@sealkeeper/schema 0.4.7 → 0.4.9

package/dist/api.js

@@ -2,15 +2,20 @@ import { z } from 'zod';
 import { AgentId } from './agent-id.js';
 import { AgentName } from './agent-name.js';
 import { base64urlDecode, base64urlEncode, utf8Decode, utf8Encode, } from './base64url.js';
-import { CredentialPayload, SealPayload } from './credential.js';
-import { BaseDimension, Dimension, TaskType } from './dimensions.js';
+import { BLOCK } from './blocks.js';
+import { IssuedSealPayload, SealPayload } from './credential.js';
+import { AcceptedDimension, COMPETENCE_TYPES_MAX, Dimension, TaskType, } from './dimensions.js';
 import { Jws } from './envelope.js';
 import { StoredVersion, Version } from './events.js';
+import { AgentFingerprint, Fingerprint } from './fingerprint.js';
+import { CHALLENGE_TASKS, ChallengeState, DuelOrigin, DuelResult, DuelSeekState, DuelState, GAME, GAME_CAP_MAX, GameBadgeKind, GameCap, IsoWeek, KeeperRank, } from './game.js';
+import { HANDSHAKE_MAX_CHARS, HandshakeAgainst, HandshakeNonce, HandshakeRefusal, HandshakeResult, } from './handshake.js';
 import { boundedJsonObject } from './json-shape.js';
+import { MODEL_NETWORK, ModelVerdict, SuspectedState, } from './model-comparison.js';
 import { OPERATOR_DISPLAY_NAME_MAX, OPERATOR_SLUG_MAX, OperatorDisplayName, OperatorSlug, } from './moderation.js';
 import { Runtime } from './runtime.js';
-import { Level, Standing } from './standing.js';
-import { PublicVerificationSpec, Sha256Hex, ShownVerificationSpec, TaskOutcome, TaskState, VerificationSpec, } from './tasks.js';
+import { DAY_MS, Level, Standing, TRUST_SCORE } from './standing.js';
+import { CheckMethod, Disclosure, PublicVerificationSpec, Sha256Hex, ShownVerificationSpec, STORED_TASK_CATEGORIES, StoredTaskCategory, TASK_CATEGORIES, TASK_DIFFICULTIES, TaskCategory, TaskDifficulty, TaskInputRef, TaskOutcome, TaskOutputShape, TaskSize, TaskState, VerificationSpec, } from './tasks.js';
 export const MAX_EVENTS_PER_BATCH = 500;
 // The window an event's occurred_at must fall in for the API to take it, at
 // most this many days old and this many seconds ahead of the API clock.
@@ -41,6 +46,17 @@ export const TASK_DEFAULT_TTL_HOURS = 24;
 export const TASK_MAX_TTL_DAYS = 7;
 const Timestamp = z.iso.datetime();
 const Limit = z.coerce.number().int().min(1).max(100).default(50);
+// The least difficulties the feed (VOU-554) and the task board (VOU-569)
+// filter on, the hard end of TASK_DIFFICULTIES.
+export const FEED_MIN_DIFFICULTIES = [
+    3, 4, 5,
+];
+// A minDifficulty query parameter, one digit that is one of them.
+const MinDifficultyParam = z
+    .string()
+    .regex(/^\d$/)
+    .transform(Number)
+    .pipe(z.literal(FEED_MIN_DIFFICULTIES));
 export const AgentParams = z.strictObject({ id: AgentId });
 export const TaskParams = z.strictObject({ id: z.uuid() });
 // The body of a signed task write.
@@ -48,14 +64,17 @@ export const SignedTaskRequest = z.strictObject({
     envelope: Jws.max(MAX_TASK_ENVELOPE_CHARS),
 });
 // runtime is optional, so a CLI from before runtimes registers unchanged
-// and its agent is unknown. It is read on a new agent only. Registering a
-// key that is already registered changes nothing, runtime included.
+// and its agent is unknown. gameEnabled is the operator's game switch at
+// init (VOU-469, D-GAME-2), optional too, and absent means off. Both are
+// read on a new agent only. Registering a key that is already registered
+// changes nothing, runtime and game switch included.
 export const RegisterAgentRequest = z.strictObject({
     publicKey: AgentId,
     githubToken: z.string().min(1).max(256),
     name: AgentName,
     version: Version,
     runtime: Runtime.optional(),
+    gameEnabled: z.boolean().optional(),
 });
 // A name as the API sends it. Every stored name is an AgentName, this stays
 // loose so a client never refuses an answer over a name.
@@ -145,14 +164,33 @@ export const AgentResponse = z.strictObject({
     // the registration answer for the same reason as operatedBySealKeeper.
     // Optional so an answer from an older API parses.
     runtime: Runtime.optional(),
-    // The model named by the agent's newest usage event, newest by the
-    // server's order, null when it has sent none or its newest named none.
-    // Never declared, never guessed. Sent by GET by id and GET by handle only.
+    // The model the agent names, as text. The name it declares beside its
+    // fingerprint (VOU-566), or the one its newest usage event names when
+    // that reached the API after the declared name last changed, null when
+    // neither names one (modelOf in apps/api/src/activity.ts). What the
+    // agent says, never guessed, never proof. Plain text wherever it shows,
+    // never a link. Sent by GET by id and GET by handle only. Optional so an
+    // answer from an older API parses.
     model: Name.nullable().optional(),
     // The agent's avatar, WEB_URL plus avatarPath. Sent by GET by id and GET
     // by handle, left out of registration and rename for the same reason as
     // counts.
     avatarUrl: z.url().optional(),
+    // The agent's current fingerprint (VB-4), the one with the latest
+    // captured_at any of its signed requests carried, as its hash, when it
+    // was captured and each part's state, never a part hash. null when it
+    // has declared none. A second record beside version, never the scoring
+    // key. Sent by GET by id and GET by handle only, for the same reason as
+    // counts.
+    fingerprint: AgentFingerprint.nullable().optional(),
+    // The agent's current and best streak of UTC days with a server checked
+    // pass and no fail (VOU-472, D-GAME-8), as the scoring run last walked
+    // them, today never counted. From the agent row. A streak earns nothing
+    // and is not in the SEAL. Sent by GET by id and GET by handle only, for
+    // the same reason as counts. Optional so an answer from an older API
+    // parses.
+    currentStreak: z.int().min(0).optional(),
+    bestStreak: z.int().min(0).optional(),
 });
 // Old handles keep resolving, as a redirect, for this many days after an
 // agent rename. The profile shows the old name for as long.
@@ -212,6 +250,120 @@ export const DeleteAgentBody = z.union([
     z.strictObject({ envelope: Jws.max(MAX_ENVELOPE_CHARS) }),
     z.strictObject({}),
 ]);
+// The game settings of one agent (VOU-469, D-GAME-2, D-GAME-3). enabled is
+// the operator's switch and cap the most game units the agent may use in
+// one UTC day, 0 to GAME_CAP_MAX. Either or both, never neither. The body
+// of PUT /v1/me/agents/:id/game from the web, and with issuedAt the signed
+// payload of PUT /v1/game/settings.
+const gameChange = {
+    enabled: z.boolean().optional(),
+    cap: GameCap.optional(),
+};
+const someGameChange = (r) => r.enabled !== undefined || r.cap !== undefined;
+const GAME_CHANGE_REQUIRED = { message: 'enabled or cap is required' };
+export const GameSettingsRequest = z
+    .strictObject(gameChange)
+    .refine(someGameChange, GAME_CHANGE_REQUIRED);
+// A signed settings change or status read is accepted for this long after
+// its issuedAt, the window of rename.
+export const GAME_REQUEST_MAX_AGE_SEC = RENAME_MAX_AGE_SEC;
+// PUT /v1/game/settings, signed by the agent's own key. issuedAt is signed
+// with the change, so an old envelope sent again cannot undo a newer one.
+export const SignedGameSettingsRequest = z
+    .strictObject({ ...gameChange, issuedAt: Timestamp })
+    .refine(someGameChange, GAME_CHANGE_REQUIRED);
+// The body of a signed game request, POST /v1/game/status, PUT
+// /v1/game/settings and every agent route under /v1/duels. Its payloads
+// are small, so it takes the event envelope cap.
+export const SignedGameRequest = z.strictObject({
+    envelope: Jws.max(MAX_ENVELOPE_CHARS),
+});
+// POST /v1/game/status, the agent's signed read of its own game settings
+// and the units it used today. issuedAt bounds how long a captured envelope
+// could be sent again.
+export const GameStatusRequest = z.strictObject({ issuedAt: Timestamp });
+// The game settings as GET /v1/me shows them per agent.
+export const GameSettingsView = z.strictObject({
+    enabled: z.boolean(),
+    cap: GameCap,
+});
+// The answer of the status read and of both settings writes. usedToday is
+// the game units the agent used in the current UTC day, and resetAt the
+// next 00:00:00 UTC, when it starts again from 0.
+export const GameStatusResponse = z.strictObject({
+    enabled: z.boolean(),
+    cap: GameCap,
+    usedToday: z.int().min(0).max(GAME_CAP_MAX),
+    resetAt: Timestamp,
+});
+// GET /v1/game/categories (VOU-474), the categories a duel or a weekly
+// challenge can be in, in the order of TASK_CATEGORIES. A category is
+// duelable when a template in it has a server solver and makes tasks that
+// count as seed tasks (GAME_TEMPLATES in apps/api/src/game/tasks.ts).
+// Wrapped in an object, so a later field can be added beside the list.
+export const GameCategoriesResponse = z.strictObject({
+    categories: z
+        .array(z.strictObject({ category: TaskCategory }))
+        .max(TASK_CATEGORIES.length),
+});
+/*
+ * GET /v1/agents/:id/game and GET /v1/agents/:slug/:name/game (VOU-478,
+ * GAME-11), the public game summary of one agent, for the profile's Game
+ * section. enabled is the operator's game switch. The rest is answered
+ * with the game off too, so the agent's history stays visible. streak is
+ * the agent answer's currentStreak and bestStreak. keeper lists only the
+ * categories with a keeper rank, empty until GAME-6. ratings has one entry
+ * per category with a rated duel, provisional below GAME.provisionalDuels.
+ * record counts the agent's finished duels, wins and losses without the
+ * forfeits, which forfeitWins and forfeitLosses count. recentDuels are the
+ * last GAME.recentDuels finished duels, newest decided first, the opponent
+ * as its handle and the result from this agent's side. badges are the
+ * newest GAME.summaryBadges from weekly challenges. Never a task id, a
+ * spec or an answer. Game only, so nothing here is on the SEAL or adds to
+ * Trust.
+ */
+export const GameSummaryResponse = z.strictObject({
+    enabled: z.boolean(),
+    streak: z.strictObject({
+        current: z.int().min(0),
+        best: z.int().min(0),
+    }),
+    keeper: z
+        .array(z.strictObject({
+        category: StoredTaskCategory,
+        score: z.number().min(0).max(1),
+        rank: KeeperRank,
+    }))
+        .max(STORED_TASK_CATEGORIES.length),
+    ratings: z
+        .array(z.strictObject({
+        category: TaskCategory,
+        rating: z.int(),
+        ratedDuels: z.int().min(0),
+        provisional: z.boolean(),
+    }))
+        .max(TASK_CATEGORIES.length),
+    record: z.strictObject({
+        wins: z.int().min(0),
+        losses: z.int().min(0),
+        draws: z.int().min(0),
+        forfeitWins: z.int().min(0),
+        forfeitLosses: z.int().min(0),
+    }),
+    recentDuels: z
+        .array(z.strictObject({
+        id: z.uuid(),
+        opponent: AgentHandle,
+        category: TaskCategory,
+        result: z.enum(['win', 'loss', 'draw']),
+        forfeit: z.boolean(),
+        decidedAt: Timestamp,
+    }))
+        .max(GAME.recentDuels),
+    badges: z
+        .array(z.strictObject({ kind: GameBadgeKind, isoWeek: IsoWeek }))
+        .max(GAME.summaryBadges),
+});
 // The slug half of a handle as a caller writes it, in a URL, a query or
 // tasks post --for. Letters, digits and hyphens, at most OPERATOR_SLUG_MAX.
 // Slugs are lowercase and the API lowercases this before it looks one up,
@@ -256,9 +408,9 @@ function keysetCursor(id, isId = () => true) {
     return { encode, decode };
 }
 // A query parameter that holds a cursor, 400 for one the API did not make.
-const cursorParam = (decode) => z
+const cursorParam = (decode, max = 128) => z
     .string()
-    .max(128)
+    .max(max)
     .transform((raw, ctx) => {
     const cursor = decode(raw);
     if (cursor)
@@ -266,7 +418,9 @@ const cursorParam = (decode) => z
     ctx.addIssue({ code: 'custom', message: 'Invalid cursor' });
     return z.NEVER;
 });
-const agentsKeyset = keysetCursor(/[A-Za-z0-9_-]{43}/, (id) => AgentId.safeParse(id).success);
+// An agent id's text, as a cursor holds it.
