@github/copilot-sdk-linuxmusl-x64 1.0.13-preview.6 → 1.0.14-preview.0

package/schemas/session-events.schema.json

@@ -1755,6 +1755,10 @@
     "AssistantUsageCopilotUsage": {
       "type": "object",
       "properties": {
+        "model": {
+          "type": "string",
+          "description": "Default billing model for token details that do not identify their own model"
+        },
         "tokenDetails": {
           "type": "array",
           "items": {
@@ -1790,6 +1794,10 @@
           "minimum": 0,
           "description": "Cost per batch of tokens"
         },
+        "model": {
+          "type": "string",
+          "description": "Model responsible for this billing entry"
+        },
         "tokenCount": {
           "type": "integer",
           "minimum": 0,
@@ -3424,14 +3432,194 @@
       "enum": [
         "efficiency",
         "balance",
-        "intelligence"
+        "intelligence",
+        "fast"
       ],
-      "description": "Routing preference used when the session model is `auto`.",
+      "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference.",
       "title": "AutoTier",
       "x-enumDescriptions": {
         "efficiency": "Optimize for efficiency.",
         "balance": "Balance efficiency and intelligence.",
-        "intelligence": "Optimize for intelligence."
+        "intelligence": "Optimize for intelligence.",
+        "fast": "Integrator-only preset that optimizes for latency."
+      }
+    },
+    "AutoTierRecommendationData": {
+      "type": "object",
+      "properties": {
+        "recommendedAutoTier": {
+          "$ref": "#/definitions/RecommendedAutoTier",
+          "description": "Recommended Auto preference."
+        }
+      },
+      "required": [
+        "recommendedAutoTier"
+      ],
+      "additionalProperties": false,
+      "description": "Live-only Auto preference recommendation from Copilot API after a successful Auto model call.",
+      "title": "AutoTierRecommendationData",
+      "stability": "experimental"
+    },
+    "AutoTierRecommendationEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "const": true,
+          "description": "Always true for events that are transient and not persisted to the session event log on disk."
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "session.auto_tier_recommendation",
+          "description": "Type discriminator. Always \"session.auto_tier_recommendation\"."
+        },
+        "data": {
+          "$ref": "#/definitions/AutoTierRecommendationData",
+          "description": "Live-only Auto preference recommendation from Copilot API after a successful Auto model call."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "ephemeral",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"session.auto_tier_recommendation\". Live-only Auto preference recommendation from Copilot API after a successful Auto model call.",
+      "title": "AutoTierRecommendationEvent",
+      "stability": "experimental"
+    },
+    "AutoTierSwitchFailedData": {
+      "type": "object",
+      "properties": {
+        "effectiveAutoTier": {
+          "$ref": "#/definitions/AutoTier",
+          "description": "Auto preference that remains effective after the failed request."
+        },
+        "requestedAutoTier": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoTier",
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Auto preference that failed to activate, or null when returning to provider-default routing failed."
+        },
+        "reason": {
+          "$ref": "#/definitions/AutoTierSwitchFailureReason",
+          "description": "Low-cardinality failure outcome reported by Auto resolution."
+        }
+      },
+      "required": [
+        "requestedAutoTier",
+        "reason"
+      ],
+      "additionalProperties": false,
+      "description": "A transient Auto preference failure emitted when the runtime cannot mint or accept a usable model and token pair. The previously effective preference remains active, so SDK clients can surface a non-blocking failure without changing their committed-tier state. This event is ephemeral and is not persisted or replayed on resume.",
+      "title": "AutoTierSwitchFailedData"
+    },
+    "AutoTierSwitchFailedEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "const": true,
+          "description": "Always true for events that are transient and not persisted to the session event log on disk."
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "session.auto_tier_switch_failed",
+          "description": "Type discriminator. Always \"session.auto_tier_switch_failed\"."
+        },
+        "data": {
+          "$ref": "#/definitions/AutoTierSwitchFailedData",
+          "description": "A transient Auto preference failure emitted when the runtime cannot mint or accept a usable model and token pair. The previously effective preference remains active, so SDK clients can surface a non-blocking failure without changing their committed-tier state. This event is ephemeral and is not persisted or replayed on resume."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "ephemeral",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"session.auto_tier_switch_failed\". A transient Auto preference failure emitted when the runtime cannot mint or accept a usable model and token pair. The previously effective preference remains active, so SDK clients can surface a non-blocking failure without changing their committed-tier state. This event is ephemeral and is not persisted or replayed on resume.",
+      "title": "AutoTierSwitchFailedEvent"
+    },
+    "AutoTierSwitchFailureReason": {
+      "type": "string",
+      "enum": [
+        "policy_rejected",
+        "request_failed",
+        "setup_failed",
+        "unsupported"
+      ],
+      "description": "Terminal reason an Auto preference activation failed.",
+      "title": "AutoTierSwitchFailureReason",
+      "x-enumDescriptions": {
+        "policy_rejected": "The candidate model was rejected by model policy.",
+        "request_failed": "The Auto routing request failed or returned an unusable response.",
+        "setup_failed": "The runtime could not prepare the Auto routing request.",
+        "unsupported": "The provider does not support Auto routing."
       }
     },
     "BackgroundTasksChangedData": {
@@ -5007,6 +5195,11 @@
     "CompactionCompleteCompactionTokensUsedCopilotUsage": {
       "type": "object",
       "properties": {
+        "model": {
+          "type": "string",
+          "description": "Default billing model for token details that do not identify their own model",
+          "visibility": "internal"
+        },
         "tokenDetails": {
           "type": "array",
           "items": {
@@ -5043,6 +5236,10 @@
           "minimum": 0,
           "description": "Cost per batch of tokens"
         },
+        "model": {
+          "type": "string",
+          "description": "Model responsible for this billing entry"
+        },
         "tokenCount": {
           "type": "integer",
           "minimum": 0,
@@ -5107,6 +5304,11 @@
           "type": "string",
           "description": "LLM-generated summary of the compacted conversation history"
         },
+        "activeFactorySummary": {
+          "type": "string",
+          "description": "Authoritative active-factory reminder appended to the compacted context",
+          "visibility": "internal"
+        },
         "behaviorModelId": {
           "type": "string",
           "description": "Canonical model identifier used for model-specific behavior when replaying compaction"
@@ -5710,6 +5912,10 @@
           "type": "boolean",
           "description": "Whether the agent can be selected by the user"
         },
+        "disableModelInvocation": {
+          "type": "boolean",
+          "description": "Whether model-driven invocation is disabled for this agent."
+        },
         "model": {
           "type": "string",
           "description": "Model override for this agent, if set"
@@ -6245,6 +6451,10 @@
           "type": "string",
           "description": "Human-readable error message"
         },
+        "remediation": {
+          "$ref": "#/definitions/RemediationAction",
+          "description": "What the user must do to recover, when the runtime knows of an action. The `message` never names a client affordance, so a client that offers one — a slash command, a settings pane, a link — renders it from this value."
+        },
         "stack": {
           "type": "string",
           "description": "Error stack trace, when available"
@@ -7061,6 +7271,7 @@
       "enum": [
         "completed",
         "halted",
+        "paused",
         "cancelled",
         "error"
       ],
@@ -7069,6 +7280,7 @@
       "x-enumDescriptions": {
         "completed": "The factory body resolved and its result was committed.",
         "halted": "The run was stopped by a limit, an approval refusal or another policy decision.",
+        "paused": "The attempt paused intentionally while preserving resumable run state.",
         "cancelled": "The run was cancelled by its caller or by session disposal.",
         "error": "The run failed, with `failureType` carrying the class when it has one."
       }
@@ -10234,26 +10446,40 @@
       "description": "Session event \"mcp.resources.list_changed\". Payload identifying the MCP server associated with a list change.",
       "title": "McpResourcesListChangedEvent"
     },
-    "McpServersLoadedData": {
+    "McpServerMetadata": {
       "type": "object",
       "properties": {
-        "servers": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/McpServersLoadedServer",
-            "description": "A single MCP server status summary in `session.mcp_servers_loaded`, including name, status, source, transport, and plugin metadata."
-          },
-          "description": "Array of MCP server status summaries"
+        "instructions": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "Non-empty natural-language guidance for using the server, or null when the server omitted instructions or advertised an empty string."
