@oneharness/sdk 0.11.3 → 0.12.0

package/dist/generated/contracts.d.ts

@@ -57,7 +57,7 @@ export type ControlVerb = "interrupt";
  * new variant is a report `schema_version` bump like any other enum value, since
  * a consumer matching exhaustively learns of it only from the version.
  */
-export type FallThroughReason = "not-installed" | "spawn-error" | "auth" | "quota" | "session-not-found" | "untrusted-directory" | "input-too-large" | "model-not-found" | "rate-limit";
+export type FallThroughReason = "not-installed" | "spawn-error" | "auth" | "quota" | "session-not-found" | "untrusted-directory" | "input-too-large" | "model-mismatch" | "model-not-found" | "rate-limit";
 export type ToolCallStatus = "completed" | "failed" | "timeout" | "interrupted";
 /**
  * How a normalized tool interval was obtained.
@@ -74,7 +74,7 @@ export type TimingSource = "provider_measured" | "stdout_observed";
  * the report, history) one definition to share instead of scattered string
  * literals.
  */
-export type FailureKind = "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large";
+export type FailureKind = "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large" | "model_mismatch";
 /**
  * How a harness emits its result, which decides how `text` is extracted.
  *
@@ -308,7 +308,8 @@ export interface FallbackReport {
      * The candidates fallen through because they could not run the task at all,
      * in priority order, each with why (`not-installed`, `spawn-error`, `auth`,
      * `quota`, `session-not-found`, `untrusted-directory`, `input-too-large`,
-     * and — on a model fan-out — `model-not-found` / `rate-limit`; see
+     * `model-mismatch`, and — on a model fan-out — `model-not-found` /
+     * `rate-limit`; see
      * [`crate::domain::fallback::startup_failure_reason`]).
      */
     fell_through: FallThrough[];
@@ -415,7 +416,8 @@ export interface RunResult {
      * Best-effort failure reason; `null` when unclassified. Distinct from
      * `status`, which records oneharness's relationship to the process. Two
      * families: coarse reasons for a non-zero run (`auth`, `rate_limit`,
-     * `model_not_found`, `quota`, `session_not_found`), and `tool_deferred` — a run that exited
+     * `model_not_found`, `quota`, `session_not_found`, `untrusted_directory`,
+     * `input_too_large`, `model_mismatch`), and `tool_deferred` — a run that exited
      * *cleanly* but only deferred a builtin tool call instead of executing it
      * (Claude Code bridge/managed deployments), so it did no useful work. The
      * deferred case is the only `failure_kind` that can appear on a `status: ok`
@@ -445,6 +447,17 @@ export interface RunResult {
      * without parsing the argv.
      */
     model: string | null;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` / `thread/resume`
+     * response. `null` on every path that reports none, which today is every
+     * path but codex's app-server. Never inferred and never copied from
+     * `model`: where both are set they are the requested model and the served
+     * one, and a difference between them is exactly the `model_mismatch`
+     * refusal, which this field then names the other half of.
+     */
+    observed_model: string | null;
     output_format: OutputFormat;
     /**
      * The prompt this result ran, set only on a **batch** run (one harness

