Agency API schemas - Allternit Docs

Implementation: DESIGN (server) · Exposure: PUBLIC PREVIEW (contract). The Agency API is not live yet. This page describes the published v0.3 contract so you can review and build against it; details may change before alpha.

This page lists all 98 component schemas in the v0.3 OpenAPI contract, in contract order. The tables are generated from the contract file by surfaces/docs/scripts/gen_reference.py, so they match it field for field. Nested inline objects are flattened with dotted names (data.from, criteria[].result).

Reading the tables

Required means the field must be present: in a request body you must send it, and in a response the server always returns it. A field marked no may be absent.
Disclosure tier marks fields outside the everyday surface: B is the capability tier, C is the graph tier, D is the runtime tier. See progressive disclosure.
Request objects are closed unless the table says otherwise. Unknown request fields are rejected with ERR_INPUT_UNSUPPORTED. Clients must ignore unknown response fields and treat unknown enum values as not understood. See Versioning.
Names ending in V1 in descriptions (for example AttentionRequestV1) refer to kernel contracts. The API objects are public views of those contracts.

Index

Extensions · Metadata · Timestamp · TrustClass · PageBase · ErrorEnvelope · Error · AgencyRequest · Workspace · ResourceRef · ContextItem · Authority · Grant · NetworkPolicy · ExecutionEnvironment · Budget · BudgetUsage · CompletionCriteria · CriterionRef · Criterion · CapabilityLimits · ModelConstraints · GraphSpec · RuntimeHints · RunStatus · Run · RunLinks · RunOutput · CompletionState · VerificationResult · CancellationState · RunDebugView · ControlRequest · CancelRequest · RunInput · InputAccepted · RunPage · RunEventType · RunEventBase · RunEvent · RunStatusChangedEvent · RunProgressEvent · RunMessageEvent · AttentionRequestedEvent · AttentionResolvedEvent · InputAcceptedEvent · ArtifactCreatedEvent · ReceiptAppendedEvent · VerificationCompletedEvent · BudgetThresholdEvent · DebugTraceEvent · RunEventPage · AttentionStatus · AttentionRequest · ProposedAction · AttentionResolution · AttentionResponse · AttentionPage · Artifact · ArtifactPage · ReceiptType · Receipt · ReceiptSignature · Provenance · ReceiptChainVerification · ReceiptPage · GraphView · CampaignStatus · CampaignCreate · CampaignBudget · WakePolicy · WakeTrigger · AttentionPolicy · Campaign · CampaignControlRequest · CampaignPage · ReplayRequest · ReplayStatus · Replay · ReplayResults · DecisionRequest · DecisionResult · Capability · CapabilityPage · Agent · AgentPage · ModelClass · ModelClassPage · AuthorityProfile · AuthorityProfilePage · FilesystemScope · ApprovalRequirement · ResolvedAuthority · ResolvedCompletion · ResolvedDefaults · CompletionCriterion · CompletionCriterionPage · Jwks

Extensions

Extension pattern. Any closed object may carry properties named x-<vendor-neutral-name>. Servers preserve unknown x- properties; they never change kernel semantics. Type: object.

Metadata

Caller-owned annotations. Max 50 keys; values ≤ 500 chars. Map of string to string.

Timestamp

Type: string (date-time).

TrustClass

Type: string enum.

Value
`PUBLIC`
`INTERNAL`
`RESTRICTED`
`SECRET`
`UNTRUSTED`

PageBase

Field	Type	Required
`object`	`"list"`	yes
`has_more`	boolean	yes
`next_cursor`	string \| null	yes

ErrorEnvelope

Field	Type	Required	Description
`error`	Error	yes

No other properties are accepted.

Error

Field	Type	Required	Description
`family`	enum: `INPUT`, `STATE`, `CONTEXT`, `ROUTING`, `DECISION`, `TOOL`, `POLICY`, `MUTATION`, `VERIFY`, `TRANSFER`, `BUDGET`, `SYSTEM`, `AUTH`, `NOT_FOUND`, `IDEMPOTENCY`, `RATE_LIMIT`, `VERSION`	yes	Runtime error family (§24.2) plus API-surface families.
`code`	string	yes	`ERR_*` code. Kernel codes pass through unchanged (e.g. ERR_INPUT_AMBIGUOUS, ERR_STATE_CONFLICT, ERR_POLICY_DENIED, ERR_APPROVAL_REQUIRED, ERR_COST_BUDGET, ERR_WORKER_LOST). API codes: ERR_AUTH_INVALID, ERR_AUTH_SCOPE, ERR_NOT_FOUND, ERR_RUN_TERMINAL, ERR_ATTENTION_RESOLVED, ERR_IDEMPOTENCY_KEY_REUSED, ERR_IDEMPOTENCY_IN_PROGRESS, ERR_RATE_LIMIT, ERR_VERSION_UNSUPPORTED, ERR_CURSOR_EXPIRED, ERR_REPLAY_UNRECORDED, ERR_AUTHORITY_PROFILE_FORBIDDEN, ERR_DEFAULTS_UNRESOLVABLE (request cannot be safely defaulted; no run executes). New codes may be added; treat unknown codes by `family` and `retryable`.
`message`	string	yes
`retryable`	boolean	yes
`request_id`	string	yes
`run_id`	string \| null	no
`param`	string \| null	no	Offending request field, if any.
`policy_reason_codes`	array of string	no
`receipt_id`	string \| null	no	Receipt recording the denial or failure, if any.
`docs_url`	string (uri) \| null	no

AgencyRequest

Only goal is required. workspace, authority, budget and completion are optional; when omitted the server resolves each from the agent’s/profile’s versioned defaults and returns the resolved values on Run.resolved before execution. Supplying a field overrides the default (never widening beyond caller entitlement or hard policy). There are no hidden permissive defaults. capabilities and models are Level B, graph is Level C, runtime is Level D. Unknown fields are rejected, including any attempt to disable judge fail-closed or verifier-owned completion. thread_id is a correlation ID only.