         }
       },
       "required": [
-        "servers"
+        "instructions"
       ],
       "additionalProperties": false,
-      "description": "Payload of `session.mcp_servers_loaded` listing MCP server status summaries.",
-      "title": "McpServersLoadedData"
+      "description": "Server-advertised metadata learned through modern discovery or legacy initialization.",
+      "title": "McpServerMetadata"
     },
-    "McpServersLoadedEvent": {
+    "McpServerNeedsReconnectData": {
+      "type": "object",
+      "properties": {
+        "serverName": {
+          "type": "string",
+          "description": "Name of the MCP server that needs to reconnect"
+        }
+      },
+      "required": [
+        "serverName"
+      ],
+      "additionalProperties": false,
+      "description": "Payload of `session.mcp_server_needs_reconnect` identifying an MCP server whose connection must be re-established.",
+      "title": "McpServerNeedsReconnectData"
+    },
+    "McpServerNeedsReconnectEvent": {
       "type": "object",
       "properties": {
         "id": {
@@ -10289,12 +10515,12 @@
         },
         "type": {
           "type": "string",
-          "const": "session.mcp_servers_loaded",
-          "description": "Type discriminator. Always \"session.mcp_servers_loaded\"."
+          "const": "session.mcp_server_needs_reconnect",
+          "description": "Type discriminator. Always \"session.mcp_server_needs_reconnect\"."
         },
         "data": {
-          "$ref": "#/definitions/McpServersLoadedData",
-          "description": "Payload of `session.mcp_servers_loaded` listing MCP server status summaries."
+          "$ref": "#/definitions/McpServerNeedsReconnectData",
+          "description": "Payload of `session.mcp_server_needs_reconnect` identifying an MCP server whose connection must be re-established."
         }
       },
       "required": [
@@ -10306,49 +10532,199 @@
         "data"
       ],
       "additionalProperties": false,
-      "description": "Session event \"session.mcp_servers_loaded\". Payload of `session.mcp_servers_loaded` listing MCP server status summaries.",
-      "title": "McpServersLoadedEvent"
+      "description": "Session event \"session.mcp_server_needs_reconnect\". Payload of `session.mcp_server_needs_reconnect` identifying an MCP server whose connection must be re-established.",
+      "title": "McpServerNeedsReconnectEvent"
     },
-    "McpServersLoadedServer": {
+    "McpServerRemovedData": {
       "type": "object",
       "properties": {
-        "name": {
+        "serverName": {
           "type": "string",
-          "description": "Server name (config key)"
-        },
-        "status": {
-          "$ref": "#/definitions/McpServerStatus",
-          "description": "Connection status: connected, failed, needs-auth, pending, disabled, stopped, or not_configured"
-        },
-        "source": {
-          "$ref": "#/definitions/McpServerSource",
-          "description": "Configuration source: user, workspace, plugin, or builtin"
+          "description": "Name of the MCP server that was removed from the graph"
+        }
+      },
+      "required": [
+        "serverName"
+      ],
+      "additionalProperties": false,
+      "description": "Payload of `session.mcp_server_removed` identifying an MCP server the graph no longer runs.",
+      "title": "McpServerRemovedData"
+    },
+    "McpServerRemovedEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
         },
-        "error": {
+        "timestamp": {
           "type": "string",
-          "description": "Error message if the server failed to connect"
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
         },
-        "transport": {
-          "$ref": "#/definitions/McpServerTransport",
-          "description": "Transport mechanism: stdio, http, sse (deprecated), or memory (in-process MCP server)"
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
         },
-        "pluginName": {
+        "ephemeral": {
+          "type": "boolean",
+          "const": true,
+          "description": "Always true for events that are transient and not persisted to the session event log on disk."
+        },
+        "agentId": {
           "type": "string",
-          "description": "Name of the plugin that supplied the effective MCP server config, only when source is plugin"
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
         },
-        "pluginVersion": {
+        "type": {
           "type": "string",
-          "description": "Version of the plugin that supplied the effective MCP server config, only when source is plugin"
+          "const": "session.mcp_server_removed",
+          "description": "Type discriminator. Always \"session.mcp_server_removed\"."
+        },
+        "data": {
+          "$ref": "#/definitions/McpServerRemovedData",
+          "description": "Payload of `session.mcp_server_removed` identifying an MCP server the graph no longer runs."
         }
       },
       "required": [
-        "name",
-        "status"
-      ],
-      "additionalProperties": false,
-      "description": "A single MCP server status summary in `session.mcp_servers_loaded`, including name, status, source, transport, and plugin metadata.",
-      "title": "McpServersLoadedServer"
-    },
+        "id",
+        "timestamp",
+        "parentId",
+        "ephemeral",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"session.mcp_server_removed\". Payload of `session.mcp_server_removed` identifying an MCP server the graph no longer runs.",
+      "title": "McpServerRemovedEvent"
+    },
+    "McpServersLoadedData": {
+      "type": "object",
+      "properties": {
+        "servers": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/McpServersLoadedServer",
+            "description": "A single MCP server status summary in `session.mcp_servers_loaded`, including name, status, source, transport, and plugin metadata."
+          },
+          "description": "Array of MCP server status summaries"
+        }
+      },
+      "required": [
+        "servers"
+      ],
+      "additionalProperties": false,
+      "description": "Payload of `session.mcp_servers_loaded` listing MCP server status summaries.",
+      "title": "McpServersLoadedData"
+    },
+    "McpServersLoadedEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "const": true,
+          "description": "Always true for events that are transient and not persisted to the session event log on disk."
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "session.mcp_servers_loaded",
+          "description": "Type discriminator. Always \"session.mcp_servers_loaded\"."
+        },
+        "data": {
+          "$ref": "#/definitions/McpServersLoadedData",
+          "description": "Payload of `session.mcp_servers_loaded` listing MCP server status summaries."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "ephemeral",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"session.mcp_servers_loaded\". Payload of `session.mcp_servers_loaded` listing MCP server status summaries.",
+      "title": "McpServersLoadedEvent"
+    },
+    "McpServersLoadedServer": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Server name (config key)"
+        },
+        "status": {
+          "$ref": "#/definitions/McpServerStatus",
+          "description": "Connection status: connected, failed, needs-auth, pending, disabled, stopped, or not_configured"
+        },
+        "source": {
+          "$ref": "#/definitions/McpServerSource",
+          "description": "Configuration source: user, workspace, plugin, or builtin"
+        },
+        "error": {
+          "type": "string",
+          "description": "Error message if the server failed to connect"
+        },
+        "serverMetadata": {
+          "$ref": "#/definitions/McpServerMetadata",
+          "description": "Server-advertised metadata for a connected server. Omitted when no live connection metadata is available, including while pending or when failed, disabled, stopped, or not configured."
+        },
+        "transport": {
+          "$ref": "#/definitions/McpServerTransport",
+          "description": "Transport mechanism: stdio, http, sse (deprecated), or memory (in-process MCP server)"
+        },
+        "pluginName": {
+          "type": "string",
+          "description": "Name of the plugin that supplied the effective MCP server config, only when source is plugin"
+        },
+        "pluginVersion": {
+          "type": "string",
+          "description": "Version of the plugin that supplied the effective MCP server config, only when source is plugin"
+        }
+      },
+      "required": [
+        "name",
+        "status"
+      ],
+      "additionalProperties": false,
+      "description": "A single MCP server status summary in `session.mcp_servers_loaded`, including name, status, source, transport, and plugin metadata.",
+      "title": "McpServersLoadedServer"
+    },
     "McpServerSource": {
       "type": "string",
       "enum": [
@@ -11221,6 +11597,22 @@
         "source": {
           "$ref": "#/definitions/ModelChangeSource",
           "description": "Origin of the effective model change, when known."
+        },
+        "previousAutoTier": {
+          "$ref": "#/definitions/AutoTier",
+          "description": "Previously committed Auto preference, when one was explicitly selected."
+        },
+        "autoTier": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoTier",
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Committed Auto preference after the model configuration change, when applicable."
         }
       },
       "required": [
@@ -11643,6 +12035,96 @@
       "description": "Permission response variant indicating the request was cancelled before use, with an optional reason.",
       "title": "PermissionCancelled"
     },
+    "PermissionCarriedForwardData": {
+      "type": "object",
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "description": "Authorization edge minted for this admission. Not a prompt id: no prompt was raised, so no client should expect a request with this id.",
+          "stability": "experimental"
+        },
+        "toolCallId": {
+          "type": "string",
+          "description": "Tool call this admission authorizes. Its execution receipts the prior grant, which is how a single-effect approval is spent rather than carried forward again.",
+          "stability": "experimental"
+        },
+        "recordId": {
+          "type": "string",
+          "description": "Identity of the prior authorization record that contained the proposal.",
+          "stability": "experimental"
+        },
+        "decisionSource": {
+          "$ref": "#/definitions/PermissionDecisionSource",
+          "description": "Always `authorization_carry_forward`. Stated explicitly so a consumer reading this event cannot mistake it for a human, host-policy, or assisted-approval decision.",
+          "stability": "experimental"
+        }
+      },
+      "required": [
+        "requestId",
+        "toolCallId",
+        "recordId",
+        "decisionSource"
+      ],
+      "additionalProperties": false,
+      "description": "Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.",
+      "title": "PermissionCarriedForwardData",
+      "stability": "experimental"
+    },
+    "PermissionCarriedForwardEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "description": "When true, the event is transient and not persisted to the session event log on disk"
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "permission.carriedForward",
+          "description": "Type discriminator. Always \"permission.carriedForward\"."