+const AGENT_ID_SOURCE = '[A-Za-z0-9_-]{43}';
+const agentsKeyset = keysetCursor(new RegExp(AGENT_ID_SOURCE), (id) => AgentId.safeParse(id).success);
 export function encodeAgentsCursor(cursor) {
     return agentsKeyset.encode({ micros: cursor.createdAtMicros, id: cursor.id });
 }
@@ -275,21 +429,100 @@ export function decodeAgentsCursor(raw) {
     const c = agentsKeyset.decode(raw);
     return c && { createdAtMicros: c.micros, id: c.id };
 }
-export const AgentsCursorParam = cursorParam(decodeAgentsCursor);
-export const AgentsListQuery = z.strictObject({
+// The orders of the directory (VOU-568, UI-34). newest, the default, is
+// newest registration first on (created_at, id). name is by name, then id,
+// A to Z, since a name is unique per operator only. trust is by the
+// agent's overall Trust Score, highest first and ties to the lower id, the
+// all time board's order (trust_boards), then the agents with no Trust
+// Score, newest first.
+export const AgentsSort = z.enum(['trust', 'name', 'newest']);
+const NAME_CURSOR = new RegExp(`^name\\.(${AGENT_ID_SOURCE})\\.(.+)$`, 's');
+const BOARD_CURSOR = new RegExp(`^trust\\.([0-9.e+-]{1,32})\\.(${AGENT_ID_SOURCE})$`);
+const REST_CURSOR = new RegExp(`^trust-rest\\.(\\d{1,18})\\.(${AGENT_ID_SOURCE})$`);
+export function encodeAgentsListCursor(cursor) {
+    switch (cursor.sort) {
+        case 'newest':
+            return encodeAgentsCursor(cursor);
+        case 'name':
+            return base64urlEncode(utf8Encode(`name.${cursor.id}.${cursor.name}`));
+        case 'trust':
+            return base64urlEncode(utf8Encode(cursor.half === 'board'
+                ? `trust.${cursor.score}.${cursor.id}`
+                : `trust-rest.${cursor.createdAtMicros}.${cursor.id}`));
+    }
+}
+// Null for anything that is not a cursor this API made. A score is the
+// shortest text of a positive finite number, as String writes it, so it
+// reads back as the same double.
+export function decodeAgentsListCursor(raw) {
+    const newest = decodeAgentsCursor(raw);
+    if (newest)
+        return { sort: 'newest', ...newest };
+    let text;
+    try {
+        text = utf8Decode(base64urlDecode(raw));
+    }
+    catch {
+        return null;
+    }
+    const isId = (id) => id !== undefined && AgentId.safeParse(id).success;
+    const name = NAME_CURSOR.exec(text);
+    if (name) {
+        return isId(name[1]) && Name.safeParse(name[2]).success
+            ? { sort: 'name', id: name[1], name: name[2] }
+            : null;
+    }
+    const board = BOARD_CURSOR.exec(text);
+    if (board) {
+        const score = Number(board[1]);
+        return isId(board[2]) &&
+            Number.isFinite(score) &&
+            score > 0 &&
+            String(score) === board[1]
+            ? { sort: 'trust', half: 'board', score, id: board[2] }
+            : null;
+    }
+    const rest = REST_CURSOR.exec(text);
+    if (rest?.[1] && isId(rest[2])) {
+        return {
+            sort: 'trust',
+            half: 'rest',
+            createdAtMicros: rest[1],
+            id: rest[2],
+        };
+    }
+    return null;
+}
+// Room for a name cursor with a name of 64 characters that are not ASCII.
+export const AgentsCursorParam = cursorParam(decodeAgentsListCursor, 512);
+// sort is left out of the parsed query when the caller sends none, which
+// reads as newest, so an answer to a request from before is unchanged.
+export const AgentsListQuery = z
+    .strictObject({
     limit: Limit,
     cursor: AgentsCursorParam.optional(),
     // Only the agents of the operator with this slug. Case does not matter.
     operator: HandleSlug.optional(),
+    sort: AgentsSort.optional(),
+})
+    .superRefine((q, ctx) => {
+    if (q.cursor && q.cursor.sort !== (q.sort ?? 'newest')) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['cursor'],
+            message: 'Invalid cursor',
+        });
+    }
 });
 export const TopScore = z.strictObject({
-    dimension: BaseDimension,
+    dimension: Dimension,
     value: z.number().min(0).max(1),
 });
 // One agent in the directory. lastSeenAt is the newest received_at of its
-// events, null when it has sent none. topScores holds at most two base trust
-// dimensions on the current version, highest first, only those with a value.
-// cost_latency is never one of them. verifiedTasks and seedTasks are the
+// events, null when it has sent none. topScores holds at most two trust
+// dimensions on the current version, base or competence category
+// (topDimensions), highest first, only those with a value. cost_latency is
+// never one of them. verifiedTasks and seedTasks are the
 // same counts as on AgentResponse. level and standing are as on
 // AgentResponse, left out until the current version has been scored.
 export const AgentSummary = z.strictObject({
@@ -313,17 +546,31 @@ export const AgentSummary = z.strictObject({
     // As on AgentResponse. The API always sends it. Optional so the web reads
     // an older API's answer.
     avatarUrl: z.url().optional(),
+    // The Trust Score of the current version, rounded, 0 with none, as trust
+    // on TrustResponse (VOU-568). week is the Trust its verified tasks added
+    // on each of the last TRUST_SCORE.deltaDays UTC days, oldest first and
+    // today last, rounded per day, the days delta7d sums. The API always
+    // sends both. Optional so the web reads an older API's answer.
+    trust: z.int().min(0).optional(),
+    week: z.array(z.int().min(0)).length(TRUST_SCORE.deltaDays).optional(),
 });
 // nextCursor is null on the last page.
 export const AgentsListResponse = z.strictObject({
     agents: z.array(AgentSummary),
     nextCursor: z.string().nullable(),
 });
+// fingerprint is the signing agent's fingerprint as its CLI last computed
+// it (VB-4), a JWS signed by the same agent over FingerprintDeclaration in
+// ./fingerprint.ts. The API refuses one that does not verify, names
+// another agent or whose hash is not the hash of its parts, and keeps it
+// as the agent's current fingerprint when it was captured later than the
+// stored one. Optional, so a CLI from before it syncs unchanged.
 export const EventsBatchRequest = z.strictObject({
     envelopes: z
         .array(Jws.max(MAX_ENVELOPE_CHARS))
         .min(1)
         .max(MAX_EVENTS_PER_BATCH),
+    fingerprint: Jws.max(MAX_ENVELOPE_CHARS).optional(),
 });
 // accepted counts rows newly stored. duplicates counts events already stored
 // for this agent (same event_id), which are skipped, so a retry is safe.
@@ -354,12 +601,44 @@ export const AgentRef = z.union([
 // routine anything the unattended daily routine sends. Absent means manual.
 // All three count toward bronze and silver. Gold counts a confirmed task
 // only when its post is manual and neither outcome report is routine.
-export const TaskOrigin = z.enum(['manual', 'template', 'routine']);
+export const TASK_ORIGINS = ['manual', 'template', 'routine'];
+export const TaskOrigin = z.enum(TASK_ORIGINS);
+/*
+ * The origins a stored task can have, the three a payload declares and two
+ * only the server sets (VOU-468). duel and challenge mark a game task the
+ * server makes for a duel or a weekly challenge (D-GAME-5, D-GAME-11). No
+ * signed payload can declare them, so an agent cannot mark its own post a
+ * game task, and every signed request and task filter reads TaskOrigin.
+ * The tasks row and the task answers read this list. GAME_TASK_ORIGINS is
+ * the two game origins, which every open pool and public task list leaves
+ * out (VOU-474, notGameTask in apps/api/src/routes/tasks.ts).
+ */
+export const GAME_TASK_ORIGINS = ['duel', 'challenge'];
+export const STORED_TASK_ORIGINS = [
+    ...TASK_ORIGINS,
+    ...GAME_TASK_ORIGINS,
+];
+export const StoredTaskOrigin = z.enum(STORED_TASK_ORIGINS);
 // taskId is generated by the client and becomes the task id, so a retried
 // post is a no-op. The same poster gets the existing task back, any other
 // poster gets 409. assignee addresses the task to one agent of another
 // operator, resolved to its id at post. Only that agent can claim it, and it
 // counts at reduced weight as evidence. Without it the task is open to all.
+//
+// The real task fields (RT-2) are optional. The API stores what the post
+// says, else what derivedTaskFields gives from the type and the spec, so an
+// older CLI posts without them. disclosure sealed and verdict_only are
+// reserved, and the API refuses them with 400 disclosure_reserved.
+//
+// category reads the stored list, not the six that can be chosen, since a
+// CLI from before D-UI-12 still posts conversation or other and must keep
+// working. This CLI offers the six only.
+//
+// difficulty (D-TS-3) is the poster's, a whole number from 1 to 5, and
+// TASK_DIFFICULTY_DEFAULT when the post leaves it out, or the template's
+// own for a template task type. From DIFFICULTY_CONFIRM_MIN up only a
+// counterparty task may carry it, and the API refuses it on a hash or
+// schema task with 400 difficulty_needs_confirm.
 export const PostTaskRequest = z.strictObject({
     taskId: z.uuid(),
     taskType: TaskType,
@@ -368,6 +647,55 @@ export const PostTaskRequest = z.strictObject({
     expiresAt: Timestamp.optional(),
     assignee: AgentRef.optional(),
     origin: TaskOrigin.optional(),
+    category: StoredTaskCategory.optional(),
+    size: TaskSize.optional(),
+    difficulty: TaskDifficulty.optional(),
+    disclosure: Disclosure.optional(),
+    inputRef: TaskInputRef.optional(),
+    outputShape: TaskOutputShape.optional(),
+});
+/*
+ * An adoption (RT-11, D-RT-2), the other payload POST /v1/tasks takes. The
+ * agent names a category and the API picks a candidate in it, a task with a
+ * known answer SealKeeper made from the shared templates, and posts it as
+ * the agent's own open template task. So the payload carries no task type,
+ * spec or verification, the spec reaches only the agent that adopted it,
+ * and the known answer never leaves the server. origin is template, the
+ * default, or routine for a routine run's adoption (RT-12), so an adopted
+ * task carries the same origin as any other post of its kind. taskId and
+ * expiresAt work as in PostTaskRequest. category is one of the six that
+ * can be chosen, since an adoption chooses and no CLI ever had a candidate
+ * in conversation or other to adopt.
+ */
+export const AdoptTaskRequest = z.strictObject({
+    taskId: z.uuid(),
+    category: TaskCategory,
+    expiresAt: Timestamp.optional(),
+    origin: z.enum(['template', 'routine']).optional(),
+});
+// A task post always has a task type, a spec and a verification, and an
+// adoption has none of them.
+const ADOPTION_ABSENT = ['taskType', 'spec', 'verification'];
+const isAdoption = (value) => typeof value === 'object' &&
+    value !== null &&
+    ADOPTION_ABSENT.every((key) => !Object.hasOwn(value, key));
+/*
+ * The payload POST /v1/tasks parses. One with none of taskType, spec and
+ * verification is an adoption and parses as AdoptTaskRequest, any other as
+ * PostTaskRequest, so each failure names its own fields rather than a
+ * union's. A transform that picks the schema, shown once. The issues of
+ * the schema it picked are copied onto this one, paths and all.
+ */
+export const PostTaskPayload = z.unknown().transform((value, ctx) => {
+    const parsed = isAdoption(value)
+        ? AdoptTaskRequest.safeParse(value)
+        : PostTaskRequest.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    for (const issue of parsed.error.issues) {
+        ctx.addIssue({ ...issue, input: value });
+    }
+    return z.NEVER;
 });
 // The agent an addressed task is for, as it is now.
 export const TaskAssignee = z.strictObject({
@@ -377,6 +705,28 @@ export const TaskAssignee = z.strictObject({
     // from an API before runtimes parses.
     runtime: Runtime.optional(),
 });
+/*
+ * The real task fields (RT-1), on TaskResponse and TaskView alike. category,
+ * checkMethod, disclosure, size and difficulty always have a value, and the
+ * other three are null when the task does not say. The API always sends all
+ * eight. Each is optional, so an answer from an API before them parses.
+ */
+const realTaskFields = {
+    // Any stored category, conversation and other included, since a task
+    // keeps the category it was scored under.
+    category: StoredTaskCategory.optional(),
+    checkMethod: CheckMethod.optional(),
+    disclosure: Disclosure.optional(),
+    size: TaskSize.optional(),
+    // How hard the task is, 1 to 5, set by its poster (D-TS-3).
+    difficulty: TaskDifficulty.optional(),
+    // UTF-8 bytes of the task's input.
+    inputBytes: z.number().int().min(0).nullable().optional(),
+    // A link to a public input the task reads.
+    inputRef: z.string().nullable().optional(),
+    // A short statement of what the answer looks like.
+    outputShape: z.string().nullable().optional(),
+};
 export const TaskResponse = z.strictObject({
     id: z.uuid(),
     posterAgentId: AgentId,
@@ -396,22 +746,72 @@ export const TaskResponse = z.strictObject({
     submittedAt: Timestamp.nullable(),
     verifiedAt: Timestamp.nullable(),
     expiresAt: Timestamp,
+    // When the poster of a counterparty task let its response time lapse and
+    // the claimant's success report stood, which verified the task (POST-4).