Field	Type	Required	Description
`agent`	string	no	Logical agent ID, optionally `@version` (e.g. `allternit-code@v1`).
`goal`	string	yes
`workspace`	Workspace	no
`context`	array of ContextItem	no	Supplied context. Enters as UNTRUSTED unless a trust_class is granted by policy.
`authority`	Authority	no
`budget`	Budget	no
`completion`	CompletionCriteria	no
`capabilities`	CapabilityLimits	no
`models`	ModelConstraints	no
`graph`	GraphSpec	no	Opaque until the public Graph contract is frozen.
`runtime`	RuntimeHints	no
`stream`	boolean	no	When true, `Run.links.events` is ready to open immediately.
`thread_id`	string \| null	no	Correlation ID only. There are no Thread endpoints in v1; messages arrive as `run.message` events.
`metadata`	Metadata	no

No other properties are accepted.

Workspace

Field	Type	Required	Description
`repo`	string (uri)	no	Shorthand for one read/write repo resource, e.g. `repo://acme/store`.
`ref`	string	no	Branch, tag or commit for `repo`.
`resources`	array of ResourceRef	no

No other properties are accepted.

ResourceRef

Field	Type	Required
`uri`	string (uri)	yes
`kind`	enum: `repo`, `directory`, `file`, `dataset`, `url`, `connector`, `secret_store`	no
`access`	enum: `read`, `write`	yes
`trust_class`	TrustClass	no

No other properties are accepted.

ContextItem

Field	Type	Required
`kind`	enum: `text`, `file`, `url`, `artifact`	yes
`text`	string	no
`uri`	string (uri)	no
`artifact_id`	string	no
`label`	string	no

No other properties are accepted.

Authority

Explicit authority (optional on the request; resolved from the agent’s default profile when omitted and returned in Run.resolved.authority). A named profile (read-only, code-safe, code-write, optionally pinned name@version) compiles into capabilities and policy, not magic strings (GET /v1/authority-profiles). grants may only add scoped grants within the caller’s entitlement; nothing can weaken a hard policy deny. There is no bypass/yolo/auto-approve profile: such names are rejected with ERR_AUTHORITY_PROFILE_FORBIDDEN and no executor’s native bypass mode is honored.

Field	Type	Required	Description
`profile`	string	yes
`interaction_mode`	enum: `autonomous`, `approval_gated`, `recommend_only`	no	`autonomous` still stops at every policy ASK; it only removes discretionary review.
`grants`	array of Grant	no
`network`	NetworkPolicy	no
`environment`	ExecutionEnvironment	no
`expires_at`	string (date-time) \| null	no	Defaults to run end. Grants never outlive the run.

No other properties are accepted.

Grant

Field	Type	Required	Description
`scope`	string	yes	Capability ID (`cap.*`), tool family, or resource URI.
`actions`	array of enum: `read`, `write`, `execute`, `network`, `spend`, `external_send`	yes
`resources`	array of string	no
`effect_class`	enum: `none`, `reversible`, `external`, `irreversible`	no
`requires_approval`	boolean	no
`expires_at`	string (date-time) \| null	no

No other properties are accepted.

NetworkPolicy

Public view of NetworkAccessPolicyV1. Private-address, redirect-hop and DNS-rebind defenses are always on.

Field	Type	Required	Description
`default`	enum: `deny`, `allowlist`	no
`domains`	array of string	no
`private_ip`	enum: `deny`	no
`max_redirects`	integer	no
`redirect_scope`	enum: `same_domain`, `allowlist`	no
`dns_rebind`	enum: `pin_resolution`	no
`defaults_version`	string	no	Version of the platform defaults applied to unset fields. Defaults are versioned, not architecture constants.

No other properties are accepted.

ExecutionEnvironment

Public view of ExecutionEnvironmentV1. Raw environment inheritance is never allowed.

Field	Type	Required	Description
`allowed_env_keys`	array of string	no
`secret_refs`	array of string	no

No other properties are accepted.

Budget

On exhaustion the platform first hard-stops ALL further billable/effectful execution, then moves the run to needs_attention with attention reason budget_exhausted. No spend occurs while waiting; only a human answer can raise the budget.

Field	Type	Required	Description
`max_seconds`	integer	no
`max_cost_usd`	number	no
`max_steps`	integer	no	Cap on executed work nodes.
`max_attention_requests`	integer	no
`on_exhaustion`	enum: `request_attention`, `stop`	no	`request_attention` (default): hard-stop, then `needs_attention/budget_exhausted`. `stop`: hard-stop then `failed`. A model can never raise its own budget.

No other properties are accepted.

BudgetUsage

Field	Type	Required	Description
`seconds`	number	yes
`cost_usd`	number	yes
`steps`	integer	yes
`spend_halted`	boolean	no	True once budget exhaustion has hard-stopped billable/effectful execution.