+        },
+        "data": {
+          "$ref": "#/definitions/PermissionCarriedForwardData",
+          "description": "Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"permission.carriedForward\". Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.",
+      "title": "PermissionCarriedForwardEvent",
+      "stability": "experimental"
+    },
     "PermissionCompletedData": {
       "type": "object",
       "properties": {
@@ -11657,6 +12139,11 @@
         "result": {
           "$ref": "#/definitions/PermissionResult",
           "description": "The result of the permission request"
+        },
+        "decisionSource": {
+          "$ref": "#/definitions/PermissionDecisionSource",
+          "description": "Who decided this permission request. Absent on completions recorded before this field existed, which consumers must treat as \"not a human decision\" rather than assuming one. Authorization records are minted only for `human_response`; an assisted-approval verdict, a host policy, an unattended fallback, and a hook resolution all produce the same `result` a person does, so this is the only field that distinguishes them.",
+          "stability": "experimental"
         }
       },
       "required": [
@@ -11721,6 +12208,25 @@
       "description": "Session event \"permission.completed\". Permission request completion notification signaling UI dismissal",
       "title": "PermissionCompletedEvent"
     },
+    "PermissionDecisionSource": {
+      "type": "string",
+      "enum": [
+        "assisted_approval",
+        "human_response",
+        "host_policy",
+        "unattended_fallback",
+        "authorization_carry_forward"
+      ],
+      "description": "Controlled reason or actor responsible for a permission response.",
+      "title": "PermissionDecisionSource",
+      "x-enumDescriptions": {
+        "assisted_approval": "The response followed the assisted-approval judge recommendation.",
+        "human_response": "A human supplied the response through an interactive prompt.",
+        "host_policy": "The host applied a standing policy or override rather than a judge recommendation or human decision.",
+        "unattended_fallback": "The host denied the request because no interactive user response was available.",
+        "authorization_carry_forward": "A live authorization record from an earlier human decision in this session contained the proposal, so it ran without another prompt. This is not a new human decision and never mints authority of its own."
+      }
+    },
     "PermissionDeniedByContentExclusionPolicy": {
       "type": "object",
       "properties": {
@@ -11793,48 +12299,332 @@
         "rules"
       ],
       "additionalProperties": false,
-      "description": "Permission response variant denied because matching approval rules explicitly blocked the request.",
-      "title": "PermissionDeniedByRules"
+      "description": "Permission response variant denied because matching approval rules explicitly blocked the request.",
+      "title": "PermissionDeniedByRules"
+    },
+    "PermissionDeniedInteractivelyByUser": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "const": "denied-interactively-by-user",
+          "description": "Denied by the user during an interactive prompt"
+        },
+        "feedback": {
+          "type": "string",
+          "description": "Optional feedback from the user explaining the denial"
+        },
+        "forceReject": {
+          "type": "boolean",
+          "description": "Whether to force-reject the current agent turn"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "additionalProperties": false,
+      "description": "Permission response variant denied in an interactive user prompt, with optional feedback and force-reject flag.",
+      "title": "PermissionDeniedInteractivelyByUser"
+    },
+    "PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "const": "denied-no-approval-rule-and-could-not-request-from-user",
+          "description": "Denied because no approval rule matched and user confirmation was unavailable"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "additionalProperties": false,
+      "description": "Permission response variant denied because no approval rule matched and user confirmation was unavailable.",
+      "title": "PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser"
+    },
+    "PermissionMessageAuthorizationData": {
+      "type": "object",
+      "properties": {
+        "recordId": {
+          "type": "string",
+          "description": "Deterministic identity of the record, derived from the turn and span offsets so re-extracting the same span mints nothing new.",
+          "stability": "experimental"
+        },
+        "turnIndex": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The human turn the quoted span was read from.",
+          "stability": "experimental"
+        },
+        "polarity": {
+          "$ref": "#/definitions/PermissionMessageAuthorizationPolarity",
+          "description": "Whether the claim granted or denied authority.",
+          "stability": "experimental"
+        },
+        "actionClass": {
+          "type": "string",
+          "description": "The kind of effect authorized, as an action-class identifier.",
+          "stability": "experimental"
+        },
+        "spanStart": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Start byte offset of the authorizing span within the turn.",
+          "stability": "experimental"
+        },
+        "spanEnd": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "End byte offset of the authorizing span within the turn.",
+          "stability": "experimental"
+        },
+        "targetMembers": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "default": [],
+          "description": "Concrete named targets that appear verbatim inside the span.",
+          "stability": "experimental"
+        },
+        "task": {
+          "type": "string",
+          "description": "The task the permission is scoped to, when the human named one.",
+          "stability": "experimental"
+        },
+        "world": {
+          "description": "The trusted version discriminator, when one exists. Exact shell-command grants carry the byte-identical commands grounded in the human span; world-derived classes carry a file object, remote tip, or runner only when that state was captured safely. An opaque object mirroring the runtime's adjacently-tagged resolution.",
+          "x-opaque-json": true,
+          "stability": "experimental"
+        }
+      },
+      "required": [
+        "recordId",
+        "turnIndex",
+        "polarity",
+        "actionClass",
+        "spanStart",
+        "spanEnd"
+      ],
+      "additionalProperties": false,
+      "description": "Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.",
+      "title": "PermissionMessageAuthorizationData",
+      "stability": "experimental"
+    },
+    "PermissionMessageAuthorizationDegradedData": {
+      "type": "object",
+      "properties": {
+        "turnIndex": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The human turn that could not be represented safely.",
+          "stability": "experimental"
+        }
+      },
+      "required": [
+        "turnIndex"
+      ],
+      "additionalProperties": false,
+      "description": "Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.",
+      "title": "PermissionMessageAuthorizationDegradedData",
+      "stability": "experimental"
+    },
+    "PermissionMessageAuthorizationDegradedEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "description": "When true, the event is transient and not persisted to the session event log on disk"
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "permission.messageAuthorizationDegraded",
+          "description": "Type discriminator. Always \"permission.messageAuthorizationDegraded\"."
+        },
+        "data": {
+          "$ref": "#/definitions/PermissionMessageAuthorizationDegradedData",
+          "description": "Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"permission.messageAuthorizationDegraded\". Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.",
+      "title": "PermissionMessageAuthorizationDegradedEvent",
+      "stability": "experimental"
+    },
+    "PermissionMessageAuthorizationEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "description": "When true, the event is transient and not persisted to the session event log on disk"
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "permission.messageAuthorization",
+          "description": "Type discriminator. Always \"permission.messageAuthorization\"."
+        },
+        "data": {
+          "$ref": "#/definitions/PermissionMessageAuthorizationData",
+          "description": "Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"permission.messageAuthorization\". Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.",
+      "title": "PermissionMessageAuthorizationEvent",
+      "stability": "experimental"
     },
-    "PermissionDeniedInteractivelyByUser": {
+    "PermissionMessageAuthorizationPolarity": {
+      "type": "string",
+      "enum": [
+        "grant",
+        "denial"
+      ],
+      "description": "Which direction a message-backed authorization claim moves authority in.",
+      "title": "PermissionMessageAuthorizationPolarity",
+      "x-enumDescriptions": {
+        "grant": "The human's words authorized an effect.",
+        "denial": "The human's words refused an effect."
