@oxy-hq/cli 0.1.0

package/json-schemas/config.json

@@ -0,0 +1,2215 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Config",
+  "type": "object",
+  "required": [
+    "databases",
+    "models"
+  ],
+  "properties": {
+    "base_branch": {
+      "description": "Branch that new worktrees fork from when saving on a protected branch. Defaults to the currently checked-out branch (usually the default branch) when not set.  Use this when Oxy serves from a \"deployment\" branch but new work should fork from an \"integration\" branch (e.g. serve from `deploy`, fork new work from `main`).\n\nExample config.yml: base_branch: main",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "builder_agent": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/BuilderAgentConfig"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "databases": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Database"
+      }
+    },
+    "defaults": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/Defaults"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "health_check": {
+      "description": "Per-workspace health checks, and how often they run. Drives the workspace's `health_eval` schedule row.\n\n**Unset means off** — health checks are opt-in. Writing the block is the opt-in and the cadence defaults to 1h, so `health_check: {}` is enough to turn them on; `enabled: false` inside a block turns them back off. See `health_check::resolve_enabled`.",
+      "anyOf": [
+        {
+          "$ref": "#/definitions/HealthCheckConfig"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "integrations": {
+      "default": [],
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Integration"
+      }
+    },
+    "mcp": {
+      "description": "Optional MCP configuration for exposing resources as tools If not specified, all agents and automations are exposed by default",
+      "anyOf": [
+        {
+          "$ref": "#/definitions/McpConfig"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "models": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Model"
+      }
+    },
+    "pre_aggregations": {
+      "description": "Pre-aggregation configuration (schema, database, background worker).",
+      "anyOf": [
+        {
+          "$ref": "#/definitions/PreaggConfig"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "protected_branches": {
+      "description": "Branches that are protected: saving a file while on one of these branches will auto-create a new feature branch instead of writing directly. Defaults to [default_branch] (usually \"main\") when not set.\n\nExample config.yml: protected_branches: - main - develop",
+      "type": [
+        "array",
+        "null"
+      ],
+      "items": {
+        "type": "string"
+      }
+    },
+    "repositories": {
+      "description": "External repositories (dbt, LookML, data models, etc.) to surface in the IDE.\n\nExample config.yml: repositories: - name: dbt-models path: ../my-dbt-project - name: lookml git_url: https://github.com/acme/lookml-repo branch: main",
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Repository"
+      }
+    },
+    "timezone": {
+      "description": "IANA timezone (e.g. `America/Los_Angeles`) for resolving relative dates (\"yesterday\", \"last week\") in agentic runs. When unset, dates resolve in UTC. A per-agent `.agentic.yml` `timezone:` overrides this for that agent.",
+      "type": [
+        "string",
+        "null"
+      ]
+    }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "AppProbeTarget": {
+      "description": "One named app to run, and the control values to run it with.",
+      "type": "object",
+      "required": [
+        "app"
+      ],
+      "properties": {
+        "app": {
+          "description": "Workspace-relative path (`apps/sales.app.yml`) or bare file name (`sales.app.yml`).",
+          "type": "string"
+        },
+        "variables": {
+          "description": "Control values for this app, exactly as its Controls would supply them. Absent → the app's own defaults, which is what the `apps: true` sweep uses.\n\nValues keep their YAML type (`limit: 5` stays a number), because that is what an app's own Controls hand its tasks.",
+          "type": "object",
+          "additionalProperties": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "AppsProbeConfig": {
+      "description": "How the app probe picks its targets. Same `bool | [targets]` shape as [`SemanticProbeConfig`], with `variables` per app rather than shared across all of them — two apps rarely want the same control values.\n\n```yaml apps: true                # run every task of every .app.yml apps:                     # run only these apps - app: apps/sales.app.yml variables: region: us-east - app: apps/inventory.app.yml ```",
+      "anyOf": [
+        {
+          "description": "`apps: true|false` — run every app, or none.",
+          "type": "boolean"
+        },
+        {
+          "description": "`apps: [ { app: … }, … ]` — run only the named apps.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AppProbeTarget"
+          }
+        }
+      ]
+    },
+    "BuilderAgentConfig": {
+      "description": "Configuration for the built-in builder copilot agent.\n\nExample: `builder_agent: { model: \"claude-sonnet-4-6\" }`",
+      "anyOf": [
+        {
+          "description": "Built-in copilot configured only with a model name.",
+          "type": "object",
+          "required": [
+            "model"
+          ],
+          "properties": {
+            "model": {
+              "type": "string"
+            }
+          }
+        }
+      ]
+    },
+    "Database": {
+      "type": "object",
+      "oneOf": [
+        {
+          "type": "object",
+          "required": [
+            "type"
+          ],
+          "properties": {
+            "dataset": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "datasets": {
+              "default": {},
+              "type": "object",
+              "additionalProperties": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            },
+            "dry_run_limit": {
+              "type": [
+                "integer",
+                "null"
+              ],
+              "format": "uint64",
+              "minimum": 0.0
+            },
+            "key_path": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "key_path_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "bigquery"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "anyOf": [
+            {
+              "type": "object",
+              "required": [
+                "dataset"
+              ],
+              "properties": {
+                "dataset": {
+                  "type": "string"
+                }
+              }
+            },
+            {
+              "type": "object",
+              "required": [
+                "path"
+              ],
+              "properties": {
+                "path": {
+                  "type": "string"
+                }
+              }
+            },
+            {
+              "$ref": "#/definitions/DuckLakeConfig"
+            }
+          ],
+          "required": [
+            "type"
+          ],
+          "properties": {
+            "s3_mirror": {
+              "description": "Compiler-produced (compiled config only). When set, the connector reads the warehouse data from S3 instead of the local path, so the stateless fleet can serve a workspace whose DuckDB data lives in the working tree. Always `None` in `config.yml` — see [`DuckDbS3Mirror`].",