CompletionCriteria

Verifier-owned completion. The run reaches completed only when the system evaluates: every required criterion has a PASS verification receipt, no blocking failure is unresolved, required artifacts exist, and policy obligations are met. A model saying “done” is a proposal with no authority. INCONCLUSIVE is never PASS. Items in require are string ids or {id, version?} referring to the versioned registry (GET /v1/completion-criteria); omitted version means latest at resolution time and the resolved version is recorded in Run.resolved.completion. allow_partial is the only way a run may end partial.

Field	Type	Required	Description
`require`	array of CriterionRef	yes
`criteria`	array of Criterion	no	Custom criteria, referenced from `require` by `id`.
`allow_partial`	boolean	no	If true, a run that stops with some criteria unmet ends `partial`. `partial` is only ever produced when this is true, and is never a synonym for failed or unfinished.

No other properties are accepted.

CriterionRef

Registry criterion by id (string, latest) or pinned {id, version}. Built-ins keep their names: tests_pass, no_new_regressions, build_passes, typecheck_passes, lint_clean, artifact_exists, requirement_verified, human_review. One of: string | object.

Criterion

Custom criterion registered inline for this run/campaign; built-in and registry criteria are referenced from require.

Field	Type	Required	Description
`id`	string	yes
`description`	string	yes
`verifier`	enum: `parse`, `format`, `lint`, `typecheck`, `unit_test`, `integration_test`, `build`, `semantic_rule`, `requirement`, `security`, `regression`, `diff_review`, `human`	yes
`command`	string	no	Optional check command run in the sandbox under the run’s authority.
`blocking`	boolean	no

No other properties are accepted.

CapabilityLimits

Field	Type	Required
`allow`	array of string	no
`deny`	array of string	no
`tools_allow`	array of string	no
`tools_deny`	array of string	no

No other properties are accepted.

ModelConstraints

Constrain by logical class, locality and trust. Model or vendor names are rejected.

Field	Type	Required
`allow_classes`	array of string	no
`deny_classes`	array of string	no
`locality`	enum: `local_only`, `local_preferred`, `any`	no
`max_data_trust_class_to_remote`	TrustClass	no

No other properties are accepted.

GraphSpec

Advanced input is treated as opaque until the public Graph contract is frozen.

Field	Type	Required	Description
`template_id`	string	no
`template_params`	object	no
`ir`	object	no	Full graph IR. Statically validated; vendor or model names are rejected.

No other properties are accepted.

RuntimeHints

Research/infra hints. Never change semantics, eligibility, policy or evidence.

Field	Type	Required
`deployment_profile`	enum: `micro`, `tiny`, `compact`, `medium`, `workstation`, `large`, `fabric`	no
`readout_level_min`	enum: `L0`, `L1`, `L2`	no
`record_cassette`	boolean	no

No other properties are accepted.

RunStatus

Aggregate of WorkNodeLifecycleV1 and RunReceiptV1.completion_status. | Run.status | Lifecycle source | RunReceipt | |---|---|---| | accepted | DECLARE, ADMIT, READY; and until Run.resolved is recorded | — | | running | LEASE, SPAWN, RUN, HEARTBEAT, OUTPUT, VERIFY, CONTINUE, REPLAN | — | | waiting | any active node on a timer/dependency/event wait gate, or lease reclaim pending, and none running | — | | needs_attention | any node NEEDS_HUMAN (open AttentionRequest), incl. budget_exhausted after billable/effectful execution is hard-stopped | WAITING_APPROVAL | | paused | operator pause; leases released at a safe boundary | — | | cancelling | cancel receipted; in-flight effects settling (kept) | — | | completed | COMMIT → CLOSE with the completion predicate true | COMPLETE | | partial | CLOSE, predicate false, ONLY when the completion contract has allow_partial: true; never a synonym for failed/unfinished | PARTIAL | | failed | CLOSE after unrecoverable failure or budget stop | FAILED | | cancelled | CLOSE after cancel | CANCELLED | Precedence when nodes differ: cancelling > paused > needs_attention > running > waiting > accepted. VAULT/LEARN happen after the terminal state and are not surfaced as status. Type: string enum.

Value
`accepted`
`running`
`waiting`
`needs_attention`
`paused`
`cancelling`
`completed`
`partial`
`failed`
`cancelled`

Run

Durable execution instance. resolved is required and is populated before execution; status stays accepted until resolution is recorded.

Field	Type	Required	Description
`id`	string	yes
`object`	`"run"`	yes
`status`	RunStatus	yes
`status_reason`	string \| null	no	Short human-readable reason for the current status.
`terminal`	boolean	no
`agent`	string	yes	Logical agent ID and version, e.g. allternit-code@v1.
`thread_id`	string	yes	Correlation ID only; there are no Thread endpoints.
`campaign_id`	string \| null	no
`goal`	string	no
`created_at`	Timestamp	yes
`updated_at`	Timestamp	yes
`finished_at`	string (date-time) \| null	no
`version`	integer	yes	Monotonic durable state version (ETag source).
`budget`	Budget	yes
`budget_usage`	BudgetUsage	yes
`attention`	AttentionRequest \| null	yes	The oldest open AttentionRequest, or null.
`open_attention_count`	integer	no
`completion`	CompletionState	yes
`output`	RunOutput \| null	no
`cancellation`	CancellationState \| null	no
`error`	Error \| null	no
`links`	RunLinks	yes
`metadata`	Metadata	no
`debug`	RunDebugView \| null	no	Present only with `view=debug`.
`resolved`	ResolvedDefaults	yes
`effect_receipt_ids`	array of string	no	Durable effect receipt ids linked to this run/creating request. Receipts outlive the 24 h API replay window.

