{"openapi":"3.1.0","jsonSchemaDialect":"https://json-schema.org/draft/2020-12/schema","info":{"title":"Unclosed foundation API","version":"0.1.0","description":"Implemented /v1 account, workspace, collaboration, delegated metadata and recorded-usage and conservative budget-accounting and Cloudflare account-read-proof and GitHub repository enrollment API. This is an implementation contract, not proof of deployment or full product qualification. All JSON API responses carry X-Request-ID and Cache-Control: no-store. Browser cookie mutations require a trusted Origin; a supplied Authorization header always takes precedence and cannot fall back to a cookie. Mutations require Idempotency-Key. Body limit: 65,536 bytes. Versioning is currently path-based only. Authentication endpoints under /api/auth are maintained separately by Better Auth and are outside this document. Ordinary experiment execution, automated executor provisioning, provider invoices, exports, customer event subscriptions, test/live mode and complete agent delegation are not implemented by this contract. GitHub enrollment is repository-metadata-only: agents can initiate and inspect an authorization, while the initiating human completes consent in a browser. Provider tokens are discarded; repository metadata enrollment alone enables no code ingestion or execution. Human GitHub continuation and authenticated binary source downloads are documented non-JSON success responses. Optional managed qualification authorizes a single fixed isolation canary after owner consent and human administrator review. Producer signatures and cleanup receipts use a separate protocol boundary. Passing that check does not enable ordinary experiments or verify provider billing. Owner-scoped provider-cost imports fetch the current Cloudflare v1 overage feed with a transient Billing Read token, retain exact immutable observations, and allow conserved manual workspace attribution. They do not reconcile invoices, include all fees, or change admission accounting. The private source library accepts reviewed immutable source only through authorized GitHub CI OIDC under finite owner policy. Product credentials may configure policy or read permitted packages but cannot call the CI import boundary."},"servers":[{"url":"/","description":"Same-origin product API; the unclosed.dev POC has not been deployed or qualified by this contract. app.unclosed.dev currently serves the separate existing laboratory and is not this API origin."}],"tags":[{"name":"Account","description":"Current verified identity and self-service profile."},{"name":"Workspaces","description":"Workspace-scoped collaboration and recorded usage."},{"name":"Administration","description":"Human platform administration behind hosted Cloudflare Access."},{"name":"Budget accounting","description":"Owner-only conservative admission budgets and immutable event/allocation reads; execution and provider billing remain unavailable."},{"name":"Cloudflare account proof","description":"Owner-only point-in-time account-read verification with no retained provider credentials, executor provisioning or provider billing."},{"name":"GitHub repository enrollment","description":"Owner enrollment of projected repository metadata with explicit human GitHub App consent; no retained provider credentials or code ingestion/execution."},{"name":"Executor enrollment","description":"Workspace-owned deployment metadata and key possession. No execution or cost import authority."},{"name":"Executor qualification","description":"One fixed, owner-funded infrastructure check with administrator review, durable cleanup and conservative estimated accounting. Ordinary experiments and provider invoice import remain unavailable."},{"name":"Provider-reported costs","description":"Owner-only exact partial usage-cost observations and explicit workspace attribution. No invoice reconciliation or changes to admission budgets."},{"name":"Source library","description":"Finite owner source-sharing policy, private immutable source inventory and GitHub OIDC import. No execution authority."},{"name":"Campaigns","description":"Finite reviewed campaign consent, GitHub authorization and budget reservation. Executor delivery and launch remain gated."},{"name":"Reporting","description":"Bounded statements over recorded evidence, not provider invoices."}],"paths":{"/v1/me":{"parameters":[],"get":{"operationId":"retrieveCurrentUser","summary":"Retrieve the current account","description":"Verified human sessions may read their own account in any approval state. Bearer identity resolution still requires an approved human and live membership; pending/rejected/suspended users cannot obtain a usable delegated key.","tags":["Account"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve the current account.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":false,"x-unclosed-bearer-scopes":["workspaces:read"]},"patch":{"operationId":"updateCurrentUser","summary":"Update account profile","description":"Human session only, available in any approval state. Nonempty profile update; does not change approval status or platform administrator authority. Values are trimmed before validation.","tags":["Account"],"security":[{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Update account profile.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":false,"x-unclosed-bearer-scopes":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProfile"}}}}}},"/v1/workspaces":{"parameters":[],"get":{"operationId":"listWorkspaces","summary":"List accessible workspaces","description":"Human sessions list current memberships. A delegated credential is additionally restricted to its one workspace.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List accessible workspaces.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["workspaces:read"]},"post":{"operationId":"createWorkspace","summary":"Create a workspace","description":"Approved human session only. Creates setup workspace and owner membership atomically. Slug must be globally unique; this does not provision a provider or authorize spending.","tags":["Workspaces"],"security":[{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"201":{"description":"Create a workspace Created.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateWorkspace"}}}}}},"/v1/workspaces/{workspace_id}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"retrieveWorkspace","summary":"Retrieve a workspace","description":"Retrieve a workspace.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve a workspace.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["workspaces:read"],"x-unclosed-minimum-workspace-role":"viewer"},"patch":{"operationId":"updateWorkspace","summary":"Rename a workspace","description":"Only name is editable. Lifecycle transitions and billing settings are not implemented by this route.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Rename a workspace.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["workspaces:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWorkspace"}}}}}},"/v1/workspaces/{workspace_id}/members":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listMembers","summary":"List workspace members","description":"List workspace members.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List workspace members.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["members:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/members/{user_id}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/user_id"}],"patch":{"operationId":"updateMemberRole","summary":"Change a member role","description":"Owner only; never remove/demote the last approved owner. Promoting an existing non-owner directly to owner returns 409 ownership_acceptance_required: create an owner invitation and have the recipient explicitly accept it.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Change a member role.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberRole"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["members:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateMember"}}}}},"delete":{"operationId":"removeMember","summary":"Remove a workspace member","description":"Owner only, subject to last-owner protection. No request body is required. Removed members and their delegated keys lose subsequent access.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Remove a workspace member.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberDeleted"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["members:write"],"x-unclosed-minimum-workspace-role":"owner"}},"/v1/workspaces/{workspace_id}/projects":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listProjects","summary":"List research projects","description":"List research projects.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List research projects.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["projects:read"],"x-unclosed-minimum-workspace-role":"viewer"},"post":{"operationId":"createProject","summary":"Create a research project","description":"Create a catalog project. No compute, campaign, spending allocation, or GitHub submission is implied.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"201":{"description":"Create a research project Created.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["projects:write"],"x-unclosed-minimum-workspace-role":"editor","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateProject"}}}}}},"/v1/workspaces/{workspace_id}/invitations":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listInvitations","summary":"List workspace invitations","description":"Owners only, including read access. Lists invitation metadata without the acceptance secret.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List workspace invitations.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["members:read"],"x-unclosed-minimum-workspace-role":"owner"},"post":{"operationId":"createInvitation","summary":"Invite a collaborator","description":"Owners only. Lowercases the email, revokes prior unaccepted invitations for the same workspace/email, and records a seven-day invitation plus durable delivery event atomically. delivery_status=pending is acceptance for delivery, not evidence of a sent email. Optional transfer_from_role creates an ownership offer to an existing approved member. Recipient acceptance is human-only and atomically changes both roles. Provider billing and existing experiment consent are not transferred.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"201":{"description":"Invite a collaborator Created.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationCreated"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["members:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateInvitation"}}}}}},"/v1/workspaces/{workspace_id}/invitations/{invitation_id}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/invitation_id"}],"delete":{"operationId":"revokeInvitation","summary":"Revoke an unaccepted invitation","description":"Revoke an unaccepted invitation.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Revoke an unaccepted invitation.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Revoked"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["members:write"],"x-unclosed-minimum-workspace-role":"owner"}},"/v1/invitations/accept":{"parameters":[],"post":{"operationId":"acceptInvitation","summary":"Accept a workspace invitation","description":"Approved human with the invited email only. Rechecks database-time expiry, revocation, the inviter's current approved owner authority and workspace state (setup, ready or paused) atomically. Owner invitations require owner_acknowledgment with version workspace-owner-v1 and accepted true; this acknowledgment and its exact text commit in the acceptance audit. Ordinary invitations remain compatible with token-only requests. Ordinary owner invitations retain existing owners. Ownership transfers additionally require transfer_acknowledgment matching the preview version, inviting owner ID and new role. Acceptance atomically grants owner access to the pinned recipient and changes the inviting owner role; other owners remain. Changes to membership, identity, workspace eligibility or the initiating credential revoke pending transfers. Accepting does not transfer Cloudflare billing or renew experiment authority. Same-key retries return the original committed receipt without repeating membership writes. Tokens are JSON-body inputs only.","tags":["Workspaces"],"security":[{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Accept a workspace invitation.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MembershipAccepted"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptInvitation"}}}}}},"/v1/workspaces/{workspace_id}/comments":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listComments","summary":"List workspace comments","description":"List workspace comments.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"},{"name":"resource_type","in":"query","required":false,"schema":{"$ref":"#/components/schemas/ResourceType"}},{"name":"resource_id","in":"query","required":false,"schema":{"type":"string","minLength":1,"maxLength":128}}],"responses":{"200":{"description":"List workspace comments.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommentList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["comments:read"],"x-unclosed-minimum-workspace-role":"viewer"},"post":{"operationId":"createComment","summary":"Comment on a project","description":"Only project comments are qualified. Project resource_id must be a UUID owned by this workspace. Other recognized resource types return 503 feature_unavailable; unknown types are invalid requests.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"201":{"description":"Comment on a project Created.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Comment"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["comments:write"],"x-unclosed-minimum-workspace-role":"commenter","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateComment"}}}}}},"/v1/workspaces/{workspace_id}/credentials":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listCredentials","summary":"List delegated credential metadata","description":"A human owner can view all credential metadata in this workspace. Other humans and delegated credentials see only credentials issued by their own human. No token/hash is returned.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List delegated credential metadata.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["credentials:read"],"x-unclosed-minimum-workspace-role":"viewer"},"post":{"operationId":"createCredential","summary":"Issue a scoped delegated credential","description":"Approved human session and membership required. Requested scopes must fit the human's current role. Viewers can delegate read scopes; commenters add comments:write; editors add projects:write; owners add workspaces:write, members:write, billing:read, billing:write, connections:read and connections:write. credentials:write/admin:* are syntactically known but not delegable. Secret is revealed exactly once; replay cannot recover it. Expiry defaults to 30 days, maximum 90.","tags":["Workspaces"],"security":[{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"201":{"description":"Issue a scoped delegated credential Created.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialIssueResult"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"x-unclosed-minimum-workspace-role":"viewer","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCredential"}}}}}},"/v1/workspaces/{workspace_id}/credentials/{credential_id}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/credential_id"}],"delete":{"operationId":"revokeCredential","summary":"Revoke a delegated credential","description":"Human issuer or human workspace owner only. Delegated credentials cannot revoke or rotate keys in this slice. Idempotent replay still checks live authority.","tags":["Workspaces"],"security":[{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Revoke a delegated credential.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Revoked"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/usage":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"retrieveUsage","summary":"Retrieve recorded usage and cost totals","description":"Exact recorded aggregates, not an invoice or connected-provider bill. Both source scans are bounded to 10,000 entries. Check recorded_totals_complete; provider billing and execution counts remain unavailable.","tags":["Workspaces"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve recorded usage and cost totals.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Usage"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["usage:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/admin/users":{"parameters":[],"get":{"operationId":"listAdminUsers","summary":"List accounts by approval state","description":"Human platform administrator only. Hosted deployments also require a valid Cloudflare Access assertion. Local development explicitly bypasses that additional perimeter. Default status=pending.","tags":["Administration"],"security":[{"HumanSession":[],"AdminAccessAssertion":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"},{"name":"status","in":"query","required":false,"schema":{"$ref":"#/components/schemas/AccountStatus","default":"pending"}}],"responses":{"200":{"description":"List accounts by approval state.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"x-unclosed-platform-admin-required":true,"x-unclosed-hosted-access-required":true}},"/v1/admin/users/{user_id}/decision":{"parameters":[{"$ref":"#/components/parameters/user_id"}],"post":{"operationId":"decideAccountApproval","summary":"Approve, reject or suspend an account","description":"Human platform administrator plus hosted Access required. Cannot decide your own account state. The reason is stored in audit history. Changes and durable notification intent commit together. A decision leaving a workspace without an approved owner marks that workspace suspended; it does not prevent the account decision.","tags":["Administration"],"security":[{"HumanSession":[],"AdminAccessAssertion":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Approve, reject or suspend an account.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/User"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccountDecision"}}}},"x-unclosed-platform-admin-required":true,"x-unclosed-hosted-access-required":true}},"/v1/workspaces/{workspace_id}/budget":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"retrieveWorkspaceBudget","summary":"Retrieve workspace budget and exposure","description":"Owner-only billing:read. Returns configured:false before a policy is set. Conservative admission accounting is not a provider statement; execution remains disabled.","tags":["Budget accounting"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve workspace budget and exposure.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceBudget"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["billing:read"],"x-unclosed-minimum-workspace-role":"owner"},"put":{"operationId":"updateWorkspaceBudget","summary":"Configure or update a workspace budget","description":"Owner-only billing:write plus Idempotency-Key. expected_version is an optimistic concurrency guard: 0 initially, then the latest policy version. Same-window changes retain consumed/reserved counters. A new active, nonoverlapping window is allowed only after the old window expires; consumed period counters reset but every outstanding reservation carries forward. No automatic renewal. Reducing a limit below current exposure does not release reservations. This operation never enables execution.","tags":["Budget accounting"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Configure or update a workspace budget.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceBudget"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["billing:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateBudget"}}}}}},"/v1/workspaces/{workspace_id}/ledger":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listWorkspaceLedger","summary":"List immutable workspace admission events","description":"Owner-only billing:read, standard cursor pagination. Events describe conservative admission accounting, not provider charges. Kind determines amount semantics; counters are snapshots and must not be summed across rows.","tags":["Budget accounting"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List immutable workspace admission events.