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/DuckDbS3Mirror"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "duckdb"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "anyOf": [
+            {
+              "type": "object",
+              "required": [
+                "password"
+              ],
+              "properties": {
+                "password": {
+                  "type": "string"
+                }
+              }
+            },
+            {
+              "type": "object",
+              "required": [
+                "password_var"
+              ],
+              "properties": {
+                "password_var": {
+                  "type": "string"
+                }
+              }
+            },
+            {
+              "type": "object",
+              "required": [
+                "private_key_path"
+              ],
+              "properties": {
+                "private_key_path": {
+                  "type": "string"
+                }
+              }
+            },
+            {
+              "type": "object",
+              "properties": {
+                "browser_timeout_secs": {
+                  "default": 120,
+                  "type": "integer",
+                  "format": "uint64",
+                  "minimum": 0.0
+                },
+                "cache_dir": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                }
+              }
+            }
+          ],
+          "required": [
+            "account",
+            "database",
+            "type",
+            "username",
+            "warehouse"
+          ],
+          "properties": {
+            "account": {
+              "type": "string"
+            },
+            "database": {
+              "type": "string"
+            },
+            "datasets": {
+              "default": {},
+              "type": "object",
+              "additionalProperties": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            },
+            "filters": {
+              "default": {},
+              "type": "object",
+              "additionalProperties": {
+                "$ref": "#/definitions/SchemaObject"
+              }
+            },
+            "role": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "schema": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "snowflake"
+              ]
+            },
+            "username": {
+              "type": "string"
+            },
+            "warehouse": {
+              "type": "string"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "type"
+          ],
+          "properties": {
+            "database": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "database_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "host": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "host_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "password_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "port": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "port_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "postgres"
+              ]
+            },
+            "user": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "user_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          }
+        },
+        {
+          "description": "Airhouse: Postgres-wire-protocol warehouse that speaks the DuckDB SQL dialect.\n\nConnection uses the same pgwire transport as `Postgres`, but queries are written in DuckDB syntax — so `Database::dialect()` returns `\"duckdb\"` for Airhouse and the connector layer hardcodes the `postgres://` scheme for transport.",
+          "type": "object",
+          "required": [
+            "type"
+          ],
+          "properties": {
+            "database": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "database_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "host": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "host_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "password_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "port": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "port_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "airhouse"
+              ]
+            },
+            "user": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "user_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          }
+        },
+        {
+          "description": "Airhouse with credentials managed by oxy. The connector layer resolves host, port, dbname, user, and password from the caller's `airhouse_users` row + `org_secrets` entry — populated by the per-user provisioning flow (Settings → Airhouse). No fields needed on this variant; everything is sourced from oxy's database.",
+          "type": "object",
+          "required": [
+            "type"
+          ],
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "airhouse_managed"
+              ]
+            }
+          }
+        },
+        {
+          "description": "Per-org OLTP Postgres with credentials managed by oxy. The connector resolves host, port, dbname, user, and password from the caller's workspace → org → `oltp_tenants` row.\n\nAlways resolves the **read-only analyst** role, whatever the caller's `effective_role` — unlike `airhouse_managed`, which escalates. That database holds a customer's live business records; writes come only from published code (an app function or an Airway pipeline), never from a SQL prompt. No fields: everything is sourced from oxy's database.",
+          "type": "object",
+          "required": [
+            "type"
+          ],
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "postgres_managed"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "type"
+          ],
+          "properties": {
+            "database": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "database_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "host": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "host_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "password_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "port": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "port_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "redshift"
+              ]
+            },
+            "user": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "user_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "type"
+          ],
+          "properties": {
+            "database": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "database_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "host": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "host_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "password_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "port": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "port_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "mysql"
+              ]
+            },
+            "user": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "user_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "type"
+          ],
+          "properties": {
+            "database": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "database_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "filters": {
+              "default": {},
+              "type": "object",
+              "additionalProperties": {