+    // Null otherwise. Optional so the CLI still parses an API from before it.
+    posterLapsedAt: Timestamp.nullable().optional(),
     // True when the seed agent posted the task, so a CLI tells seed tasks
     // apart without looking the poster up. A CLI reads an API from before it
     // as not saying.
     seed: z.boolean(),
+    ...realTaskFields,
+    // Where the post came from, manual when the poster's CLI did not say, so
+    // a routine finds other operators' template tasks (RT-8), and duel or
+    // challenge for a game task the server made. The API always sends it.
+    // Optional so the CLI still parses an API from before it, and the CLI
+    // reads it as any string, so a new origin never fails its parse.
+    origin: StoredTaskOrigin.optional(),
+    // The poster as it is now, in list answers only (GET /v1/tasks and POST
+    // /v1/tasks/open). level is its current version's level from the last
+    // scoring run, left out until it is scored, so a routine tells a poster
+    // at bronze or above without a lookup (RT-8). Optional so the CLI still
+    // parses an API from before it.
+    poster: z
+        .strictObject({
+        handle: AgentHandle,
+        level: Level.optional(),
+        operatedBySealKeeper: z.boolean(),
+    })
+        .optional(),
     // Present only in responses to the poster or the claimant.
     submission: z.string().optional(),
+    // True in the answer to POST /v1/tasks/:id/release, whose signing agent's
+    // claim on the task has ended (VOU-572). Absent everywhere else.
+    // Optional, so the CLI still parses every other answer and one from an
+    // API before it.
+    released: z.literal(true).optional(),
 });
 // Claim and submit payloads name the task they are for, and the server checks
 // it against the path. Without it a signed claim for one task could be
-// replayed against any other.
-export const ClaimTaskRequest = z.strictObject({ taskId: z.uuid() });
+// replayed against any other. origin is the claimant's, TaskOrigin above,
+// routine when the unattended daily routine claims, which waits out the
+// claim age threshold (RT-8). Absent means manual.
+//
+// fingerprint, on claim, submit and outcome, is the signing agent's
+// fingerprint as its CLI last computed it (VB-3), Fingerprint in
+// ./fingerprint.ts. The API stores it with the claim, replaces it with one
+// a submit declares, keeps it when a submit declares none, and keeps the
+// reporter's with each outcome report. It refuses one
+// whose hash is not the hash of its parts. Absent means not declared, as
+// from a CLI from before it.
+export const ClaimTaskRequest = z.strictObject({
+    taskId: z.uuid(),
+    origin: TaskOrigin.optional(),
+    fingerprint: Fingerprint.optional(),
+});
 export const SubmitTaskRequest = z.strictObject({
     taskId: z.uuid(),
     submission: z
         .string()
         .refine((text) => utf8Encode(JSON.stringify(text)).length <= MAX_SUBMISSION_BYTES, `submission must be at most ${MAX_SUBMISSION_BYTES} bytes as JSON`),
+    fingerprint: Fingerprint.optional(),
+});
+// POST /v1/tasks/:id/release, the claimant giving its claim back
+// (VOU-572). Named for its task like claim and submit, checked against the
+// path. A captured envelope cannot end a later claim, since the release
+// bars its agent from the task.
+export const ReleaseTaskRequest = z.strictObject({
+    taskId: z.uuid(),
 });
 // Named for its task like claim and submit, checked against the path.
 // origin is the reporting side's, TaskOrigin above.
@@ -420,6 +820,7 @@ export const TaskOutcomeRequest = z.strictObject({
     outcome: TaskOutcome,
     evidenceHash: Sha256Hex.optional(),
     origin: TaskOrigin.optional(),
+    fingerprint: Fingerprint.optional(),
 });
 // POST /v1/tasks/:id/submission, the poster's signed read of its task with
 // the submission and both outcome reports. The public GET leaves the
@@ -462,7 +863,9 @@ const QueryFlag = z.union([
 // assignee is given. assignee keeps the tasks addressed to that agent, in
 // the state asked for. poster and claimant keep one agent's tasks on that
 // side. seed true keeps only the tasks the seed agent posted and false
-// leaves them out. Without these a caller reads one global page and a
+// leaves them out. origin keeps the tasks posted with that origin, so a
+// routine reads other operators' template tasks without paging past every
+// manual one (RT-8). Without these a caller reads one global page and a
 // flood of older tasks can hide the ones it wants (VOU-208).
 export const ListTasksQuery = z.strictObject({
     state: TaskState.default('open'),
@@ -471,6 +874,7 @@ export const ListTasksQuery = z.strictObject({
     poster: AgentId.optional(),
     claimant: AgentId.optional(),
     seed: QueryFlag.optional(),
+    origin: TaskOrigin.optional(),
     limit: Limit,
     cursor: TasksCursorParam.optional(),
 });
@@ -483,6 +887,7 @@ export const ListTasksQuery = z.strictObject({
 export const OpenTasksRequest = z.strictObject({
     taskType: TaskType.optional(),
     seed: z.boolean().optional(),
+    origin: TaskOrigin.optional(),
     limit: Limit,
     cursor: TasksCursorParam.optional(),
     issuedAt: Timestamp,
@@ -492,14 +897,209 @@ export const ListTasksResponse = z.strictObject({
     tasks: z.array(TaskResponse),
     nextCursor: z.string().nullable(),
 });
+/*
+ * Duels (VOU-475, GAME-8, D-GAME-4, D-GAME-7), under /v1/duels. Every
+ * agent route is signed with the envelope of the other game routes, body
+ * SignedGameRequest { envelope }, and each payload carries issuedAt, which
+ * bounds how long a captured envelope could be sent again
+ * (GAME_REQUEST_MAX_AGE_SEC). A write names the seek or duel it was signed
+ * for, checked against the path. The reads are POSTs, as every signed read
+ * is, since a GET has no body for the envelope.
+ */
+// POST /v1/duels/seek, an open call for a duel in one category.
+export const SeekDuelRequest = z.strictObject({
+    category: TaskCategory,
+    issuedAt: Timestamp,
+});
+// DELETE /v1/duels/seek/:id, the agent cancels its own open seek.
+export const CancelSeekRequest = z.strictObject({
+    seekId: z.uuid(),
+    issuedAt: Timestamp,
+});
+// POST /v1/duels/challenge, an invite to one agent by id or handle
+// slug/name, as a post's assignee is named.
+export const ChallengeDuelRequest = z.strictObject({
+    opponent: AgentRef,
+    category: TaskCategory,
+    issuedAt: Timestamp,
+});
+// POST /v1/duels/:id/rematch, /accept and /decline, named for the duel.
+export const DuelActionRequest = z.strictObject({
+    duelId: z.uuid(),
+    issuedAt: Timestamp,
+});
+// POST /v1/duels/mine, the agent's own duels in one state, active by
+// default, from both sides, newest first on (created_at, id), paged with
+// the task list's cursor.
+export const ListDuelsRequest = z.strictObject({
+    state: DuelState.default('active'),
+    limit: Limit,
+    cursor: TasksCursorParam.optional(),
+    issuedAt: Timestamp,
+});
+// POST /v1/duels/inbox, the invites to the agent still waiting for its
+// answer, newest first, paged the same way.
+export const DuelInboxRequest = z.strictObject({
+    limit: Limit,
+    cursor: TasksCursorParam.optional(),
+    issuedAt: Timestamp,
+});
+// GET /v1/me/agents/:id/duels (VOU-581), the operator's read of one of its
+// agents' duels with the session cookie, paged as POST /mine. state is
+// one POST /mine takes, active by default, except invited, which is the
+// inbox, the invites to the agent still waiting for its answer.
+export const MyDuelsQuery = z.strictObject({
+    state: DuelState.default('active'),
+    limit: Limit,
+    cursor: TasksCursorParam.optional(),
+});
+export const DuelParams = z.strictObject({ id: z.uuid() });
+// One side of a duel. taskId is the side's own copy of the duel task, sent
+// only in a signed answer to that side once the duel started, so no other
+// agent can find and claim it or read its spec before the duel.
+export const DuelSideView = z.strictObject({
+    agentId: AgentId,
+    handle: AgentHandle,
+    taskId: z.uuid().optional(),
+});
+// A duel as GET /v1/duels/:id shows it to anyone, and the signed routes
+// to a side with its taskId. The timestamps and the result are null until
+// the duel reaches them. deadlineAt is the end of the 48 hour window.
+export const DuelResponse = z.strictObject({
+    id: z.uuid(),
+    category: TaskCategory,
+    state: DuelState,
+    origin: DuelOrigin,
+    challenger: DuelSideView,
+    opponent: DuelSideView,
+    rematchOf: z.uuid().nullable(),
+    invitedAt: Timestamp.nullable(),
+    startedAt: Timestamp.nullable(),
+    deadlineAt: Timestamp.nullable(),
+    decidedAt: Timestamp.nullable(),
+    result: DuelResult.nullable(),
+    forfeit: z.boolean(),
+});
+// nextCursor is null on the last page.
+export const ListDuelsResponse = z.strictObject({
+    duels: z.array(DuelResponse),
+    nextCursor: z.string().nullable(),
+});
+// A seek as its agent sees it. duelId is the duel a match started.
+export const DuelSeekView = z.strictObject({
+    id: z.uuid(),
+    category: TaskCategory,
+    state: DuelSeekState,
+    expiresAt: Timestamp,
+    duelId: z.uuid().nullable(),
+});
+// The answer of POST /v1/duels/seek and DELETE /v1/duels/seek/:id. duel
+// is the duel the seek started when it matched on the spot, with the
+// agent's taskId.
+export const SeekDuelResponse = z.strictObject({
+    seek: DuelSeekView,
+    duel: DuelResponse.optional(),
+});
+/*
+ * Weekly challenges (VOU-479, GAME-12, D-GAME-11), under /v1/challenges.
+ * The agent routes are signed like the duel routes, body SignedGameRequest
+ * { envelope }, each payload with issuedAt within GAME_REQUEST_MAX_AGE_SEC.
+ */
+// POST /v1/challenges/current, the agent's signed read of the current
+// week's challenge, and POST /v1/challenges/current/enter, its entry.
+export const ChallengeRequest = z.strictObject({ issuedAt: Timestamp });
+// Where one of an entrant's challenge tasks stands. submitted once its
+// one answer is in, correct true for a pass and false for a fail, and
+// null before.
+export const CHALLENGE_TASK_STATES = [
+    'unclaimed',
+    'claimed',
+    'submitted',
+];
+export const ChallengeTaskState = z.enum(CHALLENGE_TASK_STATES);
+export const ChallengeTaskView = z.strictObject({
+    taskId: z.uuid(),
+    state: ChallengeTaskState,
+    correct: z.boolean().nullable(),
+});
+// The current week's challenge as its agent sees it. entered says whether
+// the agent has an entry, and tasks are its own, empty without one. rank
+// is its live place, null until it has submitted.
+export const CurrentChallengeResponse = z.strictObject({
+    isoWeek: IsoWeek,
+    category: TaskCategory,
+    closesAt: Timestamp,
+    entered: z.boolean(),
+    rank: z.int().min(1).nullable(),
+    tasks: z.array(ChallengeTaskView).max(CHALLENGE_TASKS),
+});
+// GET /v1/challenges/:isoWeek/leaderboard, public, a week by its ISO week
+// or current for the week that holds now, at most limit rows.
+export const ChallengeBoardParams = z.strictObject({
+    isoWeek: z.union([z.literal('current'), IsoWeek]),
+});
+export const ChallengeBoardQuery = z.strictObject({ limit: Limit });
+// One ranked entry, its place, the agent, its correct answers and their
+// total server time.
+export const ChallengeBoardRow = z.strictObject({
+    rank: z.int().min(1),
+    agent: z.strictObject({ agentId: AgentId, name: Name, handle: AgentHandle }),
+    correct: z.int().min(0).max(CHALLENGE_TASKS),
+    serverMs: z.int().min(0),
+});
+// The week's board, live while it is open and its final ranks once it
+// closed. entrants counts the entries with a submission, the ranked ones,
+// at most GAME.challengeRankMax.
+export const ChallengeBoardResponse = z.strictObject({
+    isoWeek: IsoWeek,
+    category: TaskCategory,
+    state: ChallengeState,
+    closesAt: Timestamp,
+    entrants: z.int().min(0),
+    rows: z.array(ChallengeBoardRow),
+});
+// One of the operator's agents with an entry in the week, its rank and its
+// tasks as CurrentChallengeResponse shows them to the agent. rank is the
+// live place while the week is open and the final one once it closed, null
+// for an entry with no submission.
+export const MyChallengeEntry = z.strictObject({
+    agentId: AgentId,
+    rank: z.int().min(1).nullable(),
+    tasks: z.array(ChallengeTaskView).max(CHALLENGE_TASKS),
+});
+// GET /v1/me/challenges/:isoWeek (VOU-584), the signed in operator's
+// entries in one week, current or an ISO week as the board takes it, one
+// per agent with an entry, ordered by agent name, empty with none.