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LedgerEntryList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["billing:read"],"x-unclosed-minimum-workspace-role":"owner"}},"/v1/workspaces/{workspace_id}/allocations":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listWorkspaceAllocations","summary":"List finite workspace allocations","description":"Owner-only billing:read. Read-only visibility into internal finite allocations; no public create, spend, receipt, cancellation or closure endpoint is implied.","tags":["Budget accounting"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List finite workspace allocations.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AllocationList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["billing:read"],"x-unclosed-minimum-workspace-role":"owner"}},"/v1/workspaces/{workspace_id}/allocations/{allocation_id}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/allocation_id"}],"get":{"operationId":"retrieveWorkspaceAllocation","summary":"Retrieve a finite workspace allocation","description":"Owner-only billing:read. Workspace-scoped lookup; unrelated or missing IDs are not visible. Expiration is not confirmed teardown and does not automatically release reserved exposure.","tags":["Budget accounting"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve a finite workspace allocation.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Allocation"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["billing:read"],"x-unclosed-minimum-workspace-role":"owner"}},"/v1/workspaces/{workspace_id}/connections/cloudflare":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"retrieveCloudflareConnection","summary":"Retrieve Cloudflare account-read proof","description":"Owner-only connections:read. Returns sanitized singleton metadata, or configured:false with connection:null before setup. All responses explicitly state credential_retained:false, execution_enabled:false and provider_cost_status:unavailable.","tags":["Cloudflare account proof"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve Cloudflare account-read proof.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudflareConnection"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:read"],"x-unclosed-minimum-workspace-role":"owner"},"put":{"operationId":"connectCloudflareAccount","summary":"Verify Cloudflare account read access","description":"Owner-only connections:write with Idempotency-Key and expected_version. Performs a bounded Cloudflare account read using a transient token; stores only verified sanitized metadata. Reverification increments the version. Changing the account requires prior disconnect. The token is deliberately excluded from the logical idempotency hash: replay of the same account/version/key returns the committed metadata without another provider call, even if the submitted token differs. A replay is not fresh proof of provider access. No provisioning, retained credentials or billing readiness is implied. Mutations require the workspace to be in setup or ready state.","tags":["Cloudflare account proof"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Verify Cloudflare account read access.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudflareConnection"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectCloudflare"}}}},"x-unclosed-sensitive-fields":["api_token"],"x-unclosed-idempotency-hash-excluded":["api_token"]}},"/v1/workspaces/{workspace_id}/connections/cloudflare/disconnect":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"post":{"operationId":"disconnectCloudflareAccount","summary":"Disconnect the verified account association","description":"Owner-only connections:write with Idempotency-Key and expected_version. Open allocations block disconnect. Marks the existing record disconnected while retaining metadata, configured:true, and a new version. Does not revoke the provider token, release reservations, or claim teardown. Mutations require the workspace to be in setup or ready state.","tags":["Cloudflare account proof"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Disconnect the verified account association.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudflareConnection"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisconnectCloudflare"}}}}}},"/v1/workspaces/{workspace_id}/projects/{project_id}/github":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"}],"get":{"operationId":"retrieveGitHubConnection","summary":"Retrieve project GitHub metadata","description":"Approved current owner plus connections:read for delegated keys. Metadata proof only; execution and retained credentials remain false. Public repository selection is separate from human GitHub consent.","tags":["GitHub repository enrollment"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve project GitHub metadata.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GitHubConnection"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:read"],"x-unclosed-minimum-workspace-role":"owner"}},"/v1/workspaces/{workspace_id}/projects/{project_id}/github/authorizations":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"}],"post":{"operationId":"startGitHubAuthorization","summary":"Start repository authorization","description":"Approved current owner plus connections:write; setup/ready workspace. Stable Idempotency-Key required. Returns a local human continuation; no GitHub provider credentials or redirect URL. Initial expected_version=0. Original delegated authority must remain valid through human completion. Replaying returns the saved intent, not a fresh authorization.","tags":["GitHub repository enrollment"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"201":{"description":"Start repository authorization.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GitHubAuthorization"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StartGitHubAuthorization"}}}}}},"/v1/workspaces/{workspace_id}/github/authorizations/{authorization_id}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/authorization_id"}],"get":{"operationId":"retrieveGitHubAuthorization","summary":"Retrieve authorization status","description":"Initiating user only, current owner and connections:read for delegated credentials. Expiry is derived on read; pending/processing/failed states never imply a repository link.","tags":["GitHub repository enrollment"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve authorization status.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GitHubAuthorization"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:read"],"x-unclosed-minimum-workspace-role":"owner"}},"/v1/workspaces/{workspace_id}/projects/{project_id}/github/disconnect":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"}],"post":{"operationId":"disconnectGitHubRepository","summary":"Disconnect repository association","description":"Approved current owner plus connections:write; setup/ready workspace. Requires Idempotency-Key and expected_version. Open allocations block disconnect. Retains history; does not uninstall GitHub App, revoke provider grants or stop execution/charges.","tags":["GitHub repository enrollment"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Disconnect repository association.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GitHubConnection"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisconnectGitHub"}}}}}},"/v1/workspaces/{workspace_id}/github/authorizations/{authorization_id}/authorize":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/authorization_id"}],"get":{"operationId":"continueGitHubAuthorization","summary":"Continue as the initiating human","description":"Browser navigation only, authenticated as the initiating human. Rechecks live owner and original delegated authority, expected version, pending unexpired intent and workspace state. 303 redirects to fixed GitHub authorization with server-derived state/S256 PKCE. SDKs deliberately do not expose/follow this route; give the local continuation to the human. Callback and webhook routes are not part of the public /v1 SDK contract.","tags":["GitHub repository enrollment"],"security":[{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"303":{"description":"Continue human consent at GitHub. The redirect is transient, contains OAuth correlation values and must not be logged or stored.","headers":{"Location":{"required":true,"schema":{"type":"string","format":"uri","pattern":"^https://github\\.com/login/oauth/authorize\\?"}},"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"x-unclosed-minimum-workspace-role":"owner","x-unclosed-browser-navigation":true}},"/v1/workspaces/{workspace_id}/connections/executor":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"retrieveExecutorConnection","summary":"Retrieve current executor enrollment","description":"Owner-only connections:read. Returns latest enrollment history, or configured:false, version:0 and connection:null. Enrollment remains unqualified; execution_enabled:false is not a statement that a remote laboratory has stopped.","tags":["Executor enrollment"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve current executor enrollment.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutorConnection"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:read"],"x-unclosed-minimum-workspace-role":"owner"},"put":{"operationId":"connectExecutor","summary":"Enroll an inspected executor and signing key","description":"Owner-only connections:write. Requires current Cloudflare association version, executor version and Idempotency-Key. Verifies transient provider metadata and a domain-separated signing-key proof, then atomically reserves twelve resource identities and records enrollment. An active enrollment must be disconnected before replacement. Token is excluded from idempotency identity; replay is historical, not fresh provider/key evidence. Workspace must be setup or ready. Does not authorize execution.","tags":["Executor enrollment"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Enroll an inspected executor and signing key.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutorConnection"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectExecutor"}}}},"x-unclosed-sensitive-fields":["api_token"],"x-unclosed-idempotency-hash-excluded":["api_token"]}},"/v1/workspaces/{workspace_id}/connections/executor/disconnect":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"post":{"operationId":"disconnectExecutor","summary":"Disconnect an unqualified executor enrollment","description":"Owner-only connections:write. Requires expected_version and Idempotency-Key. Atomically retires an unqualified enrollment and releases local assignments only if every workspace allocation is closed. Preserves history. Does not delete resources, revoke provider credentials, stop an independent laboratory or stop provider charges.","tags":["Executor enrollment"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Disconnect an unqualified executor enrollment.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutorConnection"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisconnectExecutor"}}}}}},"/v1/workspaces/{workspace_id}/executor-qualifications":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listExecutorQualifications","summary":"List fixed infrastructure checks","description":"List fixed infrastructure checks. Requires current owner membership and the indicated delegated scope. This authorizes only the fixed isolation canary; ordinary experiments remain disabled. Admission amounts are estimates, not Cloudflare invoice charges.","tags":["Executor qualification"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List fixed infrastructure checks","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/QualificationList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:read"],"x-unclosed-minimum-workspace-role":"owner"},"post":{"operationId":"createExecutorQualification","summary":"Record owner consent for one fixed $0.01 admission estimate","description":"Record owner consent for one fixed $0.01 admission estimate. Requires current owner membership and the indicated delegated scope. This authorizes only the fixed isolation canary; ordinary experiments remain disabled. Admission amounts are estimates, not Cloudflare invoice charges.","tags":["Executor qualification"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"201":{"description":"Record owner consent for one fixed $0.01 admission estimate","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Qualification"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["executors:qualify"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateQualification"}}}}}},"/v1/workspaces/{workspace_id}/executor-qualifications/{qualification_id}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/qualification_id"}],"get":{"operationId":"retrieveExecutorQualification","summary":"Retrieve check, cleanup and settlement status","description":"Retrieve check, cleanup and settlement status. Requires current owner membership and the indicated delegated scope. This authorizes only the fixed isolation canary; ordinary experiments remain disabled. Admission amounts are estimates, not Cloudflare invoice charges.","tags":["Executor qualification"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve check, cleanup and settlement status","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Qualification"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:read"],"x-unclosed-minimum-workspace-role":"owner"},"delete":{"operationId":"withdrawExecutorQualification","summary":"Withdraw consent; outstanding authority drains and reservations remain until authenticated closure","description":"Withdraw consent; outstanding authority drains and reservations remain until authenticated closure. Requires current owner membership and the indicated delegated scope. This authorizes only the fixed isolation canary; ordinary experiments remain disabled. Admission amounts are estimates, not Cloudflare invoice charges.","tags":["Executor qualification"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Withdraw consent; outstanding authority drains and reservations remain until authenticated closure","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Qualification"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["executors:qualify"],"x-unclosed-minimum-workspace-role":"owner"}},"/v1/admin/executor-qualifications":{"parameters":[],"get":{"operationId":"listAdminExecutorQualifications","summary":"List infrastructure check requests","description":"List infrastructure check requests. Requires an approved human platform administrator and hosted Cloudflare Access. Review records are administrator-supplied metadata, not independent provider attestation. Approval cannot enlarge or revive owner consent.","tags":["Executor qualification"],"security":[{"HumanSession":[],"AdminAccessAssertion":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List infrastructure check requests","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/QualificationList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"x-unclosed-platform-admin-required":true,"x-unclosed-hosted-access-required":true}},"/v1/admin/executor-qualifications/{qualification_id}":{"parameters":[{"$ref":"#/components/parameters/qualification_id"}],"get":{"operationId":"retrieveAdminExecutorQualification","summary":"Inspect an infrastructure check request","description":"Inspect an infrastructure check request. Requires an approved human platform administrator and hosted Cloudflare Access. Review records are administrator-supplied metadata, not independent provider attestation. Approval cannot enlarge or revive owner consent.","tags":["Executor qualification"],"security":[{"HumanSession":[],"AdminAccessAssertion":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Inspect an infrastructure check request","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Qualification"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"x-unclosed-platform-admin-required":true,"x-unclosed-hosted-access-required":true}},"/v1/admin/executor-qualifications/{qualification_id}/decision":{"parameters":[{"$ref":"#/components/parameters/qualification_id"}],"post":{"operationId":"decideExecutorQualification","summary":"Approve a finite check with review metadata or reject the request","description":"Approve a finite check with review metadata or reject the request. Requires an approved human platform administrator and hosted Cloudflare Access. Review records are administrator-supplied metadata, not independent provider attestation. Approval cannot enlarge or revive owner consent.","tags":["Executor qualification"],"security":[{"HumanSession":[],"AdminAccessAssertion":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Approve a finite check with review metadata or reject the request","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Qualification"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"x-unclosed-platform-admin-required":true,"x-unclosed-hosted-access-required":true,"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/QualificationDecision"}}}}}},"/v1/workspaces/{workspace_id}/provider-costs/imports":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listProviderCostImports","summary":"List private provider-cost imports","description":"List private provider-cost imports. Owner-only billing scope. Provider observations are partial current-period overages; attribution is an explicit owner declaration, not verified resource ownership. No execution budget is changed. Missing or stale coverage is not zero.","tags":["Provider-reported costs"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List private provider-cost imports","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProviderCostImportList"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["billing:read"],"x-unclosed-minimum-workspace-role":"owner"},"post":{"operationId":"importCloudflareCosts","summary":"Import a completed day from Cloudflare current-period usage","description":"Import a completed day from Cloudflare current-period usage. Owner-only billing scope. Provider observations are partial current-period overages; attribution is an explicit owner declaration, not verified resource ownership. No execution budget is changed. Missing or stale coverage is not zero.","tags":["Provider-reported costs"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"201":{"description":"Import a completed day from Cloudflare current-period usage","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProviderCostImport"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["billing:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ImportProviderCosts"}}}}}},"/v1/workspaces/{workspace_id}/provider-costs/imports/{import_id}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/provider_import_id"}],"get":{"operationId":"retrieveProviderCostImport","summary":"Retrieve an imported observation and its provenance","description":"Retrieve an imported observation and its provenance. Owner-only billing scope. Provider observations are partial current-period overages; attribution is an explicit owner declaration, not verified resource ownership. No execution budget is changed. Missing or stale coverage is not zero.","tags":["Provider-reported costs"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Retrieve an imported observation and its provenance","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProviderCostImport"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["billing:read"],"x-unclosed-minimum-workspace-role":"owner"}},"/v1/workspaces/{workspace_id}/provider-costs/attributions":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"put":{"operationId":"attributeProviderCosts","summary":"Assign or release this workspace share of observed costs","description":"Assign or release this workspace share of observed costs. Owner-only billing scope. Provider observations are partial current-period overages; attribution is an explicit owner declaration, not verified resource ownership. No execution budget is changed. Missing or stale coverage is not zero.","tags":["Provider-reported costs"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Assign or release this workspace share of observed costs","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProviderCostAttribution"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["billing:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssignProviderCosts"}}}}}},"/v1/workspaces/{workspace_id}/provider-costs/report":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"retrieveProviderCostReport","summary":"Report exact assigned costs and incomplete days","description":"Report exact assigned costs and incomplete days. Owner-only billing scope. Provider observations are partial current-period overages; attribution is an explicit owner declaration, not verified resource ownership. No execution budget is changed. Missing or stale coverage is not zero.","tags":["Provider-reported costs"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"name":"start_date","in":"query","required":true,"schema":{"$ref":"#/components/schemas/ProviderUsageDate"}},{"name":"end_date","in":"query","required":true,"schema":{"$ref":"#/components/schemas/ProviderUsageDate"}}],"responses":{"200":{"description":"Report exact assigned costs and incomplete days","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProviderCostReport"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["billing:read"],"x-unclosed-minimum-workspace-role":"owner"}},"/v1/workspaces/{workspace_id}/projects/{project_id}/submission-policy":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"}],"get":{"operationId":"retrieveSubmissionPolicy","summary":"Read current source-sharing policy and cumulative quota","description":"Read current source-sharing policy and cumulative quota. Current approved membership and delegated scope are rechecked on every request. Source metadata never authorizes execution.","tags":["Source library"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Read current source-sharing policy and cumulative quota.