cli

type CheckResult = doctor.Result

type CheckStatus = doctor.Status

type DoctorReport = doctor.Report

type InstallChannel string

type InstallFlags struct {
	Agents     []string
	Components []string
	Skills     []string
	Persona    string
	Preset     string
	SDDMode    string
	Scope      string
	Channel    string
	DryRun     bool

	OpenCodeBackgroundSubagents    string
	OpenCodeBackgroundSubagentsSet bool

	PiBackgroundSubagents    string
	PiBackgroundSubagentsSet bool

	PiExcludePackages []string

	ClaudeOrchestratorModules bool
}

type InstallInput struct {
	Selection model.Selection
	Scope     InstallScope
	Channel   InstallChannel
	DryRun    bool

	// ClaudeOrchestratorModules opts a global install that selects Claude into
	// the user-global module pilot (#5256).
	ClaudeOrchestratorModules bool
}

type InstallResult struct {
	Selection     model.Selection
	Resolved      planner.ResolvedPlan
	Review        planner.ReviewPayload
	Plan          pipeline.StagePlan
	Execution     pipeline.ExecutionResult
	Verify        verify.Report
	Dependencies  system.DependencyReport
	PiCodeGraph   *communitytool.PiCodeGraphResult
	ManualActions []string
	DryRun        bool

	Background              OpenCodeBackgroundResolution
	BackgroundPolicyEnabled bool

	PiBackground PiBackgroundResolution

	// PiExcludedPackages are managed Pi sources skipped by `pi install`.
	PiExcludedPackages []string
}

type InstallScope string

type OpenCodeBackgroundResolution struct {
	Intent      model.OpenCodeBackgroundIntent
	Effective   model.OpenCodeBackgroundIntent
	Persist     model.OpenCodeBackgroundIntent
	NeedsPrompt bool
	Activation  opencodeactivation.ActivationReport
	// contains filtered or unexported fields
}

type OpenCodeBackgroundResolveInput struct {
	CLISet       bool
	CLIValue     model.OpenCodeBackgroundIntent
	EnvSet       bool
	EnvValue     string
	PriorManaged model.OpenCodeBackgroundIntent
	Interactive  bool
}

type OpenCodeSDKConsent struct {
	ConfigDir  string
	Manager    string
	Dependency string
	// contains filtered or unexported fields
}

type PartialSyncError struct {
	Skipped []SyncSkippedAgent
}

type PiBackgroundResolution struct {
	Intent      model.PiBackgroundIntent
	Effective   model.PiBackgroundIntent
	Persist     model.PiBackgroundIntent
	NeedsPrompt bool
	// contains filtered or unexported fields
}

type PiBackgroundResolveInput struct {
	CLISet       bool
	CLIValue     model.PiBackgroundIntent
	EnvSet       bool
	EnvValue     string
	PriorManaged model.PiBackgroundIntent
	Interactive  bool
}

type PreparedInstall struct {
	// contains filtered or unexported fields
}

type RestoreFunc func(manifest backup.Manifest) error

type ReviewAbandonResult struct {
	Operation string                                 `json:"operation"`
	Record    reviewtransaction.CompactReclaimRecord `json:"record"`
}

type ReviewActionBinding struct {
	LineageID      string `json:"lineage_id"`
	Revision       string `json:"revision"`
	TargetIdentity string `json:"target_identity"`
}

type ReviewActionEligibility struct {
	AllowedActions   []ReviewEligibleAction  `json:"allowed_actions"`
	ForbiddenActions []ReviewForbiddenAction `json:"forbidden_actions"`
}

type ReviewAssessmentCandidate struct {
	Kind     string `json:"kind"`
	BaseRef  string `json:"base_ref,omitempty"`
	Consumed bool   `json:"consumed"`
}

type ReviewAssessmentNextTransition struct {
	Operation string                     `json:"operation"`
	Command   string                     `json:"command"`
	Arguments []ReviewTransitionArgument `json:"arguments"`
}

type ReviewAssessmentReason struct {
	Code   string `json:"code"`
	Path   string `json:"path,omitempty"`
	Detail string `json:"detail,omitempty"`
}

type ReviewAssessmentResult struct {
	Schema          string                          `json:"schema"`
	Risk            string                          `json:"risk"`
	Reasons         []ReviewAssessmentReason        `json:"reasons"`
	ChangedPaths    int                             `json:"changed_paths"`
	ChangedLines    int                             `json:"changed_lines"`
	Candidate       ReviewAssessmentCandidate       `json:"candidate"`
	ReviewDue       bool                            `json:"review_due"`
	ReviewDueReason string                          `json:"review_due_reason"`
	NextTransition  *ReviewAssessmentNextTransition `json:"next_transition,omitempty"`
}