+      },
+      "stability": "experimental"
+    },
+    "PermissionMessageAuthorizationReadData": {
       "type": "object",
       "properties": {
-        "kind": {
-          "type": "string",
-          "const": "denied-interactively-by-user",
-          "description": "Denied by the user during an interactive prompt"
-        },
-        "feedback": {
-          "type": "string",
-          "description": "Optional feedback from the user explaining the denial"
-        },
-        "forceReject": {
-          "type": "boolean",
-          "description": "Whether to force-reject the current agent turn"
+        "turnIndex": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The human turn that was read by the proposer.",
+          "stability": "experimental"
         }
       },
       "required": [
-        "kind"
+        "turnIndex"
       ],
       "additionalProperties": false,
-      "description": "Permission response variant denied in an interactive user prompt, with optional feedback and force-reject flag.",
-      "title": "PermissionDeniedInteractivelyByUser"
+      "description": "Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.",
+      "title": "PermissionMessageAuthorizationReadData",
+      "stability": "experimental"
     },
-    "PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser": {
+    "PermissionMessageAuthorizationReadEvent": {
       "type": "object",
       "properties": {
-        "kind": {
+        "id": {
           "type": "string",
-          "const": "denied-no-approval-rule-and-could-not-request-from-user",
-          "description": "Denied because no approval rule matched and user confirmation was unavailable"
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "description": "When true, the event is transient and not persisted to the session event log on disk"
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "permission.messageAuthorizationRead",
+          "description": "Type discriminator. Always \"permission.messageAuthorizationRead\"."
+        },
+        "data": {
+          "$ref": "#/definitions/PermissionMessageAuthorizationReadData",
+          "description": "Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism."
         }
       },
       "required": [
-        "kind"
+        "id",
+        "timestamp",
+        "parentId",
+        "type",
+        "data"
       ],
       "additionalProperties": false,
-      "description": "Permission response variant denied because no approval rule matched and user confirmation was unavailable.",
-      "title": "PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser"
+      "description": "Session event \"permission.messageAuthorizationRead\". Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.",
+      "title": "PermissionMessageAuthorizationReadEvent",
+      "stability": "experimental"
     },
     "PermissionMode": {
       "type": "string",
@@ -11953,6 +12743,18 @@
         "managedApprovalRequired": {
           "type": "boolean",
           "description": "Whether managed policy requires a human response and forbids host auto-approval"
+        },
+        "requestSandboxBypass": {
+          "type": "boolean",
+          "description": "True when the shell command is requesting sandbox escalation. This is a request, not a grant."
+        },
+        "requestSandboxPermissive": {
+          "type": "boolean",
+          "description": "True when the escalation is a permissive retry that keeps the sandbox and network policy attached while recording file and process accesses instead of blocking them."
+        },
+        "requestSandboxBypassReason": {
+          "type": "string",
+          "description": "Reason for the sandbox escalation request."
         }
       },
       "required": [
@@ -12429,6 +13231,11 @@
           "type": "string",
           "description": "Path of the file or directory being read"
         },
+        "resolvedPath": {
+          "type": "string",
+          "description": "Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.",
+          "stability": "experimental"
+        },
         "assistedApproval": {
           "$ref": "#/definitions/PermissionAssistedApproval",
           "description": "Assisted-approval judge information for this request; present only in assisted mode.",
@@ -12474,11 +13281,11 @@
         },
         "requestSandboxBypass": {
           "type": "boolean",
-          "description": "True when this URL fetch is requesting to bypass the sandbox network policy: either the model set requestSandboxBypass: true, or the tool re-issued the request as an interactive bypass after the network policy denied the approved URL (host opted in via sandbox.allowBypass). This is a request, not a grant: the fetch runs only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI."
+          "description": "True when the tool is asking to run this URL fetch outside the sandbox, after the network policy denied the approved URL or the sandbox proxy could not reach it (host opted in via sandbox.allowBypass). The model cannot ask for this; only the tool raises it. This is a request, not a grant: the fetch runs only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI."
         },
         "requestSandboxBypassReason": {
           "type": "string",
-          "description": "Model-provided justification for the sandbox-bypass request. Only meaningful when requestSandboxBypass is true."
+          "description": "What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true."
         },
         "assistedApproval": {
           "$ref": "#/definitions/PermissionAssistedApproval",
@@ -12519,6 +13326,11 @@
           "type": "string",
           "description": "Path of the file being written to"
         },
+        "resolvedPath": {
+          "type": "string",
+          "description": "Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.",
+          "stability": "experimental"
+        },
         "diff": {
           "type": "string",
           "description": "Unified diff showing the proposed changes"
@@ -13136,13 +13948,18 @@
           "type": "string",
           "description": "Path of the file or directory being read"
         },
+        "resolvedPath": {
+          "type": "string",
+          "description": "Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.",
+          "stability": "experimental"
+        },
         "requestSandboxBypass": {
           "type": "boolean",
-          "description": "True when the model has requested to run this search outside the sandbox (it set requestSandboxBypass: true and the host opted in via sandbox.allowBypass). This is a request, not a grant: the search runs unsandboxed only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI."
+          "description": "True when the tool is asking to re-run this search outside the sandbox, after a sandboxed run looked blocked (host opted in via sandbox.allowBypass). The model cannot ask for this; only the tool raises it. This is a request, not a grant: the search runs unsandboxed only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI."
         },
         "requestSandboxBypassReason": {
           "type": "string",
-          "description": "Model-provided justification for the sandbox-bypass request. Only meaningful when requestSandboxBypass is true."
+          "description": "What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true."
         }
       },
       "required": [
@@ -13201,6 +14018,19 @@
           },
           "description": "File paths that may be read or written by the command"
         },
+        "resolvedWorkingDirectory": {
+          "type": "string",
+          "description": "Runtime-resolved canonical working directory the command runs in, used for authorization identity checks. Internal and experimental; clients should not display it.",
+          "stability": "experimental"
+        },
+        "resolvedPaths": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Runtime-resolved canonical object each possiblePaths entry names, keyed by the requested spelling, used for authorization identity checks. Internal and experimental; clients should continue to display possiblePaths.",
+          "stability": "experimental"
+        },
         "possibleUrls": {
           "type": "array",
           "items": {
@@ -13223,11 +14053,15 @@
         },
         "requestSandboxBypass": {
           "type": "boolean",
-          "description": "True when the model has requested to run this command outside the sandbox (it set requestSandboxBypass: true and the host opted in via sandbox.allowBypass). This is a request, not a grant: the command runs unsandboxed only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI."
+          "description": "True when the tool is asking to run this command outside the sandbox, either because the command detaches and cannot be sandboxed at all, or because a sandboxed run looked blocked (host opted in via sandbox.allowBypass). The model cannot ask for this; only the tool raises it. This is a request, not a grant: the command runs unsandboxed only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI."
+        },
+        "requestSandboxPermissive": {
+          "type": "boolean",
+          "description": "True when the requested escalation is a permissive retry rather than a full bypass: the command re-runs inside the sandbox with its file and process restrictions recording instead of blocking, while the network policy stays enforced. Always accompanied by requestSandboxBypass, so hosts that do not recognize this field still treat the request as the escalation it is. Hosts that do recognize it must not describe the command as running outside the sandbox, which would overstate the privilege being granted."
         },
         "requestSandboxBypassReason": {
           "type": "string",
-          "description": "Model-provided justification for the sandbox-bypass request. Only meaningful when requestSandboxBypass is true."
+          "description": "What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true."
         }
       },
       "required": [
@@ -13329,11 +14163,11 @@
         },
         "requestSandboxBypass": {
           "type": "boolean",
-          "description": "True when this URL fetch is requesting to bypass the sandbox network policy: either the model set requestSandboxBypass: true, or the tool re-issued the request as an interactive bypass after the network policy denied the approved URL (host opted in via sandbox.allowBypass). This is a request, not a grant: the fetch runs only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI."
+          "description": "True when the tool is asking to run this URL fetch outside the sandbox, after the network policy denied the approved URL or the sandbox proxy could not reach it (host opted in via sandbox.allowBypass). The model cannot ask for this; only the tool raises it. This is a request, not a grant: the fetch runs only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI."
         },
         "requestSandboxBypassReason": {
           "type": "string",
-          "description": "Model-provided justification for the sandbox-bypass request. Only meaningful when requestSandboxBypass is true."
+          "description": "What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true."
         }
       },
       "required": [
@@ -13369,6 +14203,11 @@
           "type": "string",
           "description": "Path of the file being written to"
         },
+        "resolvedPath": {
+          "type": "string",
+          "description": "Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.",
+          "stability": "experimental"
+        },
         "diff": {
           "type": "string",
           "description": "Unified diff showing the proposed changes"
@@ -13485,10 +14324,6 @@
           "stability": "experimental"
         }
       },
-      "required": [
-        "previousMode",
-        "mode"
-      ],
       "additionalProperties": false,
       "description": "Permission-mode transition details.",
       "title": "PermissionsChangedData",
@@ -13945,6 +14780,40 @@
         "detailed": "Request a detailed summary of the model's reasoning."