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionPolicy"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["connections:read"],"x-unclosed-minimum-workspace-role":"owner"},"put":{"operationId":"updateSubmissionPolicy","summary":"Adopt or disable a finite source-sharing policy","description":"Adopt or disable a finite source-sharing policy. Current approved membership and delegated scope are rechecked on every request. Source metadata never authorizes execution.","tags":["Source library"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Adopt or disable a finite source-sharing policy.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionPolicy"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmissionPolicyUpdate"}}}}}},"/v1/workspaces/{workspace_id}/projects/{project_id}/source-packages":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"}],"get":{"operationId":"listSourcePackages","summary":"List private project source imports","description":"List private project source imports. Current approved membership and delegated scope are rechecked on every request. Source metadata never authorizes execution.","tags":["Source library"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List private project source imports.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourcePackagePage"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/projects/{project_id}/source-packages/{source_package_id}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"},{"$ref":"#/components/parameters/source_package_id"}],"get":{"operationId":"retrieveSourcePackage","summary":"Inspect private immutable source metadata and finite run intent","description":"Inspect private immutable source metadata and finite run intent. Current approved membership and delegated scope are rechecked on every request. Source metadata never authorizes execution.","tags":["Source library"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Inspect private immutable source metadata and finite run intent.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourcePackage"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/projects/{project_id}/source-packages/{source_package_id}/files/{source_file_sha256}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"},{"$ref":"#/components/parameters/source_package_id"},{"$ref":"#/components/parameters/source_file_sha256"}],"get":{"operationId":"downloadSourceFile","summary":"Download an authenticated sealed source file","description":"Download an authenticated sealed source file. Current approved membership and delegated scope are rechecked on every request. Source metadata never authorizes execution.","tags":["Source library"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Raw archived file bytes, at most8MiB. Authenticated attachment, never a public URL or R2 key. SHA-256 header matches the requested and recorded file digest.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"X-Content-SHA256":{"schema":{"type":"string","pattern":"^[a-f0-9]{64}$"}},"X-Content-Type-Options":{"schema":{"const":"nosniff"}},"Content-Disposition":{"schema":{"type":"string","pattern":"^attachment; filename=\"source-[a-f0-9]{64}\\.bin\"$"}}},"content":{"application/octet-stream":{"schema":{"type":"string","format":"binary","maxLength":8388608}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/api/integrations/github/source-imports":{"post":{"operationId":"importReviewedSource","summary":"Import immutable reviewed GitHub source from an authorized CI workflow","tags":["Source library"],"description":"GitHub OIDC only. Strict small metadata body, no uploaded source/manifest/proof/provider URL. Original live owner/delegated policy and repository review are rechecked. Feature flag, App private key and private archive required. Durable repository/commit/directory identity replaces a caller Idempotency-Key; active attempts return202, an authorized sealed replay200, newly sealed201. Up to3 fenced attempts under the same original policy; uncertain/failed storage remains reserved. No ordinary allocation or execution is created.","security":[{"GitHubOIDC":[]}],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourceImportRequest"}}}},"responses":{"200":{"description":"Existing sealed import.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourcePackage"}}}},"201":{"description":"Newly sealed private source package.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourcePackage"}}}},"202":{"description":"Existing import is processing.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourcePackage"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-github-oidc-only":true,"x-unclosed-bearer-scopes":[]}},"/v1/workspaces/{workspace_id}/projects/{project_id}/campaigns":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"}],"get":{"operationId":"listCampaigns","summary":"List project campaigns and held budget","description":"List project campaigns and held budget. A campaign requires owner consent and fresh reviewed GitHub OIDC. Authorized campaigns reserve budget. Staging is separate from execution; deferred campaigns require explicit dispatch consent and current executor authority. GET/list retain control state across refresh; cancellation alone does not prove cleanup or release liabilities.","tags":["Campaigns"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/StartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List project campaigns and held budget","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CampaignPage"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:read"],"x-unclosed-minimum-workspace-role":"viewer"},"post":{"operationId":"createCampaign","summary":"Record owner consent for one exact reviewed source campaign","description":"Record owner consent for one exact reviewed source campaign. A campaign requires owner consent and fresh reviewed GitHub OIDC. Authorized campaigns reserve budget. Staging is separate from execution; deferred campaigns require explicit dispatch consent and current executor authority. GET/list retain control state across refresh; cancellation alone does not prove cleanup or release liabilities.","tags":["Campaigns"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"201":{"description":"Record owner consent for one exact reviewed source campaign","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Campaign"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCampaign"}}}}}},"/v1/workspaces/{workspace_id}/projects/{project_id}/campaigns/{campaign_id}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"},{"$ref":"#/components/parameters/campaign_id"}],"get":{"operationId":"getCampaign","summary":"Inspect exact campaign consent and authorization state","description":"Inspect exact campaign consent and authorization state. A campaign requires owner consent and fresh reviewed GitHub OIDC. Authorized campaigns reserve budget. Staging is separate from execution; deferred campaigns require explicit dispatch consent and current executor authority. GET/list retain control state across refresh; cancellation alone does not prove cleanup or release liabilities.","tags":["Campaigns"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Inspect exact campaign consent and authorization state","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Campaign"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/projects/{project_id}/campaigns/{campaign_id}/withdraw":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"},{"$ref":"#/components/parameters/campaign_id"}],"post":{"operationId":"withdrawCampaign","summary":"Withdraw future campaign authority while retaining unresolved liabilities","description":"Withdraw future campaign authority while retaining unresolved liabilities. A campaign requires owner consent and fresh reviewed GitHub OIDC. Authorized campaigns reserve budget. Staging is separate from execution; deferred campaigns require explicit dispatch consent and current executor authority. GET/list retain control state across refresh; cancellation alone does not prove cleanup or release liabilities.","tags":["Campaigns"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Withdraw future campaign authority while retaining unresolved liabilities","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Campaign"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:write"],"x-unclosed-minimum-workspace-role":"owner"}},"/api/integrations/github/campaigns":{"post":{"operationId":"authorizeReviewedCampaign","summary":"Authorize one finite campaign from its reviewed GitHub workflow","tags":["Campaigns"],"description":"GitHub OIDC only with the configured public origin plus /api/integrations/github/campaigns audience. Rechecks exact source commit/tree/review and current owner, original delegated consent, repository binding, enrollment and budget inside the final D1 batch. Creates one immutable grant, budget reservation and pending delivery record. Stable campaign identity prevents duplicate reservations; retries require fresh OIDC. No caller proof, executable bytes, budget or provider URL is accepted. No relay or physical execution in this admission phase.","security":[{"GitHubOIDC":[]}],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CampaignAuthorizationRequest"}}}},"responses":{"200":{"description":"Existing authorized campaign.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Campaign"}}}},"201":{"description":"Newly authorized campaign with reserved budget.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Campaign"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-github-oidc-only":true,"x-unclosed-bearer-scopes":[]}},"/v1/workspaces/{workspace_id}/reports/usage":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"retrieveUsageReport","summary":"Summarize recorded workspace usage and costs","description":"Read-only recorded evidence with usage:read and current workspace membership. UTC half-open period and optional project filter. Snapshot cutoffs exclude late arrivals; fresh authorization is required for every page/export. Summary scans at most1,000 indexed candidates per kind; recorded_totals_complete=false means partial sums. Estimates, reconciled entries, provider observations and reserved budgets must never be added together. No invoice or runtime completeness is implied.","tags":["Reporting"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"name":"from","in":"query","required":false,"schema":{"type":"string"},"description":"Inclusive canonical millisecond UTC timestamp; required with to when snapshot is absent."},{"name":"to","in":"query","required":false,"schema":{"type":"string"},"description":"Exclusive canonical millisecond UTC timestamp, at most366 days after from."},{"name":"project_id","in":"query","required":false,"schema":{"type":"string"},"description":"Optional workspace project UUID; all projects and unassigned entries otherwise."},{"name":"snapshot","in":"query","required":false,"schema":{"type":"string"},"description":"Returned workspace-local immutable sequence cutoffs. Supply instead of from/to/project_id. This cursor is not an authorization capability or signed accounting attestation."}],"responses":{"200":{"description":"Retrieve recorded usage and cost totals.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UsageReport"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["usage:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/reports/usage/costs":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listCostEvidence","summary":"Page recorded cost evidence","description":"Read-only recorded evidence with usage:read and current workspace membership. UTC half-open period and optional project filter. Snapshot cutoffs exclude late arrivals; fresh authorization is required for every page/export. Summary scans at most1,000 indexed candidates per kind; recorded_totals_complete=false means partial sums. Estimates, reconciled entries, provider observations and reserved budgets must never be added together. No invoice or runtime completeness is implied.","tags":["Reporting"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"name":"from","in":"query","required":false,"schema":{"type":"string"},"description":"Inclusive canonical millisecond UTC timestamp; required with to when snapshot is absent."},{"name":"to","in":"query","required":false,"schema":{"type":"string"},"description":"Exclusive canonical millisecond UTC timestamp, at most366 days after from."},{"name":"project_id","in":"query","required":false,"schema":{"type":"string"},"description":"Optional workspace project UUID; all projects and unassigned entries otherwise."},{"name":"snapshot","in":"query","required":false,"schema":{"type":"string"},"description":"Returned workspace-local immutable sequence cutoffs. Supply instead of from/to/project_id. This cursor is not an authorization capability or signed accounting attestation."},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":200,"default":100},"description":"Maximum indexed candidates examined. Later arrivals are skipped, so pages may be short or empty with has_more=true."},{"name":"starting_after","in":"query","required":false,"schema":{"type":"string"},"description":"Opaque cursor bound to kind and snapshot. Carry snapshot unchanged."}],"responses":{"200":{"description":"Retrieve recorded usage and cost totals.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UsageEvidencePage"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["usage:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/reports/usage/events":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"listUsageEvidence","summary":"Page recorded usage evidence","description":"Read-only recorded evidence with usage:read and current workspace membership. UTC half-open period and optional project filter. Snapshot cutoffs exclude late arrivals; fresh authorization is required for every page/export. Summary scans at most1,000 indexed candidates per kind; recorded_totals_complete=false means partial sums. Estimates, reconciled entries, provider observations and reserved budgets must never be added together. No invoice or runtime completeness is implied.","tags":["Reporting"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"name":"from","in":"query","required":false,"schema":{"type":"string"},"description":"Inclusive canonical millisecond UTC timestamp; required with to when snapshot is absent."},{"name":"to","in":"query","required":false,"schema":{"type":"string"},"description":"Exclusive canonical millisecond UTC timestamp, at most366 days after from."},{"name":"project_id","in":"query","required":false,"schema":{"type":"string"},"description":"Optional workspace project UUID; all projects and unassigned entries otherwise."},{"name":"snapshot","in":"query","required":false,"schema":{"type":"string"},"description":"Returned workspace-local immutable sequence cutoffs. Supply instead of from/to/project_id. This cursor is not an authorization capability or signed accounting attestation."},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":200,"default":100},"description":"Maximum indexed candidates examined. Later arrivals are skipped, so pages may be short or empty with has_more=true."},{"name":"starting_after","in":"query","required":false,"schema":{"type":"string"},"description":"Opaque cursor bound to kind and snapshot. Carry snapshot unchanged."}],"responses":{"200":{"description":"Retrieve recorded usage and cost totals.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UsageEvidencePage"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["usage:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/reports/usage/statement":{"parameters":[{"$ref":"#/components/parameters/workspace_id"}],"get":{"operationId":"downloadUsageStatement","summary":"Download a bounded recorded usage statement","description":"Read-only recorded evidence with usage:read and current workspace membership. UTC half-open period and optional project filter. Snapshot cutoffs exclude late arrivals; fresh authorization is required for every page/export. Summary scans at most1,000 indexed candidates per kind; recorded_totals_complete=false means partial sums. Estimates, reconciled entries, provider observations and reserved budgets must never be added together. No invoice or runtime completeness is implied. Complete snapshot statements only: over1,000 candidates per kind or8MiB rejects with413. JSON preserves exact raw strings; CSV apostrophe-escapes formula-like cells (including negative signed values) and quotes every field. Narrow filters or paginate evidence when too large.","tags":["Reporting"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"name":"from","in":"query","required":false,"schema":{"type":"string"},"description":"Inclusive canonical millisecond UTC timestamp; required with to when snapshot is absent."},{"name":"to","in":"query","required":false,"schema":{"type":"string"},"description":"Exclusive canonical millisecond UTC timestamp, at most366 days after from."},{"name":"project_id","in":"query","required":false,"schema":{"type":"string"},"description":"Optional workspace project UUID; all projects and unassigned entries otherwise."},{"name":"snapshot","in":"query","required":false,"schema":{"type":"string"},"description":"Returned workspace-local immutable sequence cutoffs. Supply instead of from/to/project_id. This cursor is not an authorization capability or signed accounting attestation."},{"name":"format","in":"query","required":false,"schema":{"type":"string","enum":["json","csv"],"default":"json"}}],"responses":{"200":{"description":"Retrieve recorded usage and cost totals.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UsageStatement"}},"text/csv":{"schema":{"type":"string"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["usage:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/invitations/preview":{"parameters":[],"post":{"operationId":"previewInvitation","summary":"Preview a workspace invitation before accepting","description":"Fresh read for the approved intended human recipient. Returns workspace, offered/current role, expiry and versioned owner responsibilities. Rechecks live inviter authority and workspace state. Creates no membership, audit, outbox or idempotency receipt; optional Idempotency-Key is ignored. Send the token in the JSON body, never in a URL. Ownership offers return ownership_transfer with the inviting owner and exact role change; this requires a second explicit human acknowledgment on acceptance.","tags":["Workspaces"],"security":[{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Verified invitation details; no membership change.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationPreview"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":true,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"token":{"type":"string","pattern":"^uci_[0-9a-f]{64}$","writeOnly":true,"description":"Invitation secret delivered to the recipient. Never log or put it in a URL query."