@probelabs/visor 0.1.173 → 0.1.174-ee

package/dist/generated/config-schema.json

@@ -0,0 +1,3803 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$ref": "#/definitions/VisorConfigSchema",
+  "definitions": {
+    "VisorConfigSchema": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "hooks": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E"
+        },
+        "version": {
+          "type": "string",
+          "description": "Configuration version"
+        },
+        "extends": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "description": "Extends from other configurations - can be file path, HTTP(S) URL, or \"default\""
+        },
+        "include": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "description": "Alias for extends - include from other configurations (backward compatibility)"
+        },
+        "tools": {
+          "$ref": "#/definitions/Record%3Cstring%2CCustomToolDefinition%3E",
+          "description": "Custom tool definitions that can be used in MCP blocks"
+        },
+        "imports": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Import workflow definitions from external files or URLs"
+        },
+        "inputs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/WorkflowInput"
+          },
+          "description": "Workflow inputs (for standalone reusable workflows)"
+        },
+        "outputs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/WorkflowOutput"
+          },
+          "description": "Workflow outputs (for standalone reusable workflows)"
+        },
+        "steps": {
+          "$ref": "#/definitions/Record%3Cstring%2CCheckConfig%3E",
+          "description": "Step configurations (recommended)"
+        },
+        "checks": {
+          "$ref": "#/definitions/Record%3Cstring%2CCheckConfig%3E",
+          "description": "Check configurations (legacy, use 'steps' instead) - always populated after normalization"
+        },
+        "output": {
+          "$ref": "#/definitions/OutputConfig",
+          "description": "Output configuration (optional - defaults provided)"
+        },
+        "http_server": {
+          "$ref": "#/definitions/HttpServerConfig",
+          "description": "HTTP server configuration for receiving webhooks"
+        },
+        "memory": {
+          "$ref": "#/definitions/MemoryConfig",
+          "description": "Memory storage configuration"
+        },
+        "env": {
+          "$ref": "#/definitions/EnvConfig",
+          "description": "Global environment variables"
+        },
+        "ai_model": {
+          "type": "string",
+          "description": "Global AI model setting"
+        },
+        "ai_provider": {
+          "type": "string",
+          "description": "Global AI provider setting"
+        },
+        "ai_mcp_servers": {
+          "$ref": "#/definitions/Record%3Cstring%2CMcpServerConfig%3E",
+          "description": "Global MCP servers configuration for AI checks"
+        },
+        "max_parallelism": {
+          "type": "number",
+          "description": "Maximum number of checks to run in parallel (default: 3)"
+        },
+        "max_ai_concurrency": {
+          "type": "number",
+          "description": "Maximum total concurrent AI API calls across all checks (default: unlimited). When set, creates a shared concurrency limiter that gates every LLM request across all ProbeAgent instances in this run."
+        },
+        "fail_fast": {
+          "type": "boolean",
+          "description": "Stop execution when any check fails (default: false)"
+        },
+        "fail_if": {
+          "type": "string",
+          "description": "Simple global fail condition - fails if expression evaluates to true"
+        },
+        "failure_conditions": {
+          "$ref": "#/definitions/FailureConditions",
+          "description": "Global failure conditions - optional (deprecated, use fail_if)"
+        },
+        "tag_filter": {
+          "$ref": "#/definitions/TagFilter",
+          "description": "Tag filter for selective check execution"
+        },
+        "routing": {
+          "$ref": "#/definitions/RoutingDefaults",
+          "description": "Optional routing defaults for retry/goto/run policies"
+        },
+        "limits": {
+          "$ref": "#/definitions/LimitsConfig",
+          "description": "Global execution limits"
+        },
+        "frontends": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "Frontend name, e.g., 'ndjson-sink', 'github'"
+              },
+              "config": {
+                "description": "Frontend-specific configuration"
+              }
+            },
+            "required": [
+              "name"
+            ],
+            "additionalProperties": false
+          },
+          "description": "Optional integrations: event-driven frontends (e.g., ndjson-sink, github)"
+        },
+        "workspace": {
+          "$ref": "#/definitions/WorkspaceConfig",
+          "description": "Workspace isolation configuration for sandboxed execution"
+        },
+        "sandbox": {
+          "type": "string",
+          "description": "Workspace-level default sandbox name (all checks use this unless overridden)"
+        },
+        "sandboxes": {
+          "$ref": "#/definitions/Record%3Cstring%2CSandboxConfig%3E",
+          "description": "Named sandbox environment definitions"
+        },
+        "sandbox_defaults": {
+          "$ref": "#/definitions/SandboxDefaults",
+          "description": "Workspace-level sandbox defaults (env allowlist, etc.)"
+        },
+        "slack": {
+          "$ref": "#/definitions/SlackConfig",
+          "description": "Slack configuration"
+        },
+        "telegram": {
+          "$ref": "#/definitions/TelegramConfig",
+          "description": "Telegram bot configuration"
+        },
+        "email": {
+          "$ref": "#/definitions/EmailConfig",
+          "description": "Email integration configuration"
+        },
+        "whatsapp": {
+          "$ref": "#/definitions/WhatsAppConfig",
+          "description": "WhatsApp bot configuration"
+        },
+        "teams": {
+          "$ref": "#/definitions/TeamsConfig",
+          "description": "Microsoft Teams bot configuration"
+        },
+        "scheduler": {
+          "$ref": "#/definitions/SchedulerConfig",
+          "description": "Scheduler configuration for scheduled workflow execution"
+        },
+        "policy": {
+          "$ref": "#/definitions/PolicyConfig",
+          "description": "Enterprise policy engine configuration"
+        },
+        "agent_protocol": {
+          "$ref": "#/definitions/AgentProtocolConfig",
+          "description": "Agent protocol (A2A) server configuration"
+        },
+        "task_tracking": {
+          "type": "boolean",
+          "description": "Enable cross-frontend task tracking (default: false). When true, all workflow executions (CLI, Slack, TUI, Scheduler) are recorded in a shared SQLite TaskStore visible via `visor tasks`."
+        }
+      },
+      "required": [
+        "version"
+      ],
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "Record<string,unknown>": {
+      "type": "object",
+      "additionalProperties": {}
+    },
+    "Record<string,CustomToolDefinition>": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/CustomToolDefinition"
+      }
+    },
+    "CustomToolDefinition": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "enum": [
+            "command",
+            "api",
+            "workflow"
+          ],
+          "description": "Tool implementation type (defaults to 'command')"
+        },
+        "name": {
+          "type": "string",
+          "description": "Tool name - used to reference the tool in MCP blocks"
+        },
+        "description": {
+          "type": "string",
+          "description": "Description of what the tool does"
+        },
+        "inputSchema": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "object"
+            },
+            "properties": {
+              "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E"
+            },
+            "required": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            "additionalProperties": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "type"
+          ],
+          "additionalProperties": false,
+          "description": "Input schema for the tool (JSON Schema format)",
+          "patternProperties": {
+            "^x-": {}
+          }
+        },
+        "exec": {
+          "type": "string",
+          "description": "Command to execute - supports Liquid template (required for type: 'command')"
+        },
+        "stdin": {
+          "type": "string",
+          "description": "Optional stdin input - supports Liquid template"
+        },
+        "transform": {
+          "type": "string",
+          "description": "Transform the raw output - supports Liquid template"
+        },
+        "transform_js": {
+          "type": "string",
+          "description": "Transform the output using JavaScript - alternative to transform"
+        },
+        "cwd": {
+          "type": "string",
+          "description": "Working directory for command execution"
+        },
+        "env": {
+          "$ref": "#/definitions/Record%3Cstring%2Cstring%3E",
+          "description": "Environment variables for the command"
+        },
+        "timeout": {
+          "type": "number",
+          "description": "Timeout in milliseconds"
+        },
+        "parseJson": {
+          "type": "boolean",
+          "description": "Whether to parse output as JSON automatically"
+        },
+        "outputSchema": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Expected output schema for validation"
+        },
+        "spec": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E"
+            }
+          ],
+          "description": "OpenAPI specification path/URL or inline object (required for type: 'api')"
+        },
+        "overlays": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E"
+            },
+            {
+              "type": "array",
+              "items": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E"
+                  }
+                ]
+              }
+            }
+          ],
+          "description": "Overlay path/URL, inline object, or a mixed array applied in order"
+        },
+        "targetUrl": {
+          "type": "string",
+          "description": "Override API base URL instead of OpenAPI servers"
+        },
+        "target_url": {
+          "type": "string",
+          "description": "Alias for targetUrl (snake_case)"
+        },
+        "whitelist": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Include only operations matching these glob patterns (operationId or METHOD:/path)"
+        },
+        "blacklist": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Exclude operations matching these glob patterns (ignored when whitelist is set)"
+        },
+        "headers": {
+          "$ref": "#/definitions/Record%3Cstring%2Cstring%3E",
+          "description": "Extra headers added to all API requests"
+        },
+        "disableXMcp": {
+          "type": "boolean",
+          "description": "Disable X-MCP: 1 request header"
+        },
+        "disable_x_mcp": {
+          "type": "boolean",
+          "description": "Alias for disableXMcp (snake_case)"
+        },
+        "apiKey": {
+          "type": "string",
+          "description": "API key fallback credential used by security schemes"
+        },
+        "api_key": {
+          "type": "string",
+          "description": "Alias for apiKey (snake_case)"
+        },
+        "securitySchemeName": {
+          "type": "string",
+          "description": "Preferred security scheme name (optional hint)"
+        },
+        "security_scheme_name": {
+          "type": "string",
+          "description": "Alias for securitySchemeName (snake_case)"
+        },
+        "securityCredentials": {
+          "$ref": "#/definitions/Record%3Cstring%2Cstring%3E",
+          "description": "Credentials by OpenAPI security scheme name"
+        },
+        "security_credentials": {
+          "$ref": "#/definitions/Record%3Cstring%2Cstring%3E",
+          "description": "Alias for securityCredentials (snake_case)"
+        },
+        "namePrefix": {
+          "type": "string",
+          "description": "Optional prefix prepended to generated operation tool names"
+        },
+        "name_prefix": {
+          "type": "string",
+          "description": "Alias for namePrefix (snake_case)"
+        },
+        "requestTimeoutMs": {
+          "type": "number",
+          "description": "Request timeout in milliseconds for API calls"
+        },
+        "request_timeout_ms": {
+          "type": "number",
+          "description": "Alias for requestTimeoutMs (snake_case)"
+        },
+        "workflow": {
+          "type": "string",
+          "description": "Workflow ID (registry lookup) or file path (for type: 'workflow')"
+        },
+        "inputs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/WorkflowInput"
+          },
