@wildo-ai/platform-core-shared 1.1.4 → 1.1.6

package/dist/esm/workbench/workbench-creation-plane.custom.shared.schemas.js

@@ -1,5 +1,8 @@
+import { MetaWorkflow_ClarificationAction, MetaWorkflow_EvaluationVerdict } from '@wildo-ai/saas-models/meta-workflows';
+import { EngineCapability, } from '@wildo-ai/saas-models';
 import { z } from 'zod';
-import { initZodDecorators } from '@wildo-ai/zod-decorators';
+import { initZodDecorators, StringEditMode } from '@wildo-ai/zod-decorators';
+import { WorkbenchSpecificationArtifactConcern } from './workbench-resources.custom.shared.schemas.js';
 initZodDecorators(z);
 /**
  * The CREATION PLANE's shared vocabulary — schemas for the four companion-runtime resource
@@ -44,6 +47,26 @@ export var WorkbenchCreationPlaneBehavior;
     WorkbenchCreationPlaneBehavior["RUN_WRITE_RECORDS"] = "creation-plane.run-write-records";
     /** The execution-trace session index. */
     WorkbenchCreationPlaneBehavior["TRACE_SESSIONS"] = "creation-plane.trace-sessions";
+    /** The governance questionnaires' unanswered prompts, flattened one row per question. */
+    WorkbenchCreationPlaneBehavior["GOVERNANCE_DOCUMENTS"] = "creation-plane.governance-documents";
+    WorkbenchCreationPlaneBehavior["GOVERNANCE_QUESTIONS"] = "creation-plane.governance-questions";
+    /** The build lane's dispatch history, one row per attempt. */
+    WorkbenchCreationPlaneBehavior["BUILD_DISPATCH_PLAN"] = "creation-plane.build-dispatch-plan";
+    WorkbenchCreationPlaneBehavior["BUILD_DISPATCHES"] = "creation-plane.build-dispatches";
+    /** The playbook runs suspended waiting on a person. */
+    WorkbenchCreationPlaneBehavior["PLAYBOOK_RUNS"] = "creation-plane.playbook-runs";
+    WorkbenchCreationPlaneBehavior["WAITING_PLAYBOOK_RUNS"] = "creation-plane.waiting-playbook-runs";
+    /** The coding runs parked on a question. */
+    WorkbenchCreationPlaneBehavior["CODING_LANE_STATUS"] = "creation-plane.coding-lane-status";
+    WorkbenchCreationPlaneBehavior["PARKED_CODING_QUESTIONS"] = "creation-plane.parked-coding-questions";
+    /** The dossier: every declared interview question × the creator's answer from `creator-inputs`. */
+    WorkbenchCreationPlaneBehavior["DOSSIER_ENTRIES"] = "creation-plane.dossier-entries";
+    /** HOME's lines (#1454): what happened, what is asked of the creator, what they could do next — one derivation. */
+    WorkbenchCreationPlaneBehavior["HOME_LINES"] = "creation-plane.home-lines";
+    /** The four creation OUTCOMES with their standing, derived from the landed families and the build plan. */
+    WorkbenchCreationPlaneBehavior["CREATION_OUTCOMES"] = "creation-plane.creation-outcomes";
+    /** The application's provider secrets per environment — what it needs and what is set, never a value (#1637). */
+    WorkbenchCreationPlaneBehavior["APPLICATION_SECRETS"] = "creation-plane.application-secrets";
 })(WorkbenchCreationPlaneBehavior || (WorkbenchCreationPlaneBehavior = {}));
 /** Membership test the companion's source routes by. */
 export const WORKBENCH_CREATION_PLANE_BEHAVIOR_IDS = Object.freeze(Object.values(WorkbenchCreationPlaneBehavior));
@@ -62,6 +85,64 @@ export const WORKBENCH_CREATION_PLANE_BEHAVIOR_IDS = Object.freeze(Object.values
 export function sanitizeWorkbenchCreationPlaneIdentity(value) {
     return value.replaceAll('.', '__').replace(/[^a-zA-Z0-9_-]/g, '-');
 }
+/**
+ * A dossier row's id — `sanitize(playbookRef)--sanitize(questionRef)` for the step itself, and
+ * `sanitize(playbookRef)--<instanceKey>--sanitize(questionRef)` for one of its INSTANCES (#1609).
+ *
+ * Shared for the same reason the sanitizer is: the companion's projection EMITS the id and the
+ * conversation's answer tool ADDRESSES a row by it, and two copies would let the two drift apart the
+ * first time the shape changed — which is exactly what adding an instance did. An instance key is a
+ * kebab slug, so it needs no sanitizing and cannot contain the `--` separator's ambiguity in a way the
+ * question ref does not already (both are refused as duplicates by the projection, never guessed at).
+ */
+export function workbenchDossierEntryIdentity(input) {
+    const step = sanitizeWorkbenchCreationPlaneIdentity(input.playbookRef);
+    const question = sanitizeWorkbenchCreationPlaneIdentity(input.questionRef);
+    return input.instanceKey ? `${step}--${input.instanceKey}--${question}` : `${step}--${question}`;
+}
+/**
+ * The creation plane's CORRELATION VOCABULARY on the engine's actor task — the one named source for
+ * the `context.correlation` envelope's domain and ref keys (#1348, #1330).
+ *
+ * The engine owns the envelope and validates only that keys and values are non-empty strings; this
+ * domain owns the keys. Both ends read them: the companion's coding-agent dispatch WRITES the
+ * envelope when it admits a run for a build-plan task, and the workbench READS it to draw the run's
+ * build-plan task as a resolved link. Two spellings of one key would be a join that silently stops
+ * matching, so neither end spells it.
+ *
+ * The value under {@link WorkbenchTaskCorrelationRef.BUILD_PLAN_TASK} is the build-plan ROW's
+ * identity — `sanitizeWorkbenchCreationPlaneIdentity(taskRef)` — so a reader holding the envelope
+ * addresses the row with no lookup.
+ */
+export const WORKBENCH_TASK_CORRELATION_DOMAIN = 'application-creation';
+export var WorkbenchTaskCorrelationRef;
+(function (WorkbenchTaskCorrelationRef) {
+    /** The `workbenchBuildPlanTaskId` of the build-plan task this coding run was dispatched for. */
+    WorkbenchTaskCorrelationRef["BUILD_PLAN_TASK"] = "buildPlanTaskRef";
+    /**
+     * The creation CONVERSATION (the engine conversational execution's `executionId`) a run was
+     * started from, when it was (#1454). The conversation page joins a thread to its runs on this
+     * key; a run started from the board or the CLI carries none.
+     */
+    WorkbenchTaskCorrelationRef["CONVERSATION"] = "conversationId";
+})(WorkbenchTaskCorrelationRef || (WorkbenchTaskCorrelationRef = {}));
+/**
+ * The build-plan row a task's correlation envelope names, or `undefined` when the task was not
+ * dispatched for one — a task with no build-plan task is the normal case for anything the creation
+ * plane did not admit, and it must read as ABSENT rather than as loading.
+ */
+export function readBuildPlanTaskCorrelation(context) {
+    if (typeof context !== 'object' || context === null)
+        return undefined;
+    const correlation = context.correlation;
+    if (typeof correlation !== 'object' || correlation === null)
+        return undefined;
+    const { domain, refs } = correlation;
+    if (domain !== WORKBENCH_TASK_CORRELATION_DOMAIN || typeof refs !== 'object' || refs === null)
+        return undefined;
+    const value = refs[WorkbenchTaskCorrelationRef.BUILD_PLAN_TASK];
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
 /**
  * The dispatch status of one build-plan task — computed, never stored.
  *
@@ -75,6 +156,86 @@ export var WorkbenchBuildPlanTaskStatus;
     WorkbenchBuildPlanTaskStatus["LANDED"] = "landed";
     WorkbenchBuildPlanTaskStatus["BLOCKED"] = "blocked";
 })(WorkbenchBuildPlanTaskStatus || (WorkbenchBuildPlanTaskStatus = {}));
+/**
+ * Why a READY build-plan task cannot make progress, so dispatch passes over it.
+ *
+ * Each member carries a DIFFERENT remedy, and the remedy is the only thing the operator gets. The
+ * companion's dispatch service is the only producer; the workbench board renders it. Declared here
+ * rather than beside the producer for the reason `Workbench_BuildDispatchPhase` gives: a browser
+ * bundle cannot import the companion, and re-spelling the members board-side would be a second
+ * source (#1451).
+ *
+ * None of them refuses the queue. A stuck task is skipped so every unrelated branch proceeds, and a
+ * dispatch refuses only when NOTHING ready can move. The READ door never refuses: it answers with the
+ * stuck tasks, because "nothing can run, and here is why" is an answer.
+ */
+export var Workbench_BuildTaskStuckReason;
+(function (Workbench_BuildTaskStuckReason) {
+    /** It already ran, and its declared product is absent even from the working tree: fix the declaration or the work. */
+    Workbench_BuildTaskStuckReason["COMPLETED_UNLANDED"] = "completed_unlanded";
+    /**
+     * It already ran, and its declared product IS in the working tree but not committed. Landing means
+     * committed because acceptance is a commit.
+     *
+     * Under GUIDED that is the whole story, and the remedy is to review and commit what the run wrote.
+     * Under the autonomy posture the loop has ALREADY tried to commit it (#1534), so reaching this state
+     * means its accept REFUSED a path — carried changes from before the run, edited since, or not this
+     * run's — and the companion's warning names which. The remedy is that refusal's, not a blind commit.
+     */
+    Workbench_BuildTaskStuckReason["COMPLETED_AWAITING_COMMIT"] = "completed_awaiting_commit";
+    /** Its run suspended on a question nobody has answered; re-dispatching would abandon that session. */
+    Workbench_BuildTaskStuckReason["PARKED_AWAITING_ANSWER"] = "parked_awaiting_answer";
+    /** It produces a governed document the engine catalog does not define, so no run can author it. */
+    Workbench_BuildTaskStuckReason["NO_DOCUMENT_BLUEPRINT"] = "no_document_blueprint";
+    /**
+     * Its coding runs FAILED as many times as the attempt budget allows (#1536), so another identical
+     * dispatch is not offered. Only failures the task caused count: a run failing on a check that was
+     * already red completes instead (`carriedVerificationFailures`), so this cannot be reached on the
+     * tree's account. Read the last failure, fix its cause, and re-arm the task.
+     */
+    Workbench_BuildTaskStuckReason["ATTEMPTS_EXHAUSTED"] = "attempts_exhausted";
+    /**
+     * A run of it is LIVE right now — selected, admitted or running (#1528). Under a parallel build
+     * wave several tasks run at once, and the next selection must pass over one already being built,
+     * or two agents would build the same task. Nobody's move: it clears when that run settles.
+     */
+    Workbench_BuildTaskStuckReason["IN_FLIGHT"] = "in_flight";
+})(Workbench_BuildTaskStuckReason || (Workbench_BuildTaskStuckReason = {}));
+/**
+ * How far one BUILD DISPATCH got — the whole of what `GET /build/dispatches` can honestly say.
+ *
+ * ## Why it lives in the SHARED package rather than beside the service that sets it
+ *
+ * Both ends of this vocabulary are real consumers. The companion's dispatch service is the only
+ * PRODUCER — since #1359 by PROJECTION: every dispatch is an actor-system execution from the moment
+ * its task is selected, and the phase is a pure function of that execution's row
+ * (`projectBuildDispatchPhase`), not a record the companion keeps. Until then it was an in-memory
+ * list of five that a companion restart emptied. The workbench's build lane reads it to decide
+ * whether a dispatch reads as working, done or broken, and a browser bundle cannot import the
+ * companion. Declared companion-side, the board
+ * would have had to re-spell the four members — the second-source defect the creation board's own
+ * client docstring refuses by name. So it is declared ONCE here, where the workbench vocabulary
+ * already lives and which the companion already imports.
+ *
+ * ## The two executors resolve at DIFFERENT moments, and that is the whole reason for four members
+ *
+ * A companion generation step's dispatch resolves when the step has FINISHED. A coding task's
+ * resolves when the run is ADMITTED, with the agent still working — its outcome is the durable
+ * actor-task row the record names. Measured 2026-09-13 on Wonder CRM: the record said `ok: true`
+ * for `build-task-company-schema` at the instant its run started, and the route told the caller to
+ * poll that record "for the outcome", so a script following it read an admitted run as a success.