}},"required":["token"]}}}},"x-unclosed-read-only":true}},"/v1/workspaces/{workspace_id}/projects/{project_id}/campaigns/{campaign_id}/dispatch":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"},{"$ref":"#/components/parameters/campaign_id"}],"post":{"operationId":"dispatchCampaign","summary":"Consent to dispatch the existing reviewed finite campaign","description":"Consent to dispatch the existing reviewed finite campaign. Requires an approved current workspace owner with experiments:write and a stable Idempotency-Key. Send only an empty JSON object; reviewed source, limits and auto_dispatch remain unchanged. Dispatch requires current staged authority and enabled adoption gates. Cancellation remains available for historical cleanup. A recorded action does not prove a running experiment, confirmed teardown or a refund; unresolved liabilities remain held. Conflicts require refreshing authority rather than changing the idempotency key blindly.","tags":["Campaigns"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Existing compatible control action or original idempotent response","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CampaignControlAction"}}}},"201":{"description":"New durable control action recorded","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CampaignControlAction"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{}}}}}}},"/v1/workspaces/{workspace_id}/projects/{project_id}/campaigns/{campaign_id}/cancel":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"},{"$ref":"#/components/parameters/campaign_id"}],"post":{"operationId":"cancelCampaign","summary":"Seal admissions and request campaign cleanup","description":"Seal admissions and request campaign cleanup. Requires an approved current workspace owner with experiments:write and a stable Idempotency-Key. Send only an empty JSON object; reviewed source, limits and auto_dispatch remain unchanged. Dispatch requires current staged authority and enabled adoption gates. Cancellation remains available for historical cleanup. A recorded action does not prove a running experiment, confirmed teardown or a refund; unresolved liabilities remain held. Conflicts require refreshing authority rather than changing the idempotency key blindly.","tags":["Campaigns"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/IdempotencyKey"},{"$ref":"#/components/parameters/Origin"}],"responses":{"200":{"description":"Existing compatible control action or original idempotent response","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CampaignControlAction"}}}},"201":{"description":"New durable control action recorded","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"Idempotency-Replayed":{"$ref":"#/components/headers/Idempotency-Replayed"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CampaignControlAction"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:write"],"x-unclosed-minimum-workspace-role":"owner","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{}}}}}}},"/v1/workspaces/{workspace_id}/projects/{project_id}/campaigns/{campaign_id}/results":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"},{"$ref":"#/components/parameters/campaign_id"}],"get":{"operationId":"listCampaignResults","summary":"List reviewed campaign slots and recorded outcomes","description":"List reviewed campaign slots and recorded outcomes. Current workspace membership and experiments:read are rechecked. This read grants no execution authority. Aliases retain the physical owner provenance and never transfer charges. Missing evidence is explicit; available bytes do not prove independent scientific validation or successful replay.","tags":["Campaigns"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[{"$ref":"#/components/parameters/ResultStartingAfter"},{"$ref":"#/components/parameters/Limit"}],"responses":{"200":{"description":"List reviewed campaign slots and recorded outcomes","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CampaignResultPage"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/projects/{project_id}/campaigns/{campaign_id}/results/{source_label}":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"},{"$ref":"#/components/parameters/campaign_id"},{"$ref":"#/components/parameters/source_label"}],"get":{"operationId":"getCampaignResult","summary":"Inspect attempt history and evidence availability","description":"Inspect attempt history and evidence availability. Current workspace membership and experiments:read are rechecked. This read grants no execution authority. Aliases retain the physical owner provenance and never transfer charges. Missing evidence is explicit; available bytes do not prove independent scientific validation or successful replay.","tags":["Campaigns"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Inspect attempt history and evidence availability","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CampaignResult"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/projects/{project_id}/campaigns/{campaign_id}/results/{source_label}/export":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"},{"$ref":"#/components/parameters/campaign_id"},{"$ref":"#/components/parameters/source_label"}],"get":{"operationId":"exportCampaignResult","summary":"Read a verified immutable offline export descriptor","description":"Read a verified immutable offline export descriptor. Current workspace membership and experiments:read are rechecked. This read grants no execution authority. Aliases retain the physical owner provenance and never transfer charges. Missing evidence is explicit; available bytes do not prove independent scientific validation or successful replay.","tags":["Campaigns"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Read a verified immutable offline export descriptor","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CampaignResultExport"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:read"],"x-unclosed-minimum-workspace-role":"viewer"}},"/v1/workspaces/{workspace_id}/projects/{project_id}/campaigns/{campaign_id}/results/{source_label}/evidence/{inventory_kind}/{inventory_digest}/{object_id}/download":{"parameters":[{"$ref":"#/components/parameters/workspace_id"},{"$ref":"#/components/parameters/project_id"},{"$ref":"#/components/parameters/campaign_id"},{"$ref":"#/components/parameters/source_label"},{"$ref":"#/components/parameters/inventory_kind"},{"$ref":"#/components/parameters/inventory_digest"},{"$ref":"#/components/parameters/object_id"}],"get":{"operationId":"downloadCampaignEvidence","summary":"Download one verified historical evidence object","description":"Download one verified historical evidence object. Current workspace membership and experiments:read are rechecked. This read grants no execution authority. Aliases retain the physical owner provenance and never transfer charges. Missing evidence is explicit; available bytes do not prove independent scientific validation or successful replay.","tags":["Campaigns"],"security":[{"BearerCredential":[]},{"HumanSession":[]},{"LocalHumanSession":[]}],"parameters":[],"responses":{"200":{"description":"Download one verified historical evidence object","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"},"X-Content-SHA256":{"schema":{"type":"string","pattern":"^[a-f0-9]{64}$"}},"Content-Length":{"schema":{"type":"integer","minimum":0,"maximum":16777216}},"Content-Disposition":{"schema":{"type":"string"},"description":"Attachment only; never execute evidence as page content."}},"content":{"application/octet-stream":{"schema":{"type":"string","format":"binary"}}}},"default":{"$ref":"#/components/responses/Error"}},"x-unclosed-human-only":false,"x-unclosed-approval-required":true,"x-unclosed-bearer-scopes":["experiments:read"],"x-unclosed-minimum-workspace-role":"viewer"}}},"components":{"securitySchemes":{"BearerCredential":{"type":"http","scheme":"bearer","bearerFormat":"opaque uc_live_ token","description":"Workspace-bound delegated key. Human approval, active membership, current role, expiry, revocation and explicit scope are rechecked. Store securely; never use browser storage."},"HumanSession":{"type":"apiKey","in":"cookie","name":"__Secure-unclosed.session_token","description":"Secure HttpOnly Better Auth session issued after email verification. Cookie mutations require trusted Origin. Do not copy human session cookies into agent scripts."},"LocalHumanSession":{"type":"apiKey","in":"cookie","name":"unclosed.session_token","description":"HTTP loopback development only. Production uses HumanSession with the __Secure- prefix."},"AdminAccessAssertion":{"type":"apiKey","in":"header","name":"Cf-Access-Jwt-Assertion","description":"Additional hosted Cloudflare Access perimeter assertion; never substitutes for an approved human platform-admin session. Cloudflare injects this header after authentication. Local environment bypasses this perimeter."},"GitHubOIDC":{"type":"http","scheme":"bearer","bearerFormat":"GitHub Actions OIDC JWT","description":"Issuer https://token.actions.githubusercontent.com. Audience is the configured HTTPS product origin plus the exact source-imports or campaigns integration path. Product credentials and browser sessions cannot authorize these operations. Verified reviewed main-branch CI identity is required."}},"parameters":{"IdempotencyKey":{"name":"Idempotency-Key","in":"header","required":true,"description":"Persist a unique logical operation key before dispatch; reuse it after a lost response. Shared across all credentials of the same human, not scoped independently to each credential or workspace. Canonical parsed body, method and exact path must match. Records have a 24-hour expires_at but no purge/reuse behavior is currently implemented; do not assume keys become reusable. Replay rechecks current authority. Credential creation never replays its secret. Cloudflare connection PUT excludes its transient api_token from the logical request hash; replays return the prior proof without contacting Cloudflare again.","schema":{"type":"string","pattern":"^[!-~]{1,128}$","minLength":1,"maxLength":128}},"Origin":{"name":"Origin","in":"header","required":false,"description":"Required and matched to a configured trusted origin on every cookie-authenticated mutation; omitted for bearer requests. sec-fetch-site: cross-site is rejected for cookie mutations.","schema":{"type":"string","format":"uri"}},"StartingAfter":{"name":"starting_after","in":"query","required":false,"description":"Exclusive UUID cursor returned as next_cursor by the preceding page. Bound to this resource list and filters by caller convention; not an encoded snapshot or ownership proof.","schema":{"$ref":"#/components/schemas/Id"}},"Limit":{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},"workspace_id":{"name":"workspace_id","in":"path","required":true,"schema":{"$ref":"#/components/schemas/Id"}},"user_id":{"name":"user_id","in":"path","required":true,"schema":{"$ref":"#/components/schemas/Id"}},"invitation_id":{"name":"invitation_id","in":"path","required":true,"schema":{"$ref":"#/components/schemas/Id"}},"credential_id":{"name":"credential_id","in":"path","required":true,"schema":{"$ref":"#/components/schemas/Id"}},"allocation_id":{"name":"allocation_id","in":"path","required":true,"schema":{"$ref":"#/components/schemas/Id"}},"project_id":{"name":"project_id","in":"path","required":true,"schema":{"$ref":"#/components/schemas/Id"}},"authorization_id":{"name":"authorization_id","in":"path","required":true,"schema":{"$ref":"#/components/schemas/Id"}},"qualification_id":{"name":"qualification_id","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},"provider_import_id":{"name":"import_id","in":"path","required":true,"schema":{"$ref":"#/components/schemas/Id"}},"source_package_id":{"name":"source_package_id","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},"source_file_sha256":{"name":"source_file_sha256","in":"path","required":true,"schema":{"type":"string","pattern":"^[a-f0-9]{64}$"}},"campaign_id":{"name":"campaign_id","in":"path","required":true,"schema":{"type":"string","format":"uuid"}},"source_label":{"name":"source_label","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"}},"inventory_kind":{"name":"inventory_kind","in":"path","required":true,"schema":{"type":"string","enum":["attempt-evidence","replay-export"]}},"inventory_digest":{"name":"inventory_digest","in":"path","required":true,"schema":{"type":"string","pattern":"^[a-f0-9]{64}$"}},"object_id":{"name":"object_id","in":"path","required":true,"schema":{"type":"string","pattern":"^[a-f0-9]{64}$"}},"ResultStartingAfter":{"name":"starting_after","in":"query","required":false,"description":"Continue after the last immutable source label; not a UUID.","schema":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"}}},"headers":{"X-Request-ID":{"description":"Server-generated support correlation UUID. Caller request IDs are not trusted.","schema":{"$ref":"#/components/schemas/Id"}},"Cache-Control":{"schema":{"const":"no-store"}},"Idempotency-Replayed":{"description":"Present with value true only for a replayed committed result.","schema":{"const":"true"}}},"responses":{"Error":{"description":"Structured API failure. Common statuses: 400 invalid request or missing idempotency key; 401 missing/expired authentication or hosted Access assertion; 403 insufficient live role/scope, account approval, human session, origin or host; 404 unavailable resource; 409 idempotency/business invariant conflict; 413 body over 65,536 bytes; 415 non-JSON body; 500 internal failure; 503 unconfigured or unqualified service. Failure bodies never include credentials.","headers":{"X-Request-ID":{"$ref":"#/components/headers/X-Request-ID"},"Cache-Control":{"$ref":"#/components/headers/Cache-Control"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Id":{"type":"string","format":"uuid"},"Timestamp":{"type":"string","format":"date-time"},"Role":{"type":"string","enum":["viewer","commenter","editor","owner"]},"AccountStatus":{"type":"string","enum":["pending","approved","rejected","suspended"]},"WorkspaceStatus":{"type":"string","enum":["setup","ready","paused","suspended","closing","archived"]},"ResourceType":{"type":"string","enum":["project","hypothesis","experiment","run","finding"]},"Scope":{"type":"string","enum":["workspaces:read","workspaces:write","members:read","members:write","projects:read","projects:write","comments:read","comments:write","usage:read","credentials:read","credentials:write","admin:read","admin:write","billing:read","billing:write","connections:read","connections:write","executors:qualify","experiments:read","experiments:write"],"description":"Syntactically recognized scope names. credentials:write, admin:read and admin:write cannot currently be delegated. Other scopes are limited by the human's live workspace role. billing:read and billing:write are delegable only by a current workspace owner and remain owner-only on use. connections:read and connections:write are also delegable only by a current workspace owner and remain owner-only on use."},"Error":{"type":"object","additionalProperties":false,"properties":{"error":{"type":"object","additionalProperties":false,"properties":{"code":{"type":"string"},"message":{"type":"string"},"request_id":{"$ref":"#/components/schemas/Id"},"retryable":{"type":"boolean"},"param":{"type":"string"}},"required":["code","message","request_id","retryable"]}},"required":["error"]},"User":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"email":{"type":"string","format":"email"},"name":{"type":"string"},"intended_use":{"type":"string"},"status":{"$ref":"#/components/schemas/AccountStatus"},"is_platform_admin":{"type":"boolean"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"}},"required":["id","email","name","intended_use","status","is_platform_admin","created_at","updated_at"]},"Workspace":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"name":{"type":"string","minLength":1,"maxLength":100},"slug":{"type":"string","pattern":"^[a-z0-9]+(?:-[a-z0-9]+)*$","minLength":3,"maxLength":63},"status":{"$ref":"#/components/schemas/WorkspaceStatus"},"role":{"$ref":"#/components/schemas/Role"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"}},"required":["id","name","slug","status","role","created_at","updated_at"]},"Member":{"type":"object","additionalProperties":false,"properties":{"user_id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"role":{"$ref":"#/components/schemas/Role"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"email":{"type":"string","format":"email"},"name":{"type":"string"},"status":{"$ref":"#/components/schemas/AccountStatus"}},"required":["user_id","workspace_id","role","created_at","email","name","status"]},"MemberRole":{"type":"object","additionalProperties":false,"properties":{"workspace_id":{"$ref":"#/components/schemas/Id"},"user_id":{"$ref":"#/components/schemas/Id"},"role":{"$ref":"#/components/schemas/Role"}},"required":["workspace_id","user_id","role"]},"MembershipAccepted":{"type":"object","additionalProperties":false,"properties":{"workspace_id":{"$ref":"#/components/schemas/Id"},"user_id":{"$ref":"#/components/schemas/Id"},"role":{"$ref":"#/components/schemas/Role"},"created_at":{"$ref":"#/components/schemas/Timestamp"}},"required":["workspace_id","user_id","role","created_at"]},"MemberDeleted":{"type":"object","additionalProperties":false,"properties":{"user_id":{"$ref":"#/components/schemas/Id"},"deleted":{"const":true}},"required":["user_id","deleted"]},"Revoked":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"revoked":{"const":true}},"required":["id","revoked"]},"Project":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"name":{"type":"string","minLength":1,"maxLength":100},"description":{"type":"string","maxLength":4000},"created_by":{"$ref":"#/components/schemas/Id"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"}},"required":["id","workspace_id","name","description","created_by","created_at","updated_at"]},"Invitation":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/Role"},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"accepted_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"revoked_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"created_by":{"$ref":"#/components/schemas/Id"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"transfer_from_role":{"anyOf":[{"type":"string","enum":["viewer","commenter","editor"]},{"type":"null"}],"description":"Inviting owner role after recipient accepts; null for an ordinary invitation."},"transfer_to_user_id":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}],"description":"Pinned existing approved member; null for an ordinary invitation."}},"required":["id","workspace_id","email","role","expires_at","accepted_at","revoked_at","created_by","created_at"]},"Comment":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"resource_type":{"$ref":"#/components/schemas/ResourceType"},"resource_id":{"type":"string","minLength":1,"maxLength":128},"body":{"type":"string","minLength":1,"maxLength":10000},"created_by":{"$ref":"#/components/schemas/Id"},"created_at":{"$ref":"#/components/schemas/Timestamp"}},"required":["id","workspace_id","resource_type","resource_id","body","created_by","created_at"]},"Credential":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"user_id":{"$ref":"#/components/schemas/Id"},"name":{"type":"string"},"prefix":{"type":"string"},"scopes":{"type":"array","items":{"$ref":"#/components/schemas/Scope"}},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"revoked_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"created_at":{"$ref":"#/components/schemas/Timestamp"}},"required":["id","workspace_id","user_id","name","prefix","scopes","expires_at","revoked_at","created_at"]},"UpdateProfile":{"type":"object","additionalProperties":false,"properties":{"name":{"type":"string","pattern":"^\\s*\\S(?:[\\s\\S]{0,98}\\S)?\\s*$","description":"Trimmed before validation; normalized length 1–100 characters.","x-unclosed-trim":true},"intended_use":{"type":"string","pattern":"^(?:\\s*|\\s*\\S(?:[\\s\\S]{0,3998}\\S)?\\s*)$","description":"Trimmed before validation; normalized length 0–4000 characters.","x-unclosed-trim":true}},"required":[],"minProperties":1},"CreateWorkspace":{"type":"object","additionalProperties":false,"properties":{"name":{"type":"string","pattern":"^\\s*\\S(?:[\\s\\S]{0,98}\\S)?