RunLinks

Field	Type	Required
`self`	string (uri-reference)	yes
`events`	string (uri-reference)	yes
`artifacts`	string (uri-reference)	yes
`receipts`	string (uri-reference)	yes
`attention`	string (uri-reference)	no

RunOutput

Field	Type	Required	Description
`summary`	string	yes
`artifact_ids`	array of string	yes
`run_receipt_id`	string \| null	no	The run receipt that proves the terminal state.

CompletionState

Field	Type	Required
`status`	enum: `pending`, `satisfied`, `unsatisfied`	yes
`criteria`	array of object	yes
`criteria[].criterion`	string	yes
`criteria[].result`	VerificationResult	yes
`criteria[].receipt_ids`	array of string	no

VerificationResult

Type: string enum.

Value
`pending`
`pass`
`fail`
`inconclusive`
`error`

CancellationState

Field	Type	Required
`requested_at`	Timestamp	yes
`reason`	string \| null	no
`receipt_id`	string	no
`effects_in_flight`	array of object	yes
`effects_in_flight[].description`	string	yes
`effects_in_flight[].effect_class`	enum: `reversible`, `external`, `irreversible`	no
`effects_in_flight[].state`	enum: `settling`, `completed`, `rolled_back`, `rollback_failed`, `timed_out`	yes
`effects_in_flight[].receipt_id`	string \| null	no

RunDebugView

Opt-in kernel internals (view=debug, scope debug:read). Open object; fields may change without a major version.

Field	Type	Required	Description
`task_ref`	string	no
`graph_id`	string	no
`graph_version`	integer	no
`components_used`	array of object	no	Execution evidence only (role, mode, capability, opaque component ID).
`trace_ref`	string	no

ControlRequest

Field	Type	Required	Description
`reason`	string	no

No other properties are accepted.

CancelRequest

Field	Type	Required	Description
`reason`	string	no
`rollback_reversible_effects`	boolean	no

No other properties are accepted.

RunInput

Field	Type	Required	Description
`type`	enum: `message`, `approval`, `rejection`, `steer`, `data`	yes
`attention_id`	string	no
`value`		no	Free text for message/steer; typed payload for data.
`comment`	string	no

No other properties are accepted.

InputAccepted

Field	Type	Required
`run_id`	string	yes
`receipt_id`	string	yes
`attention_id`	string \| null	no
`status`	RunStatus	yes

RunPage

One of: PageBase & object.

RunEventType

Type: string enum.

Value
`run.status_changed`
`run.progress`
`run.message`
`attention.requested`
`attention.resolved`
`input.accepted`
`artifact.created`
`receipt.appended`
`verification.completed`
`budget.threshold`
`debug.trace`

RunEventBase

Field	Type	Required	Description
`id`	string	yes	Event cursor; use as SSE `Last-Event-ID`.
`seq`	integer	yes	Gap-free per-run sequence.
`run_id`	string	yes
`type`	RunEventType	yes
`created_at`	Timestamp	yes
`run_version`	integer	no

RunEvent

RunStatusChangedEvent

One of: RunEventBase & object.

RunProgressEvent

One of: RunEventBase & object.

RunMessageEvent

One of: RunEventBase & object.

AttentionRequestedEvent

One of: RunEventBase & object.

AttentionResolvedEvent

One of: RunEventBase & object.

InputAcceptedEvent

One of: RunEventBase & object.

ArtifactCreatedEvent

One of: RunEventBase & object.

ReceiptAppendedEvent

One of: RunEventBase & object.

VerificationCompletedEvent

One of: RunEventBase & object.

BudgetThresholdEvent

One of: RunEventBase & object.

DebugTraceEvent

Only delivered with view=debug. One of: RunEventBase & object.

RunEventPage

One of: PageBase & object.

AttentionStatus

Type: string enum.

Value
`open`
`resolved`
`expired`
`withdrawn`

AttentionRequest

Public view of AttentionRequestV1. Agents request attention; the AttentionController owns delivery, quiet hours, dedupe and quotas. Only policy ASK outcomes become approval requests; hard DENY outcomes never do.

Field	Type	Required	Description
`id`	string	yes
`object`	`"attention_request"`	yes
`run_id`	string	yes
`campaign_id`	string \| null	no
`reason`	enum: `approval_required`, `clarification_needed`, `budget_exhausted`, `verification_inconclusive`, `low_confidence`, `unsafe_resume`, `review_requested`	yes
`urgency`	enum: `low`, `normal`, `high`, `critical`	yes
`topic`	string	yes
`summary`	string	no
`expected_loss`	string \| null	no	Plain-language cost of not answering.
`proposed_action`	ProposedAction \| null	no
`response_options`	array of enum: `approval`, `rejection`, `data`, `message`	yes
`requested_channel`	string \| null	no
`expires_at`	string (date-time) \| null	no
`on_expiry`	enum: `reject`, `none`	no	Derived from `kind`: approval => reject, informational => none.
`evidence_refs`	array of string	no
`status`	AttentionStatus	yes
`resolution`	AttentionResolution \| null	no
`created_at`	Timestamp	yes
`kind`	enum: `approval`, `informational`	yes	`approval`: policy ASK; expiry = rejection/deny (fail closed). `informational`: expiry sets status `expired` with no semantic rejection.
`defaults_version`	string	no	Version of attention limit defaults applied.