+ */
+export var Workbench_BuildDispatchPhase;
+(function (Workbench_BuildDispatchPhase) {
+    /** Selected and handed to its executor; nothing has resolved yet. */
+    Workbench_BuildDispatchPhase["SUBMITTED"] = "submitted";
+    /** A coding run was admitted and is running. Its outcome is the durable actor-task row `codingTaskId`. */
+    Workbench_BuildDispatchPhase["ADMITTED"] = "admitted";
+    /** A companion generation step ran to completion. */
+    Workbench_BuildDispatchPhase["FINISHED"] = "finished";
+    /** The dispatch threw — before a coding run was admitted, or while a generation step ran. */
+    Workbench_BuildDispatchPhase["FAILED"] = "failed";
+})(Workbench_BuildDispatchPhase || (Workbench_BuildDispatchPhase = {}));
 /**
  * One playbook's row on the eligibility board.
  *
@@ -102,9 +263,13 @@ export const Workbench_Playbook_Schema = z.object({
      * what it carried: one application-level value stamped onto every row, while the workbench rendered
      * it beside each playbook as if it described that playbook. The derived application phase is gone
      * (`MetaWorkflow_Phase`); this is the label that was always true of the row.
+     *
+     * A STRING, not the enum: the vocabulary is `MetaWorkflow_Phase` in `saas-specifications`, which this
+     * package deliberately does not import. The map's lane headers (#1326) word each value through the
+     * board's own copy block, keyed by the value, so a member added to the enum renders its key — visibly
+     * unworded — rather than a guess.
      */
-    phase: z.string().min(1).isSummaryField(),
-    /** One sentence: what running this playbook produces. */
+    phase: z.string().min(1).isSummaryField(), /** One sentence: what running this playbook produces. */
     intent: z.string().isSummaryField(),
     /** The deterministic gate's verdict: may this playbook run right now. */
     eligible: z.boolean().isSummaryField(),
@@ -112,19 +277,46 @@ export const Workbench_Playbook_Schema = z.object({
     unmet: z.array(z.string()).isSummaryField(),
     /** Every READINESS precondition holds and only SEQUENCING ones do not: information, not a refusal. */
     blockedOnlyBySequencing: z.boolean().isSummaryField(),
-    /** This playbook interviews the creator, so a run will stop and ask. */
+    /** This playbook DECLARES an interview. Whether it is answered is `unansweredQuestionRefs`. */
     requiresElicitation: z.boolean().isSummaryField(),
+    /**
+     * The declared questions the dossier does not answer yet (#1454). Empty means a run can proceed
+     * without asking — the run reads its interview from the dossier — so this, not
+     * `requiresElicitation`, is what "will stop and ask" means now.
+     */
+    unansweredQuestionRefs: z.array(z.string().min(1)).isSummaryField(),
     /** Families this playbook writes that ALREADY have content — a run implies an overwrite. */
     wouldReplace: z.array(z.string()).isSummaryField(),
-    /** Families no render profile can land yet. A run would refuse; the board says so first. */
+    /** Declaring playbooks for direct and composed output families. Derived board data, never persisted authority. */
+    outputOwners: z.array(z.object({ family: z.string(), playbookRefs: z.array(z.string()) })).isSummaryField(),
+    /** Child references missing from the catalog; distinct from a missing output renderer. */
+    unresolvedPlaybookRefs: z.array(z.string()).isSummaryField(),
+    /** Direct or composed families without a renderer; child impact is descriptive, not a parent readiness gate. */
     unlandableFamilies: z.array(z.string()).isSummaryField(),
     /** Landed outputs whose declared inputs have moved since. An ANNOTATION, never a gate. */
     staleOutputs: z.array(z.object({
         family: z.string().min(1),
         changedInputs: z.array(z.string()),
     })).isSummaryField(),
+    /**
+     * Whether the application's LINE runs this playbook at all (#1607): true when it is in the line's active
+     * set. Distinct from `eligible`, which asks whether an active playbook may run RIGHT NOW. Absent when the
+     * board was computed without a line.
+     */
+    activeInLine: z.boolean().optional().isSummaryField(),
+    /**
+     * Why it is, or is not, in the active set — one sentence, already rendered by the runtime, like `unmet`:
+     * in the line, outside it, producing only what does not apply, or waiting for the line to be declared.
+     * A sentence rather than the status value because this package does not import the vocabulary.
+     */
+    activationDetail: z.string().optional().isSummaryField(),
+    /**
+     * The instances of this playbook the creator opened and has not closed (#1609): each one's key and what it
+     * is for. The default instance is not listed; it is the playbook itself. Absent without a line.
+     */
+    openInstances: z.array(z.object({ instanceKey: z.string().min(1), purpose: z.string().min(1) })).optional().isSummaryField(),
     /** When the served board was computed — the cache's honesty field, rendered as "as of". */
-    computedAt: z.string().min(1).isSummaryField(),
+    computedAt: z.date().isSummaryField(),
 });
 /**
  * One build-plan task in the DISPATCH view.
@@ -144,7 +336,7 @@ export const Workbench_BuildPlanTask_Schema = z.object({
     targetKind: z.string().min(1).isSummaryField(),
     /** Which phase of building the application this task belongs to (context, never ordering). */
     functionalTopic: z.string().min(1).isSummaryField(),
-    status: z.enum(WorkbenchBuildPlanTaskStatus).isSummaryField(),
+    status: z.enum(WorkbenchBuildPlanTaskStatus).systemEnum('WorkbenchBuildPlanTaskStatus').isSummaryField(),
     /** Task refs that must land first — the only thing that decides what may run next. */
     prerequisiteTaskRefs: z.array(z.string()).isSummaryField(),
 });
@@ -171,13 +363,15 @@ export const Workbench_RunWriteRecord_Schema = z.object({
     /** The playbook this run executed — every record has one. */
     workbenchPlaybookId: z.string().min(1).isForeignKey().isSummaryField(),
     /**
-     * The execution-trace session the run recorded under, resolved by PREFIX (a runId is
-     * `<sessionId>-<playbookRef>-<ts>`). NULL when no listed session matches — a register can
-     * legitimately outlive its trace directory, and a dangling id would render as a broken link.
+     * The execution-trace session the run recorded under, as the register RECORDED it (#1358 — the
+     * run id is the actor execution's id and carries no session, so the join is a recorded field, not
+     * a prefix match). NULL when the record carries none, or when no listed session matches — a
+     * register can legitimately outlive its trace directory, and a dangling id would render as a
+     * broken link.
      */
     workbenchTraceSessionId: z.string().min(1).isForeignKey().isSummaryField().nullable(),
-    /** When the run recorded its writes (ISO). */
-    at: z.string().min(1).isSummaryField(),
+    /** When the run recorded its writes. */
+    at: z.date().isSummaryField(),
     files: z.array(z.object({
         /** App-root-relative path of the written file. */
         path: z.string().min(1),
@@ -186,18 +380,147 @@ export const Workbench_RunWriteRecord_Schema = z.object({
     })).isSummaryField(),
     /** Projected count, so a list can say "wrote 7 files" without rendering the array. */
     fileCount: z.number().int().isSummaryField(),
+    /** The commit the workbench's `accept` made of these writes (#1454, Step 7); NULL until one has. */
+    acceptedCommitSha: z.string().min(1).isSummaryField().nullable(),
 });
 /** One execution-trace session — the queryable index the board links from. */
 export const Workbench_TraceSession_Schema = z.object({
     /** Emitted by the behavior — session ids admit `.` (`dev-<ISO-ish>` directory names), so sanitized (see the playbook id note). */
     workbenchTraceSessionId: z.string().min(1).isPrimaryKey().isSummaryField(),
     sessionId: z.string().min(1).isSummaryField(),
-    /** When the session started (ISO-ish; embedded in the session directory name). */
-    startedAt: z.string().min(1).isSummaryField(),
+    /** When the session started (the session manifest's own `startedAt`). */
+    startedAt: z.date().isSummaryField(),
     label: z.string().min(1).isSummaryField().nullable(),
     eventCount: z.number().int().isSummaryField(),
     stepCount: z.number().int().isSummaryField(),
 });
+/**
+ * One governance QUESTION a creator still owes an answer to.
+ *
+ * ## Why one row per question rather than per questionnaire
+ *
+ * The companion answers questionnaires — a document definition and the prompts it asks. The thing a
+ * creator ACTS on is one question, and the thing a board queues is one question, so the row is the
+ * question and the document it belongs to travels on it. That is the same flattening
+ * `Workbench_RunWriteRecord` does to a run's files, and for the same reason: a resource's row is
+ * whatever a reader selects.
+ *
+ * ## What it deliberately does NOT carry
+ *
+ * The ANSWER. Landing answers is a dispatch against the `document-facts-authored` family and goes
+ * through the companion's own service; a row here is the question as asked. Giving the row an answer
+ * field would make this the second place an answer lives, which is the ledger
+ * `one-source-of-truth.md` rule 5 refuses.
+ */
+/**
+ * One GOVERNED DOCUMENT whose questionnaire a person must answer — the document half of governance.
+ *
+ * ## Why this is its own resource rather than fields on the question row
+ *
+ * `derivedFactRefs` and the ask count are facts about the DOCUMENT, not about any one question, and
+ * a document-level fact repeated on every question row is a value with no owner: nothing says which
+ * copy is authoritative, and eight rows of one document can disagree.
+ *
+ * It is also what the board's document selector is a list OF. Before this it grouped question rows
+ * by `definitionRef` and had nowhere to read the derived facts from — so a panel showing only the
+ * human half presented four questions for a document declaring eight, and a reader had no way to
+ * tell a short questionnaire from a broken one.
+ */
+/**
+ * Where a dossier entry STANDS — the two states a question a playbook asks can be in from the
+ * creator's side (#1454). "Read from the product" (a typed config key) is a third source the
+ * dossier gains with the governed-document join (Step 6); it is not a standing of an interview
+ * question, so it is not here.
+ */
+export var WorkbenchDossierEntryStanding;
+(function (WorkbenchDossierEntryStanding) {
+    /** The creator answered; the value is in the committed dossier. */
+    WorkbenchDossierEntryStanding["FROM_YOU"] = "from-you";
+    /** The playbook asks it and nobody has answered. */
+    WorkbenchDossierEntryStanding["STILL_NEEDED"] = "still-needed";
+    /**
+     * An opened INSTANCE of the step asks it and has no answer of its own, so it runs on the step's own
+     * answer (#1609). Answered, not needed: nothing is blocked, and an answer given here replaces the
+     * step's for this instance only.
+     */
+    WorkbenchDossierEntryStanding["FROM_THE_STEP"] = "from-the-step";
+    /**
+     * The PRODUCT answers it: a governed-document fact the application's own declarations establish,
+     * read rather than asked (#1454, gap 4; `compliance-is-derived-from-the-product.md`). Never
+     * "needed" and never editable here — its answer changes when what the product declares changes.
+     */
+    WorkbenchDossierEntryStanding["READ_FROM_PRODUCT"] = "read-from-product";
+})(WorkbenchDossierEntryStanding || (WorkbenchDossierEntryStanding = {}));
+export const Workbench_GovernanceDocument_Schema = z.object({
+    /** The document's ref, sanitized — a definition ref carries `:` and `.`. */
+    workbenchGovernanceDocumentId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The governed document this questionnaire belongs to. */
+    definitionRef: z.string().min(1).isSummaryField(),
+    /** How many facts a PERSON must establish for it. */
+    askCount: z.number().int().isSummaryField(),
+    /**
+     * The facts the GENERATOR derives, named rather than omitted.
+     *
+     * Naming them is what lets a reader tell a short questionnaire from a broken one: a document
+     * declaring eight facts of which four are derived shows four questions, and without this the
+     * other four look missing rather than answered.
+     */
+    derivedFactRefs: z.array(z.string().min(1)).isSummaryField(),
+    /**
+     * How many of the asked facts NO authored declaration establishes yet (#1454, Step 6) — the
+     * dossier's "still needed" for this document. `askCount` is total; this is what is left.
+     */
+    openCount: z.number().int().isSummaryField(),
+    /**
+     * The creator ASKED FOR this document: a draft of it has landed. An open fact of a drafted document
+     * is waiting on the person NOW (the draft carries the gap); an open fact of a document nobody
+     * drafted is merely not told yet, and does not count as asked of you.
+     */
+    drafted: z.boolean().isSummaryField(),
+});
+export const Workbench_GovernanceQuestion_Schema = z.object({
+    /**
+     * Emitted by the behavior as `<definitionRef>--<questionRef>`, sanitized — both halves admit `.`
+     * and neither alone is unique, for the same reason the playbook id is sanitized (see its note).
