            action?: string;
-            result?: {
+            /** @description Gate that placed this run in the durable queue. Present only while `status` is `queued`. */
+            queue_reason?: components["schemas"]["LoopRunQueueReason"];
+            /** @description Org-wide concurrent-run ceiling stamped at run start. Present when the run was evaluated against a plan concurrency limit. */
+            plan_concurrency_limit?: number;
+            /** @description Terminal reason recorded when the run stops. */
+            stop_reason?: components["schemas"]["LoopRunStopReason"];
+            /**
+             * Format: double
+             * @description The run's budget ceiling in credits (1 credit = $0.01), with up to 3 decimal places. Resolved at run start from the StartRun override, the loop spec's `limits` block, or the trial-plan default, in that order. Absent when the run is unbounded.
+             */
+            credit_budget?: number;
+            /**
+             * Format: double
+             * @description Metered spend attributed to this run so far, in credits (up to 3 decimal places). Incremented atomically with each usage-ledger insert that carries this run's id. Counts all metered work regardless of credential source (BYOK calls count at their rate-card equivalent even though they bill zero credits).
+             */
+            credit_spent?: number;
+            /** @description Run-wide cap on agent turns across all steps, from the loop spec's `limits.max_agent_turns`. Absent when unbounded. */
+            max_agent_turns?: number;
+            /** @description Number of agent turns started for this run so far. Compared against `max_agent_turns` when that cap is set. */
+            agent_turns_used?: number;
+            /** @description Exact safe/canonical event object that started the run, reachable in templates at `event.*`. */
+            event?: {
                 [key: string]: unknown;
             };
-        } & {
-            [key: string]: unknown;
-        };
-        CheckVerdictPayload: {
-            step?: string;
-            verdict?: string;
-            on_fail?: string;
-            failed?: string[];
-        } & {
-            [key: string]: unknown;
-        };
-        InteractionRespondedPayload: {
-            interaction_id?: string;
-            response?: {
+            /** @description Run and trigger metadata envelope, reachable in templates at `${{ meta.* }}`: `run_id`, `loop_id`, `source`, `trigger`, plus trigger-supplied facts such as `event_type`, `source_event_id`, and `scheduled_at`. */
+            meta?: {
                 [key: string]: unknown;
             };
-            responder?: {
+            /** @description Optional static or caller-provided configuration resolved when the run started, reachable in templates at `config.*`. */
+            config?: {
                 [key: string]: unknown;
             };
-        } & {
-            [key: string]: unknown;
-        };
-        WaitPayload: {
-            step?: string;
-            /** @description Source event type or pattern this wait is listening for. */
-            event_type?: string;
-            /** @description Optional source identifier that scopes event matching. */
-            source_id?: string;
-            /** @description Optional matcher fields required on the source event. */
-            match?: {
+            /** @description Final result payload. When the loop declares an `output:` block this is that block rendered at completion; otherwise it is the run's accumulated step outputs, keyed by step id. Absent until the run terminates successfully. */
+            result?: {
                 [key: string]: unknown;
             };
-            wait_id?: string;
-            wait_kind?: string;
+            /** @description Source that started this run. */
+            source?: components["schemas"]["LoopRunSource"];
+            /** @description Run that triggered this run via an `loop` step. Present only on child runs; absent for top-level runs. */
+            parent_run_id?: string;
+            /** @description Loop that triggered this run via an `loop` step. Present only on child runs. */
+            parent_loop_id?: string;
+            /** @description Step key within the parent run's loop that triggered this run. Present only on child runs. */
+            parent_step_key?: string;
+            /** @description Human-readable failure summary; populated on `failed` runs. */
+            error_message?: string;
+            /** @description Machine-readable failure classification when available. */
+            error_type?: string;
             /**
              * Format: date-time
-             * @description Wall-clock expiry for the wait, when bounded.
+             * @description Scheduled wake time for a suspended run.
              */
-            expires_at?: string;
-            /** Format: date-time */
-            deadline?: string;
-            subject?: {
-                [key: string]: unknown;
-            };
-        } & {
-            [key: string]: unknown;
-        };
-        WaitResumedPayload: {
-            step?: string;
-            wait_id?: string;
-            payload?: {
-                [key: string]: unknown;
-            };
-        } & {
-            [key: string]: unknown;
-        };
-        WaitTimedOutPayload: {
-            step?: string;
-            wait_id?: string;
-            reason?: string;
-        } & {
-            [key: string]: unknown;
-        };
-        BudgetExceededPayload: {
-            step?: string;
-            credit_spent?: number;
-            credit_budget?: number;
-            percent_used?: number;
-        } & {
-            [key: string]: unknown;
-        };
-        ProgressStalledPayload: {
-            step?: string;
-            tool?: string;
-            duplicate_calls?: number;
-            limit?: number;
-        } & {
-            [key: string]: unknown;
+            wake_at?: string;
+            /**
+             * Format: date-time
+             * @description Deadline after which the loop reaper fails the run.
+             */
+            wall_clock_deadline_at?: string;
+            /**
+             * Format: date-time
+             * @description Time the engine moved the run to `running`.
+             */
+            started_at?: string;
+            /**
+             * Format: date-time
+             * @description Time the run reached a terminal status.
+             */
+            completed_at?: string;
+            /**
+             * Format: date-time
+             * @description Record creation timestamp.
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @description Last update timestamp.
+             */
+            updated_at: string;
         };
-        LimitReachedPayload: {
-            step?: string;
-            limit_kind?: string;
-            used?: number;
-            limit?: number;
-        } & {
-            [key: string]: unknown;
+        /**
+         * @description Run lifecycle state: `queued`, `running`, `suspended`, `completed`, `failed`, or `cancelled`.