+          "description": "Inline workflow inputs (for type: 'workflow' with inline steps)"
+        },
+        "outputs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/WorkflowOutput"
+          },
+          "description": "Inline workflow outputs (for type: 'workflow' with inline steps)"
+        },
+        "steps": {
+          "$ref": "#/definitions/Record%3Cstring%2CCheckConfig%3E",
+          "description": "Inline workflow steps (for type: 'workflow' with inline definition)"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false,
+      "description": "Custom tool definition for use in MCP blocks",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "Record<string,string>": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      }
+    },
+    "WorkflowInput": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Input parameter name"
+        },
+        "schema": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "JSON Schema for the input"
+        },
+        "required": {
+          "type": "boolean",
+          "description": "Whether this input is required"
+        },
+        "default": {
+          "description": "Default value if not provided"
+        },
+        "description": {
+          "type": "string",
+          "description": "Human-readable description"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false,
+      "description": "Workflow input definition for standalone reusable workflows",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "WorkflowOutput": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Output name"
+        },
+        "description": {
+          "type": "string",
+          "description": "Human-readable description"
+        },
+        "value": {
+          "type": "string",
+          "description": "Value using Liquid template syntax (references step outputs)"
+        },
+        "value_js": {
+          "type": "string",
+          "description": "Value using JavaScript expression (alternative to value)"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false,
+      "description": "Workflow output definition for standalone reusable workflows",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "Record<string,CheckConfig>": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/CheckConfig"
+      }
+    },
+    "CheckConfig": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "$ref": "#/definitions/ConfigCheckType",
+          "description": "Type of check to perform (defaults to 'ai' if not specified)"
+        },
+        "prompt": {
+          "type": "string",
+          "description": "AI prompt for the check - can be inline string or file path (auto-detected) - required for AI checks"
+        },
+        "appendPrompt": {
+          "type": "string",
+          "description": "Additional prompt to append when extending configurations - merged with parent prompt"
+        },
+        "exec": {
+          "type": "string",
+          "description": "Command execution with Liquid template support - required for command checks"
+        },
+        "stdin": {
+          "type": "string",
+          "description": "Stdin input for tools with Liquid template support - optional for tool checks"
+        },
+        "url": {
+          "type": "string",
+          "description": "HTTP URL - required for http output checks"
+        },
+        "body": {
+          "type": "string",
+          "description": "HTTP body template (Liquid) - required for http output checks"
+        },
+        "method": {
+          "type": "string",
+          "description": "HTTP method (defaults to POST)"
+        },
+        "headers": {
+          "$ref": "#/definitions/Record%3Cstring%2Cstring%3E",
+          "description": "HTTP headers"
+        },
+        "endpoint": {
+          "type": "string",
+          "description": "HTTP endpoint path - required for http_input checks"
+        },
+        "transform": {
+          "type": "string",
+          "description": "Transform template for http_input data (Liquid) - optional"
+        },
+        "transform_js": {
+          "type": "string",
+          "description": "Transform using JavaScript expressions (evaluated in secure sandbox) - optional"
+        },
+        "content": {
+          "type": "string",
+          "description": "Script content to execute for script checks"
+        },
+        "tools": {
+          "type": "array",
+          "items": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "workflow": {
+                    "type": "string"
+                  },
+                  "args": {
+                    "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E"
+                  }
+                },
+                "required": [
+                  "workflow"
+                ],
+                "additionalProperties": false
+              }
+            ]
+          },
+          "description": "Tool names to expose inside script checks (string names or workflow references)"
+        },
+        "tools_js": {
+          "type": "string",
+          "description": "JavaScript expression to dynamically compute tools for script checks"
+        },
+        "mcp_servers": {
+          "$ref": "#/definitions/Record%3Cstring%2CMcpServerConfig%3E",
+          "description": "MCP servers whose tools are exposed inside script checks"
+        },
+        "enable_fetch": {
+          "type": "boolean",
+          "description": "Enable fetch() function in script checks (default: false)"
+        },
+        "enable_bash": {
+          "type": "boolean",
+          "description": "Enable bash() function in script checks (default: false)"
+        },
+        "schedule": {
+          "type": "string",
+          "description": "Cron schedule expression (e.g., \"0 2 * * *\") - optional for any check type"
+        },
+        "focus": {
+          "type": "string",
+          "description": "Focus area for the check (security/performance/style/architecture/all) - optional"
+        },
+        "command": {
+          "type": "string",
+          "description": "Command that triggers this check (e.g., \"review\", \"security-scan\") - optional"
+        },
+        "on": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/EventTrigger"
+          },
+          "description": "Events that trigger this check (defaults to ['manual'] if not specified)"
+        },
+        "triggers": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "File patterns that trigger this check (optional)"
+        },
+        "ai": {
+          "$ref": "#/definitions/AIProviderConfig",
+          "description": "AI provider configuration (optional)"
+        },
+        "ai_model": {
+          "type": "string",
+          "description": "AI model to use for this check - overrides global setting"
+        },
+        "ai_provider": {
+          "type": "string",
+          "description": "AI provider to use for this check - overrides global setting"
+        },
+        "ai_persona": {
+          "type": "string",
+          "description": "Optional persona hint, prepended to the prompt as 'Persona: <value>'"
+        },
+        "ai_prompt_type": {
+          "type": "string",
+          "description": "Probe promptType for this check (underscore style)"
+        },
+        "ai_max_iterations": {
+          "type": "number",
+          "description": "Maximum tool iterations for ProbeAgent (underscore style)"
+        },
+        "ai_system_prompt": {
+          "type": "string",
+          "description": "System prompt for this check (underscore style)"
+        },
+        "ai_custom_prompt": {
+          "type": "string",
+          "description": "Legacy customPrompt (underscore style) — deprecated, use ai_system_prompt"
+        },
+        "ai_mcp_servers": {
+          "$ref": "#/definitions/Record%3Cstring%2CMcpServerConfig%3E",
+          "description": "MCP servers for this AI check - overrides global setting"
+        },
+        "ai_mcp_servers_js": {
+          "type": "string",
+          "description": "JavaScript expression to dynamically compute MCP servers for this AI check. Expression has access to: outputs, inputs, pr, files, env, memory Must return an object mapping server names to McpServerConfig objects.\n\nExample: ``` const servers = {}; const tags = outputs['route-intent']?.tags || []; if (tags.includes('jira')) {   servers.jira = {     command: \"npx\",     args: [\"-y\", \"@aashari/mcp-server-atlassian-jira\"],     env: { ATLASSIAN_SITE_NAME: \"mysite\" }   }; } return servers; ```"
+        },
+        "ai_custom_tools": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of custom tool names to expose to this AI check via ephemeral SSE MCP server"
+        },
+        "ai_custom_tools_js": {
+          "type": "string",
+          "description": "JavaScript expression to dynamically compute custom tools for this AI check. Expression has access to: outputs, inputs, pr, files, env, memory Must return an array of tool names (strings) or WorkflowToolReference objects ({ workflow: string, args?: Record<string, unknown> })\n\nExample: ``` const tools = []; if (outputs['route-intent'].intent === 'engineer') {   tools.push({ workflow: 'engineer', args: { projects: ['tyk'] } }); } return tools; ```"
+        },
+        "ai_bash_config_js": {
+          "type": "string",
+          "description": "JavaScript expression to dynamically compute bash configuration for this AI check. Expression has access to: outputs, inputs, pr, files, env, memory Must return a BashConfig object with allow/deny arrays.\n\nExample: ``` return outputs['build-config']?.bash_config ?? {}; ```"
+        },
+        "claude_code": {
+          "$ref": "#/definitions/ClaudeCodeConfig",
+          "description": "Claude Code configuration (for claude-code type checks)"
+        },
+        "env": {
+          "$ref": "#/definitions/EnvConfig",
+          "description": "Environment variables for this check"
+        },
+        "timeout": {
+          "type": "number",
+          "description": "Timeout in milliseconds for command execution (default: 60000, i.e., 60 seconds)"
+        },
+        "depends_on": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "description": "Check IDs that this check depends on (optional). Accepts single string or array."
+        },
+        "group": {
+          "type": "string",
+          "description": "Group name for comment separation (e.g., \"code-review\", \"pr-overview\") - optional"
+        },
+        "schema": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E"
+            }
+          ],
+          "description": "Schema type for template rendering (e.g., \"code-review\", \"markdown\") or inline JSON schema object - optional"
+        },
+        "output_schema": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Optional JSON Schema to validate the produced output. If omitted and `schema` is an object, the engine will treat that object as the output_schema for validation purposes while still using string schemas (e.g., 'code-review') for template selection."
+        },
+        "template": {
+          "$ref": "#/definitions/CustomTemplateConfig",
+          "description": "Custom template configuration - optional"
+        },
+        "if": {
+          "type": "string",
+          "description": "Condition to determine if check should run - runs if expression evaluates to true"
+        },
+        "reuse_ai_session": {
+          "type": [
+            "string",
+            "boolean"
+          ],
+          "description": "Check name to reuse AI session from, or true to use first dependency (only works with depends_on)"
+        },
+        "session_mode": {
+          "type": "string",
+          "enum": [
+            "clone",
+            "append"
+          ],
+          "description": "How to reuse AI session: 'clone' (default, copy history) or 'append' (share history)"
+        },
+        "fail_if": {
+          "type": "string",
+          "description": "Simple fail condition - fails check if expression evaluates to true"
+        },
+        "failure_conditions": {
+          "$ref": "#/definitions/FailureConditions",
+          "description": "Check-specific failure conditions - optional (deprecated, use fail_if)"
+        },
+        "tags": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Tags for categorizing and filtering checks (e.g., [\"local\", \"fast\", \"security\"])"
+        },
+        "criticality": {
+          "type": "string",
+          "enum": [
+            "external",
+            "internal",
+            "policy",
+            "info"
+          ],
+          "description": "Operational criticality of this step. Drives default safety policies (contracts, retries, loop budgets) at load time. Behavior can still be overridden explicitly per step via on_*, fail_if, assume/guarantee, etc.\n\n- 'external': interacts with external systems (side effects). Highest safety.\n- 'internal': modifies CI/config/state but not prod. High safety.\n- 'policy': organizational checks (linting, style, doc). Moderate safety.\n- 'info': informational checks. Lowest safety."