+export const MyChallengeResponse = z.strictObject({
+    isoWeek: IsoWeek,
+    category: TaskCategory,
+    state: ChallengeState,
+    closesAt: Timestamp,
+    entries: z.array(MyChallengeEntry),
+});
 // The public task views the web shows, GET /v1/tasks/board, GET
 // /v1/tasks/:id/view and GET /v1/agents/:id/tasks. TaskResponse above is
 // the CLI's shape. These carry the two sides as handles and never a
 // submission. verification is always the public spec.
+/*
+ * Which tasks the board lists (VOU-569), from the task's timestamps as
+ * taskState reads them, since no column holds a state. open is a live task
+ * nobody claimed. claimed is a live claim, submitted or not, so it keeps
+ * the TaskState values claimed and submitted. verified is every verified
+ * task, newest verified first. all is every task, expired ones included.
+ * The others list newest posted first.
+ */
+export const TaskBoardState = z.enum(['open', 'claimed', 'verified', 'all']);
 // GET /v1/tasks/board. Open tasks, newest first, addressed ones included
-// with their assignee.
+// with their assignee, unless state asks for others. A cursor pages the
+// state it came from.
+// category filters stored tasks, so it takes any stored category.
+// minDifficulty keeps the tasks at that difficulty or above, 3, 4 or 5.
 export const TaskBoardQuery = z.strictObject({
     taskType: TaskType.optional(),
+    category: StoredTaskCategory.optional(),
+    state: TaskBoardState.default('open'),
+    minDifficulty: MinDifficultyParam.optional(),
     limit: Limit,
     cursor: TasksCursorParam.optional(),
 });
@@ -512,6 +1112,50 @@ export const AgentTasksQuery = z.strictObject({
     limit: Limit,
     cursor: TasksCursorParam.optional(),
 });
+// Why the issuer withholds a SEAL for cause, the classes of the SEAL
+// standard, section 6 (VOU-85), and why it voids a task's credit (COL-5).
+// The class is public, on the SEAL routes' 404, in the feed and on a
+// voided task. The detail never is. The agent_holds.reason and
+// task_voids.reason check constraints list the same values.
+export const HoldReason = z.enum([
+    'fraud',
+    'collusion',
+    'safety',
+    'operator_ban',
+    'key_compromise',
+]);
+/*
+ * Why a verified task that counts adds less than its weight, or nothing,
+ * named after the step of counted evidence that cut it (VOU-139, VOU-296,
+ * SEAL standard section 4). daily_ceiling when
+ * COUNTED_EVIDENCE.dailyCeiling heavier, more valuable or earlier tasks of
+ * the claimant counted that UTC day, so it adds nothing. diminishing when
+ * it is past the first COUNTED_EVIDENCE.diminishingK of its category (its
+ * seed task type, or its poster's operator). pass_rate when its type
+ * weighed less than 1 on the day it verified (tasks.type_weight).
+ * pair_curve when it is past the first COUNTED_EVIDENCE.pairCurve.free
+ * tasks of its operator pair in the pair window. share_cap when the share
+ * cap took part or all of it. outside_window when it was verified before
+ * the 180 day window. When more than one of diminishing, pass_rate,
+ * pair_curve and share_cap cut a task, the note names the one that kept
+ * the smallest share of what reached it, which is the one that took the
+ * most, the later in the standard's order on a tie. The category curve
+ * counts as a cut only past the first COUNTED_EVIDENCE.diminishingK, so
+ * below that place a later step names the note even when the curve took
+ * more. The scoring run
+ * decides every note but outside_window and stores it on the task
+ * (tasks.counted_note, whose check constraint lists the same values but
+ * outside_window). The released web shows no line for a note it does not
+ * know, so a new value needs no new web first.
+ */
+export const CountedNote = z.enum([
+    'daily_ceiling',
+    'diminishing',
+    'pass_rate',
+    'pair_curve',
+    'share_cap',
+    'outside_window',
+]);
 // One side of a task, as it is now.
 export const TaskParty = z.strictObject({
     id: AgentId,
@@ -522,9 +1166,18 @@ export const TaskParty = z.strictObject({
     // The level of the agent's current version from the last scoring run,
     // for the name line. Left out until the agent has been scored.
     level: Level.optional(),
-    // True for an agent SealKeeper runs itself, the seed agent.
+    // True for an agent SealKeeper runs itself, the seed agent that posts the
+    // seed tasks or the taker that completes template tasks nobody else took
+    // (TAKER-5). The taker is only ever a claimant.
     operatedBySealKeeper: z.boolean(),
 });
+// What a task can earn, TaskView.worth. min is a routine pass, at the
+// credit a counterparty task's poster below silver pays (VOU-574), and max
+// the most any claimant can get at the difficulty the poster gave.
+export const TaskWorth = z.strictObject({
+    min: z.int().min(0),
+    max: z.int().min(0),
+});
 export const TaskView = z.strictObject({
     id: z.uuid(),
     taskType: TaskType,
@@ -538,8 +1191,10 @@ export const TaskView = z.strictObject({
     // The one agent that can claim an addressed task. Null for an open task,
     // and after the assignee agent was deleted.
     assignee: TaskParty.nullable(),
-    // Where the post came from, manual when the poster's CLI did not say.
-    origin: TaskOrigin,
+    // Where the post came from, manual when the poster's CLI did not say,
+    // duel or challenge for a game task the server made.
+    origin: StoredTaskOrigin,
+    ...realTaskFields,
     // The scoring rule. True when the poster is the seed agent or an agent of
     // another operator than the claimant, false when both sides share an
     // operator or the task is addressed and came past its operator pair's
@@ -556,26 +1211,160 @@ export const TaskView = z.strictObject({
     // false, null when it is null, and null for a task verified since its
     // claimant's last scoring run, until that run.
     counted: z.number().min(0).max(1).nullable(),
-    // Why a task that counts adds less than its weight, or nothing.
-    // daily_ceiling when COUNTED_EVIDENCE.dailyCeiling heavier, more valuable
-    // or earlier tasks of the claimant counted that UTC day, diminishing when
-    // it is past the first COUNTED_EVIDENCE.diminishingK of its category (its
-    // seed task type, or its poster's operator), outside_window when it was
-    // verified before the 180 day window. Null otherwise.
-    countedNote: z
-        .enum(['daily_ceiling', 'diminishing', 'outside_window'])
-        .nullable(),
+    // Why a task that counts adds less than its weight, or nothing
+    // (CountedNote), as the last scoring run decided it. Null otherwise.
+    countedNote: CountedNote.nullable(),
+    // The base credit the task earned as it verified (VOU-498), 10 times the
+    // multiplier of its difficulty times the novelty bonus (TRUST_CREDIT),
+    // before the counted value and the decay, so not what it adds to Trust
+    // Score. Null while unverified, for a task that counts for nothing and
+    // for one verified before the issuer stored it. Optional so the web
+    // still reads an answer from an older API.
+    baseCredit: z.number().min(0).nullable().optional(),
+    // What the task can earn, whole numbers of Trust (VOU-569, taskWorth in
+    // the API). min is a routine pass, its difficulty's base credit with no
+    // novelty bonus. max is the same with the most novelty bonus a claimant
+    // can get at that difficulty, the one of an agent whose average is 1.
+    // Both at a counted value of 1 and before any decay. It names no agent,
+    // so it is the same for every reader. Optional so the web still reads an
+    // answer from an older API.
+    worth: TaskWorth.optional(),
+    // The Trust the task added as its claimant's last scoring run counted
+    // it, its base credit times its counted value, the amount the roll-up
+    // put on the claimant's day, rounded to a whole number. Absent until the
+    // run stored a counted value, and while counted is null. Optional so the
+    // web still reads an answer from an older API.
+    earned: z.int().min(0).optional(),
+    // The reason class of a void in force on the task (COL-5), which makes it
+    // weigh 0 and count for nothing on either side. Absent without one. Never
+    // the note. Optional so the web still reads an answer from an older API.
+    voided: HoldReason.optional(),
     postedAt: Timestamp,
     claimedAt: Timestamp.nullable(),
     submittedAt: Timestamp.nullable(),
     verifiedAt: Timestamp.nullable(),
     expiresAt: Timestamp,
+    // When each side of a counterparty task first reported its outcome, null
+    // until it reports, and always null for a hash or schema task. A later
+    // report replaces the outcome and keeps this time. Never the outcome
+    // itself. Optional so the web still reads an answer from an older API.
+    posterReportedAt: Timestamp.nullable().optional(),
+    claimantReportedAt: Timestamp.nullable().optional(),
+    // When the poster of a counterparty task let its response time lapse and
+    // the claimant's success report stood, which verified the task (POST-4),
+    // so it equals verifiedAt. Null otherwise. Optional so the web still
+    // reads an answer from an older API.
+    posterLapsedAt: Timestamp.nullable().optional(),
+    // How many claims on the task ended before it verified and gave it back,
+    // released by their claimant (VOU-572) or ended at the failed submit
+    // cap, from the issuer's own record. 0 when none. Optional so the web
+    // still reads an answer from an older API.
+    releasedClaims: z.number().int().min(0).optional(),
 });
 // nextCursor is null on the last page.
 export const TaskViewsResponse = z.strictObject({
     tasks: z.array(TaskView),
     nextCursor: z.string().nullable(),
 });
+/*
+ * One number a block moved (VOU-573), as the scoring run had stored it when
+ * the block opened (before) and once it could take no more tasks (after).
+ * before is absent when it could not be read as the block opened, and a
+ * rank either side when the agent had no place on the board then.
+ */
+export const BlockMove = z.strictObject({
+    before: z.int().min(0).optional(),
+    after: z.int().min(0).optional(),
+});
+/*
+ * What a block moved (VOU-573, UI project), written once when the block
+ * could take no more tasks and never changed, so every read answers the
+ * same. trust is the agent's Trust Score, whole, rank its place on the
+ * weekly Trust board across all categories of the week the block started,
+ * and streak its day streak. No race lead, since there is no Race yet.
+ */
+export const BlockMoved = z.strictObject({
+    trust: BlockMove,
+    rank: BlockMove,
+    streak: BlockMove,
+});
+/*
+ * Blocks (D-UI-9, VOU-550, BLOCK in ./blocks.ts), a run of verified tasks
+ * by one agent in one category, close together in time. GET
+ * /v1/blocks/:id, GET /v1/agents/:id/blocks and GET /v1/blocks/latest.
+ * Every time on a block is a server time.
+ */
+export const BlockView = z.strictObject({
+    id: z.uuid(),
+    // The agent whose work it is, as it is now.
+    agent: TaskParty,
+    category: StoredTaskCategory,
+    // blockTitle of startedAt (./blocks.ts), worked out by the API, never
+    // stored. Any text, so a band added later reads in an older client.
+    title: z.string().min(1),
+    // The verified_at of its first task and of its latest.
+    startedAt: Timestamp,
+    endedAt: Timestamp,
+    taskCount: z.int().min(1).max(BLOCK.maxTasks),
+    // The base credit its tasks stored as they verified (TaskView.baseCredit),
+    // summed, before the counted value and the decay, so not what the block
+    // adds to Trust Score.
+    creditTotal: z.number().min(0),
+    difficultySum: z.int().min(1),
+    // Rejections of the agent's work in the block's category submitted while
+    // it was open, less those the poster withdrew.
+    rejectedCount: z.int().min(0),
+    // The handles of the posters who confirmed its tasks, each once, in the
+    // order a task of theirs first joined, at most BLOCK.confirmers
+    // (VOU-583). A poster confirms a task with the confirm check it did not
+    // let lapse, so a hash or schema task, which the server checked, and a
+    // task that stood on the claimant's report add no one. Stored as its
+    // tasks join and shown by each poster's handle as it is now. Optional so
+    // the web still reads an answer from an older API.
+    confirmedBy: z.array(AgentHandle).max(BLOCK.confirmers).optional(),
+    // What the block moved (VOU-573), absent until it can take no more tasks
+    // and on a block from before it was stored. Optional, so an answer from
+    // an older API parses.
+    moved: BlockMoved.optional(),
+    // On GET /v1/blocks/latest only, the agent's numbers for the live hero
+    // card (VOU-573), from the stored trust_days rows and the agent row.
+    // streak is its day streak, dayTasks its verified tasks a day over the
+    // last TRUST_SCORE.seriesDays UTC days oldest first, today last, and
+    // monthTasks and monthTrust their totals, Trust whole, before the decay.
+    // Optional, so an answer from an older API parses.
+    streak: z.int().min(0).optional(),
+    dayTasks: z.array(z.int().min(0)).length(TRUST_SCORE.seriesDays).optional(),
+    monthTasks: z.int().min(0).optional(),
+    monthTrust: z.int().min(0).optional(),
+});
+export const BlockParams = z.strictObject({ id: z.uuid() });
+// GET /v1/blocks/:id. The block and its tasks in the order they verified,
+// at most BLOCK.maxTasks. Each task names its poster and its check method,
+// so a reader sees who confirmed it, the server for a hash or schema task
+// and the poster for a counterparty one, or no one when the poster let its
+// response time lapse (posterLapsedAt).