package/dist/generated/history-line.d.ts

@@ -6,7 +6,7 @@ export type HistoryLine = ({
     harness: string;
     harness_id?: string | null | undefined;
     run_id: string;
-    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     type: "event";
     variant?: string | null | undefined;
     [k: string]: unknown;
@@ -27,7 +27,7 @@ export type HistoryLine = ({
     [k: string]: unknown;
 } | ({
     error: string;
-    schema_version?: "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | undefined;
+    schema_version?: "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8" | undefined;
     [k: string]: unknown;
 } & ({
     status?: "nonzero" | "timeout" | "cancelled" | "spawn-error" | "skipped" | undefined;
@@ -39,27 +39,40 @@ export type HistoryLine = ({
     work?: null | undefined;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.7" | undefined;
+    schema_version?: "1.7" | "1.8" | undefined;
     status?: "nonzero" | "timeout" | "cancelled" | undefined;
     work: "done" | "none";
     [k: string]: unknown;
+}) & ({
+    observed_model?: null | undefined;
+    [k: string]: unknown;
+} | {
+    observed_model: string;
+    schema_version?: "1.8" | undefined;
+    [k: string]: unknown;
 }) & ({
     status?: "ok" | "nonzero" | "timeout" | "spawn-error" | "skipped" | "planned" | undefined;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.4" | "1.5" | "1.6" | "1.7" | undefined;
+    schema_version?: "1.4" | "1.5" | "1.6" | "1.7" | "1.8" | undefined;
     [k: string]: unknown;
 }) & (({
-    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "tool_deferred" | "untrusted_directory" | "input_too_large" | null;
+    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "tool_deferred" | "untrusted_directory" | "input_too_large" | "model_mismatch" | null;
+    [k: string]: unknown;
+} | {
+    schema_version?: "1.5" | "1.6" | "1.7" | "1.8" | undefined;
+    [k: string]: unknown;
+}) & ({
+    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "model_mismatch" | null;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.5" | "1.6" | "1.7" | undefined;
+    schema_version?: "1.6" | "1.7" | "1.8" | undefined;
     [k: string]: unknown;
 }) & ({
-    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | null;
+    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large" | null;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.6" | "1.7" | undefined;
+    schema_version?: "1.8" | undefined;
     [k: string]: unknown;
 })) & ({
     duration_ms: number;
@@ -78,11 +91,16 @@ export type HistoryLine = ({
     model: string | null;
     model_ms: number;
     name: string;
+    /**
+     * The model the harness itself reported it would run under (see
+     * [`HistoryRecord::observed_model`]). Omitted on the wire when absent.
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     permission_mode: PermissionMode;
     project: string;
     prompt: string;
-    schema_version: "1.0" | "1.1" | "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.0" | "1.1" | "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     session: string;
     session_id: string | null;
     started_at: string;
@@ -118,11 +136,16 @@ export type HistoryLine = ({
     model: string | null;
     model_ms: number;
     name: string;
+    /**
+     * The model the harness itself reported it would run under (see
+     * [`HistoryRecord::observed_model`]). Omitted on the wire when absent.
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     permission_mode: PermissionMode;
     project: string;
     prompt: string;
-    schema_version: "1.0" | "1.1" | "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.0" | "1.1" | "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     session: string;
     session_id: string | null;
     started_at: string;
@@ -158,11 +181,16 @@ export type HistoryLine = ({
     model: string | null;
     model_ms?: never | undefined;
     name: string;
+    /**
+     * The model the harness itself reported it would run under (see
+     * [`HistoryRecord::observed_model`]). Omitted on the wire when absent.
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms: number;
     permission_mode: PermissionMode;
     project: string;
     prompt: string;
-    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     session: string;
     session_id: string | null;
     started_at?: never | undefined;
@@ -198,11 +226,16 @@ export type HistoryLine = ({
     model: string | null;
     model_ms?: never | undefined;
     name: string;
+    /**
+     * The model the harness itself reported it would run under (see
+     * [`HistoryRecord::observed_model`]). Omitted on the wire when absent.
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     permission_mode: PermissionMode;
     project: string;
     prompt: string;
-    schema_version: "1.0" | "1.1" | "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.0" | "1.1" | "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     session: string;
     session_id: string | null;
     started_at?: never | undefined;
@@ -238,11 +271,16 @@ export type HistoryLine = ({
     model: string | null;
     model_ms?: never | undefined;
     name: string;
+    /**
+     * The model the harness itself reported it would run under (see
+     * [`HistoryRecord::observed_model`]). Omitted on the wire when absent.
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     permission_mode: PermissionMode;
     project: string;
     prompt: string;
-    schema_version: "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     session: string;
     session_id: string | null;
     started_at: string;
@@ -278,11 +316,16 @@ export type HistoryLine = ({
     model: string | null;
     model_ms?: never | undefined;
     name: string;
+    /**
+     * The model the harness itself reported it would run under (see
+     * [`HistoryRecord::observed_model`]). Omitted on the wire when absent.
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     permission_mode: PermissionMode;
     project: string;
     prompt: string;
-    schema_version: "1.0" | "1.1" | "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.0" | "1.1" | "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     session: string;
     session_id: string | null;
     started_at?: never | undefined;
@@ -318,7 +361,7 @@ export type TimingSource = "provider_measured" | "stdout_observed";
  * the report, history) one definition to share instead of scattered string
  * literals.
  */
-export type FailureKind = "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large";
+export type FailureKind = "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large" | "model_mismatch";
 /**
  * The unified approval mode, from least to most autonomy. A harness may not
  * support every value (see [`crate::domain::harness::HarnessSpec::mode`]); the