ProposedAction

Field	Type	Required
`description`	string	yes
`effect_class`	enum: `reversible`, `external`, `irreversible`	yes
`resources`	array of string	no
`estimated_cost_usd`	number \| null	no

AttentionResolution

Field	Type	Required	Description
`type`	enum: `approval`, `rejection`, `data`, `message`, `expired`, `withdrawn`	yes
`resolved_by`	string \| null	no
`resolved_at`	Timestamp	yes
`receipt_id`	string	yes
`outcome`	enum: `approved`, `rejected`, `answered`, `none`	no	Expired approval => `rejected` (deny). Expired informational => `none`.

AttentionResponse

Field	Type	Required
`type`	enum: `approval`, `rejection`, `data`, `message`	yes
`value`		no
`comment`	string	no

No other properties are accepted.

AttentionPage

One of: PageBase & object.

Artifact

Public view of NodeOutputV1. Immutable, content-addressed.

Field	Type	Required	Description
`id`	string	yes
`object`	`"artifact"`	yes
`run_id`	string	yes
`name`	string	yes
`kind`	enum: `patch`, `file`, `report`, `dataset`, `log`, `other`	no
`mime_type`	string	yes
`size_bytes`	integer	no
`hash`	string	yes
`trust_class`	TrustClass	no
`verification_status`	enum: `unverified`, `pass`, `fail`, `inconclusive`, `error`	yes
`receipt_id`	string	yes
`content_url`	string (uri) \| null	no	Short-lived download URL.
`created_at`	Timestamp	yes
`metadata`	object	no

ArtifactPage

One of: PageBase & object.

ReceiptType

Type: string enum.

Value
`run`
`tool`
`action`
`mutation`
`verification`
`policy`
`node_output`
`input`
`attention`
`control`
`spawn`

Receipt

Append-only, content-addressed, hash-chained per run. content_hash = sha256 over the canonical JSON (RFC 8785) of every field except content_hash and signature. prev_hash links to the previous receipt in the run chain (null only at index 0). Corrections append a new receipt with supersedes. Signing: per-run previous-hash chain; RFC 8785 JCS canonicalization, SHA-256, Ed25519. The signed material is the JCS-canonical object {schema_id, schema_version, domain, content_hash}, so signatures bind schema id, schema version and the domain-separation tag allternit.receipt.v1. Verification keys: /.well-known/jwks.json.

Field	Type	Required	Description
`id`	string	yes
`object`	`"receipt"`	yes
`run_id`	string	yes
`type`	ReceiptType	yes
`index`	integer	yes
`content_hash`	string	yes
`prev_hash`	string \| null	yes
`signature`	ReceiptSignature \| null	no
`supersedes`	string \| null	no
`idempotency_key`	string \| null	no	Required on action receipts for external or irreversible effects.
`summary`	string	no
`provenance`	array of Provenance	yes
`payload`	object	yes	Type-specific body (e.g. tool exit class, verification result, policy decision). Open by design; component identities appear only with `view=debug`.
`created_at`	Timestamp	yes
`schema_id`	string	yes	Included in the signed payload.
`schema_version`	string	yes	Included in the signed payload.

ReceiptSignature

Field	Type	Required	Description
`alg`	enum: `ed25519`	yes
`key_id`	string	yes
`value`	string	yes	base64url Ed25519 signature over JCS({schema_id, schema_version, domain, content_hash}).
`jwks_url`	string (uri)	no	Always `https://api.allternit.com/.well-known/jwks.json`.
`domain`	`"allternit.receipt.v1"`	yes	Domain-separation tag included in the signed payload.

Provenance

AbiEnvelope provenance.

Field	Type	Required
`source_type`	enum: `USER`, `FILE`, `TOOL`, `MODEL`, `POLICY`, `SYSTEM`, `CACHE`, `RETRIEVAL`	yes
`source_id`	string	no
`trust_class`	TrustClass	yes
`content_hash`	string \| null	no
`observed_at`	string (date-time) \| null	no

ReceiptChainVerification

Field	Type	Required	Description
`run_id`	string	yes
`receipt_count`	integer	yes
`head_hash`	string	yes
`hash_chain_valid`	boolean	yes
`signatures_valid`	boolean \| null	yes	Null if any receipt is unsigned.
`first_invalid_index`	integer \| null	no
`checked_at`	Timestamp	yes

ReceiptPage

One of: PageBase & object.

GraphView

Field	Type	Required
`graph_id`	string	yes
`version`	integer	yes
`template_id`	string \| null	no
`nodes`	array of object	yes
`nodes[].node_id`	string	yes
`nodes[].primitive_id`	string	yes
`nodes[].lifecycle`	enum: `DECLARE`, `ADMIT`, `READY`, `LEASE`, `SPAWN`, `RUN`, `HEARTBEAT`, `OUTPUT`, `VERIFY`, `COMMIT`, `CONTINUE`, `REPLAN`, `NEEDS_HUMAN`, `CLOSE`, `VAULT`, `LEARN`	yes
`nodes[].wait_gate`	string \| null	no
`nodes[].output_ids`	array of string	no
`edges`	array of object	yes
`edges[].from`	string	yes
`edges[].to`	string	yes
`edges[].when`	string \| null	no

CampaignStatus

active = created, first wake pending; sleeping = waiting for next_wake; running = at least one child run non-terminal; needs_attention = a child run or the campaign itself has an open AttentionRequest; paused; completed = campaign completion criteria met by receipts; failed; cancelled. Independent of scheduling. Type: string enum.