+     */
+    workbenchGovernanceQuestionId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The governed document whose questionnaire asks this. */
+    definitionRef: z.string().min(1).isSummaryField(),
+    /** The question's own ref within that questionnaire. */
+    questionRef: z.string().min(1).isSummaryField(),
+    /** The fact the answer establishes. */
+    factRef: z.string().min(1).isSummaryField(),
+    /** The question as a person reads it — the row's own words. */
+    creatorPrompt: z.string().min(1).isSummaryField(),
+    /** Why the answer is needed, in the document's terms. */
+    decisionPurpose: z.string().min(1).isSummaryField(),
+    /** What shape of answer the question takes. */
+    answerKind: z.string().min(1).isSummaryField(),
+    /** Whose authority the answer carries — a creator decision, a qualified review, a specification. */
+    factAuthorityKind: z.string().min(1).isSummaryField(),
+    /** Whether "not applicable" is an admissible answer. */
+    allowsNotApplicable: z.boolean().isSummaryField(),
+    /** How sensitive the answer is, by the document's own classification. */
+    sensitivityRef: z.string().min(1).isSummaryField(),
+    /** The closed set of answers, when the question has one. Empty for a free-text question. */
+    semanticOptions: z.array(z.object({
+        optionRef: z.string().min(1),
+        /** What choosing this option MEANS, in the creator's language rather than the schema's. */
+        creatorMeaning: z.string().min(1),
+    })).isSummaryField(),
+    /** Answered in the authored facts (from you) or not (still needed) — the same standing vocabulary the interview dossier uses. */
+    standing: z.enum(WorkbenchDossierEntryStanding).systemEnum('WorkbenchDossierEntryStanding').isSummaryField(),
+    /** The answer as a person reads it — the text, the chosen options, or the "does not apply" reason. `null` when still needed. */
+    answerSummary: z.string().nullable().isSummaryField(),
+    /** When the answer was decided (the declaration's own instant). `null` when still needed. */
+    answeredAt: z.date().nullable().isSummaryField(),
+    /**
+     * ASKED OF YOU NOW: still needed AND the document is DRAFTED — a draft is waiting on this fact. An
+     * open fact of an undrafted document is merely not told yet. Derived by the projection, declared
+     * as a LIST filter, for the same reason the dossier entry's is.
+     */
+    askedNow: z.boolean().isSummaryField(),
+});
 /*
  * ────────────────────────── Phase 3: dispatch OPERATIONS ──────────────────────────
  *
@@ -216,6 +539,15 @@ export var WorkbenchPlaybooks_Operations;
     WorkbenchPlaybooks_Operations["RUN"] = "run";
     /** Answer a run that stopped at a clarification — accept with answers, decline, or cancel. */
     WorkbenchPlaybooks_Operations["RESUME"] = "resume_run";
+    /**
+     * The questions this playbook still needs answered, as a decision payload — the declared interview
+     * minus what the dossier already answers (shared decisions included), and `null` when nothing is left
+     * to ask: the step declares none, or the dossier answers them all (#1454 review). Read
+     * ON DEMAND, at the moment somebody chooses to run it, and deliberately not a field of the row: one
+     * playbook alone declares fifteen questions, so carrying them on every row would pay for all of
+     * them on every poll in order to show none of them.
+     */
+    WorkbenchPlaybooks_Operations["READ_INTERVIEW"] = "read_interview";
 })(WorkbenchPlaybooks_Operations || (WorkbenchPlaybooks_Operations = {}));
 /** The build-plan resource's dispatch verb. */
 export var WorkbenchBuildPlanTasks_Operations;
@@ -226,12 +558,46 @@ export var WorkbenchBuildPlanTasks_Operations;
      * with the first (the dispatch service's own doctrine).
      */
     WorkbenchBuildPlanTasks_Operations["DISPATCH_NEXT"] = "dispatch_next";
+    /**
+     * Append ONE task the creator asked for, beside the plan that exists (#1454, Step 7). Collection-
+     * level: the row does not exist until the append answers. Deterministic — no model runs; the
+     * companion validates the task against the plan's own graph rules and re-renders the plan file.
+     */
+    WorkbenchBuildPlanTasks_Operations["ADD_TASK"] = "add_task";
+    /**
+     * Run THIS task, by row. Admitted only when the task is READY — the graph still decides what may
+     * run, and this verb only lets the creator pick among the ready ones instead of taking the next.
+     * A non-ready task answers 409 naming what it waits on. Costs a coding run.
+     */
+    WorkbenchBuildPlanTasks_Operations["DISPATCH_TASK"] = "dispatch_task";
+    /**
+     * ACCEPT what this task's latest completed coding run wrote: commit exactly those paths, from the
+     * coding-run write register, in one commit whose message names the task. Paths carrying another
+     * lane's hunks (dirty at the run's baseline) and paths edited since the run are refused by name
+     * unless `force`. Acceptance is a commit (`one-source-of-truth.md`), and under the YOLO posture the
+     * system may make it on the creator's word — this verb IS that word.
+     */
+    WorkbenchBuildPlanTasks_Operations["ACCEPT"] = "accept";
 })(WorkbenchBuildPlanTasks_Operations || (WorkbenchBuildPlanTasks_Operations = {}));
-/** The write-record resource's dispatch verb. */
+/** The write-record resource's dispatch verbs. */
 export var WorkbenchRunWriteRecords_Operations;
 (function (WorkbenchRunWriteRecords_Operations) {
     /** Revert this run's writes. Files edited since are refused by name unless `force`. */
     WorkbenchRunWriteRecords_Operations["REVERT"] = "revert_writes";
+    /**
+     * ACCEPT this run's writes: commit exactly the register's paths. A file that no longer holds the
+     * bytes the run wrote is refused by name unless `force` — the same divergence test `revert` applies,
+     * because in both directions a human edit is never silently swept into the run's account.
+     */
+    WorkbenchRunWriteRecords_Operations["ACCEPT"] = "accept";
+    /**
+     * WHAT this run changed, per file — read on demand, one run at a time (#1274). Deliberately not a
+     * field of the LIST row: pre-image bytes "belong to the revert mechanism, and a list row carrying
+     * every pre-image would ship the working tree's history through every LIST". Computed from the
+     * register's own pre/post content, never from `git diff`, so it is the RUN's change and not
+     * everything uncommitted at those paths.
+     */
+    WorkbenchRunWriteRecords_Operations["READ_DIFF"] = "read_diff";
 })(WorkbenchRunWriteRecords_Operations || (WorkbenchRunWriteRecords_Operations = {}));
 export const Workbench_PlaybookRunRequest_Schema = z.object({
     /** Optional product brief forwarded to the derivation. */
@@ -247,12 +613,22 @@ export const Workbench_PlaybookRunRequest_Schema = z.object({
     })).optional(),
     /** Full pipe — generation, validation, rendering, judge — with NO filesystem writes. */
     dryRun: z.boolean().optional(),
+    /**
+     * The opened INSTANCE to run (#1609); omitted runs the step itself. An instance nobody opened is refused,
+     * and its pre-answers are filed as that instance's answers, never the step's.
+     */
+    instanceKey: z.string().min(1).optional(),
 });
 export const Workbench_PlaybookResumeRequest_Schema = z.object({
     /** The suspended run being answered — the handle `run` returned when it stopped to ask. */
     runId: z.string().min(1),
-    /** `accept` (requires ≥1 answer), `decline`, or `cancel` — the industry three-action model. */
-    action: z.string().min(1),
+    /**
+     * WHICH round of its questions this answers, declines or cancels — the waiting row's `round` (#1584). A
+     * run asks again after an answer under the same `runId`; a round it has moved past is refused 409.
+     */
+    round: z.number().int().min(1),
+    /** ACCEPT (every question answered), DECLINE (the rest delegated) or CANCEL — see `MetaWorkflow_ClarificationAction` (#1785). */
+    action: z.enum(MetaWorkflow_ClarificationAction),
     answers: z.array(z.object({
         ref: z.string().min(1),
         answer: z.string().min(1),
@@ -267,10 +643,49 @@ export const Workbench_PlaybookResumeRequest_Schema = z.object({
  * still takes a (currently empty) request body.
  */
 export const Workbench_BuildPlanDispatchNextRequest_Schema = z.object({});
+/**
+ * One task to append (#1454, Step 7). The `target` and `produces` shapes are owned by
+ * `@wildo-ai/saas-specifications` (`BuildPlanTaskSchema`), which this package deliberately does not
+ * depend on, so they cross here as records and the companion parses them against the real schema
+ * before anything is written. `taskRef` is derived from the objective when absent.
+ */
+export const Workbench_BuildPlanAddTaskRequest_Schema = z.object({
+    taskRef: z.string().min(1).optional(),
+    objective: z.string().min(1),
+    target: z.record(z.string(), z.unknown()),
+    produces: z.array(z.record(z.string(), z.unknown())),
+    functionalTopic: z.string().min(1),
+    skillRefs: z.array(z.string().min(1)).min(1),
+    prerequisiteTaskRefs: z.array(z.string().min(1)).optional(),
+    servesRefs: z.array(z.string().min(1)).optional(),
+});
+export const Workbench_BuildPlanDispatchTaskRequest_Schema = z.object({
+    /** The conversation this dispatch belongs to, so the thread shows the run as a card. */
+    conversationId: z.string().min(1).optional(),
+});
+export const Workbench_AcceptChangesRequest_Schema = z.object({
+    /** Commit paths that diverged since the run. NOT defaulted on — a human edit is never silently swept in. */
+    force: z.boolean().optional(),
+});
 export const Workbench_RunWriteRevertRequest_Schema = z.object({
     /** Overwrite files edited since the run. NOT defaulted on — a human edit is never silently destroyed. */
     force: z.boolean().optional(),
 });
+/**
+ * What a playbook run's answer says about the run, when it says anything (#1781). Absent on a run that
+ * concluded, or on a detached submission that is still going.
+ *
+ * One named home for a vocabulary the companion writes and several readers compare — the run record,
+ * the clarification lifecycle, the resume route, and the workbench's summary of a RESUME, which used
+ * to read every answer carrying a `runId` as "Started", a cancelled clarification included.
+ */
+export var Workbench_PlaybookRunOutcomeStatus;
+(function (Workbench_PlaybookRunOutcomeStatus) {
+    /** Healthy, and waiting at a clarification: the run asked the creator something and holds until answered. */
+    Workbench_PlaybookRunOutcomeStatus["AWAITING_CREATOR_INPUT"] = "awaiting_creator_input";
+    /** The creator cancelled a clarification: the run was abandoned and does not continue. */
+    Workbench_PlaybookRunOutcomeStatus["CANCELLED"] = "cancelled";
+})(Workbench_PlaybookRunOutcomeStatus || (Workbench_PlaybookRunOutcomeStatus = {}));
 /**
  * Dispatch RESPONSES are LOOSE objects, deliberately: each names the fields the board branches on
  * and forwards the rest verbatim. The companion routes already spread the whole service result, and
@@ -279,19 +694,1105 @@ export const Workbench_RunWriteRevertRequest_Schema = z.object({
  */
 export const Workbench_PlaybookRunOutcome_Schema = z.looseObject({
     runId: z.string().optional(),
-    /** Present exactly when the run is HEALTHY and waiting at a clarification. */
-    status: z.string().optional(),
+    status: z.enum(Workbench_PlaybookRunOutcomeStatus).optional(),
     note: z.string().optional(),
 });
 export const Workbench_BuildPlanDispatchOutcome_Schema = z.looseObject({
     taskRef: z.string().optional(),
     note: z.string().optional(),
 });
+export const Workbench_BuildPlanAddTaskOutcome_Schema = z.looseObject({
+    taskRef: z.string().optional(),
+    /** TRUE when no plan existed and this task is its first. */
+    createdPlan: z.boolean().optional(),
+    /** Validator findings below the hard floor — worth telling the creator, never a refusal. */
+    advisoryFindings: z.array(z.object({ code: z.string(), taskRef: z.string(), message: z.string() })).optional(),
+    note: z.string().optional(),
+});
+/** How ACCEPT answers, for a task's coding run or a playbook run alike: what was committed, what was refused and why. */
+export const Workbench_AcceptChangesOutcome_Schema = z.looseObject({
+    commitSha: z.string().optional(),
+    committedPaths: z.array(z.string()).optional(),
+    refusedPaths: z.array(z.object({ path: z.string(), reason: z.string() })).optional(),
+    message: z.string().optional(),
+    note: z.string().optional(),
+});
 export const Workbench_RunWriteRevertOutcome_Schema = z.looseObject({
     runId: z.string().optional(),
     reverted: z.array(z.string()).optional(),
     /** Files whose current bytes differ from what the run wrote — refused by name, revertable with force. */
     refusedDiverged: z.array(z.string()).optional(),
+    /**
+     * Files a LATER recorded run landed on (#1614): refused even under force, because the earlier bytes
+     * would destroy that run's work. Each names the run to revert first (#1666).