+         * @enum {string}
+         */
+        LoopRunStatus: "queued" | "running" | "suspended" | "completed" | "failed" | "cancelled";
+        /**
+         * @description Why a run is waiting in the queue. `plan_concurrency` means the organization's current plan has no active-run capacity available. `loop_policy` and `trigger_concurrency` mean authored concurrency policy deferred the run.
+         * @enum {string}
+         */
+        LoopRunQueueReason: "plan_concurrency" | "loop_policy" | "trigger_concurrency";
+        /**
+         * @description Why a run stopped. Set exactly once when the run reaches a terminal status; absent on non-terminal runs. `status` carries the lifecycle state and `error_type` classifies the error when one occurred; `stop_reason` classifies the stop itself.
+         *
+         *     Grouping: `completed` is the success terminal. `step_failed`, `check_failed`, and `gate_rejected` mean the work failed (an error, a failed verification, or a human rejection at a gate). `budget_exceeded`, `turn_limit_reached`, `wall_clock_exceeded`, `step_limit_reached`, and `progress_stalled` mean a configured guardrail halted the run — the limit worked; the loop did not break. `cancelled` and `replaced` mean somebody (or a concurrency policy) chose to stop it.
+         * @enum {string}
+         */
+        LoopRunStopReason: "completed" | "step_failed" | "check_failed" | "gate_rejected" | "cancelled" | "replaced" | "wall_clock_exceeded" | "budget_exceeded" | "turn_limit_reached" | "progress_stalled" | "step_limit_reached";
+        /**
+         * @example {
+         *       "items": [
+         *         {
+         *           "id": "run_8q5m2x9v7p3n4r6t",
+         *           "loop_id": "loop_9q2m7x5v3p8n4r6t",
+         *           "loop_version_id": "lver_4v9n2q7m5x8p3r6t",
+         *           "loop_version": 3,
+         *           "status": "running",
+         *           "created_at": "2026-06-15T14:30:00Z",
+         *           "updated_at": "2026-06-15T14:31:00Z"
+         *         }
+         *       ],
+         *       "has_more": false
+         *     }
+         */
+        LoopRunListResponse: {
+            /** @description The list of results for this page. */
+            items: components["schemas"]["LoopRun"][];
+            /** @description Opaque cursor for the next page; absent when no more results. */
+            next_cursor?: string;
+            /** @description True when more items exist after this page. */
+            has_more?: boolean;
         };
-        ArtifactCreatedPayload: {
-            artifact_id?: string;
-            name?: string;
-            content_type?: string;
-            step?: string;
-        } & {
-            [key: string]: unknown;
+        LoopRunStepListResponse: {
+            /** @description Steps for this run in `seq` order. */
+            items: components["schemas"]["LoopRunStep"][];
         };
+        /** @description Durable run lifecycle frame. SSE messages carrying this shape include `id: <sequence>`, and that value is the only cursor clients should persist for `after_sequence` or `Last-Event-ID` resume. */
+        LoopRunLifecycleFrame: components["schemas"]["LoopRunEvent"];
+        /** @description JSON payload of a single `data:` line on the run event SSE stream. Run stream frames are lifecycle/observability events and are replayable with an SSE `id:`. Agent transcript content is delivered by the referenced session stream. */
+        LoopRunStreamFrame: components["schemas"]["LoopRunLifecycleFrame"];
         LoopRunEventListResponse: {
             /** @description Run events in this page, ordered by `sequence` ascending. */
             items: components["schemas"]["LoopRunEvent"][];
@@ -7220,6 +7303,10 @@ export interface components {
         LastEventIDParam: number;
         /** @description ID of the target organization for the admin operation. */
         AdminOrgIDParam: string;
+        /** @description ID of the target loop run for the admin operation. */
+        AdminRunIDParam: string;
+        /** @description ID of the target human principal for the admin operation. */
+        AdminUserIDParam: string;
         /** @description Environment ID. */
         EnvironmentIDParam: string;
         /** @description Secret ID or secret name. */
@@ -10264,7 +10351,10 @@ export interface operations {
     };
     cancelSession: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description When true, also cancel loop-owned turns to unlock a wedged session. Use only for recovery; the owning run may be left inconsistent. */
+                force?: boolean;
+            };
             header?: never;
             path: {
                 /** @description Project handle */
@@ -10816,6 +10906,87 @@ export interface operations {
             429: components["responses"]["TooManyRequests"];
         };
     };
+    resumeRun: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Project handle */
+                project_handle: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                resource_id: components["parameters"]["IDParam"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                /**
+                 * @example {
+                 *       "reason": "operator raised run budget",
+                 *       "credit_budget": 1500
+                 *     }
+                 */
+                "application/json": components["schemas"]["RecoverLoopRunRequest"];
+            };
+        };
+        responses: {
+            /** @description Accepted. Returns the resumed run. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LoopRun"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+            429: components["responses"]["TooManyRequests"];
+        };
+    };
+    retryRun: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Project handle */
+                project_handle: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                resource_id: components["parameters"]["IDParam"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                /**
+                 * @example {
+                 *       "reason": "transient provider failure cleared"
+                 *     }
+                 */
+                "application/json": components["schemas"]["RecoverLoopRunRequest"];
+            };
+        };
+        responses: {
+            /** @description Accepted. Returns the resumed run. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LoopRun"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
+            429: components["responses"]["TooManyRequests"];
+        };
+    };
     listRunSteps: {
         parameters: {
             query?: never;