Value
`active`
`sleeping`
`running`
`needs_attention`
`paused`
`completed`
`failed`
`cancelled`

CampaignCreate

Only objective is required. workspace, authority, budget, completion_criteria and wake_policy resolve from the agent/profile defaults and are returned explicitly on Campaign.resolved before any run is created. No hidden permissive defaults: if a safe value cannot be resolved the request fails with ERR_DEFAULTS_UNRESOLVABLE.

Field	Type	Required	Description
`agent`	string	no
`objective`	string	yes
`workspace`	Workspace	no
`authority`	Authority	no
`budget`	CampaignBudget	no
`completion_criteria`	CompletionCriteria	no
`graph_template`	string	no	Disclosure tier C.
`wake_policy`	WakePolicy	no
`attention_policy`	AttentionPolicy	no
`metadata`	Metadata	no

No other properties are accepted.

CampaignBudget

Whole-campaign caps plus a per-run budget applied to every child run.

Field	Type	Required
`max_cost_usd`	number	no
`max_runs`	integer	no
`per_run`	Budget	yes
`on_exhaustion`	enum: `request_attention`, `stop`	no

No other properties are accepted.

WakePolicy

When the campaign may consider waking. Triggers only make a wake eligible; the campaign then decides whether another check is useful (not cron). Wake triggers are accepted, but autonomous scheduled waking is disabled until go-live: the Campaign reports scheduling: disabled_pending_golive. Limits are versioned defaults (defaults_version).

Field	Type	Required
`triggers`	array of WakeTrigger	yes
`min_interval_seconds`	integer	no
`max_wakes_per_day`	integer	no
`skip_if_run_active`	boolean	no
`until`	string (date-time) \| null	no
`defaults_version`	string	no

No other properties are accepted.

WakeTrigger

One of: object | object | object | object | object.

AttentionPolicy

Field	Type	Required	Description
`channels`	array of string	no
`quiet_hours`	object \| null	no
`interrupt_quiet_hours_at`	enum: `critical`, `never`	no
`max_per_hour`	integer	no
`max_per_day`	integer	no
`dedupe_window_seconds`	integer	no
`escalate_after_seconds`	integer \| null	no
`defaults_version`	string	no	Versioned defaults for caps/dedupe/quiet-hours; not architecture constants.

No other properties are accepted.

Campaign

Campaigns can be created but autonomous scheduled waking is disabled until go-live; see scheduling.

Field	Type	Required	Description
`id`	string	yes
`object`	`"campaign"`	yes
`agent`	string	yes
`objective`	string	yes
`status`	CampaignStatus	yes
`owner`	string	yes
`budget`	CampaignBudget	yes
`budget_usage`	BudgetUsage & object	yes
`wake_policy`	WakePolicy	yes
`attention_policy`	AttentionPolicy	yes
`completion_criteria`	CompletionCriteria	yes
`completion`	CompletionState	no
`next_wake`	string (date-time) \| null	yes
`last_wake`	string (date-time) \| null	no
`active_run_ids`	array of string	no
`created_at`	Timestamp	yes
`updated_at`	Timestamp	no
`metadata`	Metadata	no
`scheduling`	enum: `disabled_pending_golive`, `enabled`	yes	`disabled_pending_golive` until Agency API alpha/conformance and an explicit go-live decision. While disabled, no wake fires and `next_wake` is null; manual runs still work.
`defaults_version`	string	yes	Version of campaign limit defaults.
`resolved`	ResolvedDefaults	yes	Explicit workspace/authority/budget/completion the campaign’s runs will use, recorded before the first run. Each run also carries its own Run.resolved.

CampaignControlRequest

Field	Type	Required	Description
`reason`	string	no
`cascade`	boolean	no

No other properties are accepted.

CampaignPage

One of: PageBase & object.

ReplayRequest

Field	Type	Required	Description
`source_run_id`	string	yes
`effects`	`"recorded_only"`	no	The only allowed value. Replays never perform external effects.
`overrides`	object	no	What to vary. Anything not overridden is taken from the source run’s recording.
`overrides.authority_profile`	string	no
`overrides.completion`	CompletionCriteria	no
`overrides.models`	ModelConstraints	no
`overrides.runtime`	RuntimeHints	no

No other properties are accepted.

ReplayStatus

Type: string enum.