+     */
+    refusedLaterRun: z.array(z.object({ path: z.string(), runId: z.string() })).optional(),
     note: z.string().optional(),
 });
+/**
+ * One BUILD DISPATCH — an attempt to run one build-plan task.
+ *
+ * The lane's own history: what was selected, when, and how it ended. A task may be dispatched more
+ * than once (a failure is re-dispatchable), so the row is the ATTEMPT and `taskRef` is what groups
+ * them — the same relationship a run write record has to its playbook.
+ */
+/**
+ * The NEXT build task — what a dispatch would do, with nothing started. At most one row.
+ *
+ * ## Why a proposal is a row
+ *
+ * It looks like a computed answer rather than a record, and that is why it stayed a bespoke read
+ * longest. But everything a person asks of it is what they ask of a row: what is it, what may it
+ * touch, what must it pass, and how far through the plan are we. It has an identity (`taskRef`), it
+ * is polled, it is rendered as a card, and a dispatch acts on it.
+ *
+ * ## Distinct from the build-plan TASK, deliberately
+ *
+ * `workbenchBuildPlanTasks` is every task and its status. This is the SELECTION — which one is next,
+ * plus the guard rails a dispatch of it would carry (allowed paths, prohibited paths, required
+ * checks, installed skills), which belong to the dispatch rather than to the task. Two resources
+ * because they answer different questions; the task list never changes because a selection did.
+ *
+ * ## Zero rows means the build is FINISHED, not that the read failed
+ *
+ * The companion answers `plan: null` with an `exhausted` count for a completed build, and it is a
+ * 200. That used to be a non-2xx, so the end of the journey rendered as "could not look" — the board
+ * telling an operator something went wrong at the moment everything had gone right. The counts live
+ * on this row so the finished state can say how far it got.
+ */
+export const Workbench_BuildDispatchPlan_Schema = z.object({
+    /** The task's ref, sanitized — a task ref carries dots. */
+    workbenchBuildDispatchPlanId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The task a dispatch would run. NULL exactly when the build is exhausted. */
+    taskRef: z.string().min(1).isSummaryField().nullable(),
+    /** What it is for, in the plan's own words. */
+    objective: z.string().min(1).isSummaryField().nullable(),
+    /** What kind of thing it produces. */
+    targetKind: z.string().min(1).isSummaryField().nullable(),
+    /** Present exactly when the next task is a companion GENERATION step rather than a coding task. */
+    generationStepRef: z.string().min(1).isSummaryField().nullable(),
+    /** Where a dispatch of it MAY write. */
+    allowedPathPrefixes: z.array(z.string().min(1)).isSummaryField(),
+    /** Where it may NOT, whatever the agent decides. */
+    prohibitedPathPrefixes: z.array(z.string().min(1)).isSummaryField(),
+    /** What its work must pass before it counts as done. */
+    requiredChecks: z.array(z.string().min(1)).isSummaryField(),
+    /** The framework knowledge the agent is given for it. */
+    installedSkillRefs: z.array(z.string().min(1)).isSummaryField(),
+    /** Every task that could run right now — this one is the head of that queue. */
+    readyTaskRefs: z.array(z.string().min(1)).isSummaryField(),
+    /** Every task already landed. */
+    landedTaskRefs: z.array(z.string().min(1)).isSummaryField(),
+    /**
+     * The subset of `landedTaskRefs` that landed WITHOUT PROOF — a task declaring no product, which
+     * ran and therefore cannot be held against the queue, but whose work nothing verified.
+     *
+     * Empty and "not reported" are the same array here, which is the one thing this loses against the
+     * optional wire field it replaced. That is acceptable because the board never rendered a count: it
+     * names the refs, and naming none is what an empty list looks like either way.
+     */
+    unverifiableLandedTaskRefs: z.array(z.string().min(1)).isSummaryField(),
+    /** TRUE when there is no next task because every one has landed. */
+    exhausted: z.boolean().isSummaryField(),
+    /**
+     * Every READY task dispatch passed over because it cannot make progress, and why (#1451).
+     *
+     * Present on BOTH kinds of row. Beside a next task it names what that selection skipped; with no
+     * next task and `exhausted` false it IS the answer: nothing ready can run. That state used to fail
+     * the read, so the board said "could not look" at the one moment it had a precise answer.
+     *
+     * Typed facts rather than a sentence: the remedy's WORDS belong to the reason
+     * (`system_enums.Workbench_BuildTaskStuckReason`), and each reason carries only the facts its
+     * remedy needs.
+     */
+    stuckTasks: z.array(z.object({
+        taskRef: z.string().min(1),
+        reason: z.enum(Workbench_BuildTaskStuckReason).systemEnum('Workbench_BuildTaskStuckReason'),
+        /** The run that proves it is stuck; NULL for a task that is unbuildable before any run. */
+        priorTaskId: z.string().min(1).nullable(),
+        /** `completed_awaiting_commit` only: the probed paths present in the working tree and not committed. */
+        uncommittedPaths: z.array(z.string().min(1)),
+        /** `parked_awaiting_answer` (and a parked `no_document_blueprint`): the question the run is waiting on. */
+        question: z.string().min(1).nullable(),
+        /** `no_document_blueprint` only: the governed document the catalog does not define. */
+        documentRef: z.string().min(1).nullable(),
+    })).isSummaryField(),
+    /** How many tasks the plan holds. Meaningful on the exhausted row, where it is the total reached. */
+    taskCount: z.number().int().isSummaryField(),
+    /** How many have landed. */
+    landedCount: z.number().int().isSummaryField(),
+});
+export const Workbench_BuildDispatch_Schema = z.object({
+    /** Emitted by the behavior as `<taskRef>--<startedAt>`, sanitized — a task can be dispatched twice. */
+    workbenchBuildDispatchId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The build-plan task this attempt ran. */
+    taskRef: z.string().min(1).isSummaryField(),
+    /**
+     * What the task delivers, in its own sentence — joined from the plan by `taskRef` so a card, a pane
+     * title and a Home line name the run by what it does rather than by its key (#1454, gap 1). NULL when
+     * the plan no longer holds the task (a plan re-decomposed since): the ref is then the only name.
+     */
+    objective: z.string().min(1).isSummaryField().nullable(),
+    /**
+     * How the attempt ended, or that it has not.
+     *
+     * `.systemEnum(...)` so the four words are authored ONCE for the enum rather than per field path:
+     * the frontend's label cascade reads only the vocabulary a field DECLARES, and without it every
+     * surface renders the raw constant.
+     */
+    phase: z.enum(Workbench_BuildDispatchPhase).systemEnum('Workbench_BuildDispatchPhase').isSummaryField(),
+    /** When the dispatch was handed to its executor. */
+    startedAt: z.date().isSummaryField(),
+    /** When the phase left SUBMITTED. NULL while it has not — a dispatch still running has no end. */
+    settledAt: z.date().isSummaryField().nullable(),
+    /**
+     * The durable actor-task row a coding run produced, when one was admitted.
+     *
+     * NULL for a generation step (there is no coding task) and for a dispatch that failed before
+     * admission. It is the edge from this lane into the control plane, which is why it is a foreign
+     * key rather than a printed id.
+     */
+    codingTaskId: z.string().min(1).isForeignKey().isSummaryField().nullable(),
+    /** Why it failed, verbatim. NULL on every dispatch that did not. */
+    error: z.string().min(1).isSummaryField().nullable(),
+    /**
+     * The conversation the dispatch was started from (#1454, Step 7), so the thread shows it as a
+     * card. NULL for a dispatch started from the plan's next-task door or before conversations existed.
+     */
+    conversationId: z.string().min(1).isSummaryField().nullable(),
+    /**
+     * Whether the coding run's writes have been ACCEPTED — committed through the `accept` verb, or
+     * found already committed. NULL when there is nothing to accept: a generation step, a failed run,
+     * a run that wrote nothing, or a run older than the coding-run write register.
+     */
+    accepted: z.boolean().isSummaryField().nullable(),
+});
+/**
+ * One playbook run SUSPENDED waiting on a person.
+ *
+ * The run stopped mid-way and asked something. The row carries where it stopped and what it asked,
+ * because both are what a creator needs to answer it — a question with no run context is a question
+ * nobody can answer.
+ */
+/**
+ * WHERE a playbook run is in its life — the one field that decides how its row reads.
+ *
+ * ## Why one vocabulary and not four collections
+ *
+ * The companion answers `{ running, runningDetached, interrupted, lastCompleted }`, and a board
+ * reading that shape has to know which array means what before it can render anything. They are not
+ * four kinds of thing: they are one thing — a run of a playbook — in four states, and the fields that
+ * differ between them (a finish time, a verdict, a checkpoint) are exactly the fields a state decides
+ * the presence of. Naming the state makes that explicit and makes the row renderable by one layout.
+ *
+ * The distinction that matters most is RUNNING vs RUNNING_DETACHED, and it is not cosmetic: the
+ * first is a composite holding its instance's single-flight subject and never an ordinary run, so a board
+ * that read it alone reported "nothing is running" while a fifteen-minute run was in flight.
+ */
+export var Workbench_PlaybookRunState;
+(function (Workbench_PlaybookRunState) {
+    /** A composite holding its instance's single-flight subject (#1610): one per running instance, several at once, never an ordinary run. */
+    Workbench_PlaybookRunState["RUNNING"] = "running";
+    /** An ordinary run this companion process is executing right now. */
+    Workbench_PlaybookRunState["RUNNING_DETACHED"] = "running_detached";
+    /** A run that stopped without finishing and left a checkpoint that can be re-run. */
+    Workbench_PlaybookRunState["INTERRUPTED"] = "interrupted";
+    /** The most recent outcome for a playbook ref — settled, with a verdict. */
+    Workbench_PlaybookRunState["COMPLETED"] = "completed";
+    /**
+     * A run that STOPPED TO ASK and is waiting on a person — not running, not finished, no verdict.
+     *
+     * It borrowed COMPLETED until 2026-09-24, flagged by `awaitingFamily`, so every reader had to remember that one
+     * "completed" row was not complete. The outcome reader remembered; Home did not, and told the creator a dry run
+     * waiting on their answer had "ran and landed its result" (#1271). A state that has to be un-said by another field
+     * is a missing member of its vocabulary.
+     */
+    Workbench_PlaybookRunState["AWAITING_ANSWER"] = "awaiting_answer";
+})(Workbench_PlaybookRunState || (Workbench_PlaybookRunState = {}));
+/**
+ * One playbook run, in whatever state it is in.
+ *
+ * Kept ONE-PER-REF for the completed state by the companion, so a COMPLETED row is the last run of
+ * that playbook and never a history of it.
+ */
+export const Workbench_PlaybookRun_Schema = z.object({
+    /** The row's own id, sanitized — run ids carry dots (see the playbook id note). */
+    workbenchPlaybookRunId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /**
+     * The run id as the companion records it. NULL only for an INTERRUPTED entry, which the companion
+     * knows by the checkpoint it left (its playbook and instance), not by a run.
+     */
+    runId: z.string().min(1).isSummaryField().nullable(),
+    /** The playbook this run is of. Every state has one; it is how a run is known. */
+    playbookRef: z.string().min(1).isSummaryField(),
+    /**
+     * The playbook INSTANCE this run is of (#1609), or null for a run of the step itself. Two instances of
+     * one playbook run and settle side by side, so a reader telling runs apart by playbook alone would show
+     * one instance's outcome as the other's.
+     */
+    instanceKey: z.string().min(1).isSummaryField().nullable(),
+    /**
+     * The execution-trace session the run recorded under, as the companion RECORDED it at run time.
+     * NULL when the request carried no session, and for the RUNNING and INTERRUPTED states.
+     *
+     * Recorded rather than derived (#1358): a run id used to be `<sessionId>-<playbookRef>-<ts>` and the
+     * board recovered the session by longest-prefix match. The run id is the actor execution's own id
+     * now, which says nothing about a session, so the join has to be a field.
+     */
+    traceSessionId: z.string().min(1).isSummaryField().nullable(),
+    /**
+     * The creation CONVERSATION the run was started from, when it was — the engine conversational
+     * execution's `executionId`, read from the run's correlation envelope (#1454). The conversation
+     * page joins a thread to its run cards on this key; `null` for a run started from the board, the
+     * CLI, or a choreography.
+     */
+    conversationId: z.string().min(1).isSummaryField().nullable(),
+    state: z.enum(Workbench_PlaybookRunState).systemEnum('Workbench_PlaybookRunState').isSummaryField(),
+    /** When it started. NULL for an INTERRUPTED entry, which records only when it checkpointed. */
+    startedAt: z.date().isSummaryField().nullable(),
+    /** When it settled. Present only for COMPLETED — a run AWAITING_ANSWER has not settled. */
+    finishedAt: z.date().isSummaryField().nullable(),
+    /**
+     * The run's own verdict, for COMPLETED only.