       }
     },
+    "RecommendedAutoTier": {
+      "type": "string",
+      "enum": [
+        "efficiency",
+        "balance",
+        "intelligence"
+      ],
+      "description": "Auto preferences that Copilot API can recommend.",
+      "title": "RecommendedAutoTier",
+      "x-enumDescriptions": {
+        "efficiency": "Optimize for efficiency.",
+        "balance": "Balance efficiency and intelligence.",
+        "intelligence": "Optimize for intelligence."
+      }
+    },
+    "RemediationAction": {
+      "type": "string",
+      "enum": [
+        "sign_in",
+        "switch_account",
+        "show_account",
+        "review_sandbox_policy",
+        "allow_sandbox_outbound"
+      ],
+      "description": "What the user must do to recover from a failure, named as an action rather than as one client's affordance. The runtime cannot know which affordance a client offers — a slash command, a settings pane, a link — so the accompanying message stays host-agnostic and each client renders its own copy from this value. Absent when the runtime knows of no action the user can take.",
+      "title": "RemediationAction",
+      "x-enumDescriptions": {
+        "sign_in": "Authenticate again with the Copilot backend. The current credential is absent, expired, or rejected.",
+        "switch_account": "Authenticate as a different account. The current account exists but lacks access to the requested resource.",
+        "show_account": "Inspect which account is currently authenticated before deciding what to change.",
+        "review_sandbox_policy": "Review or widen the sandbox policy. The blocked path or host is named by the accompanying message or by the tool result the action arrived with.",
+        "allow_sandbox_outbound": "Permit outbound network access in the sandbox policy."
+      }
+    },
     "RemoteSteerableChangedData": {
       "type": "object",
       "properties": {
@@ -14351,9 +15220,9 @@
       "description": "Where a request to run outside the process sandbox originated. Orthogonal to the outcome: the same verdict means a different thing depending on where the request came from.",
       "title": "SandboxBypassSource",
       "x-enumDescriptions": {
-        "model_requested": "The request originated in the tool call itself. Says nothing about whether a person saw it: the ordinary pre-execution permission prompt discloses the bypass and may have gated this one.",
-        "user_prompted": "The runtime raised its own escalation prompt after a sandboxed command looked blocked, and a person answered it.",
-        "prompt_unavailable": "The runtime attempted its own escalation after a sandboxed command looked blocked, but the permission flow produced no confirmed human answer. This includes unavailable or unreadable prompts, cancellation, and automated rule, hook, or content-exclusion denials."
+        "model_requested": "No longer produced. The model could once ask for a bypass in the tool call itself; no tool exposes that parameter now. Retained so historical events still deserialize.",
+        "user_prompted": "The runtime raised the prompt itself — either after a sandboxed attempt looked blocked, or before a run the sandbox cannot enforce at all, such as a detached command — and a person answered it. In the second case nothing had executed when the decision was made.",
+        "prompt_unavailable": "The runtime raised the prompt itself — after a sandboxed attempt looked blocked, or before a run it cannot enforce — but the permission flow produced no confirmed human answer. This includes unavailable or unreadable prompts, cancellation, and automated rule, hook, or content-exclusion denials."
       }
     },
     "SandboxControl": {
@@ -14534,36 +15403,185 @@
             },
             "platform": {
               "$ref": "#/definitions/SandboxPlatform",
-              "description": "Host platform the sandbox is running on"
-            },
-            "backend": {
-              "$ref": "#/definitions/SandboxBackend",
-              "description": "Process-containment implementation backing the sandbox"
+              "description": "Host platform the sandbox is running on"
+            },
+            "backend": {
+              "$ref": "#/definitions/SandboxBackend",
+              "description": "Process-containment implementation backing the sandbox"
+            },
+            "enforcementPoint": {
+              "$ref": "#/definitions/SandboxEnforcementPoint",
+              "description": "Runtime subsystem that applied the policy"
+            },
+            "durationMs": {
+              "type": "number",
+              "minimum": 0,
+              "description": "Wall-clock time spent spawning the sandboxed process, in milliseconds"
+            },
+            "degradationReason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDegradationReason",
+                  "description": "Finite reason why sandbox enforcement is weaker than configured"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Why enforcement is weaker than configured, when it is"
+            },
+            "kind": {
+              "type": "string",
+              "const": "spawn_completed",
+              "description": "Sandbox decision variant discriminator."
+            }
+          },
+          "required": [
+            "kind",
+            "control",
+            "outcome",
+            "platform",
+            "backend",
+            "enforcementPoint",
+            "durationMs"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "control": {
+              "$ref": "#/definitions/SandboxControl",
+              "description": "Enforcement mechanism this decision describes"
+            },
+            "outcome": {
+              "$ref": "#/definitions/SandboxOutcome",
+              "description": "Observed enforcement state: `engaged`, `inactive`, or `failed`. Derived from runtime evidence, never from the configured posture or the compile-time target platform."
+            },
+            "toolCallId": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Internal tool-call ID, used only to correlate the decision with its owning span. Omitted when the decision is not attributable to a tool call."
+            },
+            "platform": {
+              "$ref": "#/definitions/SandboxPlatform",
+              "description": "Host platform the sandbox is running on"
+            },
+            "backend": {
+              "$ref": "#/definitions/SandboxBackend",
+              "description": "Containment backend that engaged. `unsupported` for any state other than `engaged`, since no backend is known to have run."
+            },
+            "enforcementPoint": {
+              "$ref": "#/definitions/SandboxEnforcementPoint",
+              "description": "Runtime subsystem whose enforcement this describes"
+            },
+            "attestation": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxAttestation",
+                  "description": "Runtime observation backing an enforcement-state or denial claim. Absent on `enforcement_state` when no observation backs the state."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Runtime observation backing the state. Omitted for `inactive`, which has nothing to attest."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command the enforcement governed. Populated only when content capture is enabled, and only for shell commands; MCP, LSP, and search command lines are runtime plumbing."
+            },
+            "kind": {
+              "type": "string",
+              "const": "enforcement_state",
+              "description": "Sandbox decision variant discriminator."
+            }
+          },
+          "required": [
+            "kind",
+            "control",
+            "outcome",
+            "platform",
+            "backend",
+            "enforcementPoint"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "control": {
+              "$ref": "#/definitions/SandboxControl",
+              "description": "Sandbox control the denial belongs to. Follows from `denialClass`."
+            },
+            "outcome": {
+              "$ref": "#/definitions/SandboxOutcome",
+              "description": "Always `denied`."
+            },
+            "toolCallId": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Tool call the denial belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
+            },
+            "platform": {
+              "$ref": "#/definitions/SandboxPlatform",
+              "description": "Host operating-system family"
             },
             "enforcementPoint": {
               "$ref": "#/definitions/SandboxEnforcementPoint",
-              "description": "Runtime subsystem that applied the policy"
+              "description": "Runtime subsystem that performed the check"
             },
-            "durationMs": {
-              "type": "number",
-              "minimum": 0,
-              "description": "Wall-clock time spent spawning the sandboxed process, in milliseconds"
+            "denialClass": {
+              "$ref": "#/definitions/SandboxDenialClass",
+              "description": "Bounded class of the refused access."
             },
-            "degradationReason": {
+            "attestation": {
+              "$ref": "#/definitions/SandboxAttestation",
+              "description": "Runtime observation backing the denial."
+            },
+            "confidence": {
               "anyOf": [
                 {
-                  "$ref": "#/definitions/SandboxDegradationReason",
-                  "description": "Finite reason why sandbox enforcement is weaker than configured"
+                  "$ref": "#/definitions/SandboxDenialConfidence",
+                  "description": "How strong the evidence behind a denial is. A denial the sandbox itself recorded is a fact; one inferred from a command's output text is a judgement, and an analysis that cannot tell them apart will treat a false positive as enforcement."
                 },
                 {
                   "type": "null"
                 }
               ],
-              "description": "Why enforcement is weaker than configured, when it is"
+              "description": "How strong the evidence behind this denial is. Lets an analysis separate denials the sandbox recorded from ones inferred from output text, which otherwise look identical."
+            },
+            "deniedResource": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Resource the check refused, when identified and content capture is enabled."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command whose execution the denial arose from. Populated only when content capture is enabled."
+            },
+            "processName": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Executable image associated with the captured denial, normalized to a basename. Populated only when content capture is enabled."
             },
             "kind": {
               "type": "string",
-              "const": "spawn_completed",
+              "const": "access_denied",
               "description": "Sandbox decision variant discriminator."