\\s*$","description":"Trimmed before validation; normalized length 1–100 characters.","x-unclosed-trim":true},"slug":{"type":"string","pattern":"^[a-z0-9]+(?:-[a-z0-9]+)*$","minLength":3,"maxLength":63}},"required":["name","slug"]},"UpdateWorkspace":{"type":"object","additionalProperties":false,"properties":{"name":{"type":"string","pattern":"^\\s*\\S(?:[\\s\\S]{0,98}\\S)?\\s*$","description":"Trimmed before validation; normalized length 1–100 characters.","x-unclosed-trim":true}},"required":["name"]},"UpdateMember":{"type":"object","additionalProperties":false,"properties":{"role":{"$ref":"#/components/schemas/Role"}},"required":["role"]},"CreateProject":{"type":"object","additionalProperties":false,"properties":{"name":{"type":"string","pattern":"^\\s*\\S(?:[\\s\\S]{0,98}\\S)?\\s*$","description":"Trimmed before validation; normalized length 1–100 characters.","x-unclosed-trim":true},"description":{"type":"string","pattern":"^(?:\\s*|\\s*\\S(?:[\\s\\S]{0,3998}\\S)?\\s*)$","description":"Trimmed before validation; normalized length 0–4000 characters.","x-unclosed-trim":true,"default":""}},"required":["name"]},"CreateInvitation":{"oneOf":[{"type":"object","additionalProperties":false,"properties":{"email":{"type":"string","format":"email","maxLength":254},"role":{"$ref":"#/components/schemas/Role"}},"required":["email","role"]},{"type":"object","additionalProperties":false,"properties":{"email":{"type":"string","format":"email","maxLength":254},"role":{"type":"string","const":"owner"},"transfer_from_role":{"type":"string","enum":["viewer","commenter","editor"]}},"required":["email","role","transfer_from_role"]}],"description":"Omit transfer_from_role for an ordinary invitation. To transfer your ownership, offer role owner to another existing approved member and select your new role. No role changes occur until the recipient explicitly accepts. A new transfer offer supersedes your previous pending transfer in this workspace. Scoped agents may initiate; their live credential is rechecked on acceptance."},"AcceptInvitation":{"type":"object","additionalProperties":false,"properties":{"token":{"type":"string","pattern":"^uci_[0-9a-f]{64}$","writeOnly":true,"description":"Invitation secret delivered to the recipient. Never log or put it in a URL query."},"owner_acknowledgment":{"$ref":"#/components/schemas/OwnerAcknowledgment"},"transfer_acknowledgment":{"$ref":"#/components/schemas/TransferAcknowledgment"}},"required":["token"]},"CreateComment":{"type":"object","additionalProperties":false,"properties":{"resource_type":{"$ref":"#/components/schemas/ResourceType"},"resource_id":{"type":"string","minLength":1,"maxLength":128},"body":{"type":"string","pattern":"^\\s*\\S(?:[\\s\\S]{0,9998}\\S)?\\s*$","description":"Trimmed before validation; normalized length 1–10000 characters.","x-unclosed-trim":true}},"required":["resource_type","resource_id","body"],"description":"Only project comments are currently operational; resource_id must then be a UUID in this workspace. Other recognized resource types return 503 feature_unavailable."},"CreateCredential":{"type":"object","additionalProperties":false,"properties":{"name":{"type":"string","pattern":"^\\s*\\S(?:[\\s\\S]{0,98}\\S)?\\s*$","description":"Trimmed before validation; normalized length 1–100 characters.","x-unclosed-trim":true},"scopes":{"type":"array","items":{"$ref":"#/components/schemas/Scope"},"minItems":1,"maxItems":17},"expires_in_days":{"type":"integer","minimum":1,"maximum":90,"default":30}},"required":["name","scopes"]},"AccountDecision":{"type":"object","additionalProperties":false,"properties":{"status":{"type":"string","enum":["approved","rejected","suspended"]},"reason":{"type":"string","pattern":"^(?:\\s*|\\s*\\S(?:[\\s\\S]{0,1998}\\S)?\\s*)$","description":"Trimmed before validation; normalized length 0–2000 characters.","x-unclosed-trim":true}},"required":["status"]},"InvitationCreated":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/Role"},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"accepted_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"revoked_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"created_by":{"$ref":"#/components/schemas/Id"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"delivery_status":{"const":"pending"},"transfer_from_role":{"anyOf":[{"type":"string","enum":["viewer","commenter","editor"]},{"type":"null"}],"description":"Inviting owner role after recipient accepts; null for an ordinary invitation."},"transfer_to_user_id":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}],"description":"Pinned existing approved member; null for an ordinary invitation."}},"required":["id","workspace_id","email","role","expires_at","accepted_at","revoked_at","created_by","created_at","delivery_status"]},"CredentialCreated":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"user_id":{"$ref":"#/components/schemas/Id"},"name":{"type":"string"},"prefix":{"type":"string"},"scopes":{"type":"array","items":{"$ref":"#/components/schemas/Scope"}},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"revoked_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"created_at":{"$ref":"#/components/schemas/Timestamp"},"secret":{"type":"string","pattern":"^uc_live_[0-9a-f]{64}$","readOnly":true,"description":"Revealed once on the first successful response. Store securely immediately; never log this response. It is not stored in the idempotency receipt."}},"required":["id","workspace_id","user_id","name","prefix","scopes","expires_at","revoked_at","created_at","secret"]},"CredentialReplay":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"user_id":{"$ref":"#/components/schemas/Id"},"name":{"type":"string"},"prefix":{"type":"string"},"scopes":{"type":"array","items":{"$ref":"#/components/schemas/Scope"}},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"revoked_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"created_at":{"$ref":"#/components/schemas/Timestamp"},"secret_retrievable":{"const":false}},"required":["id","workspace_id","user_id","name","prefix","scopes","expires_at","revoked_at","created_at","secret_retrievable"]},"CredentialIssueResult":{"oneOf":[{"$ref":"#/components/schemas/CredentialCreated"},{"$ref":"#/components/schemas/CredentialReplay"}],"description":"First response contains secret. An idempotent replay returns the same credential metadata with secret_retrievable:false and no secret; revoke and replace if the first secret was lost."},"Usage":{"type":"object","additionalProperties":false,"properties":{"workspace_id":{"$ref":"#/components/schemas/Id"},"currency":{"const":"USD"},"provider_status":{"const":"not_connected","description":"Legacy recorded ledger adapter status only. Separate owner-scoped provider-cost observations are available through /provider-costs/report."},"billing_status":{"const":"unavailable"},"recorded_costs":{"type":"array","items":{"type":"object","additionalProperties":false,"properties":{"category":{"type":"string"},"quality":{"type":"string","enum":["estimated","reconciled"]},"amount_micro_usd":{"type":"string","pattern":"^-?(0|[1-9][0-9]*)$","description":"Exact signed aggregate in micro-USD. Individual rows are bounded to safe integers; aggregates can exceed that bound. Preserve as a string."}},"required":["category","quality","amount_micro_usd"]}},"recorded_usage":{"type":"array","items":{"type":"object","additionalProperties":false,"properties":{"metric":{"type":"string"},"unit":{"type":"string"},"quality":{"type":"string","enum":["measured","estimated","reconciled"]},"quantity":{"type":"string","pattern":"^-?(0|[1-9][0-9]*)(\\.[0-9]{1,9})?$","description":"Exact signed decimal quantity with at most nine fractional digits."}},"required":["metric","unit","quality","quantity"]}},"recorded_totals_complete":{"type":"boolean","description":"False when either source exceeds the initial 10,000-row scan limit. Totals must then be labeled partial."},"execution":{"type":"object","additionalProperties":false,"properties":{"status":{"const":"unavailable"},"running":{"type":"null"},"queued":{"type":"null"},"completed":{"type":"null"},"failed":{"type":"null"}},"required":["status","running","queued","completed","failed"]},"freshness":{"type":"object","additionalProperties":false,"properties":{"as_of":{"$ref":"#/components/schemas/Timestamp"},"source":{"const":"product_ledger"},"complete":{"const":false}},"required":["as_of","source","complete"]},"message":{"type":"string"}},"required":["workspace_id","currency","provider_status","billing_status","recorded_costs","recorded_usage","recorded_totals_complete","execution","freshness","message"],"description":"Recorded rows only; an empty list is not a zero provider bill. No connected provider, reconciliation, execution aggregate, or budget-admission authority is implied."},"UserList":{"type":"object","additionalProperties":false,"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/User"},"maxItems":100},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"description":"Ascending UUID order, not chronological order. next_cursor is the final returned id (user_id for members) only while has_more=true; otherwise null. Concurrent changes are not a snapshot."},"WorkspaceList":{"type":"object","additionalProperties":false,"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Workspace"},"maxItems":100},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"description":"Ascending UUID order, not chronological order. next_cursor is the final returned id (user_id for members) only while has_more=true; otherwise null. Concurrent changes are not a snapshot."},"MemberList":{"type":"object","additionalProperties":false,"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Member"},"maxItems":100},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"description":"Ascending UUID order, not chronological order. next_cursor is the final returned id (user_id for members) only while has_more=true; otherwise null. Concurrent changes are not a snapshot."},"ProjectList":{"type":"object","additionalProperties":false,"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Project"},"maxItems":100},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"description":"Ascending UUID order, not chronological order. next_cursor is the final returned id (user_id for members) only while has_more=true; otherwise null. Concurrent changes are not a snapshot."},"InvitationList":{"type":"object","additionalProperties":false,"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Invitation"},"maxItems":100},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"description":"Ascending UUID order, not chronological order. next_cursor is the final returned id (user_id for members) only while has_more=true; otherwise null. Concurrent changes are not a snapshot."},"CommentList":{"type":"object","additionalProperties":false,"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Comment"},"maxItems":100},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"description":"Ascending UUID order, not chronological order. next_cursor is the final returned id (user_id for members) only while has_more=true; otherwise null. Concurrent changes are not a snapshot."},"CredentialList":{"type":"object","additionalProperties":false,"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Credential"},"maxItems":100},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"description":"Ascending UUID order, not chronological order. next_cursor is the final returned id (user_id for members) only while has_more=true; otherwise null. Concurrent changes are not a snapshot."},"BudgetAmount":{"type":"string","pattern":"^(0|[1-9][0-9]*)$","description":"Canonical unsigned integer micro-USD. Keep as a string; these are admission amounts, not provider invoices."},"BudgetLimit":{"type":"string","pattern":"^(?:0|[1-9][0-9]{0,14}|[1-8][0-9]{15}|900[0-6][0-9]{12}|90070[0-9]{11}|90071[0-8][0-9]{10}|900719[0-8][0-9]{9}|9007199[0-1][0-9]{8}|90071992[0-4][0-9]{7}|900719925[0-3][0-9]{6}|9007199254[0-6][0-9]{5}|90071992547[0-3][0-9]{4}|9007199254740[0-8][0-9]{2}|90071992547409[0-8][0-9]{1}|9007199254740990|9007199254740991)$","description":"Canonical unsigned integer micro-USD from 0 through 9007199254740991. Numeric JSON values, leading zeros, signs, decimals and scientific notation are rejected."},"BudgetTimestamp":{"type":"string","format":"date-time","pattern":"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$","description":"Canonical UTC timestamp with exactly three fractional digits and Z; offsets and omitted milliseconds are rejected."},"UpdateBudget":{"type":"object","additionalProperties":false,"properties":{"limit_micro_usd":{"$ref":"#/components/schemas/BudgetLimit"},"period_start":{"$ref":"#/components/schemas/BudgetTimestamp"},"period_end":{"$ref":"#/components/schemas/BudgetTimestamp"},"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["limit_micro_usd","period_start","period_end","expected_version"],"description":"Version 0 creates the initial policy. Use the latest retrieved version for subsequent changes; stale versions return 409. Start must precede end. Initial/new periods must be active now. An existing window may change its limit while retaining counters. A new window requires the old period to have expired, must not overlap, and carries all outstanding reservations; no automatic renewal. Setting a policy does not enable execution."},"BudgetPolicy":{"type":"object","additionalProperties":false,"properties":{"version":{"type":"integer","minimum":1,"maximum":9007199254740991},"limit_micro_usd":{"$ref":"#/components/schemas/BudgetLimit"},"period_start":{"$ref":"#/components/schemas/BudgetTimestamp"},"period_end":{"$ref":"#/components/schemas/BudgetTimestamp"}},"required":["version","limit_micro_usd","period_start","period_end"]},"BudgetAccounting":{"type":"object","additionalProperties":false,"properties":{"consumed_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"reserved_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"exposure_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"available_micro_usd":{"anyOf":[{"$ref":"#/components/schemas/BudgetAmount"},{"type":"null"}]},"over_limit":{"type":"boolean"},"period_active":{"type":"boolean"}},"required":["consumed_micro_usd","reserved_micro_usd","exposure_micro_usd","available_micro_usd","over_limit","period_active"],"description":"Conservative admission counters. Exposure includes consumed plus outstanding reservations. available_micro_usd is null before configuration. These counters are distinct from provider costs, invoices and the /usage recorded-cost view; do not sum them together. With a configured but inactive period or exhausted headroom, available_micro_usd is \"0\"; it is never negative."},"WorkspaceBudget":{"type":"object","additionalProperties":false,"properties":{"object":{"const":"workspace_budget"},"workspace_id":{"$ref":"#/components/schemas/Id"},"configured":{"type":"boolean"},"policy":{"anyOf":[{"$ref":"#/components/schemas/BudgetPolicy"},{"type":"null"}]},"accounting":{"$ref":"#/components/schemas/BudgetAccounting"},"execution_enabled":{"const":false},"provider_cost_status":{"const":"unavailable"},"accounting_basis":{"const":"conservative_admission"}},"required":["object","workspace_id","configured","policy","accounting","execution_enabled","provider_cost_status","accounting_basis"],"description":"An absent policy is returned as configured:false and policy:null, not a fabricated zero budget. This API does not enable execution or connect billing to a provider."},"LedgerEntry":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"kind":{"type":"string","enum":["policy_configured","allocation_reserved","consumption_recorded","allocation_closed"]},"allocation_id":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}]},"policy_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"amount_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"consumed_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"reserved_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"released_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"details":{"type":"object","additionalProperties":true}},"required":["id","workspace_id","kind","allocation_id","policy_version","amount_micro_usd","consumed_micro_usd","reserved_micro_usd","released_micro_usd","created_at","details"],"description":"Immutable admission event. amount is the policy limit, reserved maximum, consumption delta, or closure final consumption delta according to kind. consumed/reserved are aggregate snapshots after the event; released is the event release. Do not add all rows as if they were charges."},"Allocation":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"deployment_id":{"$ref":"#/components/schemas/Id"},"grant_digest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"epoch":{"type":"integer","minimum":1,"maximum":9007199254740991},"policy_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"max_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"consumed_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"reserved_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"released_micro_usd":{"$ref":"#/components/schemas/BudgetAmount"},"state":{"type":"string","enum":["reserved","active","closed"]},"last_sequence":{"type":"integer","minimum":0,"maximum":9007199254740991},"expires_at":{"$ref":"#/components/schemas/BudgetTimestamp"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"closed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}},"required":["id","workspace_id","deployment_id","grant_digest","epoch","policy_version","max_micro_usd","consumed_micro_usd","reserved_micro_usd","released_micro_usd","state","last_sequence","expires_at","created_at","closed_at"],"description":"Read-only finite allocation record. Expiration alone is not proof of teardown or permission to release the reservation. Creation, consumption receipts and confirmed closure remain internal and are not exposed by this API."},"LedgerEntryList":{"type":"object","additionalProperties":false,"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/LedgerEntry"},"maxItems":100},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"description":"Standard ascending UUID pagination. Only this workspace is returned; follow next_cursor while has_more is true."},"AllocationList":{"type":"object","additionalProperties":false,"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Allocation"},"maxItems":100},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"$ref":"#/components/schemas/Id"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"description":"Standard ascending UUID pagination. Only this workspace is returned; follow next_cursor while has_more is true."},"CloudflareAccountId":{"type":"string","pattern":"^[a-f0-9]{32}$","description":"Cloudflare account ID, lowercase 32-character hexadecimal."},"CloudflareAccount":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"version":{"type":"integer","minimum":1,"maximum":9007199254740991},"account_id":{"$ref":"#/components/schemas/CloudflareAccountId"},"account_name":{"type":"string","minLength":1,"maxLength":256,"pattern":"^[^\\u0000-\\u001f\\u007f]+$"},"status":{"type":"string","enum":["read_access_verified","disconnected"]},"verified_at":{"$ref":"#/components/schemas/Timestamp"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"},"disconnected_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}},"required":["id","version","account_id","account_name","status","verified_at","created_at","updated_at","disconnected_at"],"description":"Sanitized metadata only. read_access_verified is a point-in-time account-read proof, not retained credentials, continued provider access, execution readiness or billing availability."},"CloudflareConnection":{"type":"object","additionalProperties":false,"properties":{"object":{"const":"cloudflare_connection"},"workspace_id":{"$ref":"#/components/schemas/Id"},"configured":{"type":"boolean"},"connection":{"anyOf":[{"$ref":"#/components/schemas/CloudflareAccount"},{"type":"null"}]},"credential_retained":{"const":false},"execution_enabled":{"const":false},"provider_cost_status":{"const":"unavailable"},"verification_kind":{"const":"account_read_access"}},"required":["object","workspace_id","configured","connection","credential_retained","execution_enabled","provider_cost_status","verification_kind"],"description":"Singleton workspace account-read proof. Before first setup, configured=false and connection=null. After disconnect, configured remains true and the record status becomes disconnected; metadata is retained for audit."