+        },
+        "continue_on_failure": {
+          "type": "boolean",
+          "description": "Allow dependents to run even if this step fails. Defaults to false (dependents are gated when this step fails). Similar to GitHub Actions' continue-on-error."
+        },
+        "forEach": {
+          "type": "boolean",
+          "description": "Process output as array and run dependent checks for each item"
+        },
+        "fanout": {
+          "type": "string",
+          "enum": [
+            "map",
+            "reduce"
+          ],
+          "description": "Control scheduling behavior when this check is triggered via routing (run/goto) from a forEach scope.\n- 'map': schedule once per item (fan-out) using item scopes.\n- 'reduce': schedule a single run at the parent scope (aggregation). If unset, the current default is a single run (reduce) for backward compatibility."
+        },
+        "reduce": {
+          "type": "boolean",
+          "description": "Alias for fanout: 'reduce'"
+        },
+        "on_init": {
+          "$ref": "#/definitions/OnInitConfig",
+          "description": "Init routing configuration for this check (runs before execution/preprocessing)"
+        },
+        "on_fail": {
+          "$ref": "#/definitions/OnFailConfig",
+          "description": "Failure routing configuration for this check (retry/goto/run)"
+        },
+        "on_success": {
+          "$ref": "#/definitions/OnSuccessConfig",
+          "description": "Success routing configuration for this check (post-actions and optional goto)"
+        },
+        "on_finish": {
+          "$ref": "#/definitions/OnFinishConfig",
+          "description": "Finish routing configuration for forEach checks (runs after ALL iterations complete)"
+        },
+        "assume": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "description": "Preconditions that must hold before executing the check. If any expression evaluates to false, the check is skipped (skipReason='assume')."
+        },
+        "guarantee": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "description": "Postconditions that should hold after executing the check. Expressions are evaluated against the produced result/output; violations are recorded as error issues with ruleId \"contract/guarantee_failed\"."
+        },
+        "max_runs": {
+          "type": "number",
+          "description": "Hard cap on how many times this check may execute within a single engine run. Overrides global limits.max_runs_per_check. Set to 0 or negative to disable for this step."
+        },
+        "message": {
+          "type": "string",
+          "description": "Message template for log checks"
+        },
+        "level": {
+          "type": "string",
+          "enum": [
+            "debug",
+            "info",
+            "warn",
+            "error"
+          ],
+          "description": "Log level for log checks"
+        },
+        "include_pr_context": {
+          "type": "boolean",
+          "description": "Include PR context in log output"
+        },
+        "include_dependencies": {
+          "type": "boolean",
+          "description": "Include dependency summaries in log output"
+        },
+        "include_metadata": {
+          "type": "boolean",
+          "description": "Include execution metadata in log output"
+        },
+        "output_format": {
+          "type": "string",
+          "enum": [
+            "json",
+            "text"
+          ],
+          "description": "Output parsing hint for command provider (optional) When set to 'json', command stdout is expected to be JSON. When 'text', treat as plain text. Note: command provider attempts JSON parsing heuristically; this flag mainly suppresses schema warnings and may be used by providers to alter parsing behavior in the future."
+        },
+        "operation": {
+          "type": "string",
+          "enum": [
+            "get",
+            "set",
+            "append",
+            "increment",
+            "delete",
+            "clear",
+            "list"
+          ],
+          "description": "Memory operation to perform. Use `type: 'script'` for custom JavaScript."
+        },
+        "key": {
+          "type": "string",
+          "description": "Key for memory operation"
+        },
+        "value": {
+          "description": "Value for set/append operations"
+        },
+        "value_js": {
+          "type": "string",
+          "description": "JavaScript expression to compute value dynamically"
+        },
+        "namespace": {
+          "type": "string",
+          "description": "Override namespace for this check"
+        },
+        "op": {
+          "type": "string",
+          "description": "GitHub operation to perform (e.g., 'labels.add', 'labels.remove', 'comment.create')"
+        },
+        "values": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Values for GitHub operations (can be array or single value)"
+        },
+        "transport": {
+          "type": "string",
+          "enum": [
+            "stdio",
+            "sse",
+            "http"
+          ],
+          "description": "Transport type for MCP: stdio (default), sse (legacy), or http (streamable HTTP)"
+        },
+        "methodArgs": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Arguments to pass to the MCP method (supports Liquid templates)"
+        },
+        "argsTransform": {
+          "type": "string",
+          "description": "Transform template for method arguments (Liquid)"
+        },
+        "sessionId": {
+          "type": "string",
+          "description": "Session ID for HTTP transport (optional, server may generate one)"
+        },
+        "command_args": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Command arguments (for stdio transport in MCP checks)"
+        },
+        "workingDirectory": {
+          "type": "string",
+          "description": "Working directory (for stdio transport in MCP checks)"
+        },
+        "placeholder": {
+          "type": "string",
+          "description": "Placeholder text to show in input field"
+        },
+        "allow_empty": {
+          "type": "boolean",
+          "description": "Allow empty input (default: false)"
+        },
+        "multiline": {
+          "type": "boolean",
+          "description": "Support multiline input (default: false)"
+        },
+        "default": {
+          "type": "string",
+          "description": "Default value if timeout occurs or empty input when allow_empty is true"
+        },
+        "workflow": {
+          "type": "string",
+          "description": "Workflow ID or path to workflow file"
+        },
+        "args": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Arguments/inputs for the workflow"
+        },
+        "overrides": {
+          "$ref": "#/definitions/Record%3Cstring%2CPartial%3Cinterface-src_types_config.ts-14017-28611-src_types_config.ts-0-56833%3E%3E",
+          "description": "Override specific step configurations in the workflow"
+        },
+        "output_mapping": {
+          "$ref": "#/definitions/Record%3Cstring%2Cstring%3E",
+          "description": "Map workflow outputs to check outputs"
+        },
+        "workflow_inputs": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Alias for args - workflow inputs (backward compatibility)"
+        },
+        "config": {
+          "type": "string",
+          "description": "Config file path - alternative to workflow ID (loads a Visor config file as workflow)"
+        },
+        "workflow_overrides": {
+          "$ref": "#/definitions/Record%3Cstring%2CPartial%3Cinterface-src_types_config.ts-14017-28611-src_types_config.ts-0-56833%3E%3E",
+          "description": "Alias for overrides - workflow step overrides (backward compatibility)"
+        },
+        "ref": {
+          "type": "string",
+          "description": "Git reference to checkout (branch, tag, commit SHA) - supports templates"
+        },
+        "repository": {
+          "type": "string",
+          "description": "Repository URL or owner/repo format (defaults to current repository)"
+        },
+        "token": {
+          "type": "string",
+          "description": "GitHub token for private repositories (defaults to GITHUB_TOKEN env)"
+        },
+        "fetch_depth": {
+          "type": "number",
+          "description": "Number of commits to fetch (0 for full history, default: 1)"
+        },
+        "fetch_tags": {
+          "type": "boolean",
+          "description": "Whether to fetch tags (default: false)"
+        },
+        "submodules": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "type": "string",
+              "const": "recursive"
+            }
+          ],
+          "description": "Checkout submodules: false, true, or 'recursive'"
+        },
+        "working_directory": {
+          "type": "string",
+          "description": "Working directory for the checkout (defaults to temp directory)"
+        },
+        "use_worktree": {
+          "type": "boolean",
+          "description": "Use git worktree for efficient parallel checkouts (default: true)"
+        },
+        "clean": {
+          "type": "boolean",
+          "description": "Clean the working directory before checkout (default: true)"
+        },
+        "sparse_checkout": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Sparse checkout paths - only checkout specific directories/files"
+        },
+        "lfs": {
+          "type": "boolean",
+          "description": "Enable Git LFS (Large File Storage)"
+        },
+        "clone_timeout_ms": {
+          "type": "number",
+          "description": "Timeout in ms for cloning the bare repository (default: 300000 = 5 min)"
+        },
+        "cleanup_on_failure": {
+          "type": "boolean",
+          "description": "Clean up worktree on failure (default: true)"
+        },
+        "persist_worktree": {
+          "type": "boolean",
+          "description": "Keep worktree after workflow completion (default: false)"
+        },
+        "sandbox": {
+          "type": "string",
+          "description": "Sandbox name to use for this check (overrides workspace-level default)"
+        },
+        "policy": {
+          "$ref": "#/definitions/StepPolicyOverride",
+          "description": "Per-step policy override (enterprise)"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Configuration for a single check",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "ConfigCheckType": {
+      "type": "string",
+      "enum": [
+        "ai",
+        "command",
+        "script",
+        "http",
+        "http_input",
+        "http_client",
+        "noop",
+        "log",
+        "memory",
+        "github",
+        "claude-code",
+        "mcp",
+        "human-input",
+        "workflow",
+        "git-checkout",
+        "a2a"
+      ],
+      "description": "Valid check types in configuration"
+    },
+    "Record<string,McpServerConfig>": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/McpServerConfig"
+      }
+    },
+    "McpServerConfig": {
+      "type": "object",
+      "properties": {
+        "command": {
+          "type": "string",
+          "description": "Command to execute (presence indicates stdio server)"
+        },
+        "args": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Arguments to pass to the command"
+        },
+        "env": {
+          "$ref": "#/definitions/Record%3Cstring%2Cstring%3E",
+          "description": "Environment variables for the MCP server"
+        },
+        "url": {
+          "type": "string",
+          "description": "URL endpoint (presence indicates external server)"
+        },
+        "transport": {
+          "type": "string",
+          "enum": [
+            "stdio",
+            "sse",
+            "http"
+          ],
+          "description": "Transport type"
+        },
+        "workflow": {
+          "type": "string",
+          "description": "Workflow ID or path (presence indicates workflow tool)"
+        },
+        "inputs": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Inputs to pass to workflow"
+        },
+        "description": {
+          "type": "string",
+          "description": "Tool description for AI"
+        },
+        "allowedMethods": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Whitelist specific methods from this MCP server (supports wildcards like \"search_*\")"
+        },
+        "blockedMethods": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Block specific methods from this MCP server (supports wildcards like \"*_delete\")"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Unified MCP server/tool entry - type detected by which properties are present\n\nDetection logic (priority order): 1. Has `command` → stdio MCP server (external process) 2. Has `url` → SSE/HTTP MCP server (external endpoint) 3. Has `workflow` → workflow tool reference 4. Empty `{}` or just key → auto-detect from `tools:` section",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "EventTrigger": {
+      "type": "string",
+      "enum": [
+        "pr_opened",
+        "pr_updated",
+        "pr_closed",
+        "issue_opened",
+        "issue_comment",
+        "manual",
+        "schedule",
+        "webhook_received",
+        "slack_message",
+        "telegram_message",
+        "email_message",
+        "whatsapp_message",
+        "teams_message"
+      ],
+      "description": "Valid event triggers for checks"
+    },
+    "AIProviderConfig": {
+      "type": "object",
+      "properties": {
+        "provider": {
+          "type": "string",
+          "enum": [
+            "google",
+            "anthropic",
+            "openai",
+            "bedrock",
+            "mock"
+          ],
+          "description": "AI provider to use"
+        },
+        "model": {
+          "type": "string",
+          "description": "Model name to use"
+        },
+        "apiKey": {
+          "type": "string",
+          "description": "API key (usually from environment variables)"
+        },
+        "timeout": {
+          "type": "number",
+          "description": "Request timeout in milliseconds"
+        },
+        "max_iterations": {
+          "type": "number",
+          "description": "Maximum tool iterations for ProbeAgent"
+        },
+        "debug": {
+          "type": "boolean",
+          "description": "Enable debug mode"
+        },
+        "prompt_type": {
+          "type": "string",
+          "description": "Probe promptType to use (e.g., engineer, code-review, architect)"
+        },
+        "system_prompt": {
+          "type": "string",
+          "description": "System prompt (baseline preamble). Replaces legacy custom_prompt."