Value
`queued`
`running`
`completed`
`failed`
`cancelled`

Replay

Field	Type	Required
`id`	string	yes
`object`	`"replay"`	yes
`source_run_id`	string	yes
`status`	ReplayStatus	yes
`effects`	`"recorded_only"`	yes
`verdict`	enum \| null: `equivalent`, `diverged_expected`, `diverged_unexpected`	no
`created_at`	Timestamp	yes
`finished_at`	string (date-time) \| null	no
`results_url`	string (uri-reference)	no
`error`	Error \| null	no

ReplayResults

Field	Type	Required
`replay_id`	string	yes
`verdict`	enum: `equivalent`, `diverged_expected`, `diverged_unexpected`	yes
`decisions_total`	integer	yes
`decisions_matched`	integer	yes
`completion_matched`	boolean	no
`divergences`	array of object	yes
`divergences[].step_ref`	string	yes
`divergences[].kind`	enum: `expected`, `unexpected`	yes
`divergences[].description`	string	no
`divergences[].source_receipt_id`	string \| null	no
`divergences[].replay_receipt_id`	string \| null	no
`has_more`	boolean	yes
`next_cursor`	string \| null	yes

DecisionRequest

Field	Type	Required	Description
`operation`	enum: `belief`, `choice`, `score`, `rank`, `subset`, `estimate`, `gate`, `verify`, `pair_score`	yes
`question`	string	yes
`state`		yes	Caller-supplied state (object or text).
`candidates`	array of object	no	Required for choice/rank/subset/gate/pair_score. The backend never invents options.
`candidates[].id`	string	yes
`candidates[].label`	string	no
`candidates[].value`		no
`scale`	array of string	no	Ordered labels for score.
`range`	object	no	Bounds for estimate.
`range.min`	number	no
`range.max`	number	no
`require_level`	enum: `L0`, `L1`, `L2`, `auto`	no	Minimum calibration level. Raw uncalibrated readouts are never served for action.
`max_latency_ms`	integer	no

No other properties are accepted.

DecisionResult

Field	Type	Required	Description
`operation`	string	yes
`answer`		yes	Typed answer (candidate id, id list, number, or boolean).
`probabilities`	map of number \| null	no
`confidence`	number	yes
`calibration`	object	yes
`calibration.level_served`	enum: `L0`, `L1`, `L2`	yes
`calibration.calibrated`	boolean	no
`calibration.calibration_id`	string \| null	no
`threshold_action`	enum \| null: `auto`, `review`, `escalate`, `reject`	no
`evidence_refs`	array of string	yes
`debug`	object \| null	no	Present only with `view=debug` (backend class, component identity, latency).

Capability

Field	Type	Required
`id`	string	yes
`object`	`"capability"`	yes
`description`	string	yes
`status`	enum: `available`, `degraded`, `unavailable`	yes
`trust_classes`	array of TrustClass	no
`localities`	array of enum: `local`, `fabric`, `remote`	no

CapabilityPage

One of: PageBase & object.

Agent

Field	Type	Required	Description
`id`	string	yes
`object`	`"agent"`	yes
`description`	string	no
`versions`	array of string	yes
`default_version`	string	yes
`capabilities`	array of string	no
`completion_criteria`	array of CriterionRef	no	Built-in criteria this agent can verify.
`authority_profiles`	array of string	no
`templates`	array of string	no

AgentPage

One of: PageBase & object.

ModelClass

Logical class only. Concrete models are interchangeable components and are never listed here. Logical capability/locality/trust classes only; never vendor identities in default responses. The first-party workspace UI may show model choice separately.

Field	Type	Required	Description
`id`	string	yes
`object`	`"model_class"`	yes
`description`	string	no
`trust_classes`	array of TrustClass	yes	Highest data trust class this class may receive.
`locality`	enum: `local`, `fabric`, `remote`	yes
`capabilities`	array of string	no
`latency_class`	enum: `interactive`, `normal`, `background`	no

ModelClassPage

One of: PageBase & object.

AuthorityProfile

Exact typed semantics of a profile. Compiles into capabilities/policy. Only read-only, code-safe and code-write exist; no bypass equivalent is ever public.

Field	Type	Required	Description
`id`	enum: `read-only`, `code-safe`, `code-write`	yes
`object`	`"authority_profile"`	yes
`description`	string	yes
`grants`	array of Grant	yes
`network`	NetworkPolicy	yes
`version`	integer	yes	Profile version; runs record `id@version` in `Run.resolved.authority`.
`capabilities`	array of string	yes	Capabilities the profile grants (`cap.*`).
`denied_capabilities`	array of string	no
`filesystem_scope`	FilesystemScope	yes
`approval_requirements`	array of ApprovalRequirement	yes
`defaults_version`	string	no	Version of platform limit defaults referenced.

AuthorityProfilePage

One of: PageBase & object.

FilesystemScope

Field	Type	Required
`read`	enum: `none`, `workspace`, `workspace_and_declared_resources`	yes
`write`	enum: `none`, `scratch_only`, `workspace_paths_declared_writable`	yes
`execute`	enum: `none`, `sandboxed_workspace`	yes
`outside_workspace`	enum: `deny`	no

No other properties are accepted.

ApprovalRequirement

Field	Type	Required	Description
`effect`	enum: `write`, `execute`, `network`, `spend`, `external`, `irreversible`	yes
`mode`	enum: `never_allowed`, `always_ask`, `ask_unless_granted`, `allowed`	yes

No other properties are accepted.

ResolvedAuthority

Field	Type	Required	Description
`profile`	object	yes
`profile.id`	string	yes
`profile.version`	integer	yes
`grants_summary`	object	yes	Summary of the compiled grants.
`grants_summary.capabilities`	array of string	yes
`grants_summary.filesystem_scope`	FilesystemScope	yes
`grants_summary.network`	NetworkPolicy	yes
`grants_summary.approval_requirements`	array of ApprovalRequirement	yes
`grants_summary.grant_count`	integer	no
`interaction_mode`	enum: `autonomous`, `approval_gated`, `recommend_only`	no
`expires_at`	string (date-time) \| null	no

No other properties are accepted.