+                "$ref": "#/definitions/SchemaObject"
+              }
+            },
+            "host": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "host_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "password_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "role": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "schemas": {
+              "default": {},
+              "type": "object",
+              "additionalProperties": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            },
+            "settings_prefix": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "clickhouse"
+              ]
+            },
+            "user": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "user_var": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "dataset_id",
+            "developer_token_var",
+            "instance",
+            "type"
+          ],
+          "properties": {
+            "dataset_id": {
+              "type": "string"
+            },
+            "developer_token_var": {
+              "type": "string"
+            },
+            "instance": {
+              "type": "string"
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "domo"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "token_var",
+            "type"
+          ],
+          "properties": {
+            "database": {
+              "default": null,
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "schemas": {
+              "default": {},
+              "type": "object",
+              "additionalProperties": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            },
+            "token_var": {
+              "type": "string"
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "motherduck"
+              ]
+            }
+          }
+        }
+      ],
+      "required": [
+        "name"
+      ],
+      "properties": {
+        "name": {
+          "type": "string"
+        }
+      }
+    },
+    "Defaults": {
+      "type": "object",
+      "properties": {
+        "database": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      }
+    },
+    "DuckDbS3Mirror": {
+      "description": "Compiler-produced S3 mirror of a **local-file** DuckDB warehouse (`Local` / `File` modes). Present **only in the compiled config**, never in `config.yml`: when the compile worker uploads a workspace's on-disk DuckDB data to S3, it records the location here so a stateless serve replica — which has no working copy — can read the data over `httpfs` instead of the absent local path. Its mere presence means \"this is a fleet read\"; local / IDE reads come from the filesystem and never carry it.\n\nCredentials are the pod's instance role (S3 `credential_chain`), so nothing sensitive is stored here.",
+      "type": "object",
+      "required": [
+        "bucket"
+      ],
+      "properties": {
+        "attach_key": {
+          "description": "`File` mode: the mirrored `.duckdb` object key (attached read-only).",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "bucket": {
+          "description": "Bucket the data was mirrored into (`OXY_COMPILE_BLOB_S3_BUCKET`).",
+          "type": "string"
+        },
+        "endpoint_url": {
+          "description": "Custom endpoint (MinIO / LocalStack); when set, path-style addressing is used.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "region": {
+          "description": "AWS region for the S3 secret.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "tables": {
+          "description": "`Local` mode: one mirrored data file per table (table name = slugified file stem, matching local registration).",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/DuckDbS3Table"
+          }
+        }
+      }
+    },
+    "DuckDbS3Table": {
+      "type": "object",
+      "required": [
+        "format",
+        "key",
+        "table"
+      ],
+      "properties": {
+        "format": {
+          "description": "`parquet` | `csv`.",
+          "type": "string"
+        },
+        "key": {
+          "type": "string"
+        },
+        "table": {
+          "type": "string"
+        }
+      }
+    },
+    "DuckLakeConfig": {
+      "type": "object",
+      "oneOf": [
+        {
+          "type": "object",
+          "required": [
+            "key_id",
+            "s3_secret_type"
+          ],
+          "properties": {
+            "endpoint_url": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "key_id": {
+              "type": "string"
+            },
+            "region": {
+              "default": "us-east-1",
+              "type": "string"
+            },
+            "s3_secret_type": {
+              "type": "string",
+              "enum": [
+                "config"
+              ]
+            },
+            "secret": {
+              "description": "The secret key, referenced by a key variable name stored in SecretManager. In YAML, specify the secret key name: `secret: AWS_S3_SECRET`",
+              "default": "DUCKLAKE_S3_SECRET",
+              "allOf": [
+                {
+                  "$ref": "#/definitions/ManagedSecret"
+                }
+              ]
+            },
+            "url_style": {
+              "default": "path",
+              "type": "string"
+            },
+            "use_ssl": {
+              "default": false,
+              "type": "boolean"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "s3_secret_type"
+          ],
+          "properties": {
+            "chain": {
+              "default": "sso;config",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "region": {
+              "default": "us-east-1",
+              "type": "string"
+            },
+            "s3_secret_type": {
+              "type": "string",
+              "enum": [
+                "credential_chain"
+              ]
+            }
+          }
+        }
+      ],
+      "required": [
+        "data_path",
+        "schema_name"
+      ],
+      "properties": {
+        "catalog_path": {
+          "description": "The catalog path, referenced by a key variable name stored in SecretManager. The secret value should be a postgres connection string URL like: `postgres://user:pass@localhost:5432/catalog_db`",
+          "default": "DUCKLAKE_CATALOG_PATH",
+          "allOf": [
+            {
+              "$ref": "#/definitions/ManagedSecret"
+            }
+          ]
+        },
+        "data_path": {
+          "type": "string"
+        },
+        "schema_name": {
+          "type": "string"
+        }
+      }
+    },
+    "HeaderValue": {
+      "description": "Header value that can be either a direct string or an environment variable reference. Used in model configurations to specify custom HTTP headers.",
+      "anyOf": [
+        {
+          "description": "Direct header value",
+          "type": "string"
+        },
+        {
+          "description": "Header value from environment variable",
+          "type": "object",
+          "required": [
+            "env_var"
+          ],
+          "properties": {
+            "env_var": {
+              "description": "Environment variable name containing the header value",
+              "type": "string"
+            }
+          }
+        }
+      ]
+    },