+        },
+        "custom_prompt": {
+          "type": "string",
+          "description": "Probe customPrompt (baseline/system prompt) — deprecated, use system_prompt"
+        },
+        "skip_code_context": {
+          "type": "boolean",
+          "description": "Skip adding code context (diffs, files, PR info) to the prompt"
+        },
+        "skip_slack_context": {
+          "type": "boolean",
+          "description": "Skip adding Slack conversation context to the prompt (when running under Slack)"
+        },
+        "skip_transport_context": {
+          "type": "boolean",
+          "description": "Skip adding transport-specific context (e.g., GitHub PR/issue XML, Slack conversation XML) to the prompt. When true, this behaves like setting both skip_code_context and skip_slack_context to true, unless those are explicitly overridden."
+        },
+        "mcpServers": {
+          "$ref": "#/definitions/Record%3Cstring%2CMcpServerConfig%3E",
+          "description": "MCP servers configuration"
+        },
+        "enableDelegate": {
+          "type": "boolean",
+          "description": "Enable the delegate tool for task distribution to subagents"
+        },
+        "enableTasks": {
+          "type": "boolean",
+          "description": "Enable task management for tracking multi-goal requests"
+        },
+        "retry": {
+          "$ref": "#/definitions/AIRetryConfig",
+          "description": "Retry configuration for this provider"
+        },
+        "fallback": {
+          "$ref": "#/definitions/AIFallbackConfig",
+          "description": "Fallback configuration for provider failures"
+        },
+        "allowEdit": {
+          "type": "boolean",
+          "description": "Enable Edit and Create tools for file modification (disabled by default for security)"
+        },
+        "allowedTools": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Filter allowed tools - supports whitelist, exclusion (!prefix), or raw AI mode (empty array)"
+        },
+        "disableTools": {
+          "type": "boolean",
+          "description": "Disable all tools for raw AI mode (alternative to allowedTools: [])"
+        },
+        "allowBash": {
+          "type": "boolean",
+          "description": "Enable bash command execution (shorthand for bashConfig.enabled)"
+        },
+        "search_delegate_provider": {
+          "type": "string",
+          "description": "Override provider for search delegate sub-agents (e.g., 'google' for cheaper search)"
+        },
+        "search_delegate_model": {
+          "type": "string",
+          "description": "Override model for search delegate sub-agents (e.g., 'gemini-2.0-flash')"
+        },
+        "bashConfig": {
+          "$ref": "#/definitions/BashConfig",
+          "description": "Advanced bash command execution configuration"
+        },
+        "completion_prompt": {
+          "type": "string",
+          "description": "Completion prompt for post-completion validation/review (runs after attempt_completion)"
+        },
+        "enable_scheduler": {
+          "type": "boolean",
+          "description": "Enable the schedule tool for scheduling workflow executions (requires scheduler configuration)"
+        },
+        "enableExecutePlan": {
+          "type": "boolean",
+          "description": "Enable the execute_plan DSL orchestration tool (replaces analyze_all when enabled)"
+        }
+      },
+      "additionalProperties": false,
+      "description": "AI provider configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "AIRetryConfig": {
+      "type": "object",
+      "properties": {
+        "maxRetries": {
+          "type": "number",
+          "description": "Maximum retry attempts (0-50)"
+        },
+        "initialDelay": {
+          "type": "number",
+          "description": "Initial delay in milliseconds (0-60000)"
+        },
+        "maxDelay": {
+          "type": "number",
+          "description": "Maximum delay cap in milliseconds (0-300000)"
+        },
+        "backoffFactor": {
+          "type": "number",
+          "description": "Exponential backoff multiplier (1-10)"
+        },
+        "retryableErrors": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Custom error patterns to retry on"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Retry configuration for AI provider calls",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "AIFallbackConfig": {
+      "type": "object",
+      "properties": {
+        "strategy": {
+          "type": "string",
+          "enum": [
+            "same-model",
+            "same-provider",
+            "any",
+            "custom"
+          ],
+          "description": "Fallback strategy: 'same-model', 'same-provider', 'any', or 'custom'"
+        },
+        "providers": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AIFallbackProviderConfig"
+          },
+          "description": "Array of fallback provider configurations"
+        },
+        "maxTotalAttempts": {
+          "type": "number",
+          "description": "Maximum total attempts across all providers"
+        },
+        "auto": {
+          "type": "boolean",
+          "description": "Enable automatic fallback using available environment variables"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Fallback configuration for AI providers",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "AIFallbackProviderConfig": {
+      "type": "object",
+      "properties": {
+        "provider": {
+          "type": "string",
+          "enum": [
+            "google",
+            "anthropic",
+            "openai",
+            "bedrock"
+          ],
+          "description": "AI provider to use"
+        },
+        "model": {
+          "type": "string",
+          "description": "Model name to use"
+        },
+        "apiKey": {
+          "type": "string",
+          "description": "API key for this provider"
+        },
+        "maxRetries": {
+          "type": "number",
+          "description": "Per-provider retry override"
+        },
+        "region": {
+          "type": "string",
+          "description": "AWS region (for Bedrock)"
+        },
+        "accessKeyId": {
+          "type": "string",
+          "description": "AWS access key ID (for Bedrock)"
+        },
+        "secretAccessKey": {
+          "type": "string",
+          "description": "AWS secret access key (for Bedrock)"
+        }
+      },
+      "required": [
+        "provider",
+        "model"
+      ],
+      "additionalProperties": false,
+      "description": "Fallback provider configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "BashConfig": {
+      "type": "object",
+      "properties": {
+        "allow": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Array of permitted command patterns (e.g., ['ls', 'git status'])"
+        },
+        "deny": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Array of blocked command patterns (e.g., ['rm -rf', 'sudo'])"
+        },
+        "disableDefaultAllow": {
+          "type": "boolean",
+          "description": "Disable default safe command list (use with caution)"
+        },
+        "disableDefaultDeny": {
+          "type": "boolean",
+          "description": "Disable default dangerous command blocklist (use with extreme caution)"
+        },
+        "timeout": {
+          "type": "number",
+          "description": "Execution timeout in milliseconds"
+        },
+        "workingDirectory": {
+          "type": "string",
+          "description": "Default working directory for command execution"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Bash command execution configuration for ProbeAgent Note: Use 'allowBash: true' in AIProviderConfig to enable bash execution",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "ClaudeCodeConfig": {
+      "type": "object",
+      "properties": {
+        "allowedTools": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of allowed tools for Claude Code to use"
+        },
+        "maxTurns": {
+          "type": "number",
+          "description": "Maximum number of turns in conversation"
+        },
+        "systemPrompt": {
+          "type": "string",
+          "description": "System prompt for Claude Code"
+        },
+        "mcpServers": {
+          "$ref": "#/definitions/Record%3Cstring%2CMcpServerConfig%3E",
+          "description": "MCP servers configuration"
+        },
+        "subagent": {
+          "type": "string",
+          "description": "Path to subagent script"
+        },
+        "enableDelegate": {
+          "type": "boolean",
+          "description": "Enable the delegate tool for task distribution to subagents"
+        },
+        "hooks": {
+          "type": "object",
+          "properties": {
+            "onStart": {
+              "type": "string",
+              "description": "Called when check starts"
+            },
+            "onEnd": {
+              "type": "string",
+              "description": "Called when check ends"
+            },
+            "onError": {
+              "type": "string",
+              "description": "Called when check encounters an error"
+            }
+          },
+          "additionalProperties": false,
+          "description": "Event hooks for lifecycle management",
+          "patternProperties": {
+            "^x-": {}
+          }
+        }
+      },
+      "additionalProperties": false,
+      "description": "Claude Code configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "EnvConfig": {
+      "type": "object",
+      "additionalProperties": {
+        "type": [
+          "string",
+          "number",
+          "boolean"
+        ]
+      },
+      "description": "Environment variable reference configuration"
+    },
+    "CustomTemplateConfig": {
+      "type": "object",
+      "properties": {
+        "file": {
+          "type": "string",
+          "description": "Path to custom template file (relative to config file or absolute)"
+        },
+        "content": {
+          "type": "string",
+          "description": "Raw template content as string"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Custom template configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "FailureConditions": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/FailureCondition"
+      },
+      "description": "Collection of failure conditions"
+    },
+    "FailureCondition": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/SimpleFailureCondition"
+        },
+        {
+          "$ref": "#/definitions/ComplexFailureCondition"
+        }
+      ],
+      "description": "Failure condition - can be a simple expression string or complex object"
+    },
+    "SimpleFailureCondition": {
+      "type": "string",