+     *
+     * TRUE for a run that SUSPENDED to ask, which is why `awaitingCreatorInput` below has to be read
+     * beside it: `ok` records whether the run threw, and a suspension does not throw. A board reading
+     * `ok` alone rendered a green "completed" badge for a run waiting on a person — the worst available
+     * lie, because their correct next action is to answer it and "completed" reads as no action at all.
+     */
+    ok: z.boolean().isSummaryField().nullable(),
+    /**
+     * Why it failed, verbatim.
+     *
+     * A validation refusal an async submission could not throw — an unanswered elicitation, an
+     * ineligible playbook — surfaces HERE rather than as an HTTP error, which is the whole reason the
+     * board must render it.
+     */
+    error: z.string().min(1).isSummaryField().nullable(),
+    /** How many iterations a checkpointed run completed. INTERRUPTED only. */
+    completedIterations: z.number().int().isSummaryField().nullable(),
+    /** When it checkpointed. INTERRUPTED only. */
+    checkpointedAt: z.date().isSummaryField().nullable(),
+    /** The family a suspended run was producing when it stopped to ask. Present only when it did. */
+    awaitingFamily: z.string().min(1).isSummaryField().nullable(),
+    /** Which round of asking a suspended run reached. Present only when it stopped to ask. */
+    awaitingRound: z.number().int().isSummaryField().nullable(),
+    /**
+     * The ADVISORY judge's verdict over the run's landed artifacts — the worst criterion, in
+     * PASS < CONCERN < INDETERMINATE < GAP order. COMPLETED only, and NULL when the judge did not run
+     * (`judgeSkipped` says why) or the playbook declares no evaluation (#1329).
+     *
+     * Lifted onto the row from the run's own result envelope, where it always was, because the
+     * timeline row and the detail's verdict tab both need it and `events.ndjson` — the only other
+     * place it lives — is a second call per run.
+     */
+    judgeOverall: z.enum(MetaWorkflow_EvaluationVerdict).systemEnum('MetaWorkflow_EvaluationVerdict').isSummaryField().nullable(),
+    /** The per-criterion verdicts behind `judgeOverall`, with the judge's rationale for each. */
+    judgeCriteria: z.array(z.object({
+        criterionRef: z.string().min(1),
+        verdict: z.enum(MetaWorkflow_EvaluationVerdict).systemEnum('MetaWorkflow_EvaluationVerdict'),
+        rationale: z.string(),
+    })).nullable(),
+    /** Why the judge stayed silent, in its own words — a failed call, or an evaluation that never ran. */
+    judgeSkipped: z.string().min(1).nullable(),
+});
+export const Workbench_WaitingPlaybookRun_Schema = z.object({
+    /** The run's own id, sanitized — run ids carry dots (see the playbook id note). */
+    workbenchWaitingPlaybookRunId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The run id as the companion records it. */
+    runId: z.string().min(1).isSummaryField(),
+    /**
+     * Whether the checkpoint on disk could be READ.
+     *
+     * FALSE is a real row, not an omission. A checkpoint file that exists and fails to parse is a
+     * suspended run an operator must deal with — the run is stopped, nothing will resume it, and the
+     * remedy is to inspect or remove that file. Dropping it would make a stuck lane look like an idle
+     * one, and the only thing knowable about such a run is its id, which is why every descriptive
+     * field below is nullable.
+     *
+     * This is what keeps the resource TOTAL over what the companion knows. The bespoke read it
+     * replaced carried the same fact in a separate `unreadable: string[]` beside the rows, which no
+     * resource lane could express and which therefore had no way to reach a row template.
+     */
+    readable: z.boolean().isSummaryField(),
+    /** The playbook that was running. NULL when the checkpoint could not be read. */
+    playbookRef: z.string().min(1).isSummaryField().nullable(),
+    /** The family it was producing when it stopped. NULL when the checkpoint could not be read. */
+    family: z.string().min(1).isSummaryField().nullable(),
+    /** When it suspended. NULL when the checkpoint could not be read. */
+    suspendedAt: z.date().isSummaryField().nullable(),
+    /** Which round of asking this is — a run may stop more than once. NULL when unreadable. */
+    round: z.number().int().isSummaryField().nullable(),
+    /** Whether the suspended run was a dry run, which changes what answering it will write. */
+    dryRun: z.boolean().isSummaryField().nullable(),
+    /** What it is waiting to be told. */
+    requests: z.array(z.object({
+        ref: z.string().min(1),
+        /** The question as a person reads it. */
+        question: z.string().min(1),
+        /** Why the run needs it — what it cannot decide without an answer. */
+        why: z.string().min(1),
+        /**
+         * The question's shape. A plain string by this tier's contract: the vocabulary is
+         * `HumanDecision_FieldKind` in `saas-specifications`, which this package
+         * deliberately does not import.
+         */
+        kind: z.string().min(1),
+        /** The closed answer set, when the question has one. */
+        options: z.array(z.string().min(1)),
+    })).isSummaryField(),
+    /**
+     * The signed-in person the question is ROUTED to (#1751): whoever started the run from the workbench or
+     * the conversation. Only they may answer it; anybody else is refused as if nothing waited. NULL when the
+     * question is unrouted (a run started from the console) or the checkpoint could not be read.
+     */
+    routedToUserId: z.string().min(1).isSummaryField().nullable(),
+});
+/**
+ * One coding run PARKED on a question.
+ *
+ * It arrives inside the coding-agent status payload, which is a singleton and stays a companion
+ * read. These do not: a parked question is identified by the task that parked on it, it persists
+ * until somebody answers, and a queue of work waiting on a person is the last thing that should be
+ * reachable only by reading a status blob.
+ */
+/**
+ * The coding lane's own posture — ONE row, always present.
+ *
+ * ## Why a singleton resource rather than the read it replaced
+ *
+ * It was a companion read answering a status object, and that read ALSO carried the parked
+ * questions — a queue keyed by task id — inside it. Two different things in one payload: a queue of
+ * work waiting on a person, and a statement about the lane. The queue is
+ * `workbenchParkedCodingQuestions`; this is what remains, and it is genuinely one row.
+ *
+ * ## What each field is careful about
+ *
+ * `codingAgentRegistered` reports exactly what the dispatch service can ESTABLISH — that every
+ * declared agent resolves in the registry — and deliberately does not claim the transport is usable,
+ * because that depends on the provider configuration and on a process it has not started. Anything
+ * reading this must not upgrade it to "ready".
+ *
+ * `activeRunTaskId` being NULL does not mean idle. A run that parks on a question clears it while
+ * staying very much alive, so a badge derived from this field alone read "idle" with a question
+ * outstanding — which is why the parked queue has to be read beside it.
+ */
+export const Workbench_CodingLaneStatus_Schema = z.object({
+    /** One row, one id. The projection stamps a constant: there is exactly one coding lane. */
+    workbenchCodingLaneStatusId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** Every declared coding agent resolves in the registry. NOT a claim that the transport works. */
+    codingAgentRegistered: z.boolean().isSummaryField(),
+    /**
+     * The coding agent this host dispatches to (a provider ref: `anthropic`, `openai`, `opencode`).
+     * NULL when the selection cannot be resolved (#1637).
+     */
+    codingAgentProviderRef: z.string().min(1).isSummaryField().nullable(),
+    /**
+     * Whether that agent's operator is signed in on this host, read from the agent's own status command
+     * without a model call — what `codingAgentRegistered` cannot say: a registered agent with no login
+     * fails every run on its first prompt. `false` means a definite "not signed in" — the one state a
+     * dispatch refuses on. NULL when the state could not be read, and when the agent's status command is not
+     * installed: the Claude and Codex agents run through adapters that do not need it, so its absence says
+     * nothing about the login; {@link codingAgentLoginRemedy} then names the install (#1637).
+     */
+    codingAgentSignedIn: z.boolean().isSummaryField().nullable(),
+    /** What the status command reported, in one line. NULL when nothing was read. */
+    codingAgentLoginDetail: z.string().nullable(),
+    /** What to do when the agent is not signed in — the login or install command. NULL when nothing is owed. */
+    codingAgentLoginRemedy: z.string().nullable(),
+    /**
+     * The durable actor-task row of the run in flight — the edge from this lane into the control
+     * plane, which is why it is a foreign key rather than a printed id. NULL when none is running,
+     * INCLUDING while a run is parked on a question.
+     */
+    activeRunTaskId: z.string().min(1).isForeignKey().isSummaryField().nullable(),
+    /** When the run in flight started. NULL when none is running. */
+    activeRunStartedAt: z.date().isSummaryField().nullable(),
+    /** The workspace mutation lock — one coding run at a time, and this is the file that says so. */
+    lockFilePath: z.string().min(1).isSummaryField().nullable(),
+    /** What a dispatch gets when it asks for no timeout of its own (ms). */
+    defaultTimeoutMs: z.number().int(),
+    /** The ceiling a dispatch cannot ask past (ms) — the answer to "why did my long run stop". */
+    hardMaxTimeoutMs: z.number().int(),
+    /** How much of an agent's output is captured by default (bytes). */
+    defaultMaxCapturedBytes: z.number().int(),
+    /** The capture ceiling (bytes). */
+    hardMaxCapturedBytes: z.number().int(),
+});
+/**
+ * The option refs a parked coding run offers. Closed, because the caller BRANCHES on which came back.
+ *
+ * Both are real decisions here, unlike a playbook interview — which offers only "run with these
+ * answers", because declining an interview settles nothing that is waiting. A parked run IS waiting:
+ * answering resumes the same session, and cancelling ends the run.
+ *
+ * ## Why it lives HERE rather than in the companion that mints it
+ *
+ * Both ends need it and neither can import the other: the companion projects a parked run as a
+ * decision, and the workbench reconstructs that decision from the ROW to render the answer form. It
+ * was declared in the companion alone until 2026-09-19, which meant a browser wanting to branch on
+ * an option had to re-spell the two values — a second copy of a closed vocabulary, compiling
+ * perfectly and free to drift.
+ */
+export var Workbench_ParkedCodingQuestionOptionRef;
+(function (Workbench_ParkedCodingQuestionOptionRef) {
+    Workbench_ParkedCodingQuestionOptionRef["ANSWER"] = "answer";
+    Workbench_ParkedCodingQuestionOptionRef["CANCEL"] = "cancel";
+})(Workbench_ParkedCodingQuestionOptionRef || (Workbench_ParkedCodingQuestionOptionRef = {}));
+/** The single field a parked run asks: the agent's own question, verbatim. */
+export const WORKBENCH_PARKED_CODING_QUESTION_FIELD_REF = 'answer';
+export const Workbench_ParkedCodingQuestion_Schema = z.object({
+    /** The parked task's id, sanitized. */
+    workbenchParkedCodingQuestionId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The durable actor-task row that parked — the edge into the control plane. */
+    taskId: z.string().min(1).isForeignKey().isSummaryField(),
+    /** The build-plan task it was running. */
+    taskRef: z.string().min(1).isSummaryField(),
+    /** What the run is asking. */
+    question: z.string().min(1).isSummaryField(),
+    /** When it parked. */
+    parkedAt: z.date().isSummaryField(),
+    /**
+     * Whether the SAME session can be re-entered.
+     *
+     * False is not a refusal: answering still works, but it starts a new session that must restate the
+     * task context. Carried because it changes what answering COSTS, which is a thing a creator weighs
+     * before answering rather than after.
+     */
+    resumable: z.boolean().isSummaryField(),
+    /**
+     * WHICH of the run's questions this row shows — opaque, echoed back by an answer (#1581, eighth review).
+     * A run may ask again after an answer, under the same task id, so the task id alone cannot say which
+     * question a person was looking at when they typed; an answer carrying this continues only that one.
+     */
+    suspensionRef: z.string().min(1),
+});
+/**
+ * One dossier entry: a question a playbook declares, and what the creator said to it, if anything.
+ *
+ * The identity is the pair (`playbookRef`, `questionRef`), sanitized — the key the `creator-inputs`
+ * family stores answers under, so the page addresses an answer the way the file does. The
+ * question's own text, kind and options are carried on the row (from the compiled catalog) so a
+ * surface can ASK it without a second read.
+ */
+export const Workbench_DossierEntry_Schema = z.object({
+    /** EMITTED BY THE BEHAVIOR through `workbenchDossierEntryIdentity`. */
+    workbenchDossierEntryId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    playbookRef: z.string().min(1).isSummaryField(),
+    questionRef: z.string().min(1).isSummaryField(),
+    /**
+     * The INSTANCE of the step this question is asked for (#1609), or null for the step itself. An opened
+     * instance asks its own questions, so the same question appears once per instance; an instance that
+     * has not answered one falls back to the step's own answer when it runs.