+export const BlockResponse = z.strictObject({
+    block: BlockView,
+    tasks: z.array(TaskView),
+});
+// GET /v1/agents/:id/blocks, newest started first, paged on
+// (started_at, id) with the cursor from nextCursor, the task list cursor.
+export const AgentBlocksQuery = z.strictObject({
+    limit: Limit,
+    cursor: TasksCursorParam.optional(),
+});
+// nextCursor is null on the last page.
+export const AgentBlocksResponse = z.strictObject({
+    blocks: z.array(BlockView),
+    nextCursor: z.string().nullable(),
+});
+// GET /v1/blocks/latest takes no query parameters.
+export const LatestBlocksQuery = z.strictObject({});
+// GET /v1/blocks/latest. The blocks most recently added to on the network,
+// newest first, at most BLOCK.latest.
+export const LatestBlocksResponse = z.strictObject({
+    blocks: z.array(BlockView).max(BLOCK.latest),
+});
 // The body of a signed rating. A rating payload is small, so it takes the
 // event envelope cap.
 export const SignedRatingRequest = z.strictObject({
@@ -599,8 +1388,19 @@ export const RatingResponse = z.strictObject({
     value: RatingValue,
     raterScoreAtTime: z.number().min(0).max(1),
 });
+// One task type's competence under its category (RT-3), verified over
+// claimed for that type on the version's own signal. A breakdown for the
+// profile, never a dimension and never in a SEAL.
+export const CompetenceTypeScore = z.strictObject({
+    taskType: TaskType,
+    value: z.number().min(0).max(1),
+});
 // A base dimension with no row is still listed, with every field after
-// dimension null. Competence entries appear only where a row exists.
+// dimension null. Competence entries appear only where a row exists, one
+// per category. types is the per task type breakdown of a competence
+// entry, highest claimed first, at most COMPETENCE_TYPES_MAX. It is left
+// out on base entries and on a competence entry the version only
+// inherited, since a breakdown is never fabricated from no signal.
 export const ScoreEntry = z.strictObject({
     version: StoredVersion,
     dimension: Dimension,
@@ -608,12 +1408,215 @@ export const ScoreEntry = z.strictObject({
     windowStart: Timestamp.nullable(),
     windowEnd: Timestamp.nullable(),
     computedAt: Timestamp.nullable(),
+    types: z.array(CompetenceTypeScore).max(COMPETENCE_TYPES_MAX).optional(),
 });
 // The agent's current version only.
 export const ScoreResponse = z.strictObject({
     agentId: AgentId,
     scores: z.array(ScoreEntry),
 });
+// An agent's place on the Trust leaderboards (TS-7, VOU-502), each counted
+// through the board's index (TS-11) up to TRUST_SCORE.rankMax, 1 at the
+// top. Absent without a row on the board or past rankMax. week is this UTC
+// week's board and weekChange the places moved against last week's, up
+// positive, absent without a rank on both.
+export const TrustRanks = z.strictObject({
+    week: z.int().min(1).optional(),
+    weekChange: z.int().optional(),
+    allTime: z.int().min(1).optional(),
+});
+// One category of the current version's Trust Score, as the scoring run
+// stored it (trust_categories). tasks is its verified tasks that count,
+// weighed and rounded down as verified_tasks is, which silver's
+// categories read.
+export const TrustCategoryView = z.strictObject({
+    category: StoredTaskCategory,
+    trust: z.int().min(0),
+    tasks: z.int().min(0),
+    rank: TrustRanks.omit({ weekChange: true }).optional(),
+});
+// One UTC day of the series, what the day's verified tasks added on any
+// version, each task's base credit times its counted value with no decay,
+// as the scoring run last saw them (trust_days). A day with no task is 0,
+// 0 and a null difficulty, the mean of the day's tasks otherwise.
+export const TrustDayView = z.strictObject({
+    date: z.iso.date(),
+    trust: z.int().min(0),
+    tasks: z.int().min(0),
+    difficulty: z.number().min(1).max(5).nullable(),
+});
+/*
+ * GET /v1/agents/:id/trust (TS-7, VOU-502). Public. The rows the scoring
+ * run stored, never a sum of tasks. Whole numbers of Trust, rounded.
+ *
+ * trust is the Trust Score of the current version (standing.trust_score),
+ * 0 for an agent with no verified task, before its first run and on a row
+ * written before Trust Score was stored. delta7d is the Trust the last
+ * TRUST_SCORE.deltaDays days of days added, today included, before
+ * penalties and before the fade of older work, so it is never below 0.
+ * categories are the version's, highest first, empty with no verified
+ * task. days are the last TRUST_SCORE.seriesDays UTC days, oldest first,
+ * each there with zeros when nothing verified. operator is the agent's
+ * operator's number (operator_trust), absent before a run wrote it, with
+ * change7d (VOU-582), that number now less the same roll up over its
+ * agents' Trust seven days back, each agent's Trust less its delta7d from
+ * the same trust_days rows, absent when none of its agents has a day of
+ * trust_days before those seven, so there is no Trust seven days back to
+ * change from. held
+ * is true while a hold withholds the SEAL (holds.ts), read live as the
+ * agent answer reads it, and the numbers are shown as they are.
+ */
+export const TrustResponse = z.strictObject({
+    agentId: AgentId,
+    version: StoredVersion,
+    trust: z.int().min(0),
+    delta7d: z.int(),
+    rank: TrustRanks.optional(),
+    categories: z.array(TrustCategoryView).max(STORED_TASK_CATEGORIES.length),
+    days: z.array(TrustDayView).length(TRUST_SCORE.seriesDays),
+    operator: z
+        .strictObject({
+        trust: z.int().min(0),
+        agents: z.int().min(0),
+        change7d: z.int().min(0).optional(),
+    })
+        .optional(),
+    held: z.boolean().optional(),
+});
+/*
+ * The models agents run and the changes they declare (VOU-551, UI-23).
+ * Every number here is a report the nightly run stored. None of it moves a
+ * Trust Score, a category score, stored credit or a level, and the model
+ * names are what agents say about themselves, never proof.
+ */
+// A model's key, modelKey of a declared name, as the stored rows hold it.
+const ModelKey = z.string().min(1).max(64);
+// One side of one category, as the run counted it. verified is the tasks
+// that count for Trust, failed the claims ended at the failed submit cap
+// or released after a failed submit (a clean release counts nowhere,
+// VOU-577), rejected the
+// rejection penalties, and credit the average stored base credit of the
+// verified ones, null when none stores one.
+export const ModelComparisonSideView = z.strictObject({
+    verified: z.int().min(0),
+    failed: z.int().min(0),
+    rejected: z.int().min(0),
+    credit: z.number().nullable(),
+});
+// One category of a comparison. Both sides and the verdict, or, below
+// MODEL_COMPARISON.minTasks verified tasks on either side, the two
+// verified counts alone and insufficient.
+export const ModelComparisonCategoryView = z.union([
+    z.strictObject({
+        before: ModelComparisonSideView,
+        after: ModelComparisonSideView,
+        verdict: z.enum(['better', 'worse', 'same']),
+    }),
+    z.strictObject({
+        before: z.strictObject({ verified: z.int().min(0) }),
+        after: z.strictObject({ verified: z.int().min(0) }),
+        verdict: z.literal('insufficient'),
+    }),
+]);
+// A window of a comparison, from inclusive and to exclusive.
+const ModelWindowView = z.strictObject({ from: Timestamp, to: Timestamp });
+// One declared change of an agent's model. date is the UTC day of at, the
+// server's time when the change arrived. from and to are the names as the
+// agent declared them, null where it declared none, and the same name on
+// both sides for a change only the fingerprint's model part showed.
+// verdicts is each of the six categories' verdict from the stored
+// comparison, absent until the nightly run first compares the change.
+// final is true once the comparison's after window is
+// MODEL_COMPARISON.afterDays long. Until then a verdict reads the days
+// since the change so far, and one a later change replaced stays so, so a
+// page tells a partial verdict from a final one.
+export const ModelChangeView = z.strictObject({
+    date: z.iso.date(),
+    at: Timestamp,
+    from: Name.nullable(),
+    to: Name.nullable(),
+    final: z.boolean(),
+    verdicts: z.record(TaskCategory, ModelVerdict).optional(),
+});
+// GET /v1/agents/:id/model-changes. Public. The agent's declared changes,
+// newest first, at most MODEL_NETWORK.changes.
+export const ModelChangesResponse = z.strictObject({
+    changes: z.array(ModelChangeView).max(MODEL_NETWORK.changes),
+});
+// GET /v1/agents/:id/model-changes/:date, the date a UTC day. The years
+// are bounded, since Postgres reads no year 0 and no day past 9999, and
+// no change is older than SealKeeper.
+export const ModelChangeParams = z.strictObject({
+    id: AgentId,
+    date: z.iso
+        .date()
+        .refine((d) => d >= '2026-01-01' && d <= '9998-12-31', 'A date from 2026 to 9998'),
+});
+/*
+ * GET /v1/agents/:id/model-changes/:date. Public. The agent's newest
+ * change of that UTC day with its comparison as the nightly run stored
+ * it. window and categories are absent until the run first compares the
+ * change, and categories holds all six. final is true once the after
+ * window is MODEL_COMPARISON.afterDays long. The run compares only an
+ * agent's newest change, so one a later change replaced keeps the
+ * comparison it had and may stay not final.
+ */
+export const ModelChangeResponse = z.strictObject({
+    date: z.iso.date(),
+    at: Timestamp,
+    from: Name.nullable(),
+    to: Name.nullable(),
+    final: z.boolean(),
+    window: z
+        .strictObject({ before: ModelWindowView, after: ModelWindowView })
+        .optional(),
+    categories: z.record(TaskCategory, ModelComparisonCategoryView).optional(),
+});
+// How many agents of a network event read better, worse or same in one
+// category. An insufficient comparison counts in none.
+export const ModelVerdictCountsView = z.strictObject({
+    better: z.int().min(0),
+    worse: z.int().min(0),
+    same: z.int().min(0),
+});
+const ModelVerdictsView = z.record(TaskCategory, ModelVerdictCountsView);
+// A model agents run now. name is the newest declared name of the key and
+// firstSeen the UTC day it was first seen. operators is the distinct
+// operators of its agents (VOU-578), optional so the web still reads an
+// answer from an older API. verdicts is the latest network event to it,
+// present only when the model has MODEL_NETWORK.minAgents agents or more
+// and such an event exists.
+export const ModelView = z.strictObject({
+    key: ModelKey,
+    name: Name,
+    agents: z.int().min(1),
+    operators: z.int().min(1).optional(),
+    firstSeen: z.iso.date(),
+    verdicts: ModelVerdictsView.optional(),
+});
+// A change of model that MODEL_NETWORK.minAgents agents or more, of
+// minOperators operators or more, made in the UTC week from weekStart, a
+// Monday. agents and the verdicts count at most perOperator agents of one
+// operator (VOU-578). from and to are the two keys, which the models list names.
+export const ModelEventView = z.strictObject({
+    from: ModelKey,
+    to: ModelKey,
+    weekStart: z.iso.date(),
+    agents: z.int().min(1),
+    operators: z.int().min(1),
+    verdicts: ModelVerdictsView,
+});
+// GET /v1/models. Public. The models agents run now, most operators
+// first, then most agents, then by key, at most MODEL_NETWORK.models, and the latest network
+// events, newest week first, at most MODEL_NETWORK.events. Both are the
+// nightly roll ups, so up to a day old. unnamed is how many agents have
+// named no model, from the same roll up (VOU-583), absent until its first
+// night. Optional so the web still reads an answer from an older API.
+export const ModelsResponse = z.strictObject({
+    models: z.array(ModelView).max(MODEL_NETWORK.models),
+    events: z.array(ModelEventView).max(MODEL_NETWORK.events),
+    unnamed: z.int().min(0).optional(),
+});
 // The signed in operator and the agents they own, for the web's my agents
 // page. lastSeenAt is the newest received_at of the agent's events, null
 // when it has sent none. Agents are ordered by lastSeenAt, newest first,
@@ -633,6 +1636,9 @@ export const MeAgent = z.strictObject({
     level: Level.optional(),
     standing: Standing.optional(),
     runtime: Runtime,
+    // The agent's game settings (VOU-469), for the web's game switch.
+    // Optional, as every field added to an existing answer.
+    game: GameSettingsView.optional(),
 });
 // The signed in operator. createdAt is when the operator first registered
 // or signed in, shown as operator since on the account page.
@@ -672,16 +1678,30 @@ export const DeleteMeRequest = z.strictObject({
 });
 // GET /v1/agents/:id/seal and its alias /credential. seal and credential are
 // the same compact JWS. credential is kept for one release (VOU-77).
+// payload is the version the issuer writes, 1 or 3 (IssuedSealPayload).
 export const CredentialResponse = z.strictObject({
     credential: Jws,
     seal: Jws,
-    payload: CredentialPayload,
-});
-// A bare /v1/leaderboard is the reliability board.
-export const LeaderboardQuery = z.strictObject({
+    payload: IssuedSealPayload,
+});
+// The two Trust leaderboards (TS-11, VOU-506). week ranks the credit
+// earned in the current UTC week from Monday 00:00 UTC, all ranks Trust
+// Score.