+      "description": "Simple failure condition - just an expression string"
+    },
+    "ComplexFailureCondition": {
+      "type": "object",
+      "properties": {
+        "condition": {
+          "type": "string",
+          "description": "Expression to evaluate using Function Constructor"
+        },
+        "message": {
+          "type": "string",
+          "description": "Human-readable message when condition is met"
+        },
+        "severity": {
+          "$ref": "#/definitions/FailureConditionSeverity",
+          "description": "Severity level of the failure"
+        },
+        "halt_execution": {
+          "type": "boolean",
+          "description": "Whether this condition should halt execution"
+        }
+      },
+      "required": [
+        "condition"
+      ],
+      "additionalProperties": false,
+      "description": "Complex failure condition with additional metadata",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "FailureConditionSeverity": {
+      "type": "string",
+      "enum": [
+        "error",
+        "warning",
+        "info"
+      ],
+      "description": "Failure condition severity levels"
+    },
+    "OnInitConfig": {
+      "type": "object",
+      "properties": {
+        "run": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/OnInitRunItem"
+          },
+          "description": "Items to run before this check executes"
+        },
+        "run_js": {
+          "type": "string",
+          "description": "Dynamic init items: JS expression returning OnInitRunItem[]"
+        },
+        "transitions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TransitionRule"
+          },
+          "description": "Declarative transitions (optional, for advanced use cases)"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Init routing configuration per check Runs BEFORE the check executes (preprocessing/setup)",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "OnInitRunItem": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/OnInitToolInvocation"
+        },
+        {
+          "$ref": "#/definitions/OnInitStepInvocation"
+        },
+        {
+          "$ref": "#/definitions/OnInitWorkflowInvocation"
+        },
+        {
+          "type": "string"
+        }
+      ],
+      "description": "Unified on_init run item - can be tool, step, workflow, or plain string"
+    },
+    "OnInitToolInvocation": {
+      "type": "object",
+      "properties": {
+        "tool": {
+          "type": "string",
+          "description": "Tool name (must exist in tools: section)"
+        },
+        "with": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Arguments to pass to the tool (Liquid templates supported)"
+        },
+        "as": {
+          "type": "string",
+          "description": "Custom output name (defaults to tool name)"
+        }
+      },
+      "required": [
+        "tool"
+      ],
+      "additionalProperties": false,
+      "description": "Invoke a custom tool (from tools: section)",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "OnInitStepInvocation": {
+      "type": "object",
+      "properties": {
+        "step": {
+          "type": "string",
+          "description": "Step name (must exist in steps: section)"
+        },
+        "with": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Arguments to pass to the step (Liquid templates supported)"
+        },
+        "as": {
+          "type": "string",
+          "description": "Custom output name (defaults to step name)"
+        }
+      },
+      "required": [
+        "step"
+      ],
+      "additionalProperties": false,
+      "description": "Invoke a helper step (regular check)",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "OnInitWorkflowInvocation": {
+      "type": "object",
+      "properties": {
+        "workflow": {
+          "type": "string",
+          "description": "Workflow ID or path"
+        },
+        "with": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Workflow inputs (Liquid templates supported)"
+        },
+        "as": {
+          "type": "string",
+          "description": "Custom output name (defaults to workflow name)"
+        },
+        "overrides": {
+          "$ref": "#/definitions/Record%3Cstring%2CPartial%3Cinterface-src_types_config.ts-14017-28611-src_types_config.ts-0-56833%3E%3E",
+          "description": "Step overrides"
+        },
+        "output_mapping": {
+          "$ref": "#/definitions/Record%3Cstring%2Cstring%3E",
+          "description": "Output mapping"
+        }
+      },
+      "required": [
+        "workflow"
+      ],
+      "additionalProperties": false,
+      "description": "Invoke a reusable workflow",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "Record<string,Partial<interface-src_types_config.ts-14017-28611-src_types_config.ts-0-56833>>": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/Partial%3Cinterface-src_types_config.ts-14017-28611-src_types_config.ts-0-56833%3E"
+      }
+    },
+    "Partial<interface-src_types_config.ts-14017-28611-src_types_config.ts-0-56833>": {
+      "type": "object",
+      "additionalProperties": false
+    },
+    "TransitionRule": {
+      "type": "object",
+      "properties": {
+        "when": {
+          "type": "string",
+          "description": "JavaScript expression evaluated in the same sandbox as goto_js; truthy enables the rule."
+        },
+        "to": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "Target step ID, or null to explicitly prevent goto."
+        },
+        "goto_event": {
+          "$ref": "#/definitions/EventTrigger",
+          "description": "Optional event override when performing goto."
+        }
+      },
+      "required": [
+        "when"
+      ],
+      "additionalProperties": false,
+      "description": "Declarative transition rule for on_* blocks.",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "OnFailConfig": {
+      "type": "object",
+      "properties": {
+        "retry": {
+          "$ref": "#/definitions/RetryPolicy",
+          "description": "Retry policy"
+        },
+        "run": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Remediation steps to run before reattempt"
+        },
+        "goto": {
+          "type": "string",
+          "description": "Jump back to an ancestor step (by id)"
+        },
+        "goto_event": {
+          "$ref": "#/definitions/EventTrigger",
+          "description": "Simulate a different event when performing goto (e.g., 'pr_updated')"
+        },
+        "goto_js": {
+          "type": "string",
+          "description": "Dynamic goto: JS expression returning step id or null"
+        },
+        "run_js": {
+          "type": "string",
+          "description": "Dynamic remediation list: JS expression returning string[]"
+        },
+        "transitions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TransitionRule"
+          },
+          "description": "Declarative transitions. Evaluated in order; first matching rule wins. If a rule's `to` is null, no goto occurs. When omitted or none match, the engine falls back to goto_js/goto for backward compatibility."
+        }
+      },
+      "additionalProperties": false,
+      "description": "Failure routing configuration per check",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "RetryPolicy": {
+      "type": "object",
+      "properties": {
+        "max": {
+          "type": "number",
+          "description": "Maximum retry attempts (excluding the first attempt)"
+        },
+        "backoff": {
+          "$ref": "#/definitions/BackoffPolicy",
+          "description": "Backoff policy"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Retry policy for a step",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "BackoffPolicy": {
+      "type": "object",
+      "properties": {
+        "mode": {
+          "type": "string",
+          "enum": [
+            "fixed",
+            "exponential"
+          ],
+          "description": "Backoff mode"
+        },
+        "delay_ms": {
+          "type": "number",
+          "description": "Initial delay in milliseconds"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Backoff policy for retries",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "OnSuccessConfig": {
+      "type": "object",
+      "properties": {
+        "run": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/OnSuccessRunItem"
+          },
+          "description": "Post-success steps to run - can be step names or rich invocations with arguments"
+        },
+        "goto": {
+          "type": "string",
+          "description": "Optional jump back to ancestor step (by id)"
+        },
+        "goto_event": {
+          "$ref": "#/definitions/EventTrigger",
+          "description": "Simulate a different event when performing goto (e.g., 'pr_updated')"
+        },
+        "goto_js": {
+          "type": "string",
+          "description": "Dynamic goto: JS expression returning step id or null"
+        },
+        "run_js": {
+          "type": "string",
+          "description": "Dynamic post-success steps: JS expression returning string[]"
+        },
+        "transitions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TransitionRule"
+          },
+          "description": "Declarative transitions (see OnFailConfig.transitions)."
+        }
+      },
+      "additionalProperties": false,
+      "description": "Success routing configuration per check",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "OnSuccessRunItem": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "$ref": "#/definitions/OnInitStepInvocation"
+        },
+        {
+          "$ref": "#/definitions/OnInitWorkflowInvocation"
+        }
+      ],
+      "description": "Success routing run item - can be step name, step with args, or workflow with args"
+    },
+    "OnFinishConfig": {
+      "type": "object",
+      "properties": {
+        "run": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Post-finish steps to run"
+        },
+        "goto": {
+          "type": "string",
+          "description": "Optional jump back to ancestor step (by id)"
+        },
+        "goto_event": {
+          "$ref": "#/definitions/EventTrigger",
+          "description": "Simulate a different event when performing goto (e.g., 'pr_updated')"
+        },
+        "goto_js": {
+          "type": "string",
+          "description": "Dynamic goto: JS expression returning step id or null"
+        },
+        "run_js": {
+          "type": "string",
+          "description": "Dynamic post-finish steps: JS expression returning string[]"
+        },
+        "transitions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TransitionRule"
+          },
+          "description": "Declarative transitions (see OnFailConfig.transitions)."