type ReviewBundleResult struct {
	Schema          string `json:"schema"`
	Operation       string `json:"operation"`
	LineageID       string `json:"lineage_id"`
	BundleDigest    string `json:"bundle_digest"`
	StoreRevision   string `json:"store_revision"`
	GenesisRevision string `json:"genesis_revision"`
	ChainIdentity   string `json:"chain_identity"`
	BundlePath      string `json:"bundle_path,omitempty"`
}

type ReviewCapabilitiesBootstrap struct {
	Command                string                             `json:"command"`
	TargetSelectorVariants []ReviewCapabilitiesTargetSelector `json:"target_selector_variants"`
	RequiredFeature        string                             `json:"required_feature"`
	UnsupportedOutcome     string                             `json:"unsupported_outcome"`
	ParentOnly             bool                               `json:"parent_only"`
}

type ReviewCapabilitiesBuild struct {
	ID            string `json:"id"`
	GoVersion     string `json:"go_version"`
	ModuleVersion string `json:"module_version"`
	VCS           string `json:"vcs"`
	VCSRevision   string `json:"vcs_revision"`
	VCSTime       string `json:"vcs_time"`
	VCSModified   string `json:"vcs_modified"`
}

type ReviewCapabilitiesCompatibility struct {
	MinimumProtocolMajor int                            `json:"minimum_protocol_major"`
	MaximumProtocolMajor int                            `json:"maximum_protocol_major"`
	AdditiveMinorPolicy  string                         `json:"additive_minor_policy"`
	UnknownMandatory     string                         `json:"unknown_mandatory"`
	UnknownOptional      string                         `json:"unknown_optional"`
	Modes                []string                       `json:"modes"`
	LegacyWindow         ReviewCapabilitiesLegacyWindow `json:"legacy_window"`
}

type ReviewCapabilitiesExecutable struct {
	SHA256       string `json:"sha256"`
	Evidence     string `json:"evidence"`
	Verification string `json:"verification"`
}

type ReviewCapabilitiesFeatures struct {
	Mandatory []ReviewCapabilityFeature `json:"mandatory"`
	Optional  []ReviewCapabilityFeature `json:"optional"`
}

type ReviewCapabilitiesLegacyWindow struct {
	Mode                         string `json:"mode"`
	State                        string `json:"state"`
	ReadOnly                     bool   `json:"read_only"`
	DeprecationStarted           bool   `json:"deprecation_started"`
	Removal                      string `json:"removal"`
	MinimumCompatibilityReleases int    `json:"minimum_compatibility_releases"`
}

type ReviewCapabilitiesPackage struct {
	Name           string `json:"name"`
	Version        string `json:"version"`
	ReleaseChannel string `json:"release_channel"`
}

type ReviewCapabilitiesProtocol struct {
	Major int `json:"major"`
	Minor int `json:"minor"`
}

type ReviewCapabilitiesResult struct {
	Schema        string                          `json:"schema"`
	Contract      string                          `json:"contract"`
	Protocol      ReviewCapabilitiesProtocol      `json:"protocol"`
	Package       ReviewCapabilitiesPackage       `json:"package"`
	Build         ReviewCapabilitiesBuild         `json:"build"`
	Executable    ReviewCapabilitiesExecutable    `json:"executable"`
	Operations    []string                        `json:"operations"`
	Gates         []string                        `json:"gates"`
	Projections   []string                        `json:"projections"`
	Schemas       []string                        `json:"schemas"`
	Features      ReviewCapabilitiesFeatures      `json:"features"`
	Bootstrap     *ReviewCapabilitiesBootstrap    `json:"bootstrap,omitempty"`
	Compatibility ReviewCapabilitiesCompatibility `json:"compatibility"`
}

type ReviewCapabilitiesTargetSelector struct {
	TargetType string   `json:"target_type"`
	Arguments  []string `json:"arguments"`
}

type ReviewCapabilityFeature struct {
	Name      string   `json:"name"`
	Supported bool     `json:"supported"`
	Requires  []string `json:"requires"`
}

type ReviewEligibleAction struct {
	Action         string                                `json:"action"`
	ReasonCode     string                                `json:"reason_code"`
	RequiredInputs []string                              `json:"required_inputs"`
	Disposition    reviewtransaction.RecoveryDisposition `json:"disposition,omitempty"`
	Binding        *ReviewActionBinding                  `json:"binding,omitempty"`
}

type ReviewFacadeLensBinding struct {
	Lens  string `json:"lens"`
	Order int    `json:"order"`
	// FindingIDPrefix is the prefix admission requires for explicit finding
	// IDs bound to this lens. It follows the lens, not the selection order:
	// high-risk START selects review-resilience at order 1, but its explicit
	// IDs must still carry R4-.
	FindingIDPrefix string `json:"finding_id_prefix"`
}