+    "HealthCheckConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "description": "When false, the workspace's health schedule row is disabled and no eval is enqueued. Defaults to true *within a written block* — having gone to the trouble of writing `health_check:`, you meant to turn it on.\n\nThis default says nothing about a workspace with **no** `health_check:` block: that one is off. Ask [`resolve_enabled`] rather than reaching for `unwrap_or(..)` on an `Option<HealthCheckConfig>` at a call site.",
+          "default": true,
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Evaluation cadence as a humantime duration (e.g. `\"30m\"`, `\"2h\"`). Absent → 1h. Out-of-range or unparseable values clamp/fall back to the safe default rather than erroring — a malformed cadence must never wedge the scheduler.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "smoke_test": {
+          "description": "Active end-to-end probes of the workspace's own artifacts, run on their own slower cadence inside the eval pass.\n\nAbsent → [`SmokeTestConfig::default`]: the smoke test still runs, but only the zero-scan `connections` probe, so opting into health checks at all buys free credential-expiry detection. To turn it off entirely, write `smoke_test: { enabled: false }`.",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SmokeTestConfig"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "InstanceType": {
+      "description": "The possible types of values in JSON Schema documents.\n\nSee [JSON Schema 4.2.1. Instance Data Model](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-4.2.1).",
+      "type": "string",
+      "enum": [
+        "null",
+        "boolean",
+        "object",
+        "array",
+        "number",
+        "string",
+        "integer"
+      ]
+    },
+    "Integration": {
+      "type": "object",
+      "oneOf": [
+        {
+          "type": "object",
+          "required": [
+            "api_key_var",
+            "base_url",
+            "topics",
+            "type"
+          ],
+          "properties": {
+            "api_key_var": {
+              "type": "string"
+            },
+            "arrow_threshold_rows": {
+              "description": "Row count threshold for switching to Arrow format (file path response) If query result exceeds this threshold, return file_path instead of row arrays Default: 1000 rows",
+              "default": 1000,
+              "type": "integer",
+              "format": "uint",
+              "minimum": 0.0
+            },
+            "base_url": {
+              "type": "string"
+            },
+            "topics": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/OmniTopic"
+              }
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "omni"
+              ]
+            }
+          }
+        },
+        {
+          "description": "Looker integration configuration.\n\nProvides connection settings for a Looker instance, including OAuth credentials and the list of explores to expose.",
+          "type": "object",
+          "required": [
+            "base_url",
+            "client_id_var",
+            "client_secret_var",
+            "explores",
+            "type"
+          ],
+          "properties": {
+            "base_url": {
+              "description": "Base URL for the Looker instance (e.g., https://your.looker.com:19999)",
+              "type": "string"
+            },
+            "client_id_var": {
+              "description": "Environment variable containing the Looker client ID",
+              "type": "string"
+            },
+            "client_secret_var": {
+              "description": "Environment variable containing the Looker client secret",
+              "type": "string"
+            },
+            "explores": {
+              "description": "List of explores to expose from this Looker instance",
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/LookerExplore"
+              }
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "looker"
+              ]
+            }
+          }
+        },
+        {
+          "description": "Toast POS webhook integration.\n\nThe webhook receiver at `POST /api/webhooks/toast/orders?project_id=...` validates incoming payloads with the secret referenced by `webhook_secret_var` (HMAC-SHA256 over body + timestamp).",
+          "type": "object",
+          "required": [
+            "type",
+            "webhook_secret_var"
+          ],
+          "properties": {
+            "restaurant_guids": {
+              "description": "Restaurant GUIDs this workspace is authorized to receive events for. Empty list = accept all (dev convenience).",
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "toast"
+              ]
+            },
+            "webhook_secret_var": {
+              "description": "Environment variable / workspace secret name containing the Toast webhook signing secret.",
+              "type": "string"
+            }
+          }
+        },
+        {
+          "description": "Toast Analytics API integration — the **reconciliation** source.\n\nDistinct from `ToastIntegration` (webhooks): this carries the credentials and gateway the workspace-health **Reconciliation** dimension uses to call Toast's async Analytics Metrics API. A `reconcile.yml` check binds to it by name via `integration:`. Keeping it separate leaves the webhook integration (managed through the world-model Apps UI) untouched.",
+          "type": "object",
+          "required": [
+            "type"
+          ],
+          "properties": {
+            "api_token_var": {
+              "description": "Workspace-secret name holding a static Toast API bearer token, used when the OAuth client pair is not configured.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "base_url": {
+              "description": "Toast API gateway base URL (e.g. `https://ws-api.toasttab.com` prod, `https://ws-sandbox-api.toasttab.com` sandbox). Absent ⇒ fall back to the `OXY_TOAST_BASE_URL` env var, then the prod gateway default.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "client_id_var": {
+              "description": "Workspace-secret name holding the Toast OAuth client id. Paired with `client_secret_var` for client-credentials auth; absent ⇒ fall back to `api_token_var`. (Validation is skipped: in cloud mode the value lives in the workspace secret store, not the process env.)",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "client_secret_var": {
+              "description": "Workspace-secret name holding the Toast OAuth client secret. See `client_id_var`.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "toast_analytics"
+              ]
+            }
+          }
+        },
+        {
+          "description": "OpenWeatherMap weather data integration.\n\nPowers the world-model weather tile proxy and current-weather batch endpoint. Reads `api_key_var` from workspace secrets.",
+          "type": "object",
+          "required": [
+            "api_key_var",
+            "type"
+          ],
+          "properties": {
+            "api_key_var": {
+              "type": "string"
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "openweathermap"
+              ]
+            }
+          }
+        },
+        {
+          "description": "BestTime foot-traffic integration.\n\nPowers the world-model foot-traffic and radar endpoints. Reads `api_key_var` from workspace secrets.",
+          "type": "object",
+          "required": [
+            "api_key_var",
+            "type"
+          ],
+          "properties": {