ResolvedCompletion

Field	Type	Required
`contract_id`	string	yes
`contract_version`	integer	yes
`require`	array of object	yes
`require[].id`	string	yes
`require[].version`	integer	yes
`allow_partial`	boolean	yes

No other properties are accepted.

ResolvedDefaults

Everything the server resolved before execution: explicit, safe, versioned and auditable. Populated before the run leaves accepted; the run cannot execute without it. Never contains a permissive fallback.

Field	Type	Required	Description
`workspace`	Workspace	yes
`authority`	ResolvedAuthority	yes
`budget`	Budget	yes
`completion`	ResolvedCompletion	yes
`defaults_source`	string	yes	Which agent/profile defaults (with versions) filled omitted fields; `request` if all four were supplied.
`defaults_version`	string	no	Version of platform limit defaults.
`enforcement`	object	yes	Always true for runs created via this API; not client-disableable.
`enforcement.judge_fail_closed`	`true`	yes
`enforcement.verifier_owned_completion`	`true`	yes
`resolved_at`	Timestamp	yes

No other properties are accepted.

CompletionCriterion

Field	Type	Required	Description
`id`	string	yes
`object`	`"completion_criterion"`	yes
`version`	integer	yes
`description`	string	yes
`verifier_semantics`	string	yes	Precise text of what PASS means, including that INCONCLUSIVE is never PASS.
`verifier_kind`	enum: `parse`, `format`, `lint`, `typecheck`, `unit_test`, `integration_test`, `build`, `semantic_rule`, `requirement`, `security`, `regression`, `diff_review`, `human`	yes
`built_in`	boolean	no
`deprecated`	boolean	no
`blocking_default`	boolean	no

CompletionCriterionPage

One of: PageBase & object.

Jwks

Field	Type	Required
`keys`	array of object	yes
`keys[].kty`	`"OKP"`	yes
`keys[].crv`	`"Ed25519"`	yes
`keys[].x`	string	yes
`keys[].kid`	string	yes
`keys[].use`	`"sig"`	no
`keys[].alg`	`"EdDSA"`	no

​Reading the tables

​Index

​Extensions

​Metadata

​Timestamp

​TrustClass

​PageBase

​ErrorEnvelope

​Error

​AgencyRequest

​Workspace

​ResourceRef

​ContextItem

​Authority

​Grant

​NetworkPolicy

​ExecutionEnvironment

​Budget

​BudgetUsage

​CompletionCriteria

​CriterionRef

​Criterion

​CapabilityLimits

​ModelConstraints

​GraphSpec

​RuntimeHints

​RunStatus

​Run

​RunLinks

​RunOutput

​CompletionState

​VerificationResult

​CancellationState

​RunDebugView

​ControlRequest

​CancelRequest

​RunInput

​InputAccepted

​RunPage

​RunEventType

​RunEventBase

​RunEvent

​RunStatusChangedEvent

​RunProgressEvent

​RunMessageEvent

​AttentionRequestedEvent

​AttentionResolvedEvent

​InputAcceptedEvent

​ArtifactCreatedEvent

​ReceiptAppendedEvent

​VerificationCompletedEvent

​BudgetThresholdEvent

​DebugTraceEvent

​RunEventPage

​AttentionStatus

​AttentionRequest

​ProposedAction

​AttentionResolution

​AttentionResponse

​AttentionPage

​Artifact

​ArtifactPage

​ReceiptType

​Receipt

​ReceiptSignature

​Provenance

​ReceiptChainVerification

​ReceiptPage

​GraphView

​CampaignStatus

​CampaignCreate

​CampaignBudget

​WakePolicy

​WakeTrigger

​AttentionPolicy

​Campaign

​CampaignControlRequest

​CampaignPage

​ReplayRequest

​ReplayStatus

Reading the tables

Index

Extensions

Metadata

Timestamp

TrustClass

PageBase

ErrorEnvelope

Error

AgencyRequest

Workspace

ResourceRef

ContextItem

Authority

Grant

NetworkPolicy

ExecutionEnvironment

Budget

BudgetUsage

CompletionCriteria

CriterionRef

Criterion

CapabilityLimits

ModelConstraints

GraphSpec

RuntimeHints

RunStatus

Run

RunLinks

RunOutput

CompletionState

VerificationResult

CancellationState

RunDebugView

ControlRequest

CancelRequest

RunInput

InputAccepted

RunPage

RunEventType

RunEventBase

RunEvent

RunStatusChangedEvent

RunProgressEvent

RunMessageEvent

AttentionRequestedEvent

AttentionResolvedEvent

InputAcceptedEvent

ArtifactCreatedEvent

ReceiptAppendedEvent

VerificationCompletedEvent

BudgetThresholdEvent

DebugTraceEvent

RunEventPage

AttentionStatus

AttentionRequest

ProposedAction

AttentionResolution

AttentionResponse

AttentionPage

Artifact

ArtifactPage

ReceiptType

Receipt

ReceiptSignature

Provenance

ReceiptChainVerification

ReceiptPage

GraphView

CampaignStatus

CampaignCreate

CampaignBudget

WakePolicy

WakeTrigger

AttentionPolicy

Campaign

CampaignControlRequest

CampaignPage

ReplayRequest

ReplayStatus