type ReviewFacadeStartResult struct {
	Operation        string                       `json:"operation"`
	Action           string                       `json:"action"`
	LensesRequired   bool                         `json:"lenses_required"`
	LineageID        string                       `json:"lineage_id"`
	State            reviewtransaction.State      `json:"state"`
	RiskLevel        reviewtransaction.RiskLevel  `json:"risk_level"`
	SelectedLenses   []string                     `json:"selected_lenses"`
	LensBindings     []ReviewFacadeLensBinding    `json:"lens_bindings"`
	Projection       reviewtransaction.Projection `json:"projection"`
	TargetMode       reviewtransaction.TargetKind `json:"target_mode,omitempty"`
	TargetIdentity   string                       `json:"target_identity,omitempty"`
	BaseTree         string                       `json:"base_tree,omitempty"`
	CandidateTree    string                       `json:"candidate_tree,omitempty"`
	ChangedFiles     int                          `json:"changed_files"`
	ChangedLines     int                          `json:"changed_lines"`
	CorrectionBudget int                          `json:"correction_budget"`
	// RiskEvidence carries the same human phrases the interactive consent
	// prompt speaks for the frozen candidate, so a headless consumer can relay
	// WHY the tier escalated. Absent when no evidence drove an escalation.
	RiskEvidence []string `json:"risk_evidence,omitempty"`
	// Hint is a purely informational recovery pointer; it never changes START
	// behavior and is absent outside its one scoped case.
	Hint string `json:"hint,omitempty"`
	// Consent reports a user consent choice as a typed outcome instead of an
	// error, in the same additive omitted-by-default spirit as RiskEvidence,
	// Hint, and the gate result's Delivery: every start that already shipped
	// keeps its exact field set, and only a candidate the user declined
	// carries the extra token. A decline is a reported choice, never a veto.
	Consent string `json:"consent,omitempty"`
	// Acknowledgement is present only for a v2 zero-lens approved START. It
	// carries the exact continuation that burns the pending compact authority.
	Acknowledgement *ReviewTransitionExecution `json:"acknowledgement,omitempty"`
	// Trace is present only when --trace was explicitly requested for this
	// START (#1854). The authority mutation above always represents what
	// actually committed; Trace separately reports whether the requested
	// diagnostic entry was also persisted, never the other way around.
	Trace *ReviewTraceOutcome `json:"trace,omitempty"`
}

type ReviewForbiddenAction struct {
	Action     string `json:"action"`
	ReasonCode string `json:"reason_code"`
}

type ReviewForecast struct {
	Horizon ReviewForecastHorizon `json:"horizon"`
	Steps   []ReviewForecastItem  `json:"steps"`
}

type ReviewForecastHorizon string

type ReviewForecastItem struct {
	Step        int    `json:"step"`
	Kind        string `json:"kind"`
	ReasonCode  string `json:"reason_code"`
	Description string `json:"description"`
}

type ReviewGateDeniedError struct {
	Result reviewtransaction.GateResult
	// Reason is the exact reason the JSON gate-result envelope publishes for
	// this denial. It is carried here so the human surface renders the same
	// specific statement the machine surface already had, instead of throwing
	// it away and substituting a placeholder.
	Reason  string
	Context reviewtransaction.GateContext
	Cause   error
}

type ReviewInspectAuthorityResult struct {
	Schema           string                                             `json:"schema"`
	Operation        string                                             `json:"operation"`
	RepositoryRoot   string                                             `json:"repository_root"`
	Complete         bool                                               `json:"complete"`
	Valid            bool                                               `json:"valid"`
	Totals           reviewtransaction.CompactRecoveryInspectionTotals  `json:"totals"`
	Edges            []reviewtransaction.CompactRecoveryEdgeInspection  `json:"edges"`
	EntryDiagnostics []reviewtransaction.CompactRecoveryEntryDiagnostic `json:"entry_diagnostics"`
	// SanctionedExits names, per invalid edge, the operation that would accept
	// it right now. It is reported beside the edges rather than inside them
	// because the edge shape is the binding identity batch reconciliation
	// re-derives and compares, while this is derived against the live store.
	SanctionedExits []reviewtransaction.CompactRecoverySanctionedExit `json:"sanctioned_exits"`
}

type ReviewIntegrationConsentChoice = consentenvelope.Choice

type ReviewIntegrationConsentOffPath = consentenvelope.OffPath

type ReviewIntegrationConsentResult struct {
	Schema    string `json:"schema"`
	Contract  string `json:"contract"`
	Operation string `json:"operation"`
	Action    string `json:"action"`
	Agent     string `json:"agent,omitempty"`
	// Blocking marks this envelope as a decision the caller must relay before
	// any review work starts; nothing has been persisted.
	Blocking       bool                             `json:"blocking"`
	TargetIdentity string                           `json:"target_identity"`
	Projection     reviewtransaction.Projection     `json:"projection"`
	RiskLevel      reviewtransaction.RiskLevel      `json:"risk_level"`
	ChangedFiles   int                              `json:"changed_files"`
	ChangedLines   int                              `json:"changed_lines"`
	Headline       string                           `json:"headline"`
	Reason         string                           `json:"reason"`
	Value          string                           `json:"value"`
	RiskEvidence   []string                         `json:"risk_evidence"`
	Choices        []ReviewIntegrationConsentChoice `json:"choices"`
	// OffPath documents the permanent disable outside the choice set, exactly
	// as the interactive prompt does: a decline is deliberately not the kill
	// switch, and turning reviews off for good must cost more than answering
	// a relayed question in a hurry.
	OffPath ReviewIntegrationConsentOffPath `json:"off_path"`
}