+            "api_key_var": {
+              "type": "string"
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "besttime"
+              ]
+            }
+          }
+        },
+        {
+          "description": "UniFi camera integration.\n\nPowers the world-model camera proxy (UniFi Site Manager devices). Reads `api_key_var` from workspace secrets, mirroring the weather/foot-traffic integrations instead of reading a raw process env var.",
+          "type": "object",
+          "required": [
+            "api_key_var",
+            "type"
+          ],
+          "properties": {
+            "api_key_var": {
+              "type": "string"
+            },
+            "type": {
+              "type": "string",
+              "enum": [
+                "unifi"
+              ]
+            }
+          }
+        }
+      ],
+      "required": [
+        "name"
+      ],
+      "properties": {
+        "name": {
+          "type": "string"
+        }
+      }
+    },
+    "LookerExplore": {
+      "description": "Configuration for a Looker explore to expose.",
+      "type": "object",
+      "required": [
+        "model",
+        "name"
+      ],
+      "properties": {
+        "description": {
+          "description": "Optional description for the explore",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "model": {
+          "description": "The LookML model name containing this explore",
+          "type": "string"
+        },
+        "name": {
+          "description": "The explore name within the model",
+          "type": "string"
+        }
+      }
+    },
+    "ManagedSecret": {
+      "type": "string"
+    },
+    "McpConfig": {
+      "type": "object",
+      "properties": {
+        "tools": {
+          "description": "List of file patterns to expose as MCP tools Supports glob patterns like \"agents/*.agent.yml\" Examples: - \"agents/sql-generator.agent.yml\" (specific file) - \"agents/*.agent.yml\" (all agents in directory) - \"workflows/**/*.automation.yml\" (all automations recursively) - \"semantics/topics/*.topic.yml\" (semantic topics) - \"sqls/queries/*.sql\" (SQL files)",
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "Model": {
+      "description": "LLM model configuration supporting multiple vendors",
+      "oneOf": [
+        {
+          "description": "Azure OpenAI deployment configuration",
+          "type": "object",
+          "required": [
+            "key_var",
+            "model_ref",
+            "name",
+            "vendor"
+          ],
+          "properties": {
+            "api_url": {
+              "default": "https://api.openai.com/v1",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "azure_api_version": {
+              "type": "string"
+            },
+            "azure_deployment_id": {
+              "type": "string"
+            },
+            "headers": {
+              "type": [
+                "object",
+                "null"
+              ],
+              "additionalProperties": {
+                "$ref": "#/definitions/HeaderValue"
+              }
+            },
+            "key_var": {
+              "type": "string"
+            },
+            "model_ref": {
+              "type": "string"
+            },
+            "name": {
+              "type": "string"
+            },
+            "vendor": {
+              "type": "string",
+              "enum": [
+                "openai"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "key_var",
+            "model_ref",
+            "name",
+            "vendor"
+          ],
+          "properties": {
+            "key_var": {
+              "type": "string"
+            },
+            "model_ref": {
+              "type": "string"
+            },
+            "name": {
+              "type": "string"
+            },
+            "vendor": {
+              "type": "string",
+              "enum": [
+                "google"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "api_key",
+            "api_url",
+            "model_ref",
+            "name",
+            "vendor"
+          ],
+          "properties": {
+            "api_key": {
+              "type": "string"
+            },
+            "api_url": {
+              "type": "string"
+            },
+            "model_ref": {
+              "type": "string"
+            },
+            "name": {
+              "type": "string"
+            },
+            "vendor": {
+              "type": "string",
+              "enum": [
+                "ollama"
+              ]
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "key_var",
+            "model_ref",
+            "name",
+            "vendor"
+          ],
+          "properties": {
+            "api_url": {
+              "default": "https://api.anthropic.com/v1",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "headers": {
+              "type": [
+                "object",
+                "null"
+              ],
+              "additionalProperties": {
+                "$ref": "#/definitions/HeaderValue"
+              }
+            },
+            "key_var": {
+              "type": "string"
+            },
+            "model_ref": {
+              "type": "string"
+            },
+            "name": {
+              "type": "string"
+            },
+            "vendor": {
+              "type": "string",
+              "enum": [
+                "anthropic"
+              ]
+            }
+          }
+        },
+        {
+          "description": "An OpenAI-compatible gateway that speaks **Chat Completions** (`/chat/completions`) rather than the Responses API (`/responses`).\n\nDistinct from [`Model::OpenAI`] only in which wire protocol the agentic pipeline targets — third-party and EU-hosted gateways (LangDock, vLLM, LM Studio, most self-hosted proxies) implement Chat Completions only and return 404 on `/responses`.\n\nReuses [`OpenAIModelConfig`] so it inherits `key_var`, meaning the API key resolves through the managed workspace secret store like any other keyed vendor. [`Model::Ollama`] also targets Chat Completions but carries its key inline with no `key_var`, so it cannot bind a managed secret.",
+          "type": "object",
+          "required": [
+            "key_var",
+            "model_ref",
+            "name",
+            "vendor"
+          ],
+          "properties": {
+            "api_url": {
+              "default": "https://api.openai.com/v1",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "azure_api_version": {
+              "type": "string"
+            },
+            "azure_deployment_id": {
+              "type": "string"
+            },
+            "headers": {
+              "type": [
+                "object",
+                "null"
+              ],
+              "additionalProperties": {
+                "$ref": "#/definitions/HeaderValue"
+              }
+            },
+            "key_var": {
+              "type": "string"
+            },
+            "model_ref": {
+              "type": "string"
+            },
+            "name": {
+              "type": "string"
+            },
+            "vendor": {
+              "type": "string",
+              "enum": [
+                "openai_compat"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "OmniTopic": {
+      "type": "object",
+      "required": [
+        "model_id",
+        "name"
+      ],
+      "properties": {