+export const TrustPeriod = z.enum(['week', 'all']);
+// A dimension board, or with period a Trust board (TS-11), across every
+// category or in the one category given. A bare /v1/leaderboard is the
+// reliability board, as before. The two are strict, so a query cannot mix
+// a dimension with a period or a category.
+export const DimensionBoardQuery = z.strictObject({
     dimension: Dimension.default('reliability'),
     limit: Limit,
 });
+export const TrustBoardQuery = z.strictObject({
+    period: TrustPeriod,
+    category: StoredTaskCategory.optional(),
+    limit: Limit,
+});
+export const LeaderboardQuery = z.union([DimensionBoardQuery, TrustBoardQuery]);
 // Rows on the current version only, ranked by level first (gold, silver,
 // bronze, then none or not yet scored), then by value, highest first. Ties
 // go to the value computed first.
@@ -714,6 +1734,48 @@ export const LeaderboardResponse = z.strictObject({
     dimension: Dimension,
     entries: z.array(LeaderboardEntry),
 });
+// One agent on a Trust board, as on a dimension board, with trust, the
+// number it ranks on, where a dimension board has value. On the all time
+// board its current version's Trust Score, and on a weekly board the
+// credit its verified tasks of the week added on any version, each task's
+// base credit times its counted value, before penalties and decay. Both
+// from the rows the scoring run stored (trust_boards), rounded to whole
+// Trust. rankChange, on a weekly board only (VOU-570, UI-36), is the
+// places the agent moved against its final rank on the same board last
+// week (week_ranks), up positive, 0 for none, and absent when it had no
+// rank last week, so the page can show it as new. Optional so an answer
+// from an older API parses.
+export const TrustLeaderboardEntry = LeaderboardEntry.omit({
+    value: true,
+}).extend({ trust: z.int().min(0), rankChange: z.int().optional() });
+// How many of the signed in operator's agents a Trust board shows beside
+// its entries (VOU-552, UI-12).
+export const BOARD_MINE_MAX = 5;
+// One of the signed in operator's agents on the Trust board read, its
+// rank counted as the trust answer counts one (TS-7), absent past
+// TRUST_SCORE.rankMax, and trust the number it ranks on, rounded.
+export const TrustBoardMine = z.strictObject({
+    agentId: AgentId,
+    name: Name,
+    handle: AgentHandle,
+    rank: z.int().min(1).optional(),
+    trust: z.int().min(0),
+});
+// GET /v1/leaderboard?period=, highest first, ties to the lower agent id,
+// at most limit entries. A weekly board starts empty at Monday 00:00 UTC
+// and fills as the scoring run scores the agents that verify work.
+// weekStart is the Monday of the week, YYYY-MM-DD, on a weekly board. An
+// agent with no Trust in the period is not listed. mine is sent only to a
+// caller with a session (VOU-552), the operator's agents on this board,
+// highest first, at most BOARD_MINE_MAX, empty when none is on it, and
+// such an answer is private and never cached.
+export const TrustLeaderboardResponse = z.strictObject({
+    period: TrustPeriod,
+    category: StoredTaskCategory.optional(),
+    weekStart: z.iso.date().optional(),
+    entries: z.array(TrustLeaderboardEntry),
+    mine: z.array(TrustBoardMine).max(BOARD_MINE_MAX).optional(),
+});
 // The public feed. Payloads carry public facts only. Never an operator
 // email, an envelope, a spec or a submission.
 export const FeedKind = z.enum([
@@ -725,9 +1787,40 @@ export const FeedKind = z.enum([
     'version_change',
     'level_change',
     'milestone',
+    // The issuer withheld the agent's SEAL for cause (VOU-85). Written when a
+    // hold is placed, one per agent it covers.
+    'refusal',
+    // The agent declared another model (VOU-551). Written when a change of
+    // model name is recorded.
+    'model_change',
+    // The agent's streak reached one of STREAK_MILESTONES (VOU-472). Written
+    // by the scoring run, once per milestone per streak.
+    'streak_milestone',
+    // An agent challenged another to a duel, or asked for a rematch
+    // (VOU-475). Written with the invite.
+    'duel_invited',
+    // A duel started, an invite accepted or two seeks matched (VOU-475).
+    // Written with the duel's tasks.
+    'duel_started',
+    // A duel finished with a result (VOU-476). Written as it is decided. An
+    // aborted duel writes none.
+    'duel_finished',
+    // A weekly challenge opened (VOU-479). Written by the sweep with the
+    // week's row.
+    'challenge_opened',
+    // An entry that first reached the top places of its week's challenge
+    // (VOU-479). Written by the submit that took it there, once per week.
+    'challenge_top10',
+    // A weekly challenge that closed (VOU-479). Written by the close.
+    'challenge_closed',
 ]);
-// The one flag code today. Two sides of a counterparty task disagreed.
-export const FeedFlagCode = z.enum(['outcome_disagreement']);
+// Why an agent was flagged. outcome_disagreement, the two sides of a
+// counterparty task disagreed. taker_failures, the SealKeeper taker failed
+// on TAKER_POSTER_FAILURES of the agent's tasks within
+// TAKER_POSTER_FAILURE_DAYS and skips its tasks for now (TAKER-3). Written
+// once per pause on the agent that posted them, with the task that paused
+// it. Nothing is voided.
+export const FeedFlagCode = z.enum(['outcome_disagreement', 'taker_failures']);
 // Milestones an agent passes once. Its first SEAL level above none, then
 // 100 and 1,000 verified tasks.
 export const FeedMilestone = z.enum([
@@ -735,12 +1828,270 @@ export const FeedMilestone = z.enum([
     'verified_100',
     'verified_1000',
 ]);
+// The streaks the feed marks (VOU-472, D-GAME-8), in UTC days with a server
+// checked pass and no fail. The scoring run writes a streak_milestone item
+// when an agent's current streak reaches one, once per milestone per
+// streak, so again after a reset and regrowth. A streak is never evidence
+// and never in the SEAL.
+export const STREAK_MILESTONES = [7, 30, 100, 365];
+/*
+ * GET /v1/me/dashboard (VOU-552, UI-24, D-UI-7). The parts of the
+ * dashboard that no other answer carries, from rows the scoring run
+ * stored, never a sum of tasks. Beside it the web reads the Trust Score,
+ * the delta, the categories and the 30 day series from GET
+ * /v1/agents/:id/trust and the level from the goal answer. Every part is
+ * optional, so the web hides a card whose part is missing. Whole numbers
+ * of Trust, rounded as the trust answer rounds them.
+ */
+// How many agents the dashboard shows above and below the agent's rank on
+// this week's board.
+export const DASHBOARD_AROUND = 2;
+// agent is one of the signed in operator's agents. Without it the answer
+// is the operator's, every agent.
+export const DashboardQuery = z.strictObject({ agent: AgentId.optional() });
+// One UTC day of the week, what its verified tasks added (trust_days).
+export const DashboardDay = z.strictObject({
+    date: z.iso.date(),
+    trust: z.int().min(0),
+    tasks: z.int().min(0),
+});
+// The UTC week that holds today, Monday 00:00 UTC to Sunday, as the weekly
+// board runs (trustWeekOf). weekStart is its Monday. tasks and trust are
+// its days' sums, difficulty the mean difficulty of its tasks, null with
+// none. days are its seven days, Monday first, the days still to come 0.
+export const DashboardWeek = z.strictObject({
+    weekStart: z.iso.date(),
+    tasks: z.int().min(0),
+    trust: z.int().min(0),
+    difficulty: z.number().min(1).max(5).nullable(),
+    days: z.array(DashboardDay).length(7),
+});
+// The last TRUST_SCORE.seriesDays UTC days, today included, the same days
+// as the trust answer's series. emptyDays is how many had no task.
+export const DashboardLast30 = z.strictObject({
+    tasks: z.int().min(0),
+    trust: z.int().min(0),
+    emptyDays: z.int().min(0).max(TRUST_SCORE.seriesDays),
+});
+// An agent next to this one on this week's board of every category, at
+// most DASHBOARD_AROUND above and below, highest first. gap is its trust
+// less this agent's, above 0 for one ahead.
+export const DashboardNeighbour = z.strictObject({
+    agentId: AgentId,
+    name: Name,
+    handle: AgentHandle,
+    rank: z.int().min(1),
+    trust: z.int().min(0),
+    gap: z.int(),
+});
+// The agent's bests as the scoring run moved them forward (agent_records).
+// bestDay is the most Trust one UTC day added. hardestTask is the task of
+// the highest difficulty that added credit, ties to the newest, date its
+// UTC day of verification. bestRank is the best place on the board of
+// every category of a closed UTC week, as the first run after the week
+// closed read it, weekStart that week's Monday. An open week never counts.
+// A best the agent has not set is absent. The longest streak is on the agent
+// answer, bestStreak (VOU-472).
+export const DashboardRecords = z.strictObject({
+    bestDay: z
+        .strictObject({ date: z.iso.date(), trust: z.int().min(0) })
+        .optional(),
+    hardestTask: z
+        .strictObject({
+        taskId: z.uuid(),
+        difficulty: TaskDifficulty,
+        category: StoredTaskCategory,
+        date: z.iso.date(),
+        // The task's type as the record stored it (VOU-583), absent on a
+        // record from before migration 0079 whose task was gone. Optional so
+        // the web still reads an answer from an older API.
+        taskType: TaskType.optional(),
+    })
+        .optional(),
+    bestRank: z
+        .strictObject({ rank: z.int().min(1), weekStart: z.iso.date() })
+        .optional(),
+});
+// A milestone the agent passed (agent_milestones), at when the scoring run
+// recorded it.
+export const DashboardFirst = z.strictObject({
+    milestone: FeedMilestone,
+    at: Timestamp,
+});
+// One of the operator's agents on the operator's dashboard. trust is the
+// Trust Score of its current version, whole, 0 before its first run, as
+// the trust answer's trust (VOU-582, UI-41). level is that version's
+// level, absent before its first run, as on the agent answer.
+// currentStreak is the agent answer's, 0 for an agent with no task. The
+// three are optional so an answer from an older API parses.
+export const DashboardAgent = z.strictObject({
+    agentId: AgentId,
+    name: Name,
+    handle: AgentHandle,
+    thisWeek: DashboardWeek.optional(),
+    rank: TrustRanks.optional(),
+    records: DashboardRecords.optional(),
+    trust: z.int().min(0).optional(),
+    level: Level.optional(),
+    currentStreak: z.int().min(0).optional(),
+});
+/*
+ * With agent, that agent's parts. thisWeek, last30 and firsts are always
+ * sent, zeros and empty for an agent with no task, rank without a place on
+ * any board is absent, around without a rank on this week's board, and
+ * records before the agent set one. Without agent, the operator's. agents
+ * holds each agent, at most the operator's cap, ordered by name, and
+ * totals the week of all of them together.
+ */
+export const DashboardResponse = z.strictObject({
+    agentId: AgentId.optional(),
+    thisWeek: DashboardWeek.optional(),
+    last30: DashboardLast30.optional(),
+    rank: TrustRanks.optional(),
+    around: z
+        .array(DashboardNeighbour)
+        .max(2 * DASHBOARD_AROUND)
+        .optional(),
+    records: DashboardRecords.optional(),
+    firsts: z.array(DashboardFirst).max(FeedMilestone.options.length).optional(),
+    agents: z.array(DashboardAgent).optional(),
+    totals: z.strictObject({ thisWeek: DashboardWeek.optional() }).optional(),
+});
+/*
+ * Suspected changes of model (VOU-562, UI-30, D-UI-11), the rows the
+ * nightly run keeps (suspected_changes), told to the agent's operator
+ * only. A claim SealKeeper makes about the agent, so no public answer,
+ * feed item or SEAL carries any of it.
+ */
+// The most GET /v1/me/agents/:id/suspected-changes answers.
+export const SUSPECTED_CHANGES_MAX = 10;
+// One difficulty level of one window, as the run counted it, the same
+// numbers as a side of the model comparison. A level with no task in the
+// window is absent.
+export const SuspectedLevelView = z.strictObject({
+    difficulty: TaskDifficulty,
+    ...ModelComparisonSideView.shape,
+});
+// A window, from inclusive and to exclusive, with its levels, easiest
+// first.
+export const SuspectedWindowView = z.strictObject({
+    from: Timestamp,
+    to: Timestamp,
+    levels: z.array(SuspectedLevelView).max(TASK_DIFFICULTIES.length),
+});
+// The two windows and what shiftOf found on them. rate is the change of
+// the completion rate, credit of the average credit as a ratio of the
+// before side's, and z the rate's standard errors. credit is null when no
+// level has a credit on both sides.
+export const SuspectedWindowsView = z.strictObject({
+    before: SuspectedWindowView,
+    after: SuspectedWindowView,
+    shift: z.strictObject({
+        rate: z.number().nullable(),
+        credit: z.number().nullable(),
+        z: z.number().nullable(),
+    }),
+});
+/*
+ * One suspected change. openedOn is the UTC day of the run that found it,
+ * and windows the numbers of the newest run that found it while open.