type ReviewIntegrationFailure struct {
	Schema                 string                          `json:"schema"`
	Contract               string                          `json:"contract"`
	Operation              string                          `json:"operation"`
	Phase                  string                          `json:"phase"`
	Code                   string                          `json:"code"`
	Message                string                          `json:"message"`
	MutationOutcome        ReviewMutationOutcome           `json:"mutation_outcome"`
	AuthorityApplicability string                          `json:"authority_applicability"`
	RetrySafe              bool                            `json:"retry_safe"`
	Replayability          reviewtransaction.Replayability `json:"replayability"`
	LineageID              string                          `json:"lineage_id,omitempty"`
	// TargetIdentity binds an operation failure to the frozen candidate whose
	// retained lineage the caller must query with STATUS. It is optional for
	// unrelated historical failure classes.
	TargetIdentity   string   `json:"target_identity,omitempty"`
	RequestDigest    string   `json:"request_digest,omitempty"`
	ProgressIdentity string   `json:"progress_identity,omitempty"`
	RequiredInputs   []string `json:"required_inputs"`
	NextAction       string   `json:"next_action"`
	CauseCategory    string   `json:"cause_category,omitempty"`
	// Cause is additive: the scrubbed, bounded native cause for a typed failure
	// branch that has a safe diagnostic to publish.
	Cause   string                           `json:"cause,omitempty"`
	Context *ReviewIntegrationFailureContext `json:"context,omitempty"`
	// Continuation is the one candidate-preserving runnable follow-up a
	// managed_assets_outdated refusal can offer (#3299, #4170): the exact
	// `teicos sync` invocation that reconciles the recorded digest. It is
	// additive and, on THIS envelope, only ever set for that one refusal code;
	// the release continuation the type also carries travels on a STATUS stop,
	// never here.
	Continuation *ReviewStopContinuation `json:"continuation,omitempty"`
}

type ReviewIntegrationFailureContext struct {
	ScopeChange *ReviewIntegrationScopeChange `json:"scope_change,omitempty"`
	// TargetDrift is the additive #4494 stale-target evidence: the negotiated
	// components beside their live rebuild, with the differing component
	// names. Exactly one of the two context variants is ever set.
	TargetDrift *ReviewIntegrationTargetDrift `json:"target_drift,omitempty"`
}

type ReviewIntegrationFailureError struct {
	Failure ReviewIntegrationFailure
	// contains filtered or unexported fields
}

type ReviewIntegrationNegotiatedComponents struct {
	Kind          string `json:"kind"`
	Projection    string `json:"projection"`
	BaseTree      string `json:"base_tree,omitempty"`
	CandidateTree string `json:"candidate_tree"`
	PathsDigest   string `json:"paths_digest"`
}

type ReviewIntegrationOperationResult struct {
	Schema    string          `json:"schema"`
	Contract  string          `json:"contract"`
	Operation string          `json:"operation"`
	Result    json.RawMessage `json:"result"`
}

type ReviewIntegrationScopeChange struct {
	Expected               ReviewIntegrationScopeTarget `json:"expected"`
	Actual                 ReviewIntegrationScopeTarget `json:"actual"`
	DifferingPathCount     int                          `json:"differing_path_count"`
	DifferingPathsDigest   string                       `json:"differing_paths_digest"`
	PredecessorLineageID   string                       `json:"predecessor_lineage_id"`
	PredecessorRevision    string                       `json:"predecessor_revision"`
	RecoveryOperation      string                       `json:"recovery_operation"`
	RecoveryRequiredInputs []string                     `json:"recovery_required_inputs"`
}

type ReviewIntegrationScopeTarget struct {
	CandidateTree string `json:"candidate_tree"`
	PathsDigest   string `json:"paths_digest"`
}