+        "model_id": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        }
+      }
+    },
+    "PreaggConfig": {
+      "description": "Top-level `pre_aggregations:` block in `config.yml`.",
+      "type": "object",
+      "properties": {
+        "database": {
+          "description": "Database connector used for pre-agg builds. Defaults to each view's own `datasource`.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "refresh_worker": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/RefreshWorkerConfig"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "schema": {
+          "description": "Warehouse schema where pre-agg tables are created. Defaults to `\"AIRLAYER\"`.",
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "RefreshWorkerConfig": {
+      "description": "Configuration for the background pre-aggregation refresh worker.",
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "description": "Set to `false` to disable the background worker entirely.",
+          "default": true,
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
+        "heartbeat": {
+          "description": "How often the worker wakes up to check staleness (e.g. \"30s\", \"5m\").",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "renewal_threshold": {
+          "description": "How long a cached refresh_key result is valid before re-evaluating (e.g. \"120s\").",
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "Repository": {
+      "description": "An external repository (dbt, LookML, data models, etc.) linked to an Oxy project. Either `path` or `git_url` must be set.",
+      "type": "object",
+      "required": [
+        "name"
+      ],
+      "properties": {
+        "branch": {
+          "description": "Branch to check out when cloning from `git_url`. Defaults to HEAD.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "git_namespace_id": {
+          "description": "GitHub namespace UUID used to get a fresh installation token for push. Set when the repo was linked via the GitHub App.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "git_url": {
+          "description": "Remote git URL to clone. Repo is cloned to `.repositories/{name}/`.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "name": {
+          "description": "Display name used as the path prefix `@{name}/` in the IDE.",
+          "type": "string"
+        },
+        "path": {
+          "description": "Local filesystem path, relative to the project root or absolute.",
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      }
+    },
+    "Schema": {
+      "description": "A JSON Schema.",
+      "anyOf": [
+        {
+          "description": "A trivial boolean JSON Schema.\n\nThe schema `true` matches everything (always passes validation), whereas the schema `false` matches nothing (always fails validation).",
+          "type": "boolean"
+        },
+        {
+          "description": "A JSON Schema object.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/SchemaObject"
+            }
+          ]
+        }
+      ]
+    },
+    "SchemaObject": {
+      "description": "A JSON Schema object.",
+      "type": "object",
+      "properties": {
+        "$id": {
+          "description": "The `$id` keyword.\n\nSee [JSON Schema 8.2.2. The \"$id\" Keyword](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-8.2.2).",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "$ref": {
+          "description": "The `$ref` keyword.\n\nSee [JSON Schema 8.2.4.1. Direct References with \"$ref\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-8.2.4.1).",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "additionalItems": {
+          "description": "The `additionalItems` keyword.\n\nSee [JSON Schema 9.3.1.2. \"additionalItems\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.3.1.2).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/Schema"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "additionalProperties": {
+          "description": "The `additionalProperties` keyword.\n\nSee [JSON Schema 9.3.2.3. \"additionalProperties\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.3.2.3).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/Schema"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "allOf": {
+          "description": "The `allOf` keyword.\n\nSee [JSON Schema 9.2.1.1. \"allOf\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.2.1.1).",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/Schema"
+          }
+        },
+        "anyOf": {
+          "description": "The `anyOf` keyword.\n\nSee [JSON Schema 9.2.1.2. \"anyOf\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.2.1.2).",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/Schema"
+          }
+        },
+        "const": {
+          "description": "The `const` keyword.\n\nSee [JSON Schema Validation 6.1.3. \"const\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.1.3)"
+        },
+        "contains": {
+          "description": "The `contains` keyword.\n\nSee [JSON Schema 9.3.1.4. \"contains\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.3.1.4).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/Schema"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "default": {
+          "description": "The `default` keyword.\n\nSee [JSON Schema Validation 9.2. \"default\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-9.2)."
+        },
+        "deprecated": {
+          "description": "The `deprecated` keyword.\n\nSee [JSON Schema Validation 9.3. \"deprecated\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-9.3).",
+          "type": "boolean"
+        },
+        "description": {
+          "description": "The `description` keyword.\n\nSee [JSON Schema Validation 9.1. \"title\" and \"description\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-9.1).",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "else": {
+          "description": "The `else` keyword.\n\nSee [JSON Schema 9.2.2.3. \"else\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.2.2.3).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/Schema"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "enum": {
+          "description": "The `enum` keyword.\n\nSee [JSON Schema Validation 6.1.2. \"enum\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.1.2)",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": true
+        },
+        "examples": {
+          "description": "The `examples` keyword.\n\nSee [JSON Schema Validation 9.5. \"examples\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-9.5).",
+          "type": "array",
+          "items": true
+        },
+        "exclusiveMaximum": {
+          "description": "The `exclusiveMaximum` keyword.\n\nSee [JSON Schema Validation 6.2.3. \"exclusiveMaximum\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.2.3).",
+          "type": [
+            "number",
+            "null"
+          ],
+          "format": "double"
+        },
+        "exclusiveMinimum": {
+          "description": "The `exclusiveMinimum` keyword.\n\nSee [JSON Schema Validation 6.2.5. \"exclusiveMinimum\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.2.5).",
+          "type": [
+            "number",
+            "null"
+          ],
+          "format": "double"
+        },
+        "format": {