+        }
+      },
+      "additionalProperties": false,
+      "description": "Finish routing configuration for forEach checks Runs once after ALL iterations of forEach and ALL dependent checks complete",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "StepPolicyOverride": {
+      "type": "object",
+      "properties": {
+        "require": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "description": "Required role(s) - any of these roles suffices"
+        },
+        "deny": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Explicit deny for roles"
+        },
+        "rule": {
+          "type": "string",
+          "description": "Custom OPA rule path for this step"
+        }
+      },
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "OutputConfig": {
+      "type": "object",
+      "properties": {
+        "pr_comment": {
+          "$ref": "#/definitions/PrCommentOutput",
+          "description": "PR comment configuration"
+        },
+        "file_comment": {
+          "$ref": "#/definitions/FileCommentOutput",
+          "description": "File comment configuration (optional)"
+        },
+        "github_checks": {
+          "$ref": "#/definitions/GitHubCheckOutput",
+          "description": "GitHub check runs configuration (optional)"
+        },
+        "suppressionEnabled": {
+          "type": "boolean",
+          "description": "Whether to enable issue suppression via visor-disable comments (default: true)"
+        }
+      },
+      "required": [
+        "pr_comment"
+      ],
+      "additionalProperties": false,
+      "description": "Output configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "PrCommentOutput": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Whether PR comments are enabled"
+        },
+        "format": {
+          "$ref": "#/definitions/ConfigOutputFormat",
+          "description": "Format of the output"
+        },
+        "group_by": {
+          "$ref": "#/definitions/GroupByOption",
+          "description": "How to group the results"
+        },
+        "collapse": {
+          "type": "boolean",
+          "description": "Whether to collapse sections by default"
+        },
+        "debug": {
+          "$ref": "#/definitions/DebugConfig",
+          "description": "Debug mode configuration (optional)"
+        }
+      },
+      "required": [
+        "format",
+        "group_by",
+        "collapse"
+      ],
+      "additionalProperties": false,
+      "description": "PR comment output configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "ConfigOutputFormat": {
+      "type": "string",
+      "enum": [
+        "table",
+        "json",
+        "markdown",
+        "sarif"
+      ],
+      "description": "Valid output formats"
+    },
+    "GroupByOption": {
+      "type": "string",
+      "enum": [
+        "check",
+        "file",
+        "severity",
+        "group"
+      ],
+      "description": "Valid grouping options"
+    },
+    "DebugConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable debug mode"
+        },
+        "includePrompts": {
+          "type": "boolean",
+          "description": "Include AI prompts in debug output"
+        },
+        "includeRawResponses": {
+          "type": "boolean",
+          "description": "Include raw AI responses in debug output"
+        },
+        "includeTiming": {
+          "type": "boolean",
+          "description": "Include timing information"
+        },
+        "includeProviderInfo": {
+          "type": "boolean",
+          "description": "Include provider information"
+        }
+      },
+      "required": [
+        "enabled",
+        "includePrompts",
+        "includeRawResponses",
+        "includeTiming",
+        "includeProviderInfo"
+      ],
+      "additionalProperties": false,
+      "description": "Debug mode configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "FileCommentOutput": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Whether file comments are enabled"
+        },
+        "inline": {
+          "type": "boolean",
+          "description": "Whether to show inline comments"
+        }
+      },
+      "required": [
+        "enabled",
+        "inline"
+      ],
+      "additionalProperties": false,
+      "description": "File comment output configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "GitHubCheckOutput": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Whether GitHub check runs are enabled"
+        },
+        "per_check": {
+          "type": "boolean",
+          "description": "Whether to create individual check runs per configured check"
+        },
+        "name_prefix": {
+          "type": "string",
+          "description": "Custom name prefix for check runs"
+        }
+      },
+      "required": [
+        "enabled",
+        "per_check"
+      ],
+      "additionalProperties": false,
+      "description": "GitHub Check Runs output configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "HttpServerConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Whether HTTP server is enabled"
+        },
+        "port": {
+          "type": "number",
+          "description": "Port to listen on"
+        },
+        "host": {
+          "type": "string",
+          "description": "Host/IP to bind to (defaults to 0.0.0.0)"
+        },
+        "tls": {
+          "$ref": "#/definitions/TlsConfig",
+          "description": "TLS/SSL configuration for HTTPS"
+        },
+        "auth": {
+          "$ref": "#/definitions/HttpAuthConfig",
+          "description": "Authentication configuration"
+        },
+        "endpoints": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/HttpEndpointConfig"
+          },
+          "description": "HTTP endpoints configuration"
+        }
+      },
+      "required": [
+        "enabled",
+        "port"
+      ],
+      "additionalProperties": false,
+      "description": "HTTP server configuration for receiving webhooks",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "TlsConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable TLS/HTTPS"
+        },
+        "cert": {
+          "type": "string",
+          "description": "Path to TLS certificate file or certificate content"
+        },
+        "key": {
+          "type": "string",
+          "description": "Path to TLS key file or key content"
+        },
+        "ca": {
+          "type": "string",
+          "description": "Path to CA certificate file or CA content (optional)"
+        },
+        "rejectUnauthorized": {
+          "type": "boolean",
+          "description": "Reject unauthorized connections (default: true)"
+        }
+      },
+      "required": [
+        "enabled"
+      ],
+      "additionalProperties": false,
+      "description": "TLS/SSL configuration for HTTPS server",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "HttpAuthConfig": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "enum": [
+            "bearer_token",
+            "hmac",
+            "basic",
+            "none"
+          ],
+          "description": "Authentication type"
+        },
+        "secret": {
+          "type": "string",
+          "description": "Secret or token for authentication"
+        },
+        "username": {
+          "type": "string",
+          "description": "Username for basic auth"
+        },
+        "password": {
+          "type": "string",
+          "description": "Password for basic auth"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": false,
+      "description": "HTTP server authentication configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "HttpEndpointConfig": {
+      "type": "object",
+      "properties": {
+        "path": {
+          "type": "string",
+          "description": "Path for the webhook endpoint"
+        },
+        "transform": {
+          "type": "string",
+          "description": "Optional transform template (Liquid) for the received data"
+        },
+        "name": {
+          "type": "string",
+          "description": "Optional name/ID for this endpoint"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "additionalProperties": false,
+      "description": "HTTP server endpoint configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "MemoryConfig": {
+      "type": "object",
+      "properties": {
+        "storage": {
+          "type": "string",
+          "enum": [
+            "memory",
+            "file"
+          ],
+          "description": "Storage mode: \"memory\" (in-memory, default) or \"file\" (persistent)"
+        },
+        "format": {
+          "type": "string",
+          "enum": [
+            "json",
+            "csv"
+          ],
+          "description": "Storage format (only for file storage, default: json)"
+        },
+        "file": {
+          "type": "string",
+          "description": "File path (required if storage: file)"
+        },
+        "namespace": {
+          "type": "string",
+          "description": "Default namespace (default: \"default\")"
+        },
+        "auto_load": {
+          "type": "boolean",
+          "description": "Auto-load on startup (default: true if storage: file)"
+        },
+        "auto_save": {
+          "type": "boolean",
+          "description": "Auto-save after operations (default: true if storage: file)"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Memory storage configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "TagFilter": {
+      "type": "object",
+      "properties": {
+        "include": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Tags that checks must have to be included (ANY match)"
+        },
+        "exclude": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Tags that will exclude checks if present (ANY match)"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Tag filter configuration for selective check execution",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "RoutingDefaults": {
+      "type": "object",
+      "properties": {
+        "max_loops": {
+          "type": "number",
+          "description": "Per-scope cap on routing transitions (success + failure)"
+        },
+        "defaults": {
+          "type": "object",
+          "properties": {
+            "on_fail": {
+              "$ref": "#/definitions/OnFailConfig"
+            }
+          },
+          "additionalProperties": false,
+          "description": "Default policies applied to checks (step-level overrides take precedence)",
+          "patternProperties": {
+            "^x-": {}
+          }
+        }
+      },
+      "additionalProperties": false,
+      "description": "Global routing defaults",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "LimitsConfig": {
+      "type": "object",
+      "properties": {
+        "max_runs_per_check": {
+          "type": "number",
+          "description": "Maximum number of executions per check within a single engine run. Applies to each distinct scope independently for forEach item executions. Set to 0 or negative to disable. Default: 50."
+        },
+        "max_workflow_depth": {
+          "type": "number",
+          "description": "Maximum nesting depth for workflows executed by the state machine engine. Nested workflows are invoked by the workflow provider; this limit prevents accidental infinite recursion. Default: 3."
+        }
+      },
+      "additionalProperties": false,
+      "description": "Global engine limits",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "WorkspaceConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable workspace isolation (default: true when config present)"
+        },
+        "base_path": {
+          "type": "string",
+          "description": "Base path for workspaces (default: /tmp/visor-workspaces)"
+        },
+        "name": {
+          "type": "string",
+          "description": "Workspace directory name (defaults to session id)"
+        },
+        "main_project_name": {
+          "type": "string",
+          "description": "Main project folder name inside the workspace (defaults to original directory name)"
+        },
+        "cleanup_on_exit": {
+          "type": "boolean",
+          "description": "Clean up workspace on exit (default: true)"
+        },
+        "include_main_project": {
+          "type": "boolean",
+          "description": "Include main project worktree in AI allowed folders (default: false)"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Workspace isolation configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "Record<string,SandboxConfig>": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/SandboxConfig"
+      }
+    },
+    "SandboxConfig": {
+      "type": "object",
+      "properties": {
+        "engine": {
+          "type": "string",
+          "enum": [
+            "docker",
+            "bubblewrap",
+            "seatbelt"
+          ],
+          "description": "Sandbox engine type: 'docker' (default), 'bubblewrap' (Linux namespaces), or 'seatbelt' (macOS sandbox-exec)"
+        },
+        "image": {
+          "type": "string",
+          "description": "Docker image to use (e.g., \"node:20-alpine\")"
+        },
+        "dockerfile": {
+          "type": "string",
+          "description": "Path to Dockerfile (relative to config file or absolute)"
+        },
+        "dockerfile_inline": {
+          "type": "string",
+          "description": "Inline Dockerfile content"
+        },
+        "compose": {
+          "type": "string",
+          "description": "Path to docker-compose file"
+        },
+        "service": {
+          "type": "string",
+          "description": "Service name within the compose file"
+        },
+        "workdir": {
+          "type": "string",
+          "description": "Working directory inside container (default: /workspace)"
+        },
+        "env_passthrough": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Glob patterns for host env vars to forward into sandbox"
+        },
+        "network": {
+          "type": "boolean",
+          "description": "Enable/disable network access (default: true)"
+        },
+        "read_only": {
+          "type": "boolean",
+          "description": "Mount repo as read-only (default: false)"
+        },
+        "resources": {
+          "$ref": "#/definitions/SandboxResourceConfig",
+          "description": "Resource limits"
+        },
+        "visor_path": {
+          "type": "string",
+          "description": "Where visor is mounted inside container (default: /opt/visor)"
+        },
+        "cache": {
+          "$ref": "#/definitions/SandboxCacheConfig",
+          "description": "Cache volume configuration"
+        },
+        "bind_paths": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/SandboxBindPath"
+          },
+          "description": "Additional host paths to bind-mount into the sandbox"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Configuration for a single sandbox environment",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SandboxResourceConfig": {
+      "type": "object",
+      "properties": {
+        "memory": {
+          "type": "string",
+          "description": "Memory limit (e.g., \"512m\", \"2g\")"
+        },
+        "cpu": {
+          "type": "number",
+          "description": "CPU limit (e.g., 1.0, 0.5)"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Resource limits for sandbox containers",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SandboxCacheConfig": {
+      "type": "object",
+      "properties": {
+        "prefix": {
+          "type": "string",
+          "description": "Liquid template for cache scope prefix (default: git branch)"
+        },
+        "fallback_prefix": {
+          "type": "string",
+          "description": "Fallback prefix when current prefix has no cache"
+        },
+        "paths": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Paths inside the container to cache"
+        },
+        "ttl": {
+          "type": "string",
+          "description": "Time-to-live for cache volumes (e.g., \"7d\", \"24h\")"
+        },
+        "max_scopes": {
+          "type": "number",
+          "description": "Maximum number of cache scopes to keep"
+        }
+      },
+      "required": [
+        "paths"
+      ],
+      "additionalProperties": false,
+      "description": "Cache configuration for sandbox volumes",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SandboxBindPath": {
+      "type": "object",
+      "properties": {
+        "host": {
+          "type": "string",
+          "description": "Host path (supports ~ prefix for home directory)"
+        },
+        "container": {
+          "type": "string",
+          "description": "Container path (defaults to resolved host path)"
+        },
+        "read_only": {
+          "type": "boolean",
+          "description": "Mount as read-only (default: true)"
+        }
+      },
+      "required": [
+        "host"
+      ],
+      "additionalProperties": false,
+      "description": "Additional host path to bind-mount into the sandbox",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SandboxDefaults": {
+      "type": "object",
+      "properties": {
+        "env_passthrough": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Base env var patterns for all sandboxes (replaces hardcoded defaults when set)"
+        }
+      },
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SlackConfig": {
+      "type": "object",
+      "properties": {
+        "version": {
+          "type": "string",
+          "description": "Slack API version"
+        },
+        "mentions": {
+          "type": "string",
+          "description": "Mention handling: 'all', 'direct', etc."