type ReviewIntegrationStartResult struct {
	Schema              string                                        `json:"schema"`
	Contract            string                                        `json:"contract"`
	Operation           string                                        `json:"operation"`
	Action              string                                        `json:"action"`
	LensesRequired      bool                                          `json:"lenses_required"`
	LineageID           string                                        `json:"lineage_id"`
	State               reviewtransaction.State                       `json:"state"`
	RiskLevel           reviewtransaction.RiskLevel                   `json:"risk_level"`
	SelectedLenses      []string                                      `json:"selected_lenses"`
	Projection          reviewtransaction.Projection                  `json:"projection"`
	TargetMode          reviewtransaction.TargetKind                  `json:"target_mode,omitempty"`
	TargetIdentity      string                                        `json:"target_identity,omitempty"`
	BaseTree            string                                        `json:"base_tree,omitempty"`
	CandidateTree       string                                        `json:"candidate_tree,omitempty"`
	ChangedFiles        int                                           `json:"changed_files"`
	ChangedLines        int                                           `json:"changed_lines"`
	CorrectionBudget    int                                           `json:"correction_budget"`
	RiskReasons         []reviewtransaction.RiskReason                `json:"risk_reasons"`
	ArtifactSubjects    []reviewtransaction.ArtifactSubject           `json:"artifact_subjects"`
	CandidateDiff       *reviewtransaction.FrozenCandidateDiff        `json:"candidate_diff,omitempty"`
	ChangedPathManifest *[]reviewtransaction.ChangedPathManifestEntry `json:"changed_path_manifest,omitempty"`
	RepositoryContext   *ReviewRepositoryContextReference             `json:"repository_context,omitempty"`
	Acknowledgement     *ReviewTransitionExecution                    `json:"acknowledgement,omitempty"`
	NextTransition      *ReviewNextTransition                         `json:"next_transition,omitempty"`
	// Trace mirrors ReviewFacadeStartResult.Trace (#1854). It is carried
	// only on the current (non-legacy-transport) envelope, the same gating
	// Acknowledgement and NextTransition already use, so the frozen v1
	// legacy-transport wire shape (start-v2.schema.json) never gains a field.
	Trace *ReviewTraceOutcome `json:"trace,omitempty"`
}

type ReviewIntegrationTargetDrift struct {
	Expected            ReviewIntegrationNegotiatedComponents `json:"expected"`
	Actual              ReviewIntegrationNegotiatedComponents `json:"actual"`
	DifferingComponents []string                              `json:"differing_components"`
}

type ReviewInvalidateResult struct {
	Operation     string                  `json:"operation"`
	LineageID     string                  `json:"lineage_id"`
	State         reviewtransaction.State `json:"state"`
	StoreRevision string                  `json:"store_revision"`
}

type ReviewModeResult struct {
	Schema    string                          `json:"schema"`
	Operation string                          `json:"operation"`
	Scope     string                          `json:"scope"`
	Status    reviewtransaction.RDDModeStatus `json:"status"`
}

type ReviewModeUnreadableError struct {
	Scopes []ReviewModeUnreadableScope
	Cause  error
}

type ReviewModeUnreadableScope struct {
	Scope string
	Path  string
	Repo  string
}

type ReviewMutationOutcome string

type ReviewNextTransition struct {
	Kind              string                                   `json:"kind"`
	ReasonCode        string                                   `json:"reason_code"`
	Execute           *ReviewTransitionExecution               `json:"execute,omitempty"`
	Collect           *ReviewTransitionCollection              `json:"collect,omitempty"`
	CorrectionRequest *reviewtransaction.CorrectionPlanRequest `json:"correction_request,omitempty"`
	Continuation      *ReviewStopContinuation                  `json:"continuation,omitempty"`
	// UnachievableLensSlots is a pointer-to-slice, exactly like
	// ReviewTransitionExecution.SelectorArguments, so ReviewNextTransition
	// stays a comparable struct (== / != against a zero value) for the
	// existing state-table test's "omitted" check.
	UnachievableLensSlots *[]ReviewUnachievableLensSlot `json:"unachievable_lens_slots,omitempty"`
}

type ReviewProviderTask struct {
	Agent  string `json:"agent"`
	Role   string `json:"role"`
	Prompt string `json:"prompt"`
}

type ReviewReceiptDiscoveryError struct {
	Kind       ReviewReceiptDiscoveryKind
	Category   string
	Candidates []string
	Context    *reviewtransaction.GateContext
	// Detail preserves the exact typed cause of a deterministic mismatch so
	// the denial states what is actually true instead of a generic projection.
	Detail string
	// DeterministicallyStaleOnly is meaningful only when Kind ==
	// ReviewReceiptAmbiguous. It records the ambiguity's COMPOSITION: true
	// only when every lineage contributing to it classified into a
	// deterministically-typed stale bucket (scope-changed, delivery-shape, or
	// target-resolution) rather than an undecidable one (assessment-unknown
	// or scope-diagnostics-unavailable) or a genuinely competing exact match
	// (len(exact) > 1, which never sets this field). organic-dx Phase 3c: the
	// gate asks exactly one question -- does an approved receipt cover
	// exactly these candidate bytes? A stale receipt must INFORM, never
	// DECIDE. When this field is true, discovery has proven no candidate
	// governs, so the residual ambiguity is only about which stale lineage to
	// name in diagnostics -- it never has a delivery consequence, in either
	// mode. A false value (the default) means the gate genuinely cannot pick
	// -- present-tense competing authority, or an assessment that could not
	// even be completed.
	//
	// That false value keeps failing closed while reviews are ON, where
	// answering requires naming one governing receipt. It no longer decides
	// whether the gate BLOCKS while reviews are off: a switched-off system has
	// no implications, and declining to govern requires choosing nothing. What
	// it decides there is whether the reported disabled/unmanaged result must
	// additionally SAY the gate could not decide -- see
	// reviewDiscoveryLeftTheGateUndecided.
	//
	// A bool field was chosen over a distinct ReviewReceiptDiscoveryKind
	// because Kind is wire-facing (JSON "code", docs continuation table,
	// Phase 4's narration registry); splitting it would ripple through all
	// three surfaces for a distinction that has no separate wire behavior of
	// its own -- it only feeds one internal classification decision. This
	// field is package-internal bookkeeping, never serialized.
	DeterministicallyStaleOnly bool
}