             }
           },
@@ -14572,57 +15590,91 @@
             "control",
             "outcome",
             "platform",
-            "backend",
             "enforcementPoint",
-            "durationMs"
+            "denialClass",
+            "attestation"
           ],
-          "additionalProperties": false
+          "additionalProperties": false,
+          "description": "An enforcement check refused a specific access. Emitted per refusal with no deduplication, including when policy permits the caller to bypass the denial. Carries no backend: the built-in checks that produce this run in-process against the effective policy."
         },
         {
           "type": "object",
           "properties": {
             "control": {
               "$ref": "#/definitions/SandboxControl",
-              "description": "Enforcement mechanism this decision describes"
+              "description": "Always `bypass`."
             },
             "outcome": {
               "$ref": "#/definitions/SandboxOutcome",
-              "description": "Observed enforcement state: `engaged`, `inactive`, or `failed`. Derived from runtime evidence, never from the configured posture or the compile-time target platform."
+              "description": "Whether the bypass was granted: `approved` or `declined`. `declined` also covers the cases where nobody answered, since the sandboxed denial stands either way."
             },
             "toolCallId": {
               "type": [
                 "string",
                 "null"
               ],
-              "description": "Internal tool-call ID, used only to correlate the decision with its owning span. Omitted when the decision is not attributable to a tool call."
+              "description": "Tool call the decision belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
             },
             "platform": {
               "$ref": "#/definitions/SandboxPlatform",
-              "description": "Host platform the sandbox is running on"
-            },
-            "backend": {
-              "$ref": "#/definitions/SandboxBackend",
-              "description": "Containment backend that engaged. `unsupported` for any state other than `engaged`, since no backend is known to have run."
+              "description": "Host operating-system family"
             },
             "enforcementPoint": {
               "$ref": "#/definitions/SandboxEnforcementPoint",
-              "description": "Runtime subsystem whose enforcement this describes"
+              "description": "Runtime subsystem the bypass applies to"
             },
-            "attestation": {
+            "source": {
+              "$ref": "#/definitions/SandboxBypassSource",
+              "description": "Where the request originated. Orthogonal to `outcome`."
+            },
+            "denialClass": {
               "anyOf": [
                 {
-                  "$ref": "#/definitions/SandboxAttestation",
-                  "description": "Runtime observation backing an enforcement-state or denial claim. Absent on `enforcement_state` when no observation backs the state."
+                  "$ref": "#/definitions/SandboxDenialClass",
+                  "description": "Bounded class of access an enforcement check refused. Raw resources, commands, and process names accompany it only when content capture is enabled; diagnostic text and matched rules are never exported."
                 },
                 {
                   "type": "null"
                 }
               ],
-              "description": "Runtime observation backing the state. Omitted for `inactive`, which has nothing to attest."
+              "description": "Bounded class of the access whose refusal raised this escalation. Omitted for a pre-execution bypass, such as a detached command that cannot be sandboxed and therefore resolves no denial."
+            },
+            "confidence": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDenialConfidence",
+                  "description": "How strong the evidence behind a denial is. A denial the sandbox itself recorded is a fact; one inferred from a command's output text is a judgement, and an analysis that cannot tell them apart will treat a false positive as enforcement."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "How strong the evidence behind `denialClass` was. Present exactly when `denialClass` is, so a verdict that relaxed the sandbox on a guess is distinguishable from one that relaxed it on a recorded refusal. Named to match `access_denied`, which reports the same pair."
+            },
+            "deniedResource": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Resource whose refusal raised this escalation. Populated only when content capture is enabled."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command the verdict governs. Populated only when content capture is enabled."
+            },
+            "processName": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Executable image associated with the denial that raised this escalation, normalized to a basename. Populated only when content capture is enabled."
             },
             "kind": {
               "type": "string",
-              "const": "enforcement_state",
+              "const": "bypass_decided",
               "description": "Sandbox decision variant discriminator."
             }
           },
@@ -14631,28 +15683,29 @@
             "control",
             "outcome",
             "platform",
-            "backend",
-            "enforcementPoint"
+            "enforcementPoint",
+            "source"
           ],
-          "additionalProperties": false
+          "additionalProperties": false,
+          "description": "A request to run outside the process sandbox was resolved. This is what makes an `inactive` `enforcement_state` readable: without it, a command that ran unsandboxed because a person approved a bypass looks identical to one that ran unsandboxed because the session never had a sandbox. Reported only when a sandbox was in force, since bypassing a disabled sandbox bypasses nothing. Carries neither backend nor attestation: the verdict comes from the runtime's own permission flow or the local escalation prompt, not from a containment backend and not from the built-in policy check, so `source` is what records where it came from."
         },
         {
           "type": "object",
           "properties": {
             "control": {
               "$ref": "#/definitions/SandboxControl",
-              "description": "Sandbox control the denial belongs to. Follows from `denialClass`."
+              "description": "Always `process`: the process container is what this rung relaxes, and the network control is deliberately untouched."
             },
             "outcome": {
               "$ref": "#/definitions/SandboxOutcome",
-              "description": "Always `denied`."
+              "description": "Whether the permissive retry was granted: `approved` or `declined`. `declined` also covers the cases where nobody answered, since the sandboxed denial stands either way."
             },
             "toolCallId": {
               "type": [
                 "string",
                 "null"
               ],
-              "description": "Tool call the denial belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
+              "description": "Tool call the decision belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
             },
             "platform": {
               "$ref": "#/definitions/SandboxPlatform",
@@ -14660,19 +15713,60 @@
             },
             "enforcementPoint": {
               "$ref": "#/definitions/SandboxEnforcementPoint",
-              "description": "Runtime subsystem that performed the check"
+              "description": "Runtime subsystem the retry applies to"
+            },
+            "source": {
+              "$ref": "#/definitions/SandboxBypassSource",
+              "description": "Where the request originated. Orthogonal to `outcome`."
             },
             "denialClass": {
-              "$ref": "#/definitions/SandboxDenialClass",
-              "description": "Bounded class of the refused access. The only part of the denial that crosses the telemetry boundary."
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDenialClass",
+                  "description": "Bounded class of access an enforcement check refused. Raw resources, commands, and process names accompany it only when content capture is enabled; diagnostic text and matched rules are never exported."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Bounded class of the access whose refusal raised this escalation."
             },
-            "attestation": {
-              "$ref": "#/definitions/SandboxAttestation",
-              "description": "Runtime observation backing the denial."
+            "confidence": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDenialConfidence",
+                  "description": "How strong the evidence behind a denial is. A denial the sandbox itself recorded is a fact; one inferred from a command's output text is a judgement, and an analysis that cannot tell them apart will treat a false positive as enforcement."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "How strong the evidence behind `denialClass` was. Present exactly when `denialClass` is."
+            },
+            "deniedResource": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Resource whose refusal raised this escalation. Populated only when content capture is enabled."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command the verdict governs. Populated only when content capture is enabled."
+            },
+            "processName": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Executable image associated with the denial that raised this escalation, normalized to a basename. Populated only when content capture is enabled."
             },
             "kind": {
               "type": "string",
-              "const": "access_denied",
+              "const": "permissive_retry_decided",
               "description": "Sandbox decision variant discriminator."
             }
           },
@@ -14682,29 +15776,28 @@
             "outcome",
             "platform",
             "enforcementPoint",
-            "denialClass",
-            "attestation"
+            "source"
           ],
           "additionalProperties": false,
-          "description": "An enforcement check refused a specific access. Emitted per refusal with no deduplication, including when policy permits the caller to bypass the denial. Carries no backend: the built-in checks that produce this run in-process against the effective policy."
+          "description": "A permissive retry was resolved. Distinct from `bypass_decided` because this rung never requests a run outside the process sandbox: it relaxes the process container for one run while the sandbox, and with it the network policy, stays attached. Reported for both outcomes, so an escalation the user declined still leaves evidence that the runtime asked and that the sandboxed denial stood."
         },
         {
           "type": "object",
           "properties": {
             "control": {
               "$ref": "#/definitions/SandboxControl",
-              "description": "Always `bypass`."
+              "description": "Always `process`: the retry changes process-container enforcement while leaving network policy attached."
             },
             "outcome": {
               "$ref": "#/definitions/SandboxOutcome",
-              "description": "Whether the bypass was granted: `approved` or `declined`. `declined` also covers the cases where nobody answered, since the sandboxed denial stands either way."
+              "description": "Whether the permissive retry completed successfully: `succeeded` or `failed`."