},"ConnectCloudflare":{"type":"object","additionalProperties":false,"properties":{"account_id":{"$ref":"#/components/schemas/CloudflareAccountId"},"api_token":{"type":"string","format":"password","writeOnly":true,"minLength":16,"maxLength":2048,"pattern":"^[!-~]{16,2048}$","description":"Transient Cloudflare token for account-read verification. Required on each submitted request; never stored, logged, reflected, or retained. Do not put it in query strings, command arguments or source files."},"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["account_id","api_token","expected_version"],"description":"Version 0 for initial configuration, otherwise the current connection version. Reverify the same account with optimistic concurrency. Changing account_id requires an explicit prior disconnect. A successful proof increments version and never retains the token."},"DisconnectCloudflare":{"type":"object","additionalProperties":false,"properties":{"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["expected_version"],"description":"Explicit optimistic version required. Outstanding open allocations block disconnect; expiration alone is not confirmed teardown. Disconnect updates metadata and does not revoke the transient Cloudflare token at the provider."},"GitHubProviderId":{"type":"string","pattern":"^(?=[1-9])(?:0|[1-9][0-9]{0,14}|[1-8][0-9]{15}|900[0-6][0-9]{12}|90070[0-9]{11}|90071[0-8][0-9]{10}|900719[0-8][0-9]{9}|9007199[0-1][0-9]{8}|90071992[0-4][0-9]{7}|900719925[0-3][0-9]{6}|9007199254[0-6][0-9]{5}|90071992547[0-3][0-9]{4}|9007199254740[0-8][0-9]{2}|90071992547409[0-8][0-9]{1}|9007199254740990|9007199254740991)$","description":"GitHub stable positive safe-integer ID serialized as a decimal string; never a repository name or a JavaScript rounded number."},"GitHubRepositoryName":{"type":"string","minLength":3,"maxLength":140,"pattern":"^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?/(?!\\.{1,2}$)[A-Za-z0-9_.-]{1,100}$","description":"Explicit owner/name selection. Repository . and .. are rejected. Matching is case-insensitive; successful metadata uses provider canonical casing."},"GitHubRepositoryConnection":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"version":{"type":"integer","minimum":1,"maximum":9007199254740991},"repository_id":{"$ref":"#/components/schemas/GitHubProviderId"},"repository_owner_id":{"$ref":"#/components/schemas/GitHubProviderId"},"installation_id":{"$ref":"#/components/schemas/GitHubProviderId"},"github_user_id":{"$ref":"#/components/schemas/GitHubProviderId"},"repository_full_name":{"$ref":"#/components/schemas/GitHubRepositoryName"},"repository_private":{"type":"boolean"},"github_login":{"type":"string","minLength":1,"maxLength":39,"pattern":"^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$"},"status":{"type":"string","enum":["linked","disconnected","revoked"]},"verified_at":{"$ref":"#/components/schemas/Timestamp"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"},"disconnected_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"revoked_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}},"required":["id","version","repository_id","repository_owner_id","installation_id","github_user_id","repository_full_name","repository_private","github_login","status","verified_at","created_at","updated_at","disconnected_at","revoked_at"],"description":"Projected metadata and historical authority proof only; no user token, clone token, OAuth code, state, PKCE verifier or raw provider payload."},"GitHubConnection":{"type":"object","additionalProperties":false,"properties":{"object":{"const":"github_repository_connection"},"workspace_id":{"$ref":"#/components/schemas/Id"},"project_id":{"$ref":"#/components/schemas/Id"},"configured":{"type":"boolean"},"setup_available":{"type":"boolean"},"installation_url":{"anyOf":[{"type":"string","format":"uri","pattern":"^https://github\\.com/apps/[A-Za-z0-9-]+/installations/new$"},{"type":"null"}]},"connection":{"anyOf":[{"$ref":"#/components/schemas/GitHubRepositoryConnection"},{"type":"null"}]},"credential_retained":{"const":false},"execution_enabled":{"const":false}},"required":["object","workspace_id","project_id","configured","setup_available","installation_url","connection","credential_retained","execution_enabled"],"description":"One repository association per project. Before first link configured=false and connection=null. Disconnected/revoked metadata remains configured. setup_available requires valid server GitHub App configuration; it does not certify live provider setup. Installation is a separate human consent step."},"GitHubAuthorization":{"type":"object","additionalProperties":false,"properties":{"object":{"const":"github_authorization"},"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"project_id":{"$ref":"#/components/schemas/Id"},"repository":{"$ref":"#/components/schemas/GitHubRepositoryName"},"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740990},"status":{"type":"string","enum":["pending","processing","succeeded","failed","expired"]},"created_at":{"$ref":"#/components/schemas/Timestamp"},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"completed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"error_code":{"anyOf":[{"type":"string"},{"type":"null"}]},"human_action_required":{"type":"boolean"},"human_action_url":{"anyOf":[{"type":"string","pattern":"^/v1/workspaces/[^/]+/github/authorizations/[^/]+/authorize$"},{"type":"null"}]}},"required":["object","id","workspace_id","project_id","repository","expected_version","status","created_at","expires_at","completed_at","error_code","human_action_required","human_action_url"],"description":"Sanitized initiating-user state. Pending flow expires after ten minutes. human_action_url is a local continuation for the initiating human, not a provider consent URL; agents must not follow it or impersonate consent. Expired/interrupted/failed state never proves a repository link."},"StartGitHubAuthorization":{"type":"object","additionalProperties":false,"properties":{"repository":{"$ref":"#/components/schemas/GitHubRepositoryName"},"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740990}},"required":["repository","expected_version"],"description":"Explicit owner/name authorizes sharing projected repository metadata with the workspace. Version0 before first link, otherwise the current connection version. Changing the repository requires disconnect. GitHub repository admin authority must be proved during human continuation."},"DisconnectGitHub":{"type":"object","additionalProperties":false,"properties":{"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740990}},"required":["expected_version"],"description":"Preserves metadata/history and increments version. Every nonclosed workspace allocation prevents local disconnect; no provider uninstall, token revocation, work cancellation or charge cessation is implied."},"ExecutorResource":{"type":"object","additionalProperties":false,"properties":{"type":{"enum":["d1","r2_bucket","queue","workflow","durable_object_namespace"]},"binding":{"type":"string"},"id":{"type":"string"},"identity_kind":{"enum":["provider_id","provider_alias"]},"name":{"type":"string"},"jurisdiction":{"type":"string"},"created_at":{"type":"string","format":"date-time"},"class_name":{"type":"string"},"dead_letter_queue_id":{"type":"string"}},"required":["type","binding","id","identity_kind","name"]},"ExecutorManifest":{"type":"object","additionalProperties":false,"properties":{"schema_version":{"const":1},"provider":{"const":"cloudflare"},"account_id":{"$ref":"#/components/schemas/CloudflareAccountId"},"worker":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/CloudflareAccountId"},"name":{"type":"string"},"origin":{"type":"string","format":"uri"},"deployment_id":{"$ref":"#/components/schemas/Id"},"version_id":{"$ref":"#/components/schemas/Id"},"script_etag":{"type":"string"}},"required":["id","name","origin","deployment_id","version_id","script_etag"]},"resources":{"type":"array","minItems":11,"maxItems":11,"items":{"$ref":"#/components/schemas/ExecutorResource"}}},"required":["schema_version","provider","account_id","worker","resources"]},"ExecutorEnrollment":{"type":"object","additionalProperties":false,"properties":{"id":{"$ref":"#/components/schemas/Id"},"generation":{"type":"integer","minimum":1,"maximum":9007199254740991},"connection_id":{"$ref":"#/components/schemas/Id"},"connection_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"account_id":{"$ref":"#/components/schemas/CloudflareAccountId"},"status":{"enum":["connected_unqualified","disconnected"]},"public_key":{"type":"string","pattern":"^[A-Za-z0-9_-]{43}$","description":"Canonical unpadded base64url of a validated prime-order 32-byte Ed25519 public key."},"key_fingerprint":{"type":"string","pattern":"^[a-f0-9]{64}$"},"manifest_hash":{"type":"string","pattern":"^[a-f0-9]{64}$"},"manifest":{"$ref":"#/components/schemas/ExecutorManifest"},"verified_at":{"type":"string","format":"date-time"},"created_at":{"type":"string","format":"date-time"},"disconnected_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["id","generation","connection_id","connection_version","account_id","status","public_key","key_fingerprint","manifest_hash","manifest","verified_at","created_at","disconnected_at"]},"ExecutorConnection":{"type":"object","additionalProperties":false,"properties":{"object":{"const":"executor_connection"},"workspace_id":{"$ref":"#/components/schemas/Id"},"configured":{"type":"boolean"},"version":{"type":"integer","minimum":0,"maximum":9007199254740991},"connection":{"anyOf":[{"$ref":"#/components/schemas/ExecutorEnrollment"},{"type":"null"}]},"execution_enabled":{"const":false},"provider_cost_status":{"const":"unavailable"}},"required":["object","workspace_id","configured","version","connection","execution_enabled","provider_cost_status"],"description":"Current or latest historical unqualified enrollment. Version starts at zero and increments on enrollment/disconnect; generation remains the enrollment creation version. No execution authority or provider-cost coverage is granted."},"ConnectExecutor":{"type":"object","additionalProperties":false,"properties":{"worker_locator":{"type":"string","pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"public_key":{"type":"string","pattern":"^[A-Za-z0-9_-]{43}$","description":"Canonical unpadded base64url of a validated prime-order 32-byte Ed25519 public key."},"api_token":{"type":"string","format":"password","writeOnly":true,"minLength":16,"maxLength":2048,"pattern":"^[!-~]{16,2048}$","description":"Transient scoped Cloudflare user read token expiring within 24 hours. Excluded from persisted intent, audit and response. Never place in command arguments, logs, query strings or browser storage."},"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740991},"expected_connection_version":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["worker_locator","public_key","api_token","expected_version","expected_connection_version"]},"DisconnectExecutor":{"type":"object","additionalProperties":false,"properties":{"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["expected_version"]},"Qualification":{"type":"object","properties":{"object":{"const":"executor_qualification"},"id":{"type":"string","format":"uuid"},"workspace_id":{"type":"string","format":"uuid"},"enrollment_id":{"type":"string","format":"uuid"},"owner_user_id":{"type":"string","format":"uuid"},"generation":{"type":"integer","minimum":1,"maximum":9007199254740991},"connection_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"budget_policy_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"consent_expires_at":{"$ref":"#/components/schemas/BudgetTimestamp"},"max_micro_usd":{"const":"10000"},"status":{"enum":["pending_review","pending_delivery","accepted","cleanup_pending","closed","withdrawn","rejected"]},"outcome":{"enum":["pending","passed","failed","not_started"]},"allocation_id":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]},"created_at":{"$ref":"#/components/schemas/BudgetTimestamp"},"decided_at":{"anyOf":[{"$ref":"#/components/schemas/BudgetTimestamp"},{"type":"null"}]},"withdrawn_at":{"anyOf":[{"$ref":"#/components/schemas/BudgetTimestamp"},{"type":"null"}]},"closed_at":{"anyOf":[{"$ref":"#/components/schemas/BudgetTimestamp"},{"type":"null"}]},"execution_enabled":{"const":false},"provider_cost_status":{"const":"unavailable"},"qualification_status":{"enum":["unqualified","fixed_canary_passed"]},"build_verification":{"const":"administrator_recorded_metadata"}},"required":["object","id","workspace_id","enrollment_id","owner_user_id","generation","connection_version","budget_policy_version","consent_expires_at","max_micro_usd","status","outcome","allocation_id","created_at","decided_at","withdrawn_at","closed_at","execution_enabled","provider_cost_status","qualification_status","build_verification"],"additionalProperties":false},"QualificationList":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Qualification"}},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"additionalProperties":false},"CreateQualification":{"type":"object","properties":{"enrollment_id":{"type":"string","format":"uuid"},"generation":{"type":"integer","minimum":1,"maximum":9007199254740991},"connection_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"budget_policy_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"consent_expires_at":{"$ref":"#/components/schemas/BudgetTimestamp"},"max_micro_usd":{"const":"10000"}},"required":["enrollment_id","generation","connection_version","budget_policy_version","consent_expires_at","max_micro_usd"],"additionalProperties":false},"QualificationDecision":{"oneOf":[{"type":"object","properties":{"decision":{"const":"approve"},"source_commit":{"type":"string","pattern":"^[a-f0-9]{40}$"},"source_tree":{"type":"string","pattern":"^[a-f0-9]{40}$"},"worker_build_digest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"evidence_digest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"image_digest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"}},"required":["decision","source_commit","source_tree","worker_build_digest","evidence_digest","image_digest"],"additionalProperties":false},{"type":"object","properties":{"decision":{"const":"reject"}},"required":["decision"],"additionalProperties":false}]},"ExactProviderUsd":{"type":"string","maxLength":36,"pattern":"^(?:0|-?(?:9007199254740991|(?:[1-9][0-9]{0,14}|[1-8][0-9]{15}|900[0-6][0-9]{12}|90070[0-9]{11}|90071[0-8][0-9]{10}|900719[0-8][0-9]{9}|9007199[0-1][0-9]{8}|90071992[0-4][0-9]{7}|900719925[0-3][0-9]{6}|9007199254[0-6][0-9]{5}|90071992547[0-3][0-9]{4}|9007199254740[0-8][0-9]{2}|90071992547409[0-8][0-9]{1}|9007199254740990)(?:\\.[0-9]{0,17}[1-9])?|0\\.[0-9]{0,17}[1-9]))$","description":"Canonical exact signed USD decimal, at most eighteen fractional digits; absolute value at most 9007199254740991. Not a float or per-row rounded amount."},"ProviderUsageDate":{"type":"string","format":"date","pattern":"^\\d{4}-\\d{2}-\\d{2}$","description":"Valid UTC calendar date. Imports require a completed day; report dates are inclusive."},"ProviderCostObservation":{"type":"object","properties":{"schema_version":{"type":"number","const":1},"provider":{"type":"string","const":"cloudflare"},"source_kind":{"type":"string","const":"cloudflare_billable_usage_v1"},"coverage":{"type":"string","const":"partial_current_period_overages"},"evidence":{"type":"string","const":"provider_observed"},"valuation":{"type":"string","const":"BilledCost"},"account_id":{"type":"string","pattern":"^[a-f0-9]{32}$"},"usage_date":{"$ref":"#/components/schemas/ProviderUsageDate"},"currency":{"type":"string","const":"USD"},"observed_at":{"type":"string"},"coverage_digest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"source_digest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"total_usd":{"$ref":"#/components/schemas/ExactProviderUsd"},"rows":{"minItems":1,"maxItems":10000,"type":"array","items":{"type":"object","properties":{"ServiceProviderName":{"type":"string","maxLength":256},"InvoiceIssuerName":{"type":"string","maxLength":256},"HostProviderName":{"type":"string","maxLength":256},"BillingAccountId":{"type":"string","pattern":"^[a-f0-9]{32}$"},"BillingAccountName":{"anyOf":[{"type":"string","maxLength":256},{"type":"null"}]},"ServiceName":{"type":"string","maxLength":256},"ChargeCategory":{"type":"string","const":"Usage"},"ChargeClass":{"type":"null"},"ChargeDescription":{"anyOf":[{"type":"string","maxLength":256},{"type":"null"}]},"ChargePeriodStart":{"type":"string"},"ChargePeriodEnd":{"type":"string"},"BillingPeriodStart":{"type":"string"},"BillingCurrency":{"type":"string","const":"USD"},"ConsumedQuantity":{"$ref":"#/components/schemas/ExactProviderUsd"},"ConsumedUnit":{"type":"string","maxLength":256},"PricingQuantity":{"$ref":"#/components/schemas/ExactProviderUsd"},"PricingUnit":{"type":"string","maxLength":256},"CumulatedPricingQuantity":{"$ref":"#/components/schemas/ExactProviderUsd"},"ListCost":{"$ref":"#/components/schemas/ExactProviderUsd"},"ContractedCost":{"$ref":"#/components/schemas/ExactProviderUsd"},"EffectiveCost":{"$ref":"#/components/schemas/ExactProviderUsd"},"BilledCost":{"$ref":"#/components/schemas/ExactProviderUsd"},"CumulatedContractedCost":{"$ref":"#/components/schemas/ExactProviderUsd"},"ServiceFamilyName":{"type":"string","maxLength":256},"SubscriptionId":{"anyOf":[{"type":"string","maxLength":256},{"type":"null"}]},"ZoneId":{"anyOf":[{"type":"string","maxLength":256},{"type":"null"}]},"ZoneName":{"anyOf":[{"type":"string","maxLength":256},{"type":"null"}]}},"required":["ServiceProviderName","InvoiceIssuerName","HostProviderName","BillingAccountId","BillingAccountName","ServiceName","ChargeCategory","ChargeClass","ChargeDescription","ChargePeriodStart","ChargePeriodEnd","BillingPeriodStart","BillingCurrency","ConsumedQuantity","ConsumedUnit","PricingQuantity","PricingUnit","CumulatedPricingQuantity","ListCost","ContractedCost","EffectiveCost","BilledCost","CumulatedContractedCost"],"additionalProperties":false}},"context":{"type":"object","properties":{"query_profile":{"type":"string","const":"default_current_period"},"subscriptions":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":256},"start_timestamp":{"type":"string"},"billing_cycle_anchor_timestamp":{"type":"string"},"end_timestamp":{"type":["string","null"]}},"required":["id","start_timestamp","billing_cycle_anchor_timestamp","end_timestamp"],"additionalProperties":false}},"billing_period_starts":{"minItems":1,"maxItems":10000,"type":"array","items":{"type":"string"}},"billing_contexts":{"minItems":1,"maxItems":10000,"type":"array","items":{"type":"object","properties":{"subscription_id":{"anyOf":[{"type":"string","maxLength":256},{"type":"null"}]},"billing_period_start":{"type":"string"}},"required":["subscription_id","billing_period_start"],"additionalProperties":false}}},"required":["query_profile","subscriptions","billing_period_starts","billing_contexts"],"additionalProperties":false}},"required":["schema_version","provider","source_kind","coverage","evidence","valuation","account_id","usage_date","currency","observed_at","coverage_digest","source_digest","total_usd","rows","context"],"additionalProperties":false},"ProviderCostImport":{"type":"object","properties":{"object":{"const":"provider_cost_import"},"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"connection_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"created_at":{"$ref":"#/components/schemas/Timestamp"},"observation_id":{"$ref":"#/components/schemas/Id"},"source_revision":{"type":"integer","minimum":1,"maximum":9007199254740991},"observation":{"$ref":"#/components/schemas/ProviderCostObservation"}},"required":["object","id","workspace_id","connection_version","created_at","observation_id","source_revision","observation"],"additionalProperties":false},"ProviderCostImportSummary":{"type":"object","properties":{"object":{"const":"provider_cost_import"},"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"connection_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"created_at":{"$ref":"#/components/schemas/Timestamp"},"observation_id":{"$ref":"#/components/schemas/Id"},"source_revision":{"type":"integer","minimum":1,"maximum":9007199254740991},"account_id":{"type":"string","pattern":"^[a-f0-9]{32}$"},"usage_date":{"$ref":"#/components/schemas/ProviderUsageDate"},"total_usd":{"$ref":"#/components/schemas/ExactProviderUsd"},"observed_at":{"$ref":"#/components/schemas/Timestamp"},"coverage":{"const":"partial_current_period_overages"}},"required":["object","id","workspace_id","connection_version","created_at","observation_id","source_revision","account_id","usage_date","total_usd","observed_at","coverage"],"additionalProperties":false},"ProviderCostImportList":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ProviderCostImportSummary"}},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"additionalProperties":false},"ProviderCostAttribution":{"type":"object","properties":{"object":{"const":"provider_cost_attribution"},"id":{"$ref":"#/components/schemas/Id"},"workspace_id":{"$ref":"#/components/schemas/Id"},"import_id":{"$ref":"#/components/schemas/Id"},"observation_id":{"$ref":"#/components/schemas/Id"},"account_id":{"type":"string","pattern":"^[a-f0-9]{32}$"},"usage_date":{"$ref":"#/components/schemas/ProviderUsageDate"},"source_revision":{"type":"integer","minimum":1,"maximum":9007199254740991},"version":{"type":"integer","minimum":1,"maximum":9007199254740991},"amount_usd":{"$ref":"#/components/schemas/ExactProviderUsd"},"note":{"type":"string","minLength":1,"maxLength":1000,"pattern":"^[^\\x00-\\x1f\\x7f-\\x9f]+$","description":"Plain-text rationale for this workspace share."