type ReviewReceiptDiscoveryKind string

type ReviewReclaimResult struct {
	Operation string                                 `json:"operation"`
	Record    reviewtransaction.CompactReclaimRecord `json:"record"`
}

type ReviewRecoverResult struct {
	Operation      string                                      `json:"operation"`
	LineageID      string                                      `json:"lineage_id"`
	State          reviewtransaction.State                     `json:"state"`
	StoreRevision  string                                      `json:"store_revision"`
	Projection     reviewtransaction.Projection                `json:"projection"`
	TargetIdentity string                                      `json:"target_identity"`
	Recovery       reviewtransaction.CompactRecoveryProvenance `json:"recovery"`
}

type ReviewRepairDispositionExecution struct {
	Schema                     string `json:"schema"`
	Status                     string `json:"status"`
	LineageID                  string `json:"lineage_id"`
	PlanDigest                 string `json:"plan_digest"`
	AuthorityInventoryRevision string `json:"authority_inventory_revision"`
	AnomalyClass               string `json:"anomaly_class"`
	AuthorizationSHA256        string `json:"authorization_sha256"`
}

type ReviewRepairDispositionProviderInputs struct {
	PlanDigest                 string `json:"plan_digest"`
	AuthorityInventoryRevision string `json:"authority_inventory_revision"`
	SeedLineageID              string `json:"seed_lineage_id,omitempty"`
	SeedExpectedRevision       string `json:"seed_expected_revision,omitempty"`
}

type ReviewRepairMode string

type ReviewRepairProviderInputs struct {
	Class               reviewtransaction.AuthorityRepairClass       `json:"class"`
	LineageID           string                                       `json:"lineage_id"`
	ExpectedRevision    string                                       `json:"expected_revision"`
	Cause               reviewtransaction.AuthorityRepairCause       `json:"cause"`
	Disposition         reviewtransaction.AuthorityRepairDisposition `json:"disposition"`
	RepositoryBinding   string                                       `json:"repository_binding"`
	AuthorizationSchema string                                       `json:"authorization_schema"`
}

type ReviewRepairResult struct {
	Schema     string                                      `json:"schema"`
	Contract   string                                      `json:"contract"`
	Operation  string                                      `json:"operation"`
	Mode       ReviewRepairMode                            `json:"mode"`
	Assessment reviewtransaction.AuthorityRepairAssessment `json:"assessment"`
	// Continuation is populated only for a truncated preflight, and is then
	// exactly reviewRepairTruncatedContinuation.
	Continuation              string                                                `json:"continuation,omitempty"`
	ProviderInputs            *ReviewRepairProviderInputs                           `json:"provider_inputs,omitempty"`
	RequiredInputs            []string                                              `json:"required_inputs"`
	Execution                 *reviewtransaction.ClassifiedAuthorityRepairExecution `json:"execution,omitempty"`
	DispositionProviderInputs *ReviewRepairDispositionProviderInputs                `json:"disposition_provider_inputs,omitempty"`
	DispositionSelectors      []reviewtransaction.AuthorityDispositionSelector      `json:"disposition_selectors,omitempty"`
	DispositionExecution      *ReviewRepairDispositionExecution                     `json:"disposition_execution,omitempty"`
}

type ReviewRepositoryContextReference struct {
	Capability     string `json:"capability"`
	Handle         string `json:"handle"`
	Revision       string `json:"revision"`
	TargetIdentity string `json:"target_identity"`
}

type ReviewResultReopenResult struct {
	Schema    string                                       `json:"schema"`
	Operation string                                       `json:"operation"`
	Prepared  bool                                         `json:"prepared"`
	Plan      *reviewtransaction.CompactResultReopenPlan   `json:"plan,omitempty"`
	Record    *reviewtransaction.CompactResultReopenRecord `json:"record,omitempty"`
}