+     */
+    instanceKey: z.string().nullable().isSummaryField(),
+    /** What the instance was opened FOR, in the creator's words; null for the step itself. */
+    instancePurpose: z.string().nullable().isSummaryField(),
+    /** The authored question, verbatim from the playbook. */
+    question: z.string().min(1).isSummaryField(),
+    /**
+     * `free_text` | `choice` | `confirm` — `HumanDecision_FieldKind`, carried as a STRING for the same
+     * reason `phase` is above: the vocabulary is the engine's, this package restates none of it.
+     */
+    kind: z.string().min(1).isSummaryField(),
+    /** The closed set for a `choice` question; empty otherwise. */
+    options: z.array(z.string()).isSummaryField(),
+    /** Where the question sits in its playbook's interview, 0-based — the order a scripted interview asks in. */
+    position: z.number().int().min(0).isSummaryField(),
+    standing: z.enum(WorkbenchDossierEntryStanding).systemEnum('WorkbenchDossierEntryStanding').isSummaryField(),
+    /** The answer as stored, when there is one. */
+    value: z.string().nullable().isSummaryField(),
+    answeredAt: z.date().nullable().isSummaryField(),
+    answeredByRef: z.string().nullable().isSummaryField(),
+    /** Whether the asking playbook can run right now — a needed answer for an eligible playbook is what blocks something. */
+    playbookEligible: z.boolean().isSummaryField(),
+    /**
+     * ASKED OF YOU NOW: still needed AND the asking playbook can run — the one state that blocks
+     * something. Derived by the projection from the two facts above, and a declared LIST filter, so
+     * "what waits on me" is one server-side question rather than a page's own arithmetic.
+     */
+    askedNow: z.boolean().isSummaryField(),
+    /**
+     * CHANGING THIS AFFECTS: every family the answer feeds — what the asking playbook produces and
+     * everything downstream of it (#1454, Step 8). Derived by the companion from the catalog's declared
+     * inputs and outputs, so a person sees the reach of an answer before saving it, and a family
+     * derived before the answer changed reads as stale on its playbook.
+     */
+    affectsFamilies: z.array(z.string()).isSummaryField(),
+    /**
+     * WHAT THE QUESTION IS ABOUT, on the axis the artifact list groups families by (#1454, gap 4): the
+     * concern of the family the asking step produces — or, for a step that produces none, of the first
+     * family its answer reaches. The dossier groups by it, so a creator reads "why it exists", "how it
+     * gets built" and "what it must promise" rather than three lists organised by machinery.
+     */
+    subject: z.enum(WorkbenchSpecificationArtifactConcern).systemEnum('WorkbenchSpecificationArtifactConcern').isSummaryField(),
+    /**
+     * OUT OF DATE: answered, and a step READING this answer made its result before one of the answers it
+     * reads changed (its stale outputs list `creator-inputs`; #1454, gap 4 and its review). Derived from `outOfDateStepRefs` (non-empty), and
+     * kept as its own boolean because it is what the row's badge and a list filter ask.
+     */
+    outOfDate: z.boolean().isSummaryField(),
+    /**
+     * WHICH steps are out of date for this answer: the asking step and every step sharing the decision
+     * (`sharedWithPlaybookRefs`) with a stale output whose changed inputs include `creator-inputs`. A shared decision is ONE row,
+     * so "Regenerate" has to name the step it reruns; before this carried the refs, a change to a shared
+     * answer marked and reran only the owner (#1454 review, LOW).
+     */
+    outOfDateStepRefs: z.array(z.string()).isSummaryField(),
+    /**
+     * The other steps that READ this decision (a `sameDecisionAs` fallback with no answer of its own,
+     * #1454 review). One decision is one row, at its owner; those steps' interviews show and answer it,
+     * so it is asked once.
+     */
+    sharedWithPlaybookRefs: z.array(z.string()).isSummaryField(),
+});
+/** The dossier resource's one write verb. */
+export var WorkbenchDossierEntries_Operations;
+(function (WorkbenchDossierEntries_Operations) {
+    /** Record (or change) the creator's answer to this question. Lands `creator-inputs`; a commit accepts it. */
+    WorkbenchDossierEntries_Operations["ANSWER"] = "answer";
+})(WorkbenchDossierEntries_Operations || (WorkbenchDossierEntries_Operations = {}));
+export const Workbench_DossierAnswerRequest_Schema = z.object({
+    /** The answer, in the creator's words — validated against the question's kind before it is stored. */
+    value: z.string().min(1),
+});
+export const Workbench_DossierAnswerOutcome_Schema = z.looseObject({
+    /** The answer as STORED (canonical for a `confirm`). */
+    value: z.string(),
+    answeredAt: z.string(),
+    /** The dossier file this landed in, package-relative. */
+    packageRelativePath: z.string(),
+    /** The asking playbook's questions still unanswered after this one — empty means it can run. */
+    unansweredQuestionRefs: z.array(z.string()),
+});
+/**
+ * The SECTIONS of Home, the conversation page's opening surface (#1454, Step 3) — and the LIST filter
+ * a reader of `workbenchCreationHomeLines` narrows by.
+ *
+ * Three questions, three sections: what happened since I was here, what is asked of me now, what
+ * could I do next. Where the application stands is a resource of its own
+ * (`workbenchCreationOutcomes`), because an outcome is a measured STATE, not a line that opens
+ * something.
+ */
+export var WorkbenchCreationHomeSection;
+(function (WorkbenchCreationHomeSection) {
+    /** A run completed or cut short, a build dispatch settled — newest first. */
+    WorkbenchCreationHomeSection["SINCE"] = "since";
+    /** What blocks something NOW and waits on the creator: a run stopped on a question, a coding run parked on one, a drafted document missing a fact. */
+    WorkbenchCreationHomeSection["ASKED"] = "asked";
+    /** What the creator could do next, outcome-first: the plan's next task, a step producing a missing family, a step refreshing a stale one. */
+    WorkbenchCreationHomeSection["SUGGESTION"] = "suggestion";
+})(WorkbenchCreationHomeSection || (WorkbenchCreationHomeSection = {}));
+/**
+ * The KIND of a Home line — one closed vocabulary across the three sections, because a line's words
+ * and its tone are decided by its kind wherever it is rendered, and a section is only where it sits.
+ *
+ * ## Why the companion decides these and the page does not
+ *
+ * Until 2026-09-22 the page read SEVEN resources on their own cadences and derived every line itself
+ * — 900 lines of client arithmetic over rows a projection had already computed, re-run on every
+ * poll, invisible to the assistant's tools and to every other reader. A line is a FACT about the
+ * application ("this run was refused", "this task's writes wait to be committed"); facts are
+ * derived where the rows are, once, and served as rows themselves (`derive-before-you-ask.md`).
+ */
+export var WorkbenchCreationHomeLineKind;
+(function (WorkbenchCreationHomeLineKind) {
+    /** A playbook run completed — landed or refused; `failed` says which. */
+    WorkbenchCreationHomeLineKind["RUN_COMPLETED"] = "run-completed";
+    /** A playbook run the companion's restart cut short; re-running resumes it. Shown whatever its date. */
+    WorkbenchCreationHomeLineKind["RUN_INTERRUPTED"] = "run-interrupted";
+    /** A build dispatch finished or failed; `acceptable` says whether its writes wait to be committed. */
+    WorkbenchCreationHomeLineKind["DISPATCH_SETTLED"] = "dispatch-settled";
+    /** A playbook run suspended on questions only the creator can answer. */
+    WorkbenchCreationHomeLineKind["CLARIFICATION"] = "clarification";
+    /** A coding run parked on a question the agent could not answer alone. */
+    WorkbenchCreationHomeLineKind["PARKED_QUESTION"] = "parked-question";
+    /** A governed document the creator asked for (a draft exists) still needing a fact only they can give. */
+    WorkbenchCreationHomeLineKind["GOVERNANCE_DOCUMENT"] = "governance-document";
+    /** The next READY build task of the dispatch plan. */
+    WorkbenchCreationHomeLineKind["CONTINUE_THE_PLAN"] = "continue-the-plan";
+    /**
+     * The plan can run NOTHING: every ready task is stuck, and `stuckReason` says what unblocks it.
+     *
+     * ASKED rather than SUGGESTION, because every reason is the creator's move — committing what a
+     * finished run wrote under GUIDED, or, under the autonomy posture where the loop commits (#1534),
+     * resolving the path its accept refused or correcting a declaration no run can satisfy.
+     * Without it the plan simply falls silent: `CONTINUE_THE_PLAN` is derived from the next ready task,
+     * and a stuck queue has none (#1451, #1463).
+     */
+    WorkbenchCreationHomeLineKind["UNBLOCK_THE_PLAN"] = "unblock-the-plan";
+    /** An eligible playbook whose output family is missing. */
+    WorkbenchCreationHomeLineKind["PRODUCE_MISSING"] = "produce-missing";
+    /** An eligible playbook whose output is stale — derived before one of its inputs last changed. */
+    WorkbenchCreationHomeLineKind["REFRESH_STALE"] = "refresh-stale";
+})(WorkbenchCreationHomeLineKind || (WorkbenchCreationHomeLineKind = {}));
+/**
+ * One line of Home. Every line OPENS an element beside the page — `targetResourceType` +
+ * `targetResourceId` are the address the engine's hosted pane resolves — and carries the one or two
+ * facts the words need: the subject, in the creator's terms, and the flags that change the sentence.
+ *
+ * `targetResourceType` is a STRING, not `z.enum(WorkbenchShared_ResourceType)`: it is an address, not
+ * a vocabulary anyone words, and binding it here would make a line pointing at a resource a newer
+ * companion serves unparseable by an older workbench.
+ */
+export const Workbench_CreationHomeLine_Schema = z.object({
+    /** EMITTED BY THE BEHAVIOR: `<section>--<kind>--<sanitized target id>`. */
+    workbenchCreationHomeLineId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    section: z.enum(WorkbenchCreationHomeSection).systemEnum('WorkbenchCreationHomeSection').isSummaryField(),
+    kind: z.enum(WorkbenchCreationHomeLineKind).systemEnum('WorkbenchCreationHomeLineKind').isSummaryField(),
+    /** The instant the line is ordered on, newest first; null when the row records none (a suggestion, a document). */
+    at: z.date().nullable().isSummaryField(),
+    /** The playbook the line is about, when it is about one — its words come from the label tree. */
+    playbookRef: z.string().nullable().isSummaryField(),
+    /** The build task the line is about, when it is about one. */
+    taskRef: z.string().nullable().isSummaryField(),
+    /** The next task's objective, for CONTINUE_THE_PLAN; the document's definition ref, for GOVERNANCE_DOCUMENT. */
+    subject: z.string().nullable().isSummaryField(),
+    /** A refused run, a failed dispatch. */
+    failed: z.boolean().isSummaryField(),
+    /** A finished coding run whose writes are recorded and not yet committed — the one line Home offers ACCEPT on (#1454, Step 7). */
+    acceptable: z.boolean().isSummaryField(),
+    /** The suggested playbook still has questions the dossier does not answer, so the way in is its interview (#1454, Step 5). */
+    needsAnswers: z.boolean().isSummaryField(),
+    /**
+     * Why the plan is stuck, for `UNBLOCK_THE_PLAN` — the remedy is what the line is FOR, and each
+     * reason's is different. Its words are authored once for the vocabulary
+     * (`system_enums.Workbench_BuildTaskStuckReason`), so this line states no remedy of its own.
+     */
+    stuckReason: z.enum(Workbench_BuildTaskStuckReason).systemEnum('Workbench_BuildTaskStuckReason').nullable().isSummaryField(),
+    /** The element the line opens: a `WorkbenchShared_ResourceType` value and that row's addressable id. */
+    targetResourceType: z.string().min(1).isSummaryField(),
+    targetResourceId: z.string().min(1).isSummaryField(),
+});
+/**
+ * The four OUTCOMES an application's creation is measured by — the journey in the creator's words
+ * (Paul, 2026-09-21: "we do not have a real journey; top-down and bottom-up are internal
+ * considerations"). The playbook phases stay machinery underneath; this is what a person sees.
+ *
+ * Which specification family counts toward which outcome is the companion projection's business
+ * (`creation-home-projection.companion.ts`, total over `ApplicationSpecificationFamily`); this
+ * package deliberately does not import that vocabulary.