             },
             "toolCallId": {
               "type": [
                 "string",
                 "null"
               ],
-              "description": "Tool call the decision belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
+              "description": "Tool call the completion belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
             },
             "platform": {
               "$ref": "#/definitions/SandboxPlatform",
@@ -14712,15 +15805,56 @@
             },
             "enforcementPoint": {
               "$ref": "#/definitions/SandboxEnforcementPoint",
-              "description": "Runtime subsystem the bypass applies to"
+              "description": "Runtime subsystem that ran the retry"
             },
-            "source": {
-              "$ref": "#/definitions/SandboxBypassSource",
-              "description": "Where the request originated. Orthogonal to `outcome`."
+            "denialClass": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDenialClass",
+                  "description": "Bounded class of access an enforcement check refused. Raw resources, commands, and process names accompany it only when content capture is enabled; diagnostic text and matched rules are never exported."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Bounded class of the access whose refusal raised the permissive retry."
+            },
+            "confidence": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDenialConfidence",
+                  "description": "How strong the evidence behind a denial is. A denial the sandbox itself recorded is a fact; one inferred from a command's output text is a judgement, and an analysis that cannot tell them apart will treat a false positive as enforcement."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "How strong the evidence behind `denialClass` was."
+            },
+            "deniedResource": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Resource whose refusal raised the retry. Populated only when content capture is enabled."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command the retry executed. Populated only when content capture is enabled."
+            },
+            "processName": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Executable image associated with the denial that raised the retry, normalized to a basename. Populated only when content capture is enabled."
             },
             "kind": {
               "type": "string",
-              "const": "bypass_decided",
+              "const": "permissive_retry_completed",
               "description": "Sandbox decision variant discriminator."
             }
           },
@@ -14729,11 +15863,10 @@
             "control",
             "outcome",
             "platform",
-            "enforcementPoint",
-            "source"
+            "enforcementPoint"
           ],
           "additionalProperties": false,
-          "description": "A request to run outside the process sandbox was resolved. This is what makes an `inactive` `enforcement_state` readable: without it, a command that ran unsandboxed because a person approved a bypass looks identical to one that ran unsandboxed because the session never had a sandbox. Reported only when a sandbox was in force, since bypassing a disabled sandbox bypasses nothing. Carries neither backend nor attestation: the verdict comes from the runtime's own permission flow or the local escalation prompt, not from a containment backend and not from the built-in policy check, so `source` is what records where it came from."
+          "description": "An approved permissive retry finished. `succeeded` means the retry exited successfully without another correlated sandbox denial; `failed` means it failed or remained blocked and may therefore be followed by a full bypass."
         }
       ],
       "description": "Payload of `sandbox.decision`, a bounded governance record of what the process sandbox was configured to do and whether it took effect. Discriminated by `kind`.",
@@ -14814,16 +15947,49 @@
       "enum": [
         "filesystem_read",
         "filesystem_write",
+        "process_startup",
+        "registry_access",
+        "ipc_access",
+        "process_access",
+        "job_access",
+        "ui_access",
+        "service_access",
         "network_outbound",
-        "network_local"
+        "network_local",
+        "other_access"
       ],
-      "description": "Bounded class of access an enforcement check refused. The only part of a denial that crosses the telemetry boundary; the diagnostic text, matched rule, path, and host never do.",
+      "description": "Bounded class of access an enforcement check refused. Raw resources, commands, and process names accompany it only when content capture is enabled; diagnostic text and matched rules are never exported.",
       "title": "SandboxDenialClass",
       "x-enumDescriptions": {
         "filesystem_read": "A read was refused because the effective policy does not grant it.",
         "filesystem_write": "A write was refused. Distinct from `filesystem_read` because a read-only grant denies writes to a path it otherwise permits.",
+        "process_startup": "A process could not start because the sandbox refused a required process-scoped resource. Currently emitted for the Windows MSYS `BaseNamedObjects` fork failure confirmed by learning-mode capture.",
+        "registry_access": "Windows registry access was refused and correlated with capture evidence.",
+        "ipc_access": "Windows ALPC or RPC access was refused and correlated with capture evidence.",
+        "process_access": "Access to another Windows process was refused and correlated with capture evidence.",
+        "job_access": "Windows job-object access was refused and correlated with capture evidence.",
+        "ui_access": "Windows UI-handle access was refused and correlated with capture evidence.",
+        "service_access": "Windows service-control-manager access was refused and correlated with capture evidence.",
         "network_outbound": "An outbound connection was refused by `network.allowOutbound`.",
-        "network_local": "A connection to a local or loopback destination was refused by `network.allowLocalNetwork`."
+        "network_local": "A connection to a local or loopback destination was refused by `network.allowLocalNetwork`.",
+        "other_access": "The sandbox's denial capture recorded a refusal its record does not attribute to a more specific control: an unclassified resource (registry, COM, section object) or an AppContainer capability with no network meaning. Deliberately generic — the capture proves the denial happened, and naming a narrower class than the record supports would be a guess."
+      }
+    },
+    "SandboxDenialConfidence": {
+      "type": "string",
+      "enum": [
+        "captured",
+        "policy_corroborated",
+        "sandbox_reported",
+        "output_classified"
+      ],
+      "description": "How strong the evidence behind a denial is. A denial the sandbox itself recorded is a fact; one inferred from a command's output text is a judgement, and an analysis that cannot tell them apart will treat a false positive as enforcement.",
+      "title": "SandboxDenialConfidence",
+      "x-enumDescriptions": {
+        "captured": "The sandbox's own denial capture recorded the refused access. The strongest evidence available: the kernel observed it, not the runtime.",
+        "policy_corroborated": "The command named a path that the effective policy independently denies. No capture confirmed it, but the policy did.",
+        "sandbox_reported": "The failure carried a fingerprint the sandbox itself emits, so the sandbox is known to have refused something even though the resource was not confirmed.",
+        "output_classified": "Classified from the command's own output text alone. The weakest evidence: a command that merely prints sandbox-like wording reaches this level."
       }
     },
     "SandboxEnforcementPoint": {
@@ -14894,7 +16060,7 @@
         "approved",
         "declined"
       ],
-      "description": "Finite result of a sandbox decision. Each `SandboxDecisionData` variant uses a disjoint subset: `policy_resolved` is `resolved | degraded`, `spawn_completed` is `succeeded | failed`, `enforcement_state` is `engaged | inactive | failed`, `access_denied` is `denied`, and `bypass_decided` is `approved | declined`.",
+      "description": "Finite result of a sandbox decision. Each `SandboxDecisionData` variant uses a disjoint subset: `policy_resolved` is `resolved | degraded`, `spawn_completed` and `permissive_retry_completed` are `succeeded | failed`, `enforcement_state` is `engaged | inactive | failed`, `access_denied` is `denied`, and escalation decisions are `approved | declined`.",
       "title": "SandboxOutcome",
       "x-enumDescriptions": {
         "resolved": "The sandbox policy resolved successfully. Describes configuration only and makes no claim that a backend engaged.",
@@ -14902,7 +16068,7 @@
         "engaged": "A runtime-owned containment backend accepted the workload. Evidence of engagement, not of verified containment for the workload's lifetime.",
         "succeeded": "The sandbox operation completed successfully.",
         "failed": "The sandbox operation failed.",
-        "degraded": "The sandbox is active with one or more controls weakened by platform limitations.",
+        "degraded": "The sandbox is active with one or more controls weakened by platform limitations or an explicitly selected relaxed mode.",
         "denied": "An enforcement check refused the requested access.",
         "approved": "A request to run outside the process sandbox was granted.",
         "declined": "A request to run outside the process sandbox was not granted."
@@ -15276,6 +16442,14 @@
           "$ref": "#/definitions/ModelChangeEvent",
           "description": "Session event \"session.model_change\". Model change details including previous and new model identifiers"
         },
+        {
+          "$ref": "#/definitions/AutoTierRecommendationEvent",
+          "description": "Session event \"session.auto_tier_recommendation\". Live-only Auto preference recommendation from Copilot API after a successful Auto model call."
+        },
+        {
+          "$ref": "#/definitions/AutoTierSwitchFailedEvent",
+          "description": "Session event \"session.auto_tier_switch_failed\". A transient Auto preference failure emitted when the runtime cannot mint or accept a usable model and token pair. The previously effective preference remains active, so SDK clients can surface a non-blocking failure without changing their committed-tier state. This event is ephemeral and is not persisted or replayed on resume."
+        },
         {
           "$ref": "#/definitions/ModeChangedEvent",
           "description": "Session event \"session.mode_changed\". Agent mode change details including previous and new modes"
@@ -15580,6 +16754,22 @@
           "$ref": "#/definitions/PermissionCompletedEvent",
           "description": "Session event \"permission.completed\". Permission request completion notification signaling UI dismissal"
         },
+        {
+          "$ref": "#/definitions/PermissionCarriedForwardEvent",
+          "description": "Session event \"permission.carriedForward\". Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left."