type ReviewResumeResult struct {
	Schema          string                        `json:"schema"`
	Operation       string                        `json:"operation"`
	Target          reviewtransaction.Snapshot    `json:"target"`
	Transaction     reviewtransaction.Transaction `json:"transaction"`
	StoreAuthority  string                        `json:"store_authority"`
	StoreRevision   string                        `json:"store_revision"`
	GenesisRevision string                        `json:"genesis_revision"`
	ChainIdentity   string                        `json:"chain_identity"`
}

type ReviewStopContinuation struct {
	Operation   string   `json:"operation"`
	Command     string   `json:"command"`
	Agent       string   `json:"agent,omitempty"`
	StaleAssets []string `json:"stale_assets,omitempty"`
	Detail      string   `json:"detail,omitempty"`
}

type ReviewStoreResetResult struct {
	Schema    string                             `json:"schema"`
	Operation string                             `json:"operation"`
	Report    reviewtransaction.StoreResetReport `json:"report"`
}

type ReviewTargetStatusAuthority struct {
	Version              reviewtransaction.AuthorityVersion `json:"version"`
	LineageID            string                             `json:"lineage_id"`
	State                reviewtransaction.State            `json:"state"`
	Generation           int                                `json:"generation"`
	Revision             string                             `json:"revision"`
	CapturePhaseRevision string                             `json:"-"`
}

type ReviewTargetStatusFrozen struct {
	Tier                 reviewtransaction.RiskLevel `json:"tier"`
	OriginalChangedLines int                         `json:"original_changed_lines"`
	CorrectionBudget     int                         `json:"correction_budget"`
	// ChangedPathManifestSHA256 is the digest of the frozen candidate's
	// changed-path manifest, re-derived from the repository at STATUS time.
	// Per-lens capture inputs carry no manifest any more, so each subject's
	// digest is bound to this one value instead of to an inlined copy.
	ChangedPathManifestSHA256 string `json:"changed_path_manifest_sha256,omitempty"`
}

type ReviewTargetStatusProjection struct {
	Schema                  string                       `json:"schema"`
	Kind                    reviewtransaction.TargetKind `json:"kind"`
	Projection              reviewtransaction.Projection `json:"projection"`
	BaseTree                string                       `json:"base_tree"`
	InitialReviewTree       string                       `json:"initial_review_tree"`
	CurrentCandidateTree    string                       `json:"current_candidate_tree"`
	PathsDigest             string                       `json:"paths_digest"`
	Paths                   []string                     `json:"paths"`
	IntendedUntracked       []string                     `json:"intended_untracked"`
	IntendedUntrackedProof  string                       `json:"intended_untracked_proof"`
	InitialSnapshotIdentity string                       `json:"initial_snapshot_identity"`
	CurrentSnapshotIdentity string                       `json:"current_snapshot_identity"`
}

type ReviewTargetStatusResult struct {
	Schema        string                                `json:"schema"`
	Contract      string                                `json:"contract"`
	Operation     string                                `json:"operation"`
	Applicability reviewtransaction.TargetApplicability `json:"applicability"`
	Authority     *ReviewTargetStatusAuthority          `json:"authority,omitempty"`
	Action        reviewtransaction.TargetStatusAction  `json:"action"`
	// ActionDisposition names the provider recovery class accepted by the
	// selected action. Recovery remains target-scoped and independent from
	// terminal capture closure.
	ActionDisposition       reviewtransaction.RecoveryDisposition `json:"action_disposition,omitempty"`
	Replayability           reviewtransaction.Replayability       `json:"replayability"`
	Frozen                  *ReviewTargetStatusFrozen             `json:"frozen,omitempty"`
	TargetIdentity          string                                `json:"target_identity"`
	AuthorityTargetIdentity string                                `json:"authority_target_identity,omitempty"`
	Projection              ReviewTargetStatusProjection          `json:"projection"`
	// EligibleUntrackedInventory is the canonical digest
	// intendedUntrackedScopeForTarget already computes over the live
	// workspace's eligible untracked population, published unconditionally
	// on every projection that inspects untracked files (issue #4040): a
	// refusal that names this STATUS as its recovery route always yields a
	// usable value. The `staged` projection does not inspect untracked
	// files, so it leaves this at its zero value and `omitempty` drops the
	// key entirely — absence means "not applicable", not "checked, found
	// none". This is a top-level fact about what the live workspace could
	// have included; it lives outside Projection (a record of the frozen
	// candidate) because ReviewTargetStatusProjection serializes through the
	// shared, multi-version projection.schema.json.
	EligibleUntrackedInventory string                                      `json:"eligible_untracked_inventory,omitempty"`
	Repair                     reviewtransaction.AuthorityRepairAssessment `json:"repair"`
	// Disposition is Wave 6's negotiated-route provider preview (rdd-closure-
	// disposition-execution / "Reachable Through the Negotiated Transition
	// Route"): populated only when Repair is not eligible but a closed
	// closure disposition plan derives and admits. It carries the same two
	// fields `review repair --preflight` already publishes for this route
	// (ReviewRepairDispositionProviderInputs) — nothing a maintainer could
	// not already derive read-only, and nothing that changes without a real
	// authorization.
	Disposition       *ReviewRepairDispositionProviderInputs       `json:"disposition,omitempty"`
	Candidates        []string                                     `json:"candidates"`
	Eligibility       *ReviewActionEligibility                     `json:"eligibility,omitempty"`
	Forecast          *ReviewForecast                              `json:"forecast,omitempty"`
	NextTransition    *ReviewNextTransition                        `json:"next_transition,omitempty"`
	Escalation        *reviewtransaction.CompactEscalationEvidence `json:"escalation,omitempty"`
	RepositoryContext *ReviewRepositoryContextReference            `json:"repository_context,omitempty"`
	ValidationRequest *reviewtransaction.TargetedValidationRequest `json:"validation_request,omitempty"`
	// contains filtered or unexported fields
}