},"created_at":{"$ref":"#/components/schemas/Timestamp"}},"required":["object","id","workspace_id","import_id","observation_id","account_id","usage_date","source_revision","version","amount_usd","note","created_at"],"additionalProperties":false},"ImportProviderCosts":{"type":"object","properties":{"account_id":{"type":"string","pattern":"^[a-f0-9]{32}$"},"connection_version":{"type":"integer","minimum":1,"maximum":9007199254740990},"usage_date":{"$ref":"#/components/schemas/ProviderUsageDate"},"api_token":{"type":"string","minLength":16,"maxLength":2048,"pattern":"^[!-~]+$","writeOnly":true,"description":"Transient selected-account Cloudflare Billing Read token. Never retained, hashed into idempotency, or returned."}},"required":["account_id","connection_version","usage_date","api_token"],"additionalProperties":false},"AssignProviderCosts":{"type":"object","properties":{"import_id":{"$ref":"#/components/schemas/Id"},"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740990},"amount_usd":{"$ref":"#/components/schemas/ExactProviderUsd"},"note":{"type":"string","minLength":1,"maxLength":1000,"pattern":"^[^\\x00-\\x1f\\x7f-\\x9f]+$","description":"Plain-text rationale for this workspace share."}},"required":["import_id","expected_version","amount_usd","note"],"additionalProperties":false},"ProviderCostReportAccount":{"type":"object","properties":{"account_id":{"type":"string","pattern":"^[a-f0-9]{32}$"},"import_id":{"$ref":"#/components/schemas/Id"},"observation_id":{"$ref":"#/components/schemas/Id"},"source_revision":{"type":"integer","minimum":1,"maximum":9007199254740991},"observed_at":{"$ref":"#/components/schemas/Timestamp"},"provider_total_usd":{"$ref":"#/components/schemas/ExactProviderUsd"},"current_source":{"type":"boolean"},"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740991},"current_assigned_usd":{"anyOf":[{"$ref":"#/components/schemas/ExactProviderUsd"},{"type":"null"}]},"last_known_attribution":{"anyOf":[{"$ref":"#/components/schemas/ProviderCostAttribution"},{"type":"null"}]},"status":{"type":"string","enum":["observed","needs_refresh","needs_assignment"]}},"required":["account_id","import_id","observation_id","source_revision","observed_at","provider_total_usd","current_source","expected_version","current_assigned_usd","last_known_attribution","status"],"additionalProperties":false},"ProviderCostReportDay":{"type":"object","properties":{"usage_date":{"$ref":"#/components/schemas/ProviderUsageDate"},"status":{"type":"string","enum":["missing","observed","needs_refresh","needs_assignment"]},"accounts":{"type":"array","items":{"$ref":"#/components/schemas/ProviderCostReportAccount"}}},"required":["usage_date","status","accounts"],"additionalProperties":false},"ProviderCostReport":{"type":"object","properties":{"object":{"const":"provider_cost_report"},"workspace_id":{"$ref":"#/components/schemas/Id"},"start_date":{"$ref":"#/components/schemas/ProviderUsageDate"},"end_date":{"$ref":"#/components/schemas/ProviderUsageDate"},"currency":{"const":"USD"},"coverage":{"const":"partial_current_period_overages"},"evidence":{"const":"provider_observed"},"as_of":{"$ref":"#/components/schemas/Timestamp"},"known_current_assigned_total_usd":{"$ref":"#/components/schemas/ExactProviderUsd"},"assigned_total_usd":{"anyOf":[{"$ref":"#/components/schemas/ExactProviderUsd"},{"type":"null"}]},"incomplete_days":{"type":"integer","minimum":0,"maximum":31},"days":{"type":"array","minItems":1,"maxItems":31,"items":{"$ref":"#/components/schemas/ProviderCostReportDay"}},"limitations":{"type":"array","items":{"type":"string"}}},"required":["object","workspace_id","start_date","end_date","currency","coverage","evidence","as_of","known_current_assigned_total_usd","assigned_total_usd","incomplete_days","days","limitations"],"additionalProperties":false},"SourceReviewPolicy":{"type":"object","properties":{"environment":{"type":"string","pattern":"^[a-zA-Z0-9_-]{1,64}$"},"subject_format":{"enum":["legacy","immutable"]},"submission_workflow":{"type":"string","pattern":"^\\.github/workflows/[a-zA-Z0-9][a-zA-Z0-9_.-]{0,99}\\.ya?ml$"},"validation_workflow":{"type":"string","pattern":"^\\.github/workflows/[a-zA-Z0-9][a-zA-Z0-9_.-]{0,99}\\.ya?ml$"},"validation_check":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[^\\x00-\\x1f\\x7f-\\x9f]+$"},"validation_app_id":{"type":"string","pattern":"^[1-9][0-9]{0,15}$","description":"Canonical positive GitHub identifier, at most9007199254740991."},"trusted_codex_approver":{"anyOf":[{"type":"object","properties":{"id":{"type":"string","pattern":"^[1-9][0-9]{0,15}$","description":"Canonical positive GitHub identifier, at most9007199254740991."},"login":{"type":"string","pattern":"^[a-zA-Z0-9][a-zA-Z0-9-]{0,38}(?:\\[bot\\])?$"}},"required":["id","login"],"additionalProperties":false},{"type":"null"}]}},"required":["environment","subject_format","submission_workflow","validation_workflow","validation_check","validation_app_id","trusted_codex_approver"],"additionalProperties":false},"SubmissionPolicyUpdate":{"type":"object","properties":{"expected_version":{"type":"integer","minimum":0,"maximum":9007199254740990},"github_connection_version":{"type":"integer","minimum":1,"maximum":9007199254740990},"enabled":{"type":"boolean"},"expires_at":{"type":"string","format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$"},"experiment_directories":{"type":"array","items":{"type":"string","pattern":"^experiments/[a-zA-Z0-9][a-zA-Z0-9_.-]{0,99}$"},"minItems":1,"maxItems":100,"uniqueItems":true},"max_imports":{"type":"integer","minimum":1,"maximum":1000},"max_bytes":{"type":"integer","minimum":17825792,"maximum":1073741824},"review":{"$ref":"#/components/schemas/SourceReviewPolicy"}},"required":["expected_version","github_connection_version","enabled","expires_at","experiment_directories","max_imports","max_bytes","review"],"additionalProperties":false,"description":"Owner source-sharing consent. Enabling requires current linked GitHub version, writable workspace and expiry in the next90days. Disabling an existing policy may preserve its expired timestamp and original GitHub version after disconnection/archive."},"SubmissionPolicyRevision":{"type":"object","properties":{"github_connection_version":{"type":"integer","minimum":1,"maximum":9007199254740990},"enabled":{"type":"boolean"},"expires_at":{"type":"string","format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$"},"experiment_directories":{"type":"array","items":{"type":"string","pattern":"^experiments/[a-zA-Z0-9][a-zA-Z0-9_.-]{0,99}$"},"minItems":1,"maxItems":100,"uniqueItems":true},"max_imports":{"type":"integer","minimum":1,"maximum":1000},"max_bytes":{"type":"integer","minimum":17825792,"maximum":1073741824},"review":{"$ref":"#/components/schemas/SourceReviewPolicy"},"version":{"type":"integer","minimum":1,"maximum":9007199254740991},"owner_user_id":{"type":"string","format":"uuid"},"parent_credential_id":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]},"created_at":{"type":"string","format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$"}},"required":["github_connection_version","enabled","expires_at","experiment_directories","max_imports","max_bytes","review","version","owner_user_id","parent_credential_id","created_at"],"additionalProperties":false},"SourceQuota":{"type":"object","properties":{"count":{"type":"integer","minimum":0,"maximum":9007199254740991},"bytes":{"type":"integer","minimum":0,"maximum":9007199254740991},"reserved_count":{"type":"integer","minimum":0,"maximum":9007199254740991},"reserved_bytes":{"type":"integer","minimum":0,"maximum":9007199254740991},"sealed_count":{"type":"integer","minimum":0,"maximum":9007199254740991},"sealed_bytes":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["count","bytes","reserved_count","reserved_bytes","sealed_count","sealed_bytes"],"additionalProperties":false},"SubmissionPolicy":{"type":"object","properties":{"object":{"const":"submission_policy"},"workspace_id":{"type":"string","format":"uuid"},"project_id":{"type":"string","format":"uuid"},"setup_available":{"type":"boolean"},"policy":{"anyOf":[{"$ref":"#/components/schemas/SubmissionPolicyRevision"},{"type":"null"}]},"quota":{"$ref":"#/components/schemas/SourceQuota"},"execution_authorized":{"const":false}},"required":["object","workspace_id","project_id","setup_available","policy","quota","execution_authorized"],"additionalProperties":false},"SourcePackageFile":{"type":"object","properties":{"path":{"type":"string","minLength":1,"maxLength":500},"git_blob_sha":{"type":"string","pattern":"^[a-f0-9]{40}$"},"sha256":{"type":"string","pattern":"^[a-f0-9]{64}$"},"size_bytes":{"type":"integer","minimum":0,"maximum":8388608},"role":{"type":"string","enum":["control","source","input","evaluator","environment","documentation"]}},"required":["path","git_blob_sha","sha256","size_bytes","role"],"additionalProperties":false},"SourcePackageManifest":{"type":"object","properties":{"schema_version":{"type":"number","const":1},"object":{"type":"string","const":"source_package_manifest"},"repository_id":{"type":"string","pattern":"^[1-9][0-9]{0,15}$"},"repository_full_name":{"type":"string","maxLength":140},"commit_sha":{"type":"string","pattern":"^[a-f0-9]{40}$"},"reviewed_head":{"type":"string","pattern":"^[a-f0-9]{40}$"},"tree_sha":{"type":"string","pattern":"^[a-f0-9]{40}$"},"directory_tree_sha":{"type":"string","pattern":"^[a-f0-9]{40}$"},"experiment_directory":{"type":"string","pattern":"^experiments\\/[a-zA-Z0-9][a-zA-Z0-9_.-]{0,99}$"},"files":{"minItems":2,"maxItems":256,"type":"array","items":{"$ref":"#/components/schemas/SourcePackageFile"}},"file_count":{"type":"integer","minimum":2,"maximum":256},"total_bytes":{"type":"integer","minimum":0,"maximum":16777216},"specification":{"type":"object","properties":{"schema_version":{"type":"number","const":1},"title":{"type":"string","minLength":1,"maxLength":240},"command":{"minItems":1,"maxItems":32,"type":"array","items":{"type":"string","minLength":1,"maxLength":1024}},"working_directory":{"type":"string","const":"."},"executor_id":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},"image_digest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"},"runner_protocol":{"type":"string","const":"zodiac-runner-v1"},"network_policy":{"type":"string","const":"disabled"},"limits":{"type":"object","properties":{"max_wall_seconds":{"type":"integer","minimum":1,"maximum":3600},"max_attempts":{"type":"integer","minimum":1,"maximum":5},"max_output_bytes":{"type":"integer","minimum":1,"maximum":16777216},"max_input_bytes":{"type":"integer","minimum":1,"maximum":16777216},"concurrency":{"type":"integer","minimum":1,"maximum":100},"budget_micro_usd":{"type":"integer","minimum":1,"maximum":100000000}},"required":["max_wall_seconds","max_attempts","max_output_bytes","max_input_bytes","concurrency","budget_micro_usd"],"additionalProperties":false},"evaluation":{"type":"object","properties":{"primary_metric":{"type":"string","minLength":1,"maxLength":200},"success_criterion":{"type":"string","minLength":1,"maxLength":4000},"controls":{"minItems":1,"maxItems":50,"type":"array","items":{"type":"string","minLength":1,"maxLength":1000}},"interpretation":{"type":"string","minLength":1,"maxLength":4000},"known_answer":{"type":"boolean"}},"required":["primary_metric","success_criterion","controls","interpretation","known_answer"],"additionalProperties":false},"hypothesis":{"type":"object","properties":{"claim":{"type":"string","minLength":1,"maxLength":4000},"rationale":{"type":"string","minLength":1,"maxLength":8000},"sources":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":2000}},"assumptions":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":2000}},"rejection_criterion":{"type":"string","minLength":1,"maxLength":4000}},"required":["claim","rationale","sources","assumptions","rejection_criterion"],"additionalProperties":false},"inputs":{"maxItems":1000,"type":"array","items":{"type":"object","properties":{"path":{"type":"string","maxLength":500},"sha256":{"type":"string","pattern":"^[a-f0-9]{64}$"}},"required":["path","sha256"],"additionalProperties":false}}},"required":["schema_version","title","command","working_directory","executor_id","image_digest","runner_protocol","network_policy","limits","evaluation","hypothesis","inputs"],"additionalProperties":false},"approval":{"type":"object","properties":{"schema_version":{"type":"number","const":1},"enabled":{"type":"boolean"},"auto_dispatch":{"type":"boolean"},"experiment_version_id":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},"authorized_runs":{"minItems":1,"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},"seed":{"type":"string","minLength":1,"maxLength":100},"parameters":{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{}},"budget_micro_usd":{"type":"integer","minimum":0,"maximum":9007199254740991},"replication_reason":{"type":"string","minLength":1,"maxLength":1000}},"required":["id","seed","parameters","budget_micro_usd"],"additionalProperties":false}}},"required":["schema_version","enabled","auto_dispatch","authorized_runs"],"additionalProperties":false},"intent":{"type":"object","properties":{"kind":{"type":"string","enum":["source","reuse"]},"experiment_version_id":{"anyOf":[{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},{"type":"null"}]},"authorized_run_count":{"type":"integer","minimum":1,"maximum":100},"budget_micro_usd":{"type":"integer","minimum":1,"maximum":100000000}},"required":["kind","experiment_version_id","authorized_run_count","budget_micro_usd"],"additionalProperties":false},"execution_authorized":{"type":"boolean","const":false},"execution_status":{"type":"string","const":"pending_execution"}},"required":["schema_version","object","repository_id","repository_full_name","commit_sha","reviewed_head","tree_sha","directory_tree_sha","experiment_directory","files","file_count","total_bytes","specification","approval","intent","execution_authorized","execution_status"],"additionalProperties":false,"description":"Metadata only, no source bytes/storage keys. File inventory/count/byte totals, exact control files, declared input hashes and finite run count/budget are cross-validated by the server. Reuse archives only controls/README and preserves the original version reference. Importing grants no execution authority."},"SourcePackage":{"type":"object","properties":{"object":{"const":"source_package"},"id":{"type":"string","format":"uuid"},"workspace_id":{"type":"string","format":"uuid"},"project_id":{"type":"string","format":"uuid"},"policy_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"repository_id":{"type":"string","pattern":"^[1-9][0-9]{0,15}$","description":"Canonical positive GitHub identifier, at most9007199254740991."},"repository_full_name":{"type":"string","maxLength":140},"commit_sha":{"type":"string","pattern":"^[a-f0-9]{40}$"},"reviewed_head":{"type":"string","pattern":"^[a-f0-9]{40}$"},"tree_sha":{"type":"string","pattern":"^[a-f0-9]{40}$"},"experiment_directory":{"type":"string","pattern":"^experiments/[a-zA-Z0-9][a-zA-Z0-9_.-]{0,99}$"},"status":{"enum":["importing","failed","sealed"]},"attempts":{"type":"integer","minimum":1,"maximum":3},"error_code":{"anyOf":[{"type":"string","maxLength":100},{"type":"null"}]},"created_at":{"type":"string","format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$"},"sealed_at":{"anyOf":[{"type":"string","format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$"},{"type":"null"}]},"manifest":{"anyOf":[{"$ref":"#/components/schemas/SourcePackageManifest"},{"type":"null"}]},"execution_authorized":{"const":false},"execution_status":{"const":"pending_execution"}},"required":["object","id","workspace_id","project_id","policy_version","repository_id","repository_full_name","commit_sha","reviewed_head","tree_sha","experiment_directory","status","attempts","error_code","created_at","sealed_at","manifest","execution_authorized","execution_status"],"additionalProperties":false,"description":"Durable import view. Sealed detail responses have a manifest/sealed_at and downloadable files. List responses always omit the large manifest as null, including sealed rows. Failed/importing packages have null manifest/sealed_at. Failed reservations remain charged."},"SourcePackagePage":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/SourcePackage"}},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"additionalProperties":false},"SourceImportRequest":{"type":"object","properties":{"workspace_id":{"type":"string","format":"uuid"},"project_id":{"type":"string","format":"uuid"},"policy_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"commit_sha":{"type":"string","pattern":"^[a-f0-9]{40}$"},"experiment_directory":{"type":"string","pattern":"^experiments/[a-zA-Z0-9][a-zA-Z0-9_.-]{0,99}$"}},"required":["workspace_id","project_id","policy_version","commit_sha","experiment_directory"],"additionalProperties":false},"CreateCampaign":{"type":"object","properties":{"source_package_id":{"type":"string","format":"uuid"},"qualification_id":{"type":"string","format":"uuid"},"cloudflare_connection_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"budget_policy_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"image_archive_sha256":{"type":"string","pattern":"^[a-f0-9]{64}$"},"admission_before":{"$ref":"#/components/schemas/BudgetTimestamp"},"deadline":{"$ref":"#/components/schemas/BudgetTimestamp"}},"required":["source_package_id","qualification_id","cloudflare_connection_version","budget_policy_version","image_archive_sha256","admission_before","deadline"],"additionalProperties":false},"Campaign":{"type":"object","properties":{"object":{"const":"campaign"},"id":{"type":"string","format":"uuid"},"workspace_id":{"type":"string","format":"uuid"},"project_id":{"type":"string","format":"uuid"},"source_package_id":{"type":"string","format":"uuid"},"qualification_id":{"type":"string","format":"uuid"},"enrollment_id":{"type":"string","format":"uuid"},"owner_user_id":{"type":"string","format":"uuid"},"github_connection_id":{"type":"string","format":"uuid"},"source_policy_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"generation":{"type":"integer","minimum":1,"maximum":9007199254740991},"cloudflare_connection_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"budget_policy_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"github_connection_version":{"type":"integer","minimum":1,"maximum":9007199254740991},"manifest_sha256":{"type":"string","pattern":"^[a-f0-9]{64}$"},"image_archive_sha256":{"type":"string","pattern":"^[a-f0-9]{64}$"},"commit_sha":{"type":"string","pattern":"^[a-f0-9]{40}$"},"reviewed_head":{"type":"string","pattern":"^[a-f0-9]{40}$"},"tree_sha":{"type":"string","pattern":"^[a-f0-9]{40}$"},"parent_credential_id":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]},"allocation_id":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]},"repository_id":{"type":"string","pattern":"^[1-9][0-9]{0,15}$"},"repository_full_name":{"type":"string","maxLength":140},"experiment_directory":{"type":"string","pattern":"^experiments/[a-zA-Z0-9][a-zA-Z0-9_.-]{0,99}$"},"review":{"$ref":"#/components/schemas/SourceReviewPolicy"},"max_micro_usd":{"type":"string","pattern":"^[1-9][0-9]{0,8}$","description":"Exact finite reviewed budget, at most100000000 microUSD. This is an application reservation, not a provider invoice."