+        },
+        {
+          "$ref": "#/definitions/PermissionMessageAuthorizationEvent",
+          "description": "Session event \"permission.messageAuthorization\". Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume."
+        },
+        {
+          "$ref": "#/definitions/PermissionMessageAuthorizationReadEvent",
+          "description": "Session event \"permission.messageAuthorizationRead\". Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism."
+        },
+        {
+          "$ref": "#/definitions/PermissionMessageAuthorizationDegradedEvent",
+          "description": "Session event \"permission.messageAuthorizationDegraded\". Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt."
+        },
         {
           "$ref": "#/definitions/UserInputRequestedEvent",
           "description": "Session event \"user_input.requested\". User input request notification with question and optional predefined choices"
@@ -15728,6 +16918,14 @@
           "$ref": "#/definitions/McpServerStatusChangedEvent",
           "description": "Session event \"session.mcp_server_status_changed\". Payload of `session.mcp_server_status_changed` for one MCP server's status and optional failure error."
         },
+        {
+          "$ref": "#/definitions/McpServerRemovedEvent",
+          "description": "Session event \"session.mcp_server_removed\". Payload of `session.mcp_server_removed` identifying an MCP server the graph no longer runs."
+        },
+        {
+          "$ref": "#/definitions/McpServerNeedsReconnectEvent",
+          "description": "Session event \"session.mcp_server_needs_reconnect\". Payload of `session.mcp_server_needs_reconnect` identifying an MCP server whose connection must be re-established."
+        },
         {
           "$ref": "#/definitions/McpToolsListChangedEvent",
           "description": "Session event \"mcp.tools.list_changed\". Payload identifying the MCP server associated with a list change."
@@ -16987,6 +18185,10 @@
           "type": "string",
           "description": "Why an explicit task-call model did not become the effective model"
         },
+        "modelSelectionSource": {
+          "$ref": "#/definitions/SubagentModelSelectionSource",
+          "description": "Authority or runtime mechanism responsible for sub-agent model selection"
+        },
         "configuredModelMatchesActual": {
           "type": "boolean",
           "description": "Whether the first model actually dispatched matched the user's configured preference"
@@ -17261,6 +18463,10 @@
           "type": "string",
           "description": "Why an explicit task-call model did not become the effective model"
         },
+        "modelSelectionSource": {
+          "$ref": "#/definitions/SubagentModelSelectionSource",
+          "description": "Authority or runtime mechanism responsible for sub-agent model selection"
+        },
         "configuredModelMatchesActual": {
           "type": "boolean",
           "description": "Whether the first model actually dispatched matched the user's configured preference"
@@ -17346,6 +18552,29 @@
       "description": "Session event \"subagent.failed\". Sub-agent failure details including error message and agent information",
       "title": "SubagentFailedEvent"
     },
+    "SubagentModelSelectionSource": {
+      "type": "string",
+      "enum": [
+        "explicit_override",
+        "configured_required",
+        "configured_preference",
+        "complementary_default",
+        "session_inheritance",
+        "agent_definition_default",
+        "runtime_policy"
+      ],
+      "description": "Authority or runtime mechanism responsible for sub-agent model selection.",
+      "title": "SubagentModelSelectionSource",
+      "x-enumDescriptions": {
+        "explicit_override": "Explicit model supplied by the parent agent on the task call and selected for dispatch.",
+        "configured_required": "Required model policy configured for the sub-agent.",
+        "configured_preference": "Non-required model preference configured for the sub-agent.",
+        "complementary_default": "Complementary-model default selected for the sub-agent.",
+        "session_inheritance": "Model inherited from the parent session.",
+        "agent_definition_default": "Default model declared by the agent definition.",
+        "runtime_policy": "Runtime policy, Auto mode, or an experiment selected the model."
+      }
+    },
     "SubagentSelectedData": {
       "type": "object",
       "properties": {
@@ -17458,6 +18687,10 @@
           "type": "string",
           "description": "Model the sub-agent will run with, when known at start."
         },
+        "taskModelSource": {
+          "$ref": "#/definitions/SubagentTaskModelSource",
+          "description": "Where the model input for this sub-agent came from. Present when the task planner resolved the launch (the task tool and factory agents); absent for sub-agents created through other runtime paths."
+        },
         "factoryRunId": {
           "type": "string",
           "description": "Root id of the factory run that spawned this sub-agent, when it was spawned by one."
@@ -17543,6 +18776,23 @@
       "description": "Session event \"subagent.started\". Sub-agent startup details including parent tool call and agent information",
       "title": "SubagentStartedEvent"
     },
+    "SubagentTaskModelSource": {
+      "type": "string",
+      "enum": [
+        "task_argument",
+        "subagent_configuration",
+        "custom_agent_definition",
+        "unset"
+      ],
+      "description": "Where the model input for a task-tool sub-agent came from.",
+      "title": "SubagentTaskModelSource",
+      "x-enumDescriptions": {
+        "task_argument": "The spawning agent supplied the task tool's model argument.",
+        "subagent_configuration": "The task omitted a model and the per-sub-agent settings entry supplied a concrete one.",
+        "custom_agent_definition": "The task omitted a model and the user-defined custom agent's definition supplied one.",
+        "unset": "Neither the task call, the per-sub-agent settings entry, nor a custom agent definition supplied a model."
+      }
+    },
     "SystemMessageData": {
       "type": "object",
       "properties": {
@@ -17915,6 +19165,10 @@
         "retryGuidance": {
           "type": "string",
           "description": "Actionable run_factory resume guidance for a resource-limit failure."
+        },
+        "pauseInfo": {
+          "$ref": "#/definitions/SystemNotificationFactoryPauseInfo",
+          "description": "Pause initiator metadata when this attempt settled as paused."
         }
       },
       "required": [
@@ -17936,6 +19190,7 @@
       "enum": [
         "completed",
         "halted",
+        "paused",
         "cancelled",
         "error"
       ],
@@ -17944,10 +19199,48 @@
       "x-enumDescriptions": {
         "completed": "The factory completed successfully.",
         "halted": "The factory was halted.",
+        "paused": "The factory attempt paused intentionally.",
         "cancelled": "The factory was cancelled.",
         "error": "The factory failed."
       }
     },
+    "SystemNotificationFactoryPauseInfo": {
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "user",
+              "description": "Factory pause initiator discriminator."
+            }
+          },
+          "required": [
+            "type"
+          ]
+        },
+        {
+          "type": "object",
+          "properties": {
+            "key": {
+              "type": "string",
+              "description": "Stable author-defined checkpoint key that initiated the pause."
+            },
+            "type": {
+              "type": "string",
+              "const": "checkpoint",
+              "description": "Factory pause initiator discriminator."
+            }
+          },
+          "required": [
+            "type",
+            "key"
+          ]
+        }
+      ],
+      "description": "Durable metadata describing who initiated a factory pause.",
+      "title": "SystemNotificationFactoryPauseInfo"
+    },
     "SystemNotificationInstructionDiscovered": {
       "type": "object",
       "properties": {
@@ -18723,6 +20016,10 @@
         "code": {
           "type": "string",
           "description": "Machine-readable error code"
+        },
+        "remediation": {
+          "$ref": "#/definitions/RemediationAction",
+          "description": "What the user must do to recover, when the runtime knows of an action. Set on sandbox policy denials, where `message` names the rule that blocked the call but never the client affordance that relaxes it."
         }
       },
       "required": [
@@ -19250,6 +20547,10 @@
           "type": "string",
           "description": "Original tool name on the MCP server, when the tool is an MCP tool"
         },
+        "mcpTransport": {
+          "$ref": "#/definitions/McpServerTransport",
+          "description": "Transport the MCP server hosting this tool is connected over, when the tool is an MCP tool and the server is configured"
+        },
         "turnId": {
           "type": "string",
           "description": "Identifier for the agent loop turn this tool was invoked in, matching the corresponding assistant.turn_start event"
@@ -20720,6 +22021,10 @@
         "url": {
           "type": "string",
           "description": "Optional URL associated with this warning that the user can open in a browser"
+        },
+        "remediation": {
+          "$ref": "#/definitions/RemediationAction",
+          "description": "What the user must do to recover, when the runtime knows of an action. The `message` never names a client affordance, so a client that offers one — a slash command, a settings pane, a link — renders it from this value."
         }
       },
       "required": [