+ */
+export var WorkbenchCreationOutcome;
+(function (WorkbenchCreationOutcome) {
+    /** Vision, market, requirements, features, business model, roadmap, brand. */
+    WorkbenchCreationOutcome["KNOW_WHAT_WE_BUILD"] = "know-what-we-build";
+    /** The compliance programme, the processor register, the facts and policies behind every governed document, the risks. */
+    WorkbenchCreationOutcome["KNOW_THE_RULES"] = "know-the-rules";
+    /** The domain plan, the placement plan, the build plan — and the build tasks landed. */
+    WorkbenchCreationOutcome["APPLICATION_WORKS"] = "application-works";
+    /** Governed documents released and published — and every other outcome done. */
+    WorkbenchCreationOutcome["READY_FOR_A_REAL_USER"] = "ready-for-a-real-user";
+})(WorkbenchCreationOutcome || (WorkbenchCreationOutcome = {}));
+/** The order a person reads the outcomes in: what, rules, works, ready. Also the rows' `position`. */
+export const WORKBENCH_CREATION_OUTCOMES_IN_ORDER = [
+    WorkbenchCreationOutcome.KNOW_WHAT_WE_BUILD,
+    WorkbenchCreationOutcome.KNOW_THE_RULES,
+    WorkbenchCreationOutcome.APPLICATION_WORKS,
+    WorkbenchCreationOutcome.READY_FOR_A_REAL_USER,
+];
+export var WorkbenchCreationOutcomeStatus;
+(function (WorkbenchCreationOutcomeStatus) {
+    WorkbenchCreationOutcomeStatus["NOT_STARTED"] = "not-started";
+    WorkbenchCreationOutcomeStatus["IN_PROGRESS"] = "in-progress";
+    WorkbenchCreationOutcomeStatus["DONE"] = "done";
+})(WorkbenchCreationOutcomeStatus || (WorkbenchCreationOutcomeStatus = {}));
+/**
+ * Where the application stands on one outcome — ALWAYS four rows, one per outcome, in reading
+ * order. "Done" is strict: every family of the outcome landed, valid and not stale; for the
+ * application working, every build task landed too; for readiness, every other outcome done as
+ * well.
+ */
+export const Workbench_CreationOutcome_Schema = z.object({
+    /** EMITTED BY THE BEHAVIOR: the outcome value. */
+    workbenchCreationOutcomeId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    outcome: z.enum(WorkbenchCreationOutcome).systemEnum('WorkbenchCreationOutcome').isSummaryField(),
+    status: z.enum(WorkbenchCreationOutcomeStatus).systemEnum('WorkbenchCreationOutcomeStatus').isSummaryField(),
+    /** 0-based reading order. */
+    position: z.number().int().min(0).isSummaryField(),
+    /** Families this outcome is measured by — those the projection reports, placed under this outcome. */
+    familiesTotal: z.number().int().min(0).isSummaryField(),
+    /** Landed, valid, and not stale. */
+    familiesLanded: z.number().int().min(0).isSummaryField(),
+    /** Landed but refused by the family's own validator. */
+    familiesInvalid: z.number().int().min(0).isSummaryField(),
+    /** Not landed at all. */
+    familiesMissing: z.number().int().min(0).isSummaryField(),
+    /** Landed, but derived before one of its inputs last changed. */
+    familiesStale: z.number().int().min(0).isSummaryField(),
+    /** Build tasks, for APPLICATION_WORKS only; null on the other three. */
+    tasksTotal: z.number().int().min(0).nullable().isSummaryField(),
+    tasksLanded: z.number().int().min(0).nullable().isSummaryField(),
+    /**
+     * APPLICATION_WORKS only: the application's runtimes whose dev-loop supervisor has PAUSED them — it
+     * will not start them until something changes (#1537). While any is listed the outcome is not DONE,
+     * whatever has landed: an application that cannot start does not work. Null on the other three,
+     * and null when no supervisor could answer, which is "cannot tell" rather than "all up".
+     */
+    unavailableRuntimes: z.array(z.string().min(1)).nullable().isSummaryField(),
+});
+/*
+ * ────────────────────────────────────────────────────────────────────────────────────────────────
+ * The verbs that were the workbench's BESPOKE companion client until 2026-09-22 (#1454), now
+ * declared operations on the resources they always addressed. Same door for every act: the engine's
+ * auth chain and role gate, request-DTO validation, the registered path, the operation identity the
+ * invalidation chain keys on — and the companion's local token floor no longer needs a browser
+ * exemption for any of them.
+ * ────────────────────────────────────────────────────────────────────────────────────────────────
+ */
+/** An operation that takes nothing. */
+export const Workbench_EmptyRequest_Schema = z.object({});
+/** `read_interview` on a playbook: the `HumanDecision_Request` it declares, or null. Carried opaquely — the engine owns that vocabulary. */
+export const Workbench_PlaybookInterview_Schema = z.object({
+    decision: z.unknown().nullable(),
+});
+/** One file's change within a run — see `read_diff`. */
+export const Workbench_RunWriteFileDiff_Schema = z.object({
+    path: z.string().min(1),
+    existedBefore: z.boolean(),
+    /** The file on disk no longer holds what the run wrote; the diff still describes what the RUN did. */
+    diverged: z.boolean(),
+    /** Unified diff. Empty when the run rewrote a file with identical bytes. */
+    diff: z.string(),
+});
+export const Workbench_RunWriteDiff_Schema = z.object({
+    runId: z.string().min(1),
+    playbookRef: z.string().min(1),
+    at: z.string().min(1),
+    files: z.array(Workbench_RunWriteFileDiff_Schema),
+});
+/** The trace-session resource's READ-shaped verbs — what a session RECORDED, beyond the summary its row carries. */
+export var WorkbenchTraceSessions_Operations;
+(function (WorkbenchTraceSessions_Operations) {
+    /** ONE session: every event in order, and its step artifacts by name (#1328) — what the Conversation tab reads. */
+    WorkbenchTraceSessions_Operations["READ_RECORD"] = "read_record";
+    /** What one session SPENT, in tokens — summed from the agent-call usage already in its events (#1274). Never a currency. */
+    WorkbenchTraceSessions_Operations["READ_USAGE"] = "read_usage";
+    /** One step ARTIFACT, as text — the brief the model saw, the answer it gave, a coding task's input (#1329). */
+    WorkbenchTraceSessions_Operations["READ_ARTIFACT"] = "read_artifact";
+    /**
+     * The trace sessions one ACTOR TASK ran in, latest first — the alias the coding lane writes for
+     * every run (#1328). Collection-level: the task is the input, not a session. Empty for a task the
+     * lane never ran, which is the ordinary case and not an error.
+     */
+    WorkbenchTraceSessions_Operations["LIST_FOR_TASK"] = "list_for_task";
+})(WorkbenchTraceSessions_Operations || (WorkbenchTraceSessions_Operations = {}));
+/** One traced event, as the companion records it — the conversation's unit (#1328). */
+export const Workbench_TraceSessionEvent_Schema = z.object({
+    timestamp: z.string().min(1),
+    /** A `PlaybookExecutionTraceEvent` value, or a coding-lane event type; a closed vocabulary the companion owns. */
+    type: z.string().min(1),
+    summary: z.string(),
+    stepId: z.string().optional(),
+    payload: z.unknown().optional(),
+});
+/** One step directory of a session: the artifacts it holds, by file name. Bodies are read one at a time. */
+export const Workbench_TraceSessionStep_Schema = z.object({
+    stepDirName: z.string().min(1),
+    artifacts: z.array(z.string()),
+});
+export const Workbench_TraceSessionRecord_Schema = z.object({
+    sessionId: z.string().min(1),
+    startedAt: z.string().min(1),
+    label: z.string().nullable(),
+    eventCount: z.number().int(),
+    stepCount: z.number().int(),
+    events: z.array(Workbench_TraceSessionEvent_Schema),
+    steps: z.array(Workbench_TraceSessionStep_Schema),
+});
+/** What one trace session spent, in TOKENS. `callsWithoutUsage` non-zero means the totals are a FLOOR, not the figure. */
+export const Workbench_TraceSessionUsage_Schema = z.object({
+    sessionId: z.string().min(1),
+    agentCalls: z.number().int(),
+    callsWithoutUsage: z.number().int(),
+    promptTokens: z.number().int(),
+    completionTokens: z.number().int(),
+    totalTokens: z.number().int(),
+});
+export const Workbench_TraceArtifactRequest_Schema = z.object({
+    stepDirName: z.string().min(1),
+    fileName: z.string().min(1),
+});
+/** The artifact body, verbatim. A big brief renders by its OUTLINE, computed by the reader — the text is what it is owed. */
+export const Workbench_TraceArtifact_Schema = z.object({
+    body: z.string(),
+});
+export const Workbench_TraceSessionsForTaskRequest_Schema = z.object({
+    /** The durable actor-task row a coding run was dispatched as. */
+    taskId: z.string().min(1),
+});
+export const Workbench_TraceSessionsForTask_Schema = z.object({
+    sessionIds: z.array(z.string()),
+});
+/**
+ * The parked coding question's two verbs — the decision the row IS (see
+ * {@link Workbench_ParkedCodingQuestionOptionRef}): answer it and resume the same session, or end
+ * the run. Both were bespoke companion routes with a browser exemption on the token floor until
+ * 2026-09-22; the row's own operations are where a reader meets them.
+ */
+export var WorkbenchParkedCodingQuestions_Operations;
+(function (WorkbenchParkedCodingQuestions_Operations) {
+    /** Answer THIS parked run and resume the same agent session. A WRITE: it re-enters a workspace-mutating run behind the worktree lock. */
+    WorkbenchParkedCodingQuestions_Operations["ANSWER"] = "answer";
+    /**
+     * End THIS parked run. Per row since #1581 (seventh review): with waves (#1528) several runs may be
+     * live, and a collection-level cancel ended whatever this process drove — doing nothing for a park
+     * no chain held, and stopping other runs while this one stayed parked.
+     */
+    WorkbenchParkedCodingQuestions_Operations["CANCEL"] = "cancel";
+})(WorkbenchParkedCodingQuestions_Operations || (WorkbenchParkedCodingQuestions_Operations = {}));
+export const Workbench_ParkedQuestionAnswerRequest_Schema = z.object({
+    /** The answer, in the operator's words. Empty is refused by the lane with its own sentence. */
+    answer: z.string(),
+    /** The row's `suspensionRef`: the question this answers. Refused (409) once the run has asked another. */
+    suspensionRef: z.string().min(1),
+});
+/** The lane's admission of the resumed run — its own shape, carried loosely. */
+export const Workbench_ParkedQuestionAnswerOutcome_Schema = z.looseObject({});
+/**
+ * The row's `cancel` answers ONLY a run it ended or signalled: a run that moved on meanwhile is a 409 the
+ * gate shows, never a `cancelled: false` read as success (#1581, eleventh and twelfth reviews).
+ */
+export const Workbench_CodingRunCancelOutcome_Schema = z.looseObject({
+    cancelled: z.literal(true),
+});
+/**
+ * The governed document's one verb: LAND the facts a person established for it as the
+ * `document-facts-authored` family. The row is the document; the body carries the governance scope,
+ * the answers and, for a reviewed fact, the review — a per-question verb with a bare value could
+ * carry none of that, which is why the question resource has no write verb of its own.
+ */
+export var WorkbenchGovernanceDocuments_Operations;
+(function (WorkbenchGovernanceDocuments_Operations) {
+    WorkbenchGovernanceDocuments_Operations["LAND_FACTS"] = "land_facts";
+})(WorkbenchGovernanceDocuments_Operations || (WorkbenchGovernanceDocuments_Operations = {}));
+/**
+ * The landing request's ENVELOPE. The answer SEMANTICS stay with the companion service that owns the
+ * question catalog (it refuses an unknown question, a review with no reviewer, "does not apply" on a
+ * question that does not offer it — each with its own sentence); this refuses a body that is not a
+ * landing request at all.
+ */
+export const Workbench_GovernanceFactsLandingRequest_Schema = z.object({
+    definitionRef: z.string().min(1),
+    decidedByRef: z.string().min(1),
+    decidedAt: z.string().min(1),
+    governanceScope: z.object({
+        subjectKind: z.string().min(1),
+        subjectRef: z.string().min(1),
+        scopeRef: z.string().min(1),
+        scopeVersion: z.number().int().positive(),
+        participantRefs: z.array(z.string()),
+        precedenceRuleRefs: z.array(z.string()),
+    }),
+    answers: z.array(z.unknown()),
+    /** Run the whole pipe and write nothing — what lets a person see the exact file their answers produce BEFORE anything touches the tree. */
+    dryRun: z.boolean().optional(),
+});
+export const Workbench_GovernanceFactsLandingOutcome_Schema = z.object({
+    family: z.string().min(1),
+    packageRelativePath: z.string().min(1),
+    exportedConstantName: z.string().min(1),
+    renderedSource: z.string(),
+    existedBefore: z.boolean(),
+    wiringAlreadyInPlace: z.array(z.string()),
+});
+/**
+ * Where one secret stands for an application in one environment (#1637).