package/dist/generated/history-records.d.ts

@@ -69,7 +69,10 @@ export type HistoryRecord = {
     history_id: string;
     labels?: HistoryLabels | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms: number;
@@ -78,6 +81,22 @@ export type HistoryRecord = {
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -93,7 +112,7 @@ export type HistoryRecord = {
      * run's single prompt).
      */
     prompt: string;
-    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     /**
      * The oneharness session id this run belongs to (the history file's stem).
      */
@@ -211,7 +230,10 @@ export type HistoryRecord = {
     history_id: string;
     labels?: HistoryLabels1 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms: number;
@@ -220,6 +242,22 @@ export type HistoryRecord = {
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -331,7 +369,10 @@ export type HistoryRecord = {
     history_id: string;
     labels?: HistoryLabels2 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -340,6 +381,22 @@ export type HistoryRecord = {
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -355,7 +412,7 @@ export type HistoryRecord = {
      * run's single prompt).
      */
     prompt: string;
-    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     /**
      * The oneharness session id this run belongs to (the history file's stem).
      */
@@ -439,7 +496,10 @@ export type HistoryRecord = {
     history_id: string;
     labels?: HistoryLabels3 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -448,6 +508,22 @@ export type HistoryRecord = {
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms: number;
     /**
      * The normalized approval mode requested for the run.
@@ -463,7 +539,7 @@ export type HistoryRecord = {
      * run's single prompt).
      */
     prompt: string;
-    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     /**
      * The oneharness session id this run belongs to (the history file's stem).
      */
@@ -547,7 +623,10 @@ export type HistoryRecord = {
     history_id: string;
     labels?: HistoryLabels4 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -556,6 +635,22 @@ export type HistoryRecord = {
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -571,7 +666,7 @@ export type HistoryRecord = {
      * run's single prompt).
      */
     prompt: string;
-    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     /**
      * The oneharness session id this run belongs to (the history file's stem).
      */
@@ -655,7 +750,10 @@ export type HistoryRecord = {
     history_id: string;
     labels?: HistoryLabels5 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -664,6 +762,22 @@ export type HistoryRecord = {
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -679,7 +793,7 @@ export type HistoryRecord = {
      * run's single prompt).
      */
     prompt: string;
-    schema_version: "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     /**
      * The oneharness session id this run belongs to (the history file's stem).
      */
@@ -766,7 +880,10 @@ export type HistoryRecord = {
     history_id: string;
     labels?: HistoryLabels6 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -775,6 +892,22 @@ export type HistoryRecord = {
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -889,7 +1022,10 @@ export type HistoryRecord = {
     history_id: string;
     labels?: HistoryLabels7 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -898,6 +1034,22 @@ export type HistoryRecord = {
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -1000,7 +1152,10 @@ export type HistoryRecord = {
     history_id: string;
     labels?: HistoryLabels8 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: number | null | undefined;
@@ -1009,6 +1164,22 @@ export type HistoryRecord = {
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     /**
      * Union of tool intervals observed at the stdout pipe. Unlike `tool_ms`,
      * this is not provider-measured and has no model-latency counterpart.
@@ -1095,7 +1266,7 @@ export type TimingSource = "provider_measured" | "stdout_observed";
  * the report, history) one definition to share instead of scattered string
  * literals.
  */
-export type FailureKind = "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large";
+export type FailureKind = "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large" | "model_mismatch";
 /**
  * The outcome of attempting to run one harness.
  */
@@ -1125,7 +1296,7 @@ export type HistoryRecords = (({
     [k: string]: unknown;
 } | ({
     error: string;
-    schema_version?: "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | undefined;
+    schema_version?: "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8" | undefined;
     [k: string]: unknown;
 } & ({
     status?: "nonzero" | "timeout" | "cancelled" | "spawn-error" | "skipped" | undefined;
@@ -1137,27 +1308,40 @@ export type HistoryRecords = (({
     work?: null | undefined;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.7" | undefined;
+    schema_version?: "1.7" | "1.8" | undefined;
     status?: "nonzero" | "timeout" | "cancelled" | undefined;
     work: "done" | "none";
     [k: string]: unknown;
+}) & ({
+    observed_model?: null | undefined;
+    [k: string]: unknown;
+} | {
+    observed_model: string;
+    schema_version?: "1.8" | undefined;
+    [k: string]: unknown;
 }) & ({
     status?: "ok" | "nonzero" | "timeout" | "spawn-error" | "skipped" | "planned" | undefined;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.4" | "1.5" | "1.6" | "1.7" | undefined;
+    schema_version?: "1.4" | "1.5" | "1.6" | "1.7" | "1.8" | undefined;
     [k: string]: unknown;
 }) & (({
-    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "tool_deferred" | "untrusted_directory" | "input_too_large" | null;
+    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "tool_deferred" | "untrusted_directory" | "input_too_large" | "model_mismatch" | null;
+    [k: string]: unknown;
+} | {
+    schema_version?: "1.5" | "1.6" | "1.7" | "1.8" | undefined;
+    [k: string]: unknown;
+}) & ({
+    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "model_mismatch" | null;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.5" | "1.6" | "1.7" | undefined;
+    schema_version?: "1.6" | "1.7" | "1.8" | undefined;
     [k: string]: unknown;
 }) & ({
-    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | null;
+    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large" | null;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.6" | "1.7" | undefined;
+    schema_version?: "1.8" | undefined;
     [k: string]: unknown;
 })) & HistoryRecord)[];
 /**