+        },
+        "threads": {
+          "type": "string",
+          "description": "Thread handling: 'required', 'optional', etc."
+        },
+        "allow_bot_messages": {
+          "type": "boolean",
+          "description": "Allow bot_message events to trigger runs (default: false)"
+        },
+        "show_raw_output": {
+          "type": "boolean",
+          "description": "Show raw output in Slack responses"
+        },
+        "telemetry": {
+          "$ref": "#/definitions/SlackTelemetryConfig",
+          "description": "Append telemetry identifiers to Slack replies."
+        }
+      },
+      "additionalProperties": false,
+      "description": "Slack configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SlackTelemetryConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable telemetry ID suffix in Slack messages"
+        }
+      },
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "TelegramConfig": {
+      "type": "object",
+      "properties": {
+        "bot_token": {
+          "type": "string",
+          "description": "Bot token from"
+        },
+        "polling_timeout": {
+          "type": "number",
+          "description": "Polling timeout in seconds for getUpdates (default: 30)"
+        },
+        "chat_allowlist": {
+          "type": "array",
+          "items": {
+            "type": [
+              "string",
+              "number"
+            ]
+          },
+          "description": "Chat/group allowlist - numeric chat IDs that the bot responds in"
+        },
+        "require_mention": {
+          "type": "boolean",
+          "description": "In groups, only respond when"
+        },
+        "workflow": {
+          "type": "string",
+          "description": "Workflow to run when a message is received"
+        }
+      },
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "EmailConfig": {
+      "type": "object",
+      "properties": {
+        "receive": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "imap",
+                "resend"
+              ],
+              "description": "Backend type: 'imap' (universal) or 'resend' (managed webhook)"
+            },
+            "host": {
+              "type": "string",
+              "description": "IMAP server hostname"
+            },
+            "port": {
+              "type": "number",
+              "description": "IMAP server port (default: 993)"
+            },
+            "auth": {
+              "type": "object",
+              "properties": {
+                "user": {
+                  "type": "string"
+                },
+                "pass": {
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false,
+              "description": "IMAP auth credentials",
+              "patternProperties": {
+                "^x-": {}
+              }
+            },
+            "secure": {
+              "type": "boolean",
+              "description": "Use TLS (default: true)"
+            },
+            "poll_interval": {
+              "type": "number",
+              "description": "Polling interval in seconds when IDLE not available (default: 30)"
+            },
+            "folder": {
+              "type": "string",
+              "description": "IMAP folder to monitor (default: 'INBOX')"
+            },
+            "mark_read": {
+              "type": "boolean",
+              "description": "Mark processed messages as read (default: true)"
+            },
+            "api_key": {
+              "type": "string",
+              "description": "Resend API key (for type: 'resend')"
+            },
+            "webhook_secret": {
+              "type": "string",
+              "description": "Resend webhook secret for signature verification"
+            }
+          },
+          "additionalProperties": false,
+          "description": "Receive backend configuration",
+          "patternProperties": {
+            "^x-": {}
+          }
+        },
+        "send": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "smtp",
+                "resend"
+              ],
+              "description": "Backend type: 'smtp' (universal) or 'resend' (managed API)"
+            },
+            "host": {
+              "type": "string",
+              "description": "SMTP server hostname"
+            },
+            "port": {
+              "type": "number",
+              "description": "SMTP server port (default: 587)"
+            },
+            "auth": {
+              "type": "object",
+              "properties": {
+                "user": {
+                  "type": "string"
+                },
+                "pass": {
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false,
+              "description": "SMTP auth credentials",
+              "patternProperties": {
+                "^x-": {}
+              }
+            },
+            "secure": {
+              "type": "boolean",
+              "description": "Use TLS (default: true)"
+            },
+            "from": {
+              "type": "string",
+              "description": "Default sender address (e.g., \"Bot <bot@example.com>\")"
+            },
+            "api_key": {
+              "type": "string",
+              "description": "Resend API key (for type: 'resend')"
+            }
+          },
+          "additionalProperties": false,
+          "description": "Send backend configuration",
+          "patternProperties": {
+            "^x-": {}
+          }
+        },
+        "allowlist": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Only process emails from these senders"
+        },
+        "workflow": {
+          "type": "string",
+          "description": "Workflow to run when an email is received"
+        }
+      },
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "WhatsAppConfig": {
+      "type": "object",
+      "properties": {
+        "access_token": {
+          "type": "string",
+          "description": "WhatsApp Cloud API access token (or WHATSAPP_ACCESS_TOKEN env var)"
+        },
+        "phone_number_id": {
+          "type": "string",
+          "description": "Phone Number ID from Meta Business Suite (or WHATSAPP_PHONE_NUMBER_ID env var)"
+        },
+        "app_secret": {
+          "type": "string",
+          "description": "Meta App Secret for webhook signature verification (or WHATSAPP_APP_SECRET env var)"
+        },
+        "verify_token": {
+          "type": "string",
+          "description": "Verify token for webhook subscription challenge (or WHATSAPP_VERIFY_TOKEN env var)"
+        },
+        "api_version": {
+          "type": "string",
+          "description": "Graph API version (default: 'v21.0')"
+        },
+        "port": {
+          "type": "number",
+          "description": "Port for webhook HTTP server (default: 8443)"
+        },
+        "host": {
+          "type": "string",
+          "description": "Host for webhook HTTP server (default: '0.0.0.0')"
+        },
+        "phone_allowlist": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Phone number allowlist — only respond to these numbers"
+        },
+        "workflow": {
+          "type": "string",
+          "description": "Workflow to run when a message is received"
+        }
+      },
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "TeamsConfig": {
+      "type": "object",
+      "properties": {
+        "app_id": {
+          "type": "string",
+          "description": "Azure AD App (client) ID (or TEAMS_APP_ID env var)"
+        },
+        "app_password": {
+          "type": "string",
+          "description": "Azure AD App client secret (or TEAMS_APP_PASSWORD env var)"
+        },
+        "tenant_id": {
+          "type": "string",
+          "description": "Azure AD Tenant ID for single-tenant apps (or TEAMS_TENANT_ID env var)"
+        },
+        "port": {
+          "type": "number",
+          "description": "Port for webhook HTTP server (default: 3978)"
+        },
+        "host": {
+          "type": "string",
+          "description": "Host for webhook HTTP server (default: '0.0.0.0')"
+        },
+        "user_allowlist": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "User ID allowlist — only respond to these AAD user IDs"
+        },
+        "workflow": {
+          "type": "string",
+          "description": "Workflow to run when a message is received"
+        }
+      },
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SchedulerConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable/disable the scheduler (default: true)"
+        },
+        "storage": {
+          "type": "object",
+          "properties": {
+            "path": {
+              "type": "string",
+              "description": "Path to schedules JSON file (legacy, triggers auto-migration)"
+            },
+            "driver": {
+              "type": "string",
+              "enum": [
+                "sqlite",
+                "postgresql",
+                "mysql",
+                "mssql"
+              ],
+              "description": "Database driver (default: 'sqlite')"
+            },
+            "connection": {
+              "$ref": "#/definitions/SchedulerStorageConnectionConfig",
+              "description": "Database connection configuration"
+            }
+          },
+          "additionalProperties": false,
+          "description": "Storage configuration",
+          "patternProperties": {
+            "^x-": {}
+          }
+        },
+        "ha": {
+          "$ref": "#/definitions/SchedulerHAConfig",
+          "description": "High-availability configuration for multi-node deployments"
+        },
+        "limits": {
+          "$ref": "#/definitions/SchedulerLimitsConfig",
+          "description": "Limits for dynamic schedules"
+        },
+        "default_timezone": {
+          "type": "string",
+          "description": "Default timezone (IANA format, e.g., \"America/New_York\")"
+        },
+        "check_interval_ms": {
+          "type": "number",
+          "description": "Check interval in milliseconds (default: 60000)"
+        },
+        "permissions": {
+          "$ref": "#/definitions/SchedulerPermissionsConfig",
+          "description": "Permissions for dynamic schedule creation (via AI tool)"
+        },
+        "cron": {
+          "$ref": "#/definitions/Record%3Cstring%2CStaticCronJob%3E",
+          "description": "Static cron jobs defined in configuration (always executed)"
+        },
+        "on_message": {
+          "$ref": "#/definitions/Record%3Cstring%2CSlackMessageTrigger%3E",
+          "description": "Slack message triggers for reactive workflow execution"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Scheduler configuration for workflow scheduling",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SchedulerStorageConnectionConfig": {
+      "type": "object",
+      "properties": {
+        "filename": {
+          "type": "string",
+          "description": "SQLite database file path (default: '.visor/schedules.db')"
+        },
+        "host": {
+          "type": "string",
+          "description": "Database host (PostgreSQL/MySQL/MSSQL)"
+        },
+        "port": {
+          "type": "number",
+          "description": "Database port (PostgreSQL/MySQL/MSSQL)"
+        },
+        "database": {
+          "type": "string",
+          "description": "Database name (PostgreSQL/MySQL/MSSQL)"
+        },
+        "user": {
+          "type": "string",
+          "description": "Database user (PostgreSQL/MySQL/MSSQL)"
+        },
+        "password": {
+          "type": "string",
+          "description": "Database password (PostgreSQL/MySQL/MSSQL)"
+        },
+        "ssl": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/definitions/SchedulerSslConfig"
+            }
+          ],
+          "description": "SSL/TLS configuration (PostgreSQL/MySQL/MSSQL)"
+        },
+        "connection_string": {
+          "type": "string",
+          "description": "Connection string URL (e.g., postgresql://user:pass@host/db)"
+        },
+        "pool": {
+          "type": "object",
+          "properties": {
+            "min": {
+              "type": "number"
+            },
+            "max": {
+              "type": "number"
+            }
+          },
+          "additionalProperties": false,
+          "description": "Connection pool configuration",
+          "patternProperties": {
+            "^x-": {}
+          }
+        }
+      },
+      "additionalProperties": false,
+      "description": "Scheduler storage connection configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SchedulerSslConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable SSL (default: true when SslConfig object is provided)"
+        },
+        "reject_unauthorized": {
+          "type": "boolean",
+          "description": "Reject unauthorized certificates (default: true)"
+        },
+        "ca": {
+          "type": "string",
+          "description": "Path to CA certificate PEM file"
+        },
+        "cert": {
+          "type": "string",
+          "description": "Path to client certificate PEM file"
+        },
+        "key": {
+          "type": "string",
+          "description": "Path to client key PEM file"
+        }
+      },
+      "additionalProperties": false,
+      "description": "SSL/TLS configuration for scheduler database connections",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SchedulerHAConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable distributed locking for multi-node deployments (default: false)"
+        },
+        "node_id": {
+          "type": "string",
+          "description": "Unique node identifier (default: hostname-pid)"
+        },
+        "lock_ttl": {