+ *
+ * The ONE vocabulary for `wildo secrets list`, the creation essentials of `wildo init`/`setup` and
+ * the workbench's secrets section, so the three cannot disagree about what "needed" means. Derived
+ * from what the application declares (the providers it scopes, the capabilities it enables, its systems
+ * of record and inbound endpoints), never from the provider catalogue.
+ */
+export var ApplicationSecretStanding;
+(function (ApplicationSecretStanding) {
+    /**
+     * Required by something the application uses, unset, and nothing else covers what it is for: a
+     * capability, a provider the application scoped on purpose, a system of record or an inbound endpoint
+     * cannot work until it is provided.
+     */
+    ApplicationSecretStanding["NEEDED"] = "needed";
+    /** It has a value in this environment, and something reads it. */
+    ApplicationSecretStanding["SET"] = "set";
+    /** Unset, and nothing waits for it: an optional key, or a capability another provider already serves. */
+    ApplicationSecretStanding["AVAILABLE"] = "available";
+    /**
+     * It has a value, and nothing CONSUMES it: a provider key no provider declares, a system-of-record key
+     * naming no declared instance or no slot its credential has, an inbound key naming no endpoint. It is
+     * listed to be REMOVED — the one verb it offers. Usually the remains of something renamed or retired
+     * (Odoo was a provider before it was a system of record).
+     *
+     * Unconsumed is not undelivered: the dev companion's `.env` carries EVERY provider key, and the backend
+     * receives a well-formed inbound name or a slot of a declared instance. So a row says which runtimes still
+     * receive it, and removing it regenerates their `.env` files like any other change — otherwise the value
+     * would stay on disk and in the running process after the person was told it was gone.
+     */
+    ApplicationSecretStanding["UNUSED"] = "unused";
+})(ApplicationSecretStanding || (ApplicationSecretStanding = {}));
+/**
+ * What a secret belongs to, and so which section of `secrets.json` holds it and how its name is formed.
+ * Three kinds because they are three different things, not three spellings of a provider key: a system of
+ * record is deliberately NOT a provider (#1049 D10) and an inbound endpoint secret proves a delivery rather
+ * than authenticating a call.
+ */
+export var ApplicationSecretKind;
+(function (ApplicationSecretKind) {
+    /** A provider's secret, declared by its secrets contract; `secrets.json` → `providerEnv`. */
+    ApplicationSecretKind["PROVIDER"] = "provider";
+    /**
+     * A credential slot of a declared system of record (#1055), named `WILDO_SOR_<NAME>__<SLOT>`;
+     * `secrets.json` → `systemsOfRecordEnv`. Read by the application backend only.
+     */
+    ApplicationSecretKind["SYSTEM_OF_RECORD"] = "system_of_record";
+    /**
+     * The verification secret of an application inbound endpoint (#1596), named
+     * `WILDO_INBOUND_<ENDPOINT_KEY>__SECRET`; `secrets.json` → `inboundEndpointEnv`. Read by the backend only.
+     */
+    ApplicationSecretKind["INBOUND_ENDPOINT"] = "inbound_endpoint";
+})(ApplicationSecretKind || (ApplicationSecretKind = {}));
+/**
+ * Which GitHub level holds a REMOTE environment's provider secret. Remote secrets are GitHub Actions
+ * secrets; the generated deploy job declares `environment: <env>`, so an environment secret applies to
+ * that environment alone and overrides a repository secret of the same name, which is the fallback.
+ * spec-cite: https://docs.github.com/en/actions/reference/security/secrets — "If an organization, repository, and environment all have a secret with the same name, the environment-level secret takes precedence."
+ */
+export var ApplicationSecretRemoteLevel;
+(function (ApplicationSecretRemoteLevel) {
+    ApplicationSecretRemoteLevel["ENVIRONMENT"] = "environment";
+    ApplicationSecretRemoteLevel["REPOSITORY"] = "repository";
+})(ApplicationSecretRemoteLevel || (ApplicationSecretRemoteLevel = {}));
+/**
+ * Joins the parts of a secret row's id. The separator must be something an environment id and a kind cannot
+ * contain, so the id splits back on its first two occurrences. Environment ids are `^[a-z0-9]+(?:-[a-z0-9]+)*$`
+ * (`WildoEnvironmentIdSchema`), and no {@link ApplicationSecretKind} value contains `--`.
+ */
+const APPLICATION_SECRET_ROW_ID_SEPARATOR = '--';
+const APPLICATION_SECRET_KIND_VALUES = new Set(Object.values(ApplicationSecretKind));
+/**
+ * The `id` of one secret row: environment, kind and name (`local--provider--OPENAI_API_KEY`). The same name is
+ * a different secret per environment, and per KIND too — each kind is its own `secrets.json` section, so a
+ * key left in the wrong section during a migration (an Odoo credential still in `providerEnv`) is a second
+ * secret beside the one that belongs, and must be addressable on its own rather than colliding with it.
+ *
+ * The id travels in the URL of the row's page and of its `set` / `unset` operations, and the engine checks
+ * it before any handler runs (`ExecutionContextCreator.validateParameterFormat`). It was
+ * `<environment>::<NAME>` until 2026-09-26: the list rendered, but the row's page and both operations
+ * answered `400 api_call_initiator_parameter_unsupported`, because that check then held every id to
+ * `^[a-zA-Z0-9_-]+$`. Since #2048 it holds an introspected row's id to the introspection format, which admits
+ * more; this id stays inside the narrower alphabet anyway, so it is valid under both, and
+ * `workbench-application-secret-row-id.test.ts` pins that.
+ */
+export function applicationSecretRowId(envName, kind, envVarName) {
+    return [envName, kind, envVarName].join(APPLICATION_SECRET_ROW_ID_SEPARATOR);
+}
+/**
+ * Splits a secret row's id back into environment, kind and name, or `null` when it cannot be a row id. It
+ * splits on the first two separators — neither the environment nor the kind can contain one — and the name
+ * keeps any it has. A well-formed id naming nothing real is refused later by `wildo secrets`, which states
+ * the reason itself.
+ */
+export function splitApplicationSecretRowId(rowId) {
+    const first = rowId.indexOf(APPLICATION_SECRET_ROW_ID_SEPARATOR);
+    if (first <= 0)
+        return null;
+    const kindStart = first + APPLICATION_SECRET_ROW_ID_SEPARATOR.length;
+    const second = rowId.indexOf(APPLICATION_SECRET_ROW_ID_SEPARATOR, kindStart);
+    if (second <= kindStart)
+        return null;
+    const kind = rowId.slice(kindStart, second);
+    const envVarName = rowId.slice(second + APPLICATION_SECRET_ROW_ID_SEPARATOR.length);
+    if (!APPLICATION_SECRET_KIND_VALUES.has(kind) || envVarName.length === 0)
+        return null;
+    return { envName: rowId.slice(0, first), kind: kind, envVarName };
+}
+/**
+ * One secret an application declares a use for (or still holds), in one environment — the workbench's
+ * secrets section. Names and standings only: a value never enters this row, in either direction of the wire.
+ */
+export const Workbench_ApplicationSecret_Schema = z.object({
+    /**
+     * `<environment>--<kind>--<NAME>` — see {@link applicationSecretRowId}. A SUMMARY field like every other
+     * workbench row's key: the list is read in summary mode, and a card whose row carries no id cannot open its
+     * row — which is where `set` and `unset` live (#1637).
+     */
+    workbenchApplicationSecretId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The environment this row describes (`local`, or a remote environment's name). */
+    environmentName: z.string().min(1).isSummaryField(),
+    /** The environment variable the runtime reads — the key in the `secrets.json` section its {@link kind} names. */
+    envVarName: z.string().min(1).isSummaryField(),
+    /** Where it stands: needed, set, available, or unused. */
+    standing: z.enum(ApplicationSecretStanding).systemEnum('ApplicationSecretStanding').isSummaryField(),
+    /** What it belongs to: a provider, a system of record, or an inbound endpoint. */
+    kind: z.enum(ApplicationSecretKind).systemEnum('ApplicationSecretKind').isSummaryField(),
+    /**
+     * WHICH one, in the vocabulary of its {@link kind}: the provider ref, the system-of-record instance name,
+     * or the inbound endpoint key. NULL only for an {@link ApplicationSecretStanding.UNUSED} key that names
+     * no owner: a provider key no provider declares, or a system-of-record or inbound name that does not parse.
+     */
+    ownerRef: z.string().min(1).nullable().isSummaryField(),
+    /** Its owner's own description of it, when it has one. */
+    description: z.string().nullable(),
+    /** The enabled capabilities a provider serves for this application — why the secret is needed. Empty for the other kinds. */
+    capabilities: z.array(z.enum(EngineCapability).systemEnum('EngineCapability')),
+    /**
+     * The runtimes that RECEIVE it in their environment — the ones a change regenerates and restarts: `backend`,
+     * `companion`, `minions.<key>`, `workers.<key>`, `frontendServices.<key>`. For an UNUSED key this is where it
+     * is still carried, never where it is used.
+     */
+    runtimes: z.array(z.string()),
+    /** The companion's LLM key — the one secret `wildo init`/`setup` ask for, because the creation chat runs on it. */
+    creationEssential: z.boolean(),
+    /** Remote only: which GitHub level holds it. NULL locally, and NULL for a remote secret that is not set. */
+    remoteLevel: z.enum(ApplicationSecretRemoteLevel).systemEnum('ApplicationSecretRemoteLevel').nullable(),
+});
+/** The secret row's two verbs. Both run `wildo secrets set/unset`, which is the only writer of a secret. */
+export var WorkbenchApplicationSecrets_Operations;
+(function (WorkbenchApplicationSecrets_Operations) {
+    /**
+     * Provide THIS secret's value. Locally the runtimes that read it restart to pick it up; remotely it
+     * becomes the GitHub Environment secret the deploy reads.
+     */
+    WorkbenchApplicationSecrets_Operations["SET"] = "set";
+    /** Remove THIS secret from its environment. */
+    WorkbenchApplicationSecrets_Operations["UNSET"] = "unset";
+})(WorkbenchApplicationSecrets_Operations || (WorkbenchApplicationSecrets_Operations = {}));
+export const Workbench_ApplicationSecretSetRequest_Schema = z.object({
+    /**
+     * The value. Never returned, never logged, never stored by the companion: `.isWriteOnlySecret()` masks
+     * it in every RESPONSE, so once saved nothing shows it again.
+     *
+     * Entered in a multi-line box, visible while typed, as GitHub's own secret form does. Decided by
+     * practice rather than taste, and measured against the two alternatives:
+     * - A masked (`type=password`) input was tried first. It is single-line, so a pasted key file lost its
+     *   line breaks, and a browser treats it as a login: Chrome ignores `autocomplete="off"` on password
+     *   fields and still autofills or offers to save into `new-password` ones, so a provider key could be
+     *   saved as a localhost password or a saved one filled in unseen. The vocabulary has no `off` token.
+     * - A single-line text input strips newlines from a paste too (HTML value sanitization).
+     * The box preserves what was pasted, and a person can check a paste before saving it.
+     */
+    value: z.string().min(1).stringUI({ edit: { editMode: StringEditMode.TEXTAREA } }).isWriteOnlySecret(),
+});
+/**
+ * What a change did — the shape `wildo secrets set/unset --json` prints (#1637). The local fields are
+ * inert for a remote environment, whose change is the GitHub secret itself.
+ */
+export const Workbench_ApplicationSecretChangeOutcome_Schema = z.object({
+    envVarName: z.string(),
+    /** Which section the change was made in — with the name and the environment, the secret's identity. */
+    kind: z.enum(ApplicationSecretKind).systemEnum('ApplicationSecretKind'),
+    envName: z.string(),
+    /** Local: the runtimes a LIVE `wildo local dev` supervisor was asked to restart to read the change. */
+    restartSignalledRuntimes: z.array(z.string()),
+    /** Local: whether the runtimes' `.env` files were regenerated. */
+    envFilesRegenerated: z.boolean(),
+    /** Local: why the `.env` files were not regenerated, with the command to run; null when they were. */
+    envFilesRegenerationFailure: z.string().nullable(),
+    /** Local: the companion reads this key and applies the change itself instead of restarting. */
+    companionAppliesChange: z.boolean(),
+    /**
+     * Set by the COMPANION (never by the CLI) when it could not apply the change in-process: the value is
+     * saved and reaches the companion at its next start. Absent when nothing failed.
+     */
+    companionApplyFailure: z.string().optional(),
+});
 //# sourceMappingURL=workbench-creation-plane.custom.shared.schemas.js.map