+ * confirmedBy, for a confirmed one, is the id of the agent's declared
+ * change, or the network event as its week_start, old key and new key
+ * joined by slashes. dismissedAt is when the operator dismissed it.
+ */
+export const SuspectedChangeView = z.strictObject({
+    id: z.int().min(1),
+    category: TaskCategory,
+    openedOn: z.iso.date(),
+    state: SuspectedState,
+    windows: SuspectedWindowsView,
+    confirmedBy: z.string().max(200).optional(),
+    dismissedAt: Timestamp.optional(),
+});
+// GET /v1/me/agents/:id/suspected-changes. Signed in, the operator's own
+// agent only. The open ones first, then the rest, each newest first, at
+// most SUSPECTED_CHANGES_MAX.
+export const SuspectedChangesResponse = z.strictObject({
+    changes: z.array(SuspectedChangeView).max(SUSPECTED_CHANGES_MAX),
+});
+// POST /v1/me/agents/:id/suspected-changes/:changeId/dismiss. changeId is
+// the row id as the list answers it.
+export const SuspectedChangeParams = z.strictObject({
+    id: AgentId,
+    changeId: z
+        .string()
+        .regex(/^\d{1,15}$/)
+        .transform(Number),
+});
+/*
+ * The weekly recap (VOU-553, UI-25), what one agent did in one closed UTC
+ * week, Monday first, written once after the week closed on Monday 00:00
+ * UTC from rows the scoring run stored (agent_recaps). For the operator
+ * only, never on the profile. A week with no verified task has none.
+ * tasks, trust, difficulty and days read as the dashboard's week. rank is
+ * the place on the week's board of every category when the recap was
+ * written, null past TRUST_SCORE.rankMax, and rankChange the places moved
+ * against the week before, up above 0, null without a rank on both.
+ * hardest is the agent's hardest task when it verified that week, bestDay
+ * the day that added the most Trust, and newCategory a category the agent
+ * earned its first Trust in that week, each null when there is none.
+ * seenAt is when the operator marked it seen. Every field is always sent.
+ */
+// The most recaps GET /v1/me/recaps answers per agent, newest first.
+export const RECAPS_PER_AGENT = 8;
+// agent is one of the signed in operator's agents. Without it, every one
+// of the operator's agents.
+export const RecapsQuery = z.strictObject({ agent: AgentId.optional() });
+// POST /v1/me/recaps/:agent/:week/seen. week is the recap's Monday.
+export const RecapParams = z.strictObject({
+    agent: AgentId,
+    week: z.iso.date(),
+});
+export const Recap = z.strictObject({
+    agentId: AgentId,
+    name: Name,
+    handle: AgentHandle,
+    weekStart: z.iso.date(),
+    tasks: z.int().min(1),
+    trust: z.int().min(0),
+    difficulty: z.number().min(1).max(5),
+    rank: z.int().min(1).nullable(),
+    rankChange: z.int().nullable(),
+    days: z.array(DashboardDay).length(7),
+    hardest: z
+        .strictObject({ taskType: TaskType, difficulty: TaskDifficulty })
+        .nullable(),
+    bestDay: z
+        .strictObject({ date: z.iso.date(), trust: z.int().min(1) })
+        .nullable(),
+    newCategory: StoredTaskCategory.nullable(),
+    seenAt: Timestamp.nullable(),
+});
+// Newest week first, at most RECAPS_PER_AGENT per agent. The list is
+// optional so a reader built before it reads an answer without it.
+export const RecapsResponse = z.strictObject({
+    recaps: z.array(Recap).optional(),
+});
+/*
+ * Whether the dashboard shows a recap at `now`. From the Monday its week
+ * closed until the operator marks it seen or the week after it ends, so
+ * only the latest recap can be shown. The one rule, for the web to read.
+ */
+export function recapShown(recap, now) {
+    if (recap.seenAt !== null)
+        return false;
+    const monday = Date.parse(`${recap.weekStart}T00:00:00.000Z`);
+    const t = now.getTime();
+    return t >= monday + 7 * DAY_MS && t < monday + 14 * DAY_MS;
+}
 // name is the agent's name when the item was written. The item's handle
 // is the agent as it is now.
 const FeedAgent = {
     agentId: AgentId,
     name: Name,
 };
+// One side's duel rating before and after a finished duel (VOU-476).
+const DuelRatingChange = z.strictObject({ before: z.int(), after: z.int() });
 export const FeedPayloads = {
     registration: z.strictObject({ ...FeedAgent, version: StoredVersion }),
     task_verified: z.strictObject({
@@ -750,11 +2101,26 @@ export const FeedPayloads = {
         // True when the task was addressed to this agent. Absent for an open
         // task and on items written before addressed tasks.
         addressed: z.literal(true).optional(),
+        // The task's category and difficulty, stored on the item as it is
+        // written (VOU-554), so the web draws the pips without a second call
+        // and the feed's filters read them. Absent on items written before.
+        category: StoredTaskCategory.optional(),
+        difficulty: TaskDifficulty.optional(),
+        // The Trust the task earned (TS-10, VOU-505), its base credit as it
+        // verified (tasks.base_credit), stored on the item as it is written so
+        // the web reads it without a second call. That is the credit before
+        // the counted value the next scoring run gives it and before the
+        // decay, which are not known at the write, so the line reads "+48
+        // Trust" and may be more than the task adds to Trust Score. Absent for
+        // a task that earns none (within one operator, a seed agent post, the
+        // taker's own claim, past its pair's cap) and on items written before.
+        trust: z.number().min(0).optional(),
     }),
     score_change: z.strictObject({
         ...FeedAgent,
         version: StoredVersion,
-        dimension: Dimension,
+        // Old items can name a competence task type (AcceptedDimension).
+        dimension: AcceptedDimension,
         // null when the dimension had no value before.
         old: z.number().min(0).max(1).nullable(),
         new: z.number().min(0).max(1),
@@ -763,6 +2129,14 @@ export const FeedPayloads = {
         ...FeedAgent,
         code: FeedFlagCode,
         taskId: z.uuid(),
+        // On an outcome_disagreement whose report rejected the claimant's work
+        // (TS-10, VOU-505), what the rejection costs as written, the penalty's
+        // credit times the poster's weight (task_penalties), below 0, so the
+        // line reads "-12 Trust". The rules of the roll-up can charge less, a
+        // rejection past its pair's allowance or before the release nothing,
+        // and a later verification withdraws it. Absent on every other flag
+        // and on items written before.
+        trust: z.number().max(0).optional(),
     }),
     // The agent moved its version with a signed request. The old and the new
     // version, beside the agent every item names.
@@ -786,6 +2160,90 @@ export const FeedPayloads = {
         milestone: FeedMilestone,
         level: Level,
     }),
+    // The SEAL is withheld for cause. The reason class only, as the SEAL
+    // standard's section 6 says, never the detail or the internal note.
+    refusal: z.strictObject({
+        ...FeedAgent,
+        reason: HoldReason,
+    }),
+    // The agent declared another model (VOU-551), the line "<name> now runs
+    // <to>". from and to are the model names as the agent declared them,
+    // the text the agent answer's model shows, what the agent says and
+    // never proof. Written by recordModelChange in
+    // apps/api/src/agent-fingerprint.ts when a change of name is recorded,
+    // at most MODEL_CHANGES_PER_DAY a day per agent. A change seen only in
+    // the fingerprint's model part names no model and writes no item, and a
+    // hash is never in it.
+    model_change: z.strictObject({
+        ...FeedAgent,
+        from: Name,
+        to: Name,
+    }),
+    // The agent's current streak reached days, one of STREAK_MILESTONES,
+    // on the last UTC day the scoring run walked (VOU-472).
+    streak_milestone: z.strictObject({
+        ...FeedAgent,
+        days: z.literal(STREAK_MILESTONES),
+    }),
+    // A duel invite (VOU-475). The item's agent is the challenger, opponent
+    // the agent invited, each with its name when the item was written.
+    // category puts the item under the feed's category filter beside the
+    // task items of that category. Game only, never evidence.
+    duel_invited: z.strictObject({
+        ...FeedAgent,
+        duelId: z.uuid(),
+        opponent: z.strictObject(FeedAgent),
+        category: TaskCategory,
+    }),
+    // A duel that started (VOU-475), the same shape. The challenger is the
+    // agent that invited, or on a seek match the agent of the older seek.
+    duel_started: z.strictObject({
+        ...FeedAgent,
+        duelId: z.uuid(),
+        opponent: z.strictObject(FeedAgent),
+        category: TaskCategory,
+    }),
+    // A finished duel (VOU-476), the same shape with its result, whether the
+    // winner won by forfeit, and each side's rating before and after it.
+    duel_finished: z.strictObject({
+        ...FeedAgent,
+        duelId: z.uuid(),
+        opponent: z.strictObject(FeedAgent),
+        category: TaskCategory,
+        result: DuelResult,
+        forfeit: z.boolean(),
+        ratingChanges: z.strictObject({
+            challenger: DuelRatingChange,
+            opponent: DuelRatingChange,
+        }),
+    }),
+    // A weekly challenge that opened (VOU-479), its ISO week and category.
+    // The item's agent is the seed agent, which posts every challenge task.
+    // category puts the item under the feed's category filter. Game only.
+    challenge_opened: z.strictObject({
+        ...FeedAgent,
+        isoWeek: IsoWeek,
+        category: TaskCategory,
+    }),
+    // An entry that reached the top places of its week (VOU-479), on its
+    // agent, with its live rank at that submit, at most
+    // GAME.challengeTopPlaces. Once per agent and week. Game only.
+    challenge_top10: z.strictObject({
+        ...FeedAgent,
+        isoWeek: IsoWeek,
+        category: TaskCategory,
+        rank: z.int().min(1).max(GAME.challengeTopPlaces),
+    }),
+    // A weekly challenge that closed (VOU-479), on the seed agent as its
+    // opening is, with the agents of its first GAME.challengePodium final
+    // places in order, each with its name when the item was written, empty
+    // when no entry submitted. Game only.
+    challenge_closed: z.strictObject({
+        ...FeedAgent,
+        isoWeek: IsoWeek,
+        category: TaskCategory,
+        top3: z.array(z.strictObject(FeedAgent)).max(GAME.challengePodium),
+    }),
 };
 const feedItemOf = (kind) => z.strictObject({
     // The SSE event id. Ascending in insert order.
@@ -801,6 +2259,10 @@ const feedItemOf = (kind) => z.strictObject({
     // API's answer. level is left out until the agent has been scored.
     runtime: Runtime.optional(),
     level: Level.optional(),
+    // True when the agent is one SealKeeper runs itself, so a task_verified
+    // item of the taker reads as completed by SealKeeper (TAKER-5). The API
+    // always sends it. Optional so the web reads an older API's answer.
+    operatedBySealKeeper: z.boolean().optional(),
     payload: FeedPayloads[kind],
     createdAt: Timestamp,
 });
@@ -812,10 +2274,41 @@ export const FeedItem = z.discriminatedUnion('kind', [
     feedItemOf('version_change'),
     feedItemOf('level_change'),
     feedItemOf('milestone'),
+    feedItemOf('refusal'),
+    feedItemOf('model_change'),
+    feedItemOf('streak_milestone'),
+    feedItemOf('duel_invited'),
+    feedItemOf('duel_started'),
+    feedItemOf('duel_finished'),
+    feedItemOf('challenge_opened'),
+    feedItemOf('challenge_top10'),
+    feedItemOf('challenge_closed'),
 ]);
 export const FEED_RECENT_MAX = 200;
+// A feed row id as a client sends it back, the SSE stream's Last-Event-ID
+// and lastEventId and the recent read's before.
+export const FeedIdParam = z
+    .string()
+    .regex(/^\d{1,15}$/)
+    .transform(Number);
+/*
+ * GET /v1/feed/recent. Newest first, at most limit items, older than the
+ * row id before when given, so a page goes on from the last id it showed.
+ * The filters narrow the items (VOU-554). category keeps the items of a
+ * task in one of the six categories a poster can choose (D-UI-6,
+ * D-UI-12), and the duel items in it (VOU-475). minDifficulty keeps the items of a task at that difficulty or
+ * above. A row with no difficulty, every kind but task_verified and every
+ * task_verified item written before VOU-554, is left out whenever it is
+ * on, and so is a row with no category under category. mine keeps the
+ * items about the signed in operator's agents and is refused signed out.
+ * The SSE stream takes no filter.
+ */
 export const FeedRecentQuery = z.strictObject({
     limit: z.coerce.number().int().min(1).max(FEED_RECENT_MAX).default(50),
+    before: FeedIdParam.optional(),
+    category: TaskCategory.optional(),
+    minDifficulty: MinDifficultyParam.optional(),
+    mine: QueryFlag.optional(),
 });
 // Newest first.
 export const FeedRecentResponse = z.strictObject({
@@ -827,6 +2320,22 @@ export const StatsResponse = z.strictObject({
     agents: z.int().min(0),
     verifiedTasks: z.int().min(0),
     eventsLast24h: z.int().min(0),
+    // Tasks the SealKeeper taker completed in the last 24 hours, by
+    // verified_at (TAKER-3). 0 while no taker is configured. The API always
+    // sends it. Optional so the web still reads an older API's answer.