+          "description": "The `format` keyword.\n\nSee [JSON Schema Validation 7. A Vocabulary for Semantic Content With \"format\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-7).",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "if": {
+          "description": "The `if` keyword.\n\nSee [JSON Schema 9.2.2.1. \"if\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.2.2.1).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/Schema"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "items": {
+          "description": "The `items` keyword.\n\nSee [JSON Schema 9.3.1.1. \"items\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.3.1.1).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SingleOrVec_for_Schema"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "maxItems": {
+          "description": "The `maxItems` keyword.\n\nSee [JSON Schema Validation 6.4.1. \"maxItems\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.4.1).",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint32",
+          "minimum": 0.0
+        },
+        "maxLength": {
+          "description": "The `maxLength` keyword.\n\nSee [JSON Schema Validation 6.3.1. \"maxLength\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.3.1).",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint32",
+          "minimum": 0.0
+        },
+        "maxProperties": {
+          "description": "The `maxProperties` keyword.\n\nSee [JSON Schema Validation 6.5.1. \"maxProperties\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.5.1).",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint32",
+          "minimum": 0.0
+        },
+        "maximum": {
+          "description": "The `maximum` keyword.\n\nSee [JSON Schema Validation 6.2.2. \"maximum\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.2.2).",
+          "type": [
+            "number",
+            "null"
+          ],
+          "format": "double"
+        },
+        "minItems": {
+          "description": "The `minItems` keyword.\n\nSee [JSON Schema Validation 6.4.2. \"minItems\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.4.2).",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint32",
+          "minimum": 0.0
+        },
+        "minLength": {
+          "description": "The `minLength` keyword.\n\nSee [JSON Schema Validation 6.3.2. \"minLength\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.3.2).",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint32",
+          "minimum": 0.0
+        },
+        "minProperties": {
+          "description": "The `minProperties` keyword.\n\nSee [JSON Schema Validation 6.5.2. \"minProperties\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.5.2).",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint32",
+          "minimum": 0.0
+        },
+        "minimum": {
+          "description": "The `minimum` keyword.\n\nSee [JSON Schema Validation 6.2.4. \"minimum\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.2.4).",
+          "type": [
+            "number",
+            "null"
+          ],
+          "format": "double"
+        },
+        "multipleOf": {
+          "description": "The `multipleOf` keyword.\n\nSee [JSON Schema Validation 6.2.1. \"multipleOf\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.2.1).",
+          "type": [
+            "number",
+            "null"
+          ],
+          "format": "double"
+        },
+        "not": {
+          "description": "The `not` keyword.\n\nSee [JSON Schema 9.2.1.4. \"not\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.2.1.4).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/Schema"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "oneOf": {
+          "description": "The `oneOf` keyword.\n\nSee [JSON Schema 9.2.1.3. \"oneOf\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.2.1.3).",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/Schema"
+          }
+        },
+        "pattern": {
+          "description": "The `pattern` keyword.\n\nSee [JSON Schema Validation 6.3.3. \"pattern\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.3.3).",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "patternProperties": {
+          "description": "The `patternProperties` keyword.\n\nSee [JSON Schema 9.3.2.2. \"patternProperties\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.3.2.2).",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/Schema"
+          }
+        },
+        "properties": {
+          "description": "The `properties` keyword.\n\nSee [JSON Schema 9.3.2.1. \"properties\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.3.2.1).",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/Schema"
+          }
+        },
+        "propertyNames": {
+          "description": "The `propertyNames` keyword.\n\nSee [JSON Schema 9.3.2.5. \"propertyNames\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.3.2.5).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/Schema"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "readOnly": {
+          "description": "The `readOnly` keyword.\n\nSee [JSON Schema Validation 9.4. \"readOnly\" and \"writeOnly\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-9.4).",
+          "type": "boolean"
+        },
+        "required": {
+          "description": "The `required` keyword.\n\nSee [JSON Schema Validation 6.5.3. \"required\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.5.3).",
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "uniqueItems": true
+        },
+        "then": {
+          "description": "The `then` keyword.\n\nSee [JSON Schema 9.2.2.2. \"then\"](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-9.2.2.2).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/Schema"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "title": {
+          "description": "The `title` keyword.\n\nSee [JSON Schema Validation 9.1. \"title\" and \"description\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-9.1).",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "type": {
+          "description": "The `type` keyword.\n\nSee [JSON Schema Validation 6.1.1. \"type\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.1.1) and [JSON Schema 4.2.1. Instance Data Model](https://tools.ietf.org/html/draft-handrews-json-schema-02#section-4.2.1).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SingleOrVec_for_InstanceType"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "uniqueItems": {
+          "description": "The `uniqueItems` keyword.\n\nSee [JSON Schema Validation 6.4.3. \"uniqueItems\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-6.4.3).",
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
+        "writeOnly": {
+          "description": "The `writeOnly` keyword.\n\nSee [JSON Schema Validation 9.4. \"readOnly\" and \"writeOnly\"](https://tools.ietf.org/html/draft-handrews-json-schema-validation-02#section-9.4).",
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": true
+    },
+    "SemanticProbeConfig": {
+      "description": "How the semantic probe picks its targets: sweep everything, or probe a list of named topics.\n\n```yaml semantic: true            # every topic, measure auto-picked from its base view semantic:                 # only these topics - topic: fruit_business measures:             # omit to auto-pick one, as the sweep does - fruits.total_count - fruits.avg_price - topic: orders ```\n\nNaming topics is the cheaper mode and the one to reach for on a real warehouse: the sweep's cost scales with *every* topic's data volume, while a named list is a bill you chose. Explicit `measures` also pin the probe to columns you know are small, instead of whatever the base view lists first.\n\n`apps` takes the same `bool | [targets]` shape — see [`AppsProbeConfig`].",