},"authorized_run_count":{"type":"integer","minimum":1,"maximum":100},"max_attempts":{"type":"integer","minimum":1,"maximum":5},"concurrency":{"type":"integer","minimum":1,"maximum":100},"auto_dispatch":{"type":"boolean"},"status":{"enum":["pending_authorization","authorized","withdrawn"]},"delivery_state":{"enum":["not_authorized","pending","staged"],"description":"staged means the executor sealed source, version and every finite authorization slot. Ordinary execution remains disabled; the allocation remains reserved."},"execution_enabled":{"const":false},"execution_status":{"const":"pending_execution"},"admission_before":{"$ref":"#/components/schemas/BudgetTimestamp"},"deadline":{"$ref":"#/components/schemas/BudgetTimestamp"},"created_at":{"$ref":"#/components/schemas/BudgetTimestamp"},"authorized_at":{"anyOf":[{"$ref":"#/components/schemas/BudgetTimestamp"},{"type":"null"}]},"withdrawn_at":{"anyOf":[{"$ref":"#/components/schemas/BudgetTimestamp"},{"type":"null"}]},"experiment_id":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},"experiment_version_id":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},"approval_grant_id":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},"control_state":{"type":"object","additionalProperties":false,"properties":{"sequence":{"type":"integer","minimum":0,"maximum":3},"dispatch_requested":{"type":"boolean"},"admissions_sealed":{"type":"boolean"},"cancelled":{"type":"boolean"},"closed":{"type":"boolean"}},"required":["sequence","dispatch_requested","admissions_sealed","cancelled","closed"]},"dispatch_available":{"type":"boolean","description":"Deployment and retained-evidence availability hint. The action separately requires current workspace owner access and experiments:write."},"cancel_available":{"type":"boolean","description":"Deployment and retained-evidence availability hint. The action separately requires current workspace owner access and experiments:write."}},"required":["object","id","workspace_id","project_id","source_package_id","qualification_id","enrollment_id","owner_user_id","github_connection_id","source_policy_version","generation","cloudflare_connection_version","budget_policy_version","github_connection_version","manifest_sha256","image_archive_sha256","commit_sha","reviewed_head","tree_sha","parent_credential_id","allocation_id","repository_id","repository_full_name","experiment_directory","review","max_micro_usd","authorized_run_count","max_attempts","concurrency","auto_dispatch","status","delivery_state","execution_enabled","execution_status","admission_before","deadline","created_at","authorized_at","withdrawn_at","experiment_id","experiment_version_id","approval_grant_id","control_state","dispatch_available","cancel_available"],"additionalProperties":false},"CampaignPage":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Campaign"}},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]}},"required":["data","has_more","next_cursor"],"additionalProperties":false},"CampaignAuthorizationRequest":{"type":"object","properties":{"workspace_id":{"type":"string","format":"uuid"},"project_id":{"type":"string","format":"uuid"},"campaign_id":{"type":"string","format":"uuid"}},"required":["workspace_id","project_id","campaign_id"],"additionalProperties":false},"UsageReport":{"type":"object","properties":{"object":{"const":"usage_report","type":"string"},"workspace_id":{"type":"string"},"currency":{"const":"USD","type":"string"},"query":{"type":"object","properties":{"from":{"type":"string"},"to":{"type":"string"},"project_id":{"type":["string","null"]}},"required":["from","to","project_id"],"additionalProperties":false},"snapshot":{"type":"string"},"snapshot_captured_at":{"type":"string"},"recorded_totals_complete":{"type":"boolean"},"counts":{"type":"object","properties":{"costs":{"type":"integer","minimum":0},"events":{"type":"integer","minimum":0}},"required":["costs","events"],"additionalProperties":false},"recorded_costs":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string"},"quality":{"type":"string","enum":["estimated","reconciled"]},"amount_micro_usd":{"type":"string","pattern":"^-?[0-9]+$"}},"required":["category","quality","amount_micro_usd"],"additionalProperties":false}},"recorded_usage":{"type":"array","items":{"type":"object","properties":{"metric":{"type":"string"},"unit":{"type":"string"},"quality":{"type":"string","enum":["measured","estimated","reconciled"]},"quantity":{"type":"string"}},"required":["metric","unit","quality","quantity"],"additionalProperties":false}},"coverage":{"type":"string","const":"recorded_entries_only"},"execution":{"type":"object","properties":{"status":{"type":"string","const":"unavailable"},"running":{"type":"null"},"elapsed_ms":{"type":"null"},"attempt_ms":{"type":"null"}},"required":["status","running","elapsed_ms","attempt_ms"],"additionalProperties":false},"limitations":{"type":"array","items":{"type":"string"}}},"required":["object","workspace_id","currency","query","snapshot","snapshot_captured_at","recorded_totals_complete","counts","recorded_costs","recorded_usage","coverage","execution","limitations"],"additionalProperties":false},"CostEvidence":{"type":"object","properties":{"id":{"type":"string","maxLength":256},"workspace_id":{"type":"string","maxLength":256},"project_id":{"type":["string","null"],"maxLength":256},"experiment_id":{"type":["string","null"],"maxLength":256},"campaign_id":{"type":["string","null"],"maxLength":256},"run_id":{"type":["string","null"],"maxLength":256},"attempt_id":{"type":["string","null"],"maxLength":256},"source":{"type":"string","maxLength":256},"quality":{"type":"string","maxLength":256},"occurred_at":{"type":"string","maxLength":256},"source_entry_id":{"type":"string","maxLength":256},"amount_micro_usd":{"type":"string","maxLength":256},"currency":{"type":"string","maxLength":256},"category":{"type":"string","maxLength":256},"created_at":{"type":"string","maxLength":256}},"required":["id","workspace_id","project_id","experiment_id","campaign_id","run_id","attempt_id","source","quality","occurred_at","source_entry_id","amount_micro_usd","currency","category","created_at"],"additionalProperties":false},"UsageEvidence":{"type":"object","properties":{"id":{"type":"string","maxLength":256},"workspace_id":{"type":"string","maxLength":256},"project_id":{"type":["string","null"],"maxLength":256},"experiment_id":{"type":["string","null"],"maxLength":256},"campaign_id":{"type":["string","null"],"maxLength":256},"run_id":{"type":["string","null"],"maxLength":256},"attempt_id":{"type":["string","null"],"maxLength":256},"source":{"type":"string","maxLength":256},"quality":{"type":"string","maxLength":256},"occurred_at":{"type":"string","maxLength":256},"source_event_id":{"type":"string","maxLength":256},"metric":{"type":"string","maxLength":256},"quantity":{"type":"string","maxLength":256},"unit":{"type":"string","maxLength":256},"received_at":{"type":"string","maxLength":256}},"required":["id","workspace_id","project_id","experiment_id","campaign_id","run_id","attempt_id","source","quality","occurred_at","source_event_id","metric","quantity","unit","received_at"],"additionalProperties":false},"UsageEvidencePage":{"type":"object","properties":{"object":{"type":"string","const":"usage_evidence_page"},"kind":{"type":"string","enum":["costs","events"]},"snapshot":{"type":"string"},"data":{"type":"array","items":{"anyOf":[{"$ref":"#/components/schemas/CostEvidence"},{"$ref":"#/components/schemas/UsageEvidence"}]}},"has_more":{"type":"boolean"},"next_cursor":{"type":["string","null"]},"scanned_count":{"type":"integer","minimum":0},"excluded_late_count":{"type":"integer","minimum":0}},"required":["object","kind","snapshot","data","has_more","next_cursor","scanned_count","excluded_late_count"],"additionalProperties":false},"UsageStatement":{"type":"object","properties":{"object":{"type":"string","const":"usage_statement"},"workspace_id":{"type":"string"},"currency":{"const":"USD","type":"string"},"query":{"type":"object","properties":{"from":{"type":"string"},"to":{"type":"string"},"project_id":{"type":["string","null"]}},"required":["from","to","project_id"],"additionalProperties":false},"snapshot":{"type":"string"},"snapshot_captured_at":{"type":"string"},"recorded_totals_complete":{"type":"boolean"},"counts":{"type":"object","properties":{"costs":{"type":"integer","minimum":0},"events":{"type":"integer","minimum":0}},"required":["costs","events"],"additionalProperties":false},"recorded_costs":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string"},"quality":{"type":"string","enum":["estimated","reconciled"]},"amount_micro_usd":{"type":"string","pattern":"^-?[0-9]+$"}},"required":["category","quality","amount_micro_usd"],"additionalProperties":false}},"recorded_usage":{"type":"array","items":{"type":"object","properties":{"metric":{"type":"string"},"unit":{"type":"string"},"quality":{"type":"string","enum":["measured","estimated","reconciled"]},"quantity":{"type":"string"}},"required":["metric","unit","quality","quantity"],"additionalProperties":false}},"coverage":{"type":"string","const":"recorded_entries_only"},"execution":{"type":"object","properties":{"status":{"type":"string","const":"unavailable"},"running":{"type":"null"},"elapsed_ms":{"type":"null"},"attempt_ms":{"type":"null"}},"required":["status","running","elapsed_ms","attempt_ms"],"additionalProperties":false},"limitations":{"type":"array","items":{"type":"string"}},"cost_entries":{"type":"array","items":{"$ref":"#/components/schemas/CostEvidence"}},"usage_events":{"type":"array","items":{"$ref":"#/components/schemas/UsageEvidence"}}},"required":["object","workspace_id","currency","query","snapshot","snapshot_captured_at","recorded_totals_complete","counts","recorded_costs","recorded_usage","coverage","execution","limitations","cost_entries","usage_events"],"additionalProperties":false},"OwnerAcknowledgment":{"type":"object","additionalProperties":false,"required":["version","accepted"],"properties":{"version":{"type":"string","const":"workspace-owner-v1"},"accepted":{"type":"boolean","const":true}}},"InvitationPreview":{"type":"object","additionalProperties":false,"required":["object","invitation_id","workspace","role","current_role","expires_at","owner_responsibility"],"properties":{"object":{"const":"invitation_preview"},"invitation_id":{"type":"string","format":"uuid"},"workspace":{"type":"object","additionalProperties":false,"required":["id","name"],"properties":{"id":{"type":"string","format":"uuid"},"name":{"type":"string"}}},"role":{"type":"string","enum":["viewer","commenter","editor","owner"]},"current_role":{"anyOf":[{"type":"string","enum":["viewer","commenter","editor","owner"]},{"type":"null"}]},"expires_at":{"type":"string","format":"date-time"},"owner_responsibility":{"anyOf":[{"type":"null"},{"type":"object","additionalProperties":false,"required":["version","text"],"properties":{"version":{"type":"string","const":"workspace-owner-v1"},"text":{"type":"string"}}}]},"ownership_transfer":{"anyOf":[{"type":"null"},{"type":"object","additionalProperties":false,"properties":{"from_user_id":{"$ref":"#/components/schemas/Id"},"from_name":{"type":"string"},"to_role":{"type":"string","enum":["viewer","commenter","editor"]},"version":{"type":"string","const":"workspace-transfer-v1"},"text":{"type":"string"}},"required":["from_user_id","from_name","to_role","version","text"]}]}}},"CampaignControlAction":{"type":"object","additionalProperties":false,"properties":{"object":{"const":"campaign_control_action","type":"string"},"campaign_id":{"type":"string","format":"uuid"},"action":{"type":"string","enum":["dispatch","cancel"]},"control_id":{"type":"string","format":"uuid"},"digest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"sequence":{"type":"integer","minimum":1,"maximum":3},"admissions_sealed":{"type":"boolean"},"cancelled":{"type":"boolean"},"auto_dispatch":{"type":"boolean","description":"Original reviewed auto_dispatch, unchanged by this action."}},"required":["object","campaign_id","action","control_id","digest","sequence","admissions_sealed","cancelled","auto_dispatch"]},"CampaignResultSlot":{"type":"object","properties":{"object":{"type":"string","const":"campaign_result_slot"},"campaign_id":{"type":"string","format":"uuid"},"source_label":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},"authorized_run_id":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},"disposition":{"type":"string","enum":["pending","physical","alias","unstarted"]},"outcome":{"type":"string","enum":["pending","running","succeeded","failed","cancelled","timed_out"]},"owner_campaign_id":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]},"owner_run_id":{"anyOf":[{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},{"type":"null"}]},"attempt_count":{"type":"integer","minimum":0,"maximum":5},"selected_attempt_id":{"anyOf":[{"type":"string","minLength":1,"maxLength":300},{"type":"null"}]},"selected_fence":{"anyOf":[{"type":"integer","minimum":1},{"type":"null"}]},"evidence_status":{"type":"string","enum":["pending","available","unavailable","none"]},"scientific_assessment":{"type":"string","const":"inconclusive"},"independent_scientific_validation":{"const":false,"type":"boolean"},"export_available":{"type":"boolean","description":"True only after verified terminal owner closure and complete selected export evidence. Attempt evidence can be available earlier."}},"required":["object","campaign_id","source_label","authorized_run_id","disposition","outcome","owner_campaign_id","owner_run_id","attempt_count","selected_attempt_id","selected_fence","evidence_status","scientific_assessment","independent_scientific_validation","export_available"],"additionalProperties":false},"ResultDownload":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-f0-9]{64}$"},"sha256":{"type":"string","pattern":"^[a-f0-9]{64}$"},"size_bytes":{"type":"integer","minimum":0,"maximum":16777216},"download_url":{"type":"string","pattern":"^/v1/workspaces/"}},"required":["id","sha256","size_bytes","download_url"],"additionalProperties":false},"ResultArtifact":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-f0-9]{64}$"},"sha256":{"type":"string","pattern":"^[a-f0-9]{64}$"},"size_bytes":{"type":"integer","minimum":0,"maximum":16777216},"download_url":{"type":"string","pattern":"^/v1/workspaces/"},"path":{"type":"string","minLength":1,"maxLength":512},"content_type":{"type":"string","minLength":1,"maxLength":256}},"required":["id","sha256","size_bytes","download_url","path","content_type"],"additionalProperties":false},"ResultCheckpoint":{"type":"object","properties":{"id":{"type":"string","pattern":"^[a-f0-9]{64}$"},"sha256":{"type":"string","pattern":"^[a-f0-9]{64}$"},"size_bytes":{"type":"integer","minimum":0,"maximum":16777216},"download_url":{"type":"string","pattern":"^/v1/workspaces/"},"path":{"type":"string","minLength":1,"maxLength":512},"content_type":{"type":"string","minLength":1,"maxLength":256},"sequence":{"type":"integer","minimum":1},"captured_at":{"type":"string","format":"date-time"}},"required":["id","sha256","size_bytes","download_url","path","content_type","sequence","captured_at"],"additionalProperties":false},"CampaignResultAttempt":{"type":"object","properties":{"attempt_id":{"type":"string","minLength":1,"maxLength":300},"attempt_number":{"type":"integer","minimum":1,"maximum":5},"fence":{"type":"integer","minimum":1},"state":{"type":"string","enum":["held","settled"]},"outcome":{"type":"string","enum":["running","succeeded","failed","cancelled","timed_out","not_started"]},"settlement_digest":{"anyOf":[{"type":"string","pattern":"^[a-f0-9]{64}$"},{"type":"null"}]},"evidence_status":{"type":"string","enum":["pending","available","unavailable","none"]},"unavailable_reason":{"anyOf":[{"type":"string"},{"type":"null"}]},"result_manifest":{"anyOf":[{"$ref":"#/components/schemas/ResultDownload"},{"type":"null"}]},"artifacts":{"type":"array","items":{"$ref":"#/components/schemas/ResultArtifact"},"maxItems":256},"checkpoints":{"type":"array","items":{"$ref":"#/components/schemas/ResultCheckpoint"},"maxItems":128},"settlement":{"anyOf":[{"type":"object","description":"Original signed historical envelope; does not authorize new execution.","additionalProperties":true},{"type":"null"}]},"evidence":{"anyOf":[{"type":"object","description":"Original signed historical envelope; does not authorize new execution.","additionalProperties":true},{"type":"null"}]}},"required":["attempt_id","attempt_number","fence","state","outcome","settlement_digest","evidence_status","unavailable_reason","result_manifest","artifacts","checkpoints","settlement","evidence"],"additionalProperties":false},"CampaignResult":{"type":"object","properties":{"object":{"type":"string","const":"campaign_result"},"slot":{"$ref":"#/components/schemas/CampaignResultSlot"},"attempts":{"type":"array","items":{"$ref":"#/components/schemas/CampaignResultAttempt"},"maxItems":5},"provenance":{"type":"object","properties":{"requested_campaign_id":{"type":"string","format":"uuid"},"requested_source_label":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},"owner_campaign_id":{"anyOf":[{"type":"string","format":"uuid"},{"type":"null"}]},"owner_source_label":{"anyOf":[{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},{"type":"null"}]},"owner_run_id":{"anyOf":[{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},{"type":"null"}]},"alias":{"type":"boolean"},"alias_disposition":{"type":["string","null"],"enum":["referenced","detached",null]}},"required":["requested_campaign_id","requested_source_label","owner_campaign_id","owner_source_label","owner_run_id","alias"],"additionalProperties":false},"scientific_assessment":{"type":"string","const":"inconclusive"},"independent_scientific_validation":{"const":false,"type":"boolean"}},"required":["object","slot","attempts","provenance","scientific_assessment","independent_scientific_validation"],"additionalProperties":false},"CampaignResultPage":{"type":"object","properties":{"object":{"type":"string","const":"list"},"data":{"type":"array","items":{"$ref":"#/components/schemas/CampaignResultSlot"},"maxItems":100},"has_more":{"type":"boolean"},"next_cursor":{"anyOf":[{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$"},{"type":"null"}]}},"required":["object","data","has_more","next_cursor"],"additionalProperties":false},"CampaignResultExport":{"type":"object","additionalProperties":true,"properties":{"schema_version":{"const":1,"type":"integer"},"kind":{"type":"string","const":"zodiac-replay-export"},"run":{"type":"object","additionalProperties":true},"attempts":{"type":"array","items":{"type":"object","additionalProperties":true},"maxItems":5},"bundle":{"type":"object","additionalProperties":true},"manifest_sha256":{"type":"string","pattern":"^[a-f0-9]{64}$"},"specification":{"type":"object","additionalProperties":true},"result":{"anyOf":[{"type":"object","additionalProperties":true},{"type":"null"}]},"files":{"type":"array","items":{"type":"object","additionalProperties":true},"maxItems":256},"artifacts":{"type":"array","items":{"type":"object","additionalProperties":true}},"executor_archive":{"anyOf":[{"type":"object","additionalProperties":true},{"type":"null"}]},"replay_guarantee":{"type":"string"},"exported_at":{"type":"string","format":"date-time"},"managed_provenance":{"type":"object","additionalProperties":true},"managed_result_manifest":{"anyOf":[{"type":"object","additionalProperties":true},{"type":"null"}]},"managed_evidence":{"type":"array","items":{"type":"object","additionalProperties":true}}},"required":["schema_version","kind","run","attempts","bundle","manifest_sha256","specification","result","files","artifacts","executor_archive","managed_provenance","managed_result_manifest","managed_evidence"]},"TransferAcknowledgment":{"type":"object","additionalProperties":false,"properties":{"version":{"type":"string","const":"workspace-transfer-v1"},"accepted":{"type":"boolean","const":true},"from_user_id":{"$ref":"#/components/schemas/Id"},"to_role":{"type":"string","enum":["viewer","commenter","editor"]}},"required":["version","accepted","from_user_id","to_role"]}}},"x-unclosed-capability-gaps":["Account-level and admin delegated credentials","Human consent/action_required continuation flow","Executable provider connections, GitHub code ingestion/automation and campaigns beyond metadata proof","Executable budget enforcement, public allocation lifecycle, invoicing, provider reconciliation and complete activity aggregates","Outgoing webhooks, test/live mode, API version negotiation","OpenAPI-generated SDKs and public contract hosting"]}