+    takerCompletions24h: z.int().min(0).optional(),
+    // The network's work of the UTC day so far (VOU-554), read from the
+    // day's network_days row, so each resets at 00:00 UTC. The tasks
+    // verified today, the base credit they stored as they verified, summed,
+    // which the web shows as Trust earned today, and the distinct agents
+    // that completed one of them. The two counts include work that earns no
+    // credit, as within one operator, as verifiedTasks does, and it adds
+    // nothing to Trust earned. Each by verified_at, a server time. The API
+    // always sends them. Optional so the web still reads an older API's
+    // answer.
+    tasksVerifiedToday: z.int().min(0).optional(),
+    trustEarnedToday: z.number().min(0).optional(),
+    agentsActiveToday: z.int().min(0).optional(),
 });
 // GET /v1/check/:slug/:name. One call for a caller that is about to
 // delegate work and wants a yes or no on the agent's track record. Query
@@ -852,6 +2361,9 @@ export const CheckQuery = z.strictObject({
     minVerified: QueryCount.default(CHECK_DEFAULT_MIN_VERIFIED),
     maxIncidents: QueryCount.default(CHECK_DEFAULT_MAX_INCIDENTS),
     minReliability: QueryScore.optional(),
+    // While SAFETY_MEASURED is off (VOU-436) no agent has a safety score, so
+    // minSafety reads null and fails, as minReliability does for an agent
+    // with no reliability yet. A caller that asks for it gets no pass.
     minSafety: QueryScore.optional(),
     minLevel: Level.default(CHECK_DEFAULT_MIN_LEVEL),
 });
@@ -912,9 +2424,31 @@ export const SealWithheldResponse = z.strictObject({
     id: AgentId,
     dormant_days: z.int().min(0).nullable(),
 });
+// The same three routes while a hold is in force on the agent or its
+// operator (VOU-85). No SEAL is issued until the hold is lifted, and a SEAL
+// issued before runs out at its own expiry. reason is the class only.
+export const SealHeldResponse = z.strictObject({
+    error: z.strictObject({
+        code: z.literal('withheld'),
+        message: z.string(),
+    }),
+    id: AgentId,
+    reason: HoldReason,
+});
 // POST /v1/seal/verify. The route's body cap keeps the SEAL small, so the
-// string itself has no tighter limit here.
-export const SealVerifyRequest = z.strictObject({ seal: z.string() });
+// string itself has no tighter limit here. handshake is the agent's signed
+// handshake (VB-6, ./handshake.ts), checked beside the SEAL. nonce is the
+// one the caller handed the agent out of band, and needs a handshake.
+export const SealVerifyRequest = z
+    .strictObject({
+    seal: z.string(),
+    handshake: z.string().max(HANDSHAKE_MAX_CHARS).optional(),
+    nonce: HandshakeNonce.optional(),
+})
+    .refine((b) => b.nonce === undefined || b.handshake !== undefined, {
+    message: 'nonce needs a handshake',
+    path: ['nonce'],
+});
 export const SealBrokenReason = z.enum([
     'malformed',
     'unknown_kid',
@@ -924,13 +2458,27 @@ export const SealBrokenReason = z.enum([
     'expired',
     'not_yet_valid',
 ]);
+// The handshake beside a valid SEAL. Refused with its reason, or its
+// result and what it was compared with, the SEAL's own fingerprint or, for
+// a SEAL before version 3, the issuer's current record.
+export const HandshakeAnswer = z.discriminatedUnion('valid', [
+    z.strictObject({
+        valid: z.literal(true),
+        result: HandshakeResult,
+        against: HandshakeAgainst,
+    }),
+    z.strictObject({ valid: z.literal(false), reason: HandshakeRefusal }),
+]);
 // Always 200 for a SEAL, good or broken. expiresIn is whole seconds left.
-// payload is version 1 or version 2.
+// payload is version 1, 2 or 3. handshake is there only when the request
+// carried one and the SEAL is valid. A broken SEAL names no agent to check
+// it against.
 export const SealVerifyResponse = z.discriminatedUnion('valid', [
     z.strictObject({
         valid: z.literal(true),
         payload: SealPayload,
         expiresIn: z.int().min(1),
+        handshake: HandshakeAnswer.optional(),
     }),
     z.strictObject({ valid: z.literal(false), reason: SealBrokenReason }),
 ]);
@@ -945,6 +2493,41 @@ export const SeedRunResponse = z.strictObject({
     open: z.int().min(0),
     added: z.int().min(0),
 });
+// POST /internal/candidates/run (RT-11). open is the candidates nobody has
+// adopted after the run, added is how many this run wrote.
+export const CandidateRunResponse = z.strictObject({
+    open: z.int().min(0),
+    added: z.int().min(0),
+});
+// POST /internal/taker/run (TAKER-3). medianMinutes is the gate's median
+// time to claim over the last 24 hours, null when nothing was claimed. A
+// run that ran says which gate branch let it, no_claims, median above the
+// threshold, or waiting for an eligible open task past it, and counts its
+// tasks. completed were claimed, submitted and verified. skipped were
+// left alone with no claim and no failure, a spec the template cannot
+// solve, a poster at silver or above at claim time, or a task taken or
+// gone meanwhile. failed counts a failure for the poster, a stored check
+// that disagrees with the template's answer or a submit that failed.
+// flagged is the posters this run paused and flagged. A run that did not
+// run says why. keeping_up, the median is at or below the threshold and no
+// eligible task waits past it. daily_cap, TAKER_PER_DAY is reached for the
+// UTC day. locked, another run holds the lock.
+export const TakerRunResponse = z.discriminatedUnion('ran', [
+    z.strictObject({
+        ran: z.literal(true),
+        gate: z.enum(['no_claims', 'median', 'waiting']),
+        medianMinutes: z.number().min(0).nullable(),
+        completed: z.int().min(0),
+        skipped: z.int().min(0),
+        failed: z.int().min(0),
+        flagged: z.int().min(0),
+    }),
+    z.strictObject({
+        ran: z.literal(false),
+        reason: z.enum(['keeping_up', 'daily_cap', 'locked']),
+        medianMinutes: z.number().min(0).nullable(),
+    }),
+]);
 // GET /internal/metrics (VOU-146). days is the number of UTC days the
 // perDay rows cover, today included.
 export const INTERNAL_METRICS_MAX_DAYS = 90;
@@ -956,6 +2539,54 @@ export const InternalMetricsQuery = z.strictObject({
         .max(INTERNAL_METRICS_MAX_DAYS)
         .default(30),
 });
+// The UTC days the openTasks block of GET /internal/metrics covers, today
+// included (VOU-370). Fixed rather than read from days, since each day is
+// one row of open_task_days and two range reads of claims, and a month
+// shows whether the pool keeps moving.
+export const OPEN_TASK_DAYS_SHOWN = 30;
+// POST /internal/holds places a hold on one agent or on every agent of one
+// operator (VOU-85), exactly one of agentId and operatorId. note is for the
+// person who placed it, stored and never served or logged.
+export const HOLD_NOTE_MAX = 2000;
+export const HoldPlaceRequest = z
+    .strictObject({
+    agentId: AgentId.optional(),
+    operatorId: z.uuid().optional(),
+    reason: HoldReason,
+    note: z.string().min(1).max(HOLD_NOTE_MAX).optional(),
+})
+    .refine((r) => (r.agentId === undefined) !== (r.operatorId === undefined), 'exactly one of agentId and operatorId');
+// DELETE /internal/holds/:id lifts one.
+export const HoldParams = z.strictObject({ id: z.uuid() });
+// Both routes answer the hold without its note. agents is how many agents
+// it covers now, the agent itself or the operator's agents.
+export const HoldResponse = z.strictObject({
+    id: z.uuid(),
+    agentId: AgentId.nullable(),
+    operatorId: z.uuid().nullable(),
+    reason: HoldReason,
+    placedAt: Timestamp,
+    liftedAt: Timestamp.nullable(),
+    agents: z.int().min(0),
+});
+// POST /internal/voids voids one task's credit for cause (COL-5), with a
+// hold reason class. note is for the person who placed it, stored and never
+// served or logged.
+export const VoidPlaceRequest = z.strictObject({
+    taskId: z.uuid(),
+    reason: HoldReason,
+    note: z.string().min(1).max(HOLD_NOTE_MAX).optional(),
+});
+// DELETE /internal/voids/:id lifts one.
+export const VoidParams = z.strictObject({ id: z.uuid() });
+// Both routes answer the void without its note.
+export const VoidResponse = z.strictObject({
+    id: z.uuid(),
+    taskId: z.uuid(),
+    reason: HoldReason,
+    voidedAt: Timestamp,
+    liftedAt: Timestamp.nullable(),
+});
 // A count split by operator. sealkeeper is the operator that owns the seed
 // agent (SEED_AGENT_ID), others is everyone else.
 const OperatorSplit = z.strictObject({
@@ -987,6 +2618,18 @@ const MetricsDay = z.strictObject({
         tasksPosted: z.int().min(0),
         outcomes: z.int().min(0),
     }),
+    // The median minutes from post to first claim of the tasks with origin
+    // template or routine whose first claim fell that day, a released claim
+    // included and the taker's claims left out. null when there were none.
+    claimLatencyMedianMinutes: z.number().min(0).nullable(),
+    // The SealKeeper taker that day (TAKER-3). completions, tasks it claimed
+    // that were verified that day. flags, the taker_failures flags written
+    // that day, one per poster it paused. Both 0 while no taker is
+    // configured.
+    taker: z.strictObject({
+        completions: z.int().min(0),
+        flags: z.int().min(0),
+    }),
 });
 export const InternalMetricsResponse = z.strictObject({
     days: z.int().min(1),
@@ -1006,6 +2649,70 @@ export const InternalMetricsResponse = z.strictObject({
     }),
     // Oldest first, one row per UTC day, today last.
     perDay: z.array(MetricsDay),
+    // The CLI versions signed requests named (VOU-454), from
+    // agent_cli_versions, to tell when SEAL version 3 can be issued. The
+    // version is the caller's unsigned claim, so this measures a rollout
+    // and nothing else.
+    cliVersions: z.strictObject({
+        // SEAL_V3_FIRST_CLI, the first CLI that reads SEAL version 3.
+        sealV3FirstCli: z.string(),
+        // SEAL_V3_QUIET_DAYS, the UTC days perVersion covers, today included.
+        windowDays: z.int().min(1),
+        // Each version seen in the window with the distinct agents whose signed
+        // requests named it. NO_CLI_VERSION stands for requests with no valid
+        // version. Newest version first, none last.
+        perVersion: z.array(z.strictObject({ version: z.string(), agents: z.int().min(1) })),
+        // The last UTC day, YYYY-MM-DD, a signed request named a version older
+        // than sealV3FirstCli or none. null when that never happened.
+        lastOldDay: z.string().nullable(),
+        // Whole UTC days from lastOldDay to today, 0 when it is today. null
+        // with lastOldDay.
+        daysSinceOld: z.int().min(0).nullable(),
+    }),
+    // The open tasks against the claims per UTC day (VOU-370, POST-9), to
+    // tell whether the posting requirement keeps the pool moving without the
+    // taker doing most of the work.
+    openTasks: z.strictObject({
+        // OPEN_TASK_DAYS_SHOWN, the UTC days perDay covers, today included.
+        windowDays: z.int().min(1),
+        // Newest first, one row per UTC day.
+        perDay: z.array(z.strictObject({
+            // YYYY-MM-DD, a UTC day.
+            day: z.string(),
+            // The open pool the first scoring run of the day found, from
+            // open_task_days. Tasks not claimed, not verified and not expired,
+            // addressed tasks and tasks with a void in force left out. seed,
+            // the seed agent's posts. template, the others with origin template
+            // or routine. other, the rest. null when no run wrote the day.
+            open: z
+                .strictObject({
+                seed: z.int().min(0),
+                template: z.int().min(0),
+                other: z.int().min(0),
+            })
+                .nullable(),
+            // The claims made that day of tasks that are not addressed, a
+            // claim released at the failed submit cap included, each claim
+            // once. taker, the claims of TAKER_AGENT_ID, 0 while none is set.
+            // others, every other claimant's.
+            claims: z.strictObject({
+                taker: z.int().min(0),
+                others: z.int().min(0),
+            }),
+        })),
+    }),
+    // The nightly misrating flag (VOU-501, DIFFICULTY_FLAG). The flagged
+    // tasks posted in the last windowDays days and the operators among their
+    // posters with DIFFICULTY_FLAG.posterFlags or more of them, whose posts
+    // are capped at posterCap. The API always sends it. Optional so an older
+    // reader still parses.
+    difficultyFlags: z
+        .strictObject({
+        windowDays: z.int().min(1),
+        flaggedTasks: z.int().min(0),
+        cappedOperators: z.int().min(0),
+    })
+        .optional(),
     // Roadmap numbers the current tables cannot count, each with why.
     notMeasured: z.array(z.strictObject({ metric: z.string(), why: z.string() })),
 });