+      "anyOf": [
+        {
+          "description": "`semantic: true|false` — sweep every topic, or run nothing.",
+          "type": "boolean"
+        },
+        {
+          "description": "`semantic: [ { topic: … }, … ]` — probe only the named topics.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/SemanticProbeTarget"
+          }
+        }
+      ]
+    },
+    "SemanticProbeTarget": {
+      "description": "One named topic to probe, and which of its measures to probe it with.",
+      "type": "object",
+      "required": [
+        "topic"
+      ],
+      "properties": {
+        "measures": {
+          "description": "Fully-qualified `view.measure` references to query. Empty → the same auto-pick the sweep uses (first measure on the base view).\n\nAll of a topic's measures go into **one** query rather than one query each: it is a single warehouse round-trip instead of N, and it exercises the topic's join graph and fan-out protection, which per-measure queries never would. The trade is attribution — the verdict names the topic, and the failing measure shows up in the error text.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "topic": {
+          "description": "The topic's `name`, as declared in its `.topic.yml`.",
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "SingleOrVec_for_InstanceType": {
+      "description": "A type which can be serialized as a single item, or multiple items.\n\nIn some contexts, a `Single` may be semantically distinct from a `Vec` containing only item.",
+      "anyOf": [
+        {
+          "$ref": "#/definitions/InstanceType"
+        },
+        {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/InstanceType"
+          }
+        }
+      ]
+    },
+    "SingleOrVec_for_Schema": {
+      "description": "A type which can be serialized as a single item, or multiple items.\n\nIn some contexts, a `Single` may be semantically distinct from a `Vec` containing only item.",
+      "anyOf": [
+        {
+          "$ref": "#/definitions/Schema"
+        },
+        {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Schema"
+          }
+        }
+      ]
+    },
+    "SmokeAgentProbe": {
+      "description": "The agent round-trip probe: which agent to ask, and what to ask it.",
+      "type": "object",
+      "required": [
+        "agent_ref",
+        "prompt"
+      ],
+      "properties": {
+        "agent_ref": {
+          "description": "Workspace-relative path to the agent config, e.g. `agents/analytics.agentic.yml`.",
+          "type": "string"
+        },
+        "name": {
+          "description": "Label for this probe's verdict. Absent → the `agent_ref`.\n\nWorth setting once you ask one agent several questions: the verdict's check id is `agent:<label>`, so same-`agent_ref` probes would otherwise be told apart only by the `#2` suffix `resolved_agents` appends.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "prompt": {
+          "description": "The question to ask. Any non-error answer passes — the probe checks that the pipeline, the LLM key, and SQL generation all work, not that the answer is correct.",
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "SmokeTestConfig": {
+      "description": "Which probes the workspace smoke test runs, and how often.\n\n**Only `connections` defaults on**, and the whole block defaults on when absent — so a workspace that opted into `health_check:` gets a cheap credential check for free (nothing here runs for one that didn't: the smoke run is gated inside an eval pass). The other three are opt-in even then, because they are not cheap, and the reason is not obvious from their descriptions:\n\n* `connections` — `SELECT 1`. Scans zero bytes, so it is free on a bytes-billed warehouse (BigQuery on-demand, Athena). Caveat: on Snowflake it *resumes* a suspended warehouse, which bills a 60-second minimum. At the 6h default that is four wake-ups a day. * `semantic` — one measure query per topic. `SUM(x)` over an unpartitioned fact table reads the whole column; a `LIMIT` cannot shrink an aggregate's scan. Cost scales with your *data volume*, not your topic count, and on a bytes-billed warehouse it is by far the most expensive probe here. * `apps` — every task of every `.app.yml`; a superset of `semantic`. * `agent` — a real LLM round-trip, plus whatever SQL the agent decides to run.",
+      "type": "object",
+      "properties": {
+        "agent": {
+          "description": "Ask an agentic agent a fixed question and assert it answers. Absent → the probe is skipped. Costs tokens on every smoke run.\n\nSingular back-compat spelling for a single probe; prefer `agents:`. Both may be set, and [`SmokeTestConfig::resolved_agents`] runs the union.",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SmokeAgentProbe"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "agents": {
+          "description": "Ask several agents, or the same agent several questions. Each entry is a separate probe with its own verdict; every one costs tokens on every smoke run.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/SmokeAgentProbe"
+          }
+        },
+        "apps": {
+          "description": "Run every task of every `.app.yml`. Defaults false — an app can fan out into many warehouse queries.\n\n`apps: true` runs every app; an `{ include: [...] }` block runs only the apps it names. See [`AppsProbeConfig`].",
+          "default": false,
+          "allOf": [
+            {
+              "$ref": "#/definitions/AppsProbeConfig"
+            }
+          ]
+        },
+        "connections": {
+          "description": "`SELECT 1` against every database in `databases:`. Defaults **true** — the one probe cheap enough to run unasked.",
+          "default": true,
+          "type": "boolean"
+        },
+        "enabled": {
+          "description": "When false, no probes run and the dimension reads Healthy.",
+          "default": true,
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Smoke cadence as a humantime duration (e.g. `\"6h\"`, `\"1d\"`). Absent → 6h. Clamped to `[10m, 7d]`; unparseable falls back to the default. Because the smoke run is gated inside an eval pass, a cadence below the `health_check` interval simply means \"every pass\".",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "max_targets": {
+          "description": "Per-probe-kind cap on how many targets to exercise. Absent → 25.",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint",
+          "minimum": 0.0
+        },
+        "semantic": {
+          "description": "One trivial measure query per `.topic.yml`, end to end through the semantic model to the warehouse. Defaults **false**: it reads the full measure column on every run, so enabling it against a large unpartitioned fact table is a real recurring warehouse bill.\n\n`semantic: true` sweeps every topic with an auto-picked measure; a `{ topics: [...] }` block probes only what it names. See [`SemanticProbeConfig`].",
+          "default": false,
+          "allOf": [
+            {
+              "$ref": "#/definitions/SemanticProbeConfig"
+            }
+          ]
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}