+          "type": "number",
+          "description": "Lock time-to-live in seconds (default: 60)"
+        },
+        "heartbeat_interval": {
+          "type": "number",
+          "description": "Heartbeat interval for lock renewal in seconds (default: 15)"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Scheduler high-availability configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SchedulerLimitsConfig": {
+      "type": "object",
+      "properties": {
+        "max_per_user": {
+          "type": "number",
+          "description": "Maximum schedules per user (default: 25)"
+        },
+        "max_recurring_per_user": {
+          "type": "number",
+          "description": "Maximum recurring schedules per user (default: 10)"
+        },
+        "max_global": {
+          "type": "number",
+          "description": "Maximum total schedules (default: 1000)"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Scheduler limits configuration",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "SchedulerPermissionsConfig": {
+      "type": "object",
+      "properties": {
+        "allow_personal": {
+          "type": "boolean",
+          "description": "Allow personal schedules (via DM or CLI)"
+        },
+        "allow_channel": {
+          "type": "boolean",
+          "description": "Allow channel schedules (in Slack channels)"
+        },
+        "allow_dm": {
+          "type": "boolean",
+          "description": "Allow DM schedules (to specific users)"
+        },
+        "allowed_workflows": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of allowed workflow patterns (glob-style, e.g., \"report-*\")"
+        },
+        "denied_workflows": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of denied workflow patterns"
+        }
+      },
+      "additionalProperties": false,
+      "description": "Scheduler permissions for dynamic schedule creation",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "Record<string,StaticCronJob>": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/StaticCronJob"
+      }
+    },
+    "StaticCronJob": {
+      "type": "object",
+      "properties": {
+        "schedule": {
+          "type": "string",
+          "description": "Cron expression (e.g., \"0 9 * * 1\" for every Monday at 9am)"
+        },
+        "workflow": {
+          "type": "string",
+          "description": "Workflow/check ID to run"
+        },
+        "inputs": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Optional workflow inputs"
+        },
+        "output": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "slack",
+                "github",
+                "webhook",
+                "none"
+              ],
+              "description": "Output type: slack, github, webhook, or none"
+            },
+            "target": {
+              "type": "string",
+              "description": "Target (channel name, repo, URL)"
+            },
+            "thread_id": {
+              "type": "string",
+              "description": "Thread ID for threaded outputs"
+            }
+          },
+          "required": [
+            "type"
+          ],
+          "additionalProperties": false,
+          "description": "Output destination configuration",
+          "patternProperties": {
+            "^x-": {}
+          }
+        },
+        "description": {
+          "type": "string",
+          "description": "Description for logging/display"
+        },
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable/disable this job (default: true)"
+        },
+        "timezone": {
+          "type": "string",
+          "description": "Timezone for schedule (default: UTC or scheduler default)"
+        }
+      },
+      "required": [
+        "schedule",
+        "workflow"
+      ],
+      "additionalProperties": false,
+      "description": "Static cron job defined in YAML configuration These are always executed by the scheduler daemon",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "Record<string,SlackMessageTrigger>": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/SlackMessageTrigger"
+      }
+    },
+    "SlackMessageTrigger": {
+      "type": "object",
+      "properties": {
+        "channels": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Channel IDs to monitor (supports wildcard suffix, e.g., \"CENG*\")"
+        },
+        "from": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Only trigger on messages from these user IDs"
+        },
+        "from_bots": {
+          "type": "boolean",
+          "description": "Allow bot messages to trigger (default: false)"
+        },
+        "contains": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Keyword match - any keyword triggers (case-insensitive OR)"
+        },
+        "match": {
+          "type": "string",
+          "description": "Regex pattern to match against message text"
+        },
+        "threads": {
+          "type": "string",
+          "enum": [
+            "root_only",
+            "thread_only",
+            "any"
+          ],
+          "description": "Thread scope filter (default: 'any')"
+        },
+        "workflow": {
+          "type": "string",
+          "description": "Workflow/check ID to execute"
+        },
+        "inputs": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E",
+          "description": "Optional workflow inputs"
+        },
+        "output": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "slack",
+                "github",
+                "webhook",
+                "none"
+              ],
+              "description": "Output type: slack, github, webhook, or none"
+            },
+            "target": {
+              "type": "string",
+              "description": "Target (channel name, repo, URL)"
+            },
+            "thread_id": {
+              "type": "string",
+              "description": "Thread ID for threaded outputs"
+            }
+          },
+          "required": [
+            "type"
+          ],
+          "additionalProperties": false,
+          "description": "Output destination configuration",
+          "patternProperties": {
+            "^x-": {}
+          }
+        },
+        "description": {
+          "type": "string",
+          "description": "Description for logging/display"
+        },
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable/disable this trigger (default: true)"
+        }
+      },
+      "required": [
+        "workflow"
+      ],
+      "additionalProperties": false,
+      "description": "Slack message trigger for reactive workflow execution Triggers workflows based on Slack messages matching configured filters",
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "PolicyConfig": {
+      "type": "object",
+      "properties": {
+        "engine": {
+          "type": "string",
+          "enum": [
+            "local",
+            "remote",
+            "disabled"
+          ],
+          "description": "Policy engine mode"
+        },
+        "rules": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "description": "Path to .rego files or .wasm bundle (local mode)"
+        },
+        "data": {
+          "type": "string",
+          "description": "Path to a JSON file to load as OPA data document"
+        },
+        "url": {
+          "type": "string",
+          "description": "OPA server URL (remote mode)"
+        },
+        "fallback": {
+          "type": "string",
+          "enum": [
+            "allow",
+            "deny",
+            "warn"
+          ],
+          "description": "Default decision when policy evaluation fails"
+        },
+        "timeout": {
+          "type": "number",
+          "description": "Evaluation timeout in ms (default: 5000)"
+        },
+        "roles": {
+          "$ref": "#/definitions/Record%3Cstring%2CPolicyRoleConfig%3E",
+          "description": "Role definitions: map role names to conditions"
+        }
+      },
+      "required": [
+        "engine"
+      ],
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "Record<string,PolicyRoleConfig>": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/PolicyRoleConfig"
+      }
+    },
+    "PolicyRoleConfig": {
+      "type": "object",
+      "properties": {
+        "author_association": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "GitHub author associations that map to this role"
+        },
+        "teams": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "GitHub team slugs (requires GitHub API)"
+        },
+        "users": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Explicit GitHub usernames"
+        },
+        "slack_users": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Slack user IDs (e.g., [\"U0123ABC\"])"
+        },
+        "emails": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Email addresses for identity matching (e.g., [\"alice@co.com\"])"
+        },
+        "slack_channels": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Slack channel IDs — role only applies when triggered from these channels"
+        }
+      },
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "AgentProtocolConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "protocol": {
+          "type": "string"
+        },
+        "agent_card": {
+          "type": "string"
+        },
+        "agent_card_inline": {
+          "$ref": "#/definitions/AgentCard"
+        },
+        "public_url": {
+          "type": "string"
+        },
+        "port": {
+          "type": "number"
+        },
+        "host": {
+          "type": "string"
+        },
+        "tls": {
+          "$ref": "#/definitions/AgentProtocolTlsConfig"
+        },
+        "auth": {
+          "$ref": "#/definitions/AgentProtocolAuthConfig"
+        },
+        "default_workflow": {
+          "type": "string"
+        },
+        "skill_routing": {
+          "$ref": "#/definitions/Record%3Cstring%2Cstring%3E"
+        },
+        "task_ttl": {
+          "type": "string"
+        },
+        "queue": {
+          "$ref": "#/definitions/AgentProtocolQueueConfig"
+        }
+      },
+      "required": [
+        "enabled",
+        "protocol"
+      ],
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "AgentCard": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "description": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        },
+        "provider": {
+          "type": "object",
+          "properties": {
+            "organization": {
+              "type": "string"
+            },
+            "url": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "organization"
+          ],
+          "additionalProperties": false,
+          "patternProperties": {
+            "^x-": {}
+          }
+        },
+        "supported_interfaces": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "url": {
+                "type": "string"
+              },
+              "protocol_binding": {
+                "type": "string"
+              },
+              "protocol_version": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "url"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "capabilities": {
+          "$ref": "#/definitions/AgentCapabilities"
+        },
+        "default_input_modes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "default_output_modes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "security_schemes": {
+          "$ref": "#/definitions/Record%3Cstring%2Cunknown%3E"
+        },
+        "security_requirements": {
+          "type": "array",
+          "items": {}
+        },
+        "skills": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AgentSkill"
+          }
+        },
+        "icon_url": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "AgentCapabilities": {
+      "type": "object",
+      "properties": {
+        "streaming": {
+          "type": "boolean"
+        },
+        "push_notifications": {
+          "type": "boolean"
+        },
+        "extensions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "extended_agent_card": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "AgentSkill": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        },
+        "description": {
+          "type": "string"
+        },
+        "tags": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "examples": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "input_modes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "output_modes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "required": [
+        "id",
+        "name",
+        "description"
+      ],
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "AgentProtocolTlsConfig": {
+      "type": "object",
+      "properties": {
+        "cert": {
+          "type": "string"
+        },
+        "key": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "cert",
+        "key"
+      ],
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "AgentProtocolAuthConfig": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "enum": [
+            "bearer",
+            "api_key",
+            "none"
+          ]
+        },
+        "token_env": {
+          "type": "string"
+        },
+        "header_name": {
+          "type": "string"
+        },
+        "param_name": {
+          "type": "string"
+        },
+        "key_env": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    },
+    "AgentProtocolQueueConfig": {
+      "type": "object",
+      "properties": {
+        "poll_interval": {
+          "type": "number"
+        },
+        "max_concurrent": {
+          "type": "number"
+        },
+        "stale_claim_timeout": {
+          "type": "number"
+        }
+      },
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      }
+    }
+  }
+}