type ReviewTraceOutcome struct {
	// RequestedPath is a redacted identity of the --trace value, the same
	// way this surface avoids ever publishing a raw filesystem path.
	RequestedPath string `json:"requested_path,omitempty"`
	Persisted     bool   `json:"persisted"`
	// ErrorClass distinguishes mkdir/open/write/fsync/close failures; empty
	// when Persisted is true.
	ErrorClass        string `json:"error_class,omitempty"`
	CommittedRevision string `json:"committed_revision,omitempty"`
	// EventIdentity lets a caller confirm a later retry describes the same
	// event, without trusting free-form text.
	EventIdentity string `json:"event_identity,omitempty"`
	// Retry is present only when Persisted is false.
	Retry string `json:"retry,omitempty"`
}

type ReviewTransitionArgument struct {
	Name  string `json:"name"`
	Value string `json:"value"`
	// Token is the exact, literally executable argv token for this argument
	// (e.g. "--captured-results=true"). It is populated wherever the argument
	// really is argv: on ReviewTransitionExecution.Arguments, on the
	// Arguments of a ReviewTransitionInput whose CaptureOperation names an
	// operation this product performs (see reviewNativeCaptureVerb), and on
	// the SelectorArguments of a reviewing START status continuation, whose
	// rows are byte-identical copies of already-tokenized argument rows
	// (issue #3894). It stays empty on Preconditions, which are assertions
	// rather than argv, on the normalized selector echoes older transitions
	// carry, and on the Arguments of an "external.*" capture operation,
	// which are values to hand to whoever performs it somewhere this product
	// does not run. Name/Value stay byte-identical so existing consumers of
	// those two fields never move.
	Token string `json:"token,omitempty"`
}

type ReviewTransitionArtifact struct {
	Schema            string                                      `json:"schema"`
	Capability        string                                      `json:"capability"`
	SHA256            string                                      `json:"sha256"`
	LineageID         string                                      `json:"lineage_id"`
	TargetIdentity    string                                      `json:"target_identity"`
	Lens              string                                      `json:"lens"`
	SelectedOrder     int                                         `json:"selected_order"`
	SubjectHash       string                                      `json:"subject_hash"`
	AdmissionDecision reviewtransaction.ArtifactAdmissionDecision `json:"admission_decision"`
}

type ReviewTransitionBinding struct {
	LineageID         string `json:"lineage_id,omitempty"`
	Revision          string `json:"revision,omitempty"`
	TargetIdentity    string `json:"target_identity"`
	RepositoryContext string `json:"repository_context,omitempty"`
	// RepositoryRoot is rendered as the --cwd token beside the repository
	// context and never serialized into the binding object. The context handle
	// is a digest over this repository and the binding above, so the capture
	// command has to be told which repository to verify it against.
	RepositoryRoot string `json:"-"`
}

type ReviewTransitionCollection struct {
	Inputs []ReviewTransitionInput `json:"inputs"`
}

type ReviewTransitionExecution struct {
	Operation string `json:"operation"`
	// Command is the complete, literally runnable command line for this
	// transition, e.g. "gentle-ai review start --contract=... --target=...".
	// Operation alone is a dotted logical name, so a caller had to already know
	// that "review.start" means "gentle-ai review start" before it could run
	// anything. Operation, Arguments and their Tokens stay byte-identical, so
	// existing consumers never move.
	Command           string                      `json:"command,omitempty"`
	Arguments         []ReviewTransitionArgument  `json:"arguments"`
	SelectorArguments *[]ReviewTransitionArgument `json:"selector_arguments,omitempty"`
	Preconditions     []ReviewTransitionArgument  `json:"preconditions"`
	Binding           ReviewTransitionBinding     `json:"binding"`
	Artifacts         []ReviewTransitionArtifact  `json:"artifacts,omitempty"`
}

type ReviewTransitionInput struct {
	Name                string                                        `json:"name"`
	Schema              string                                        `json:"schema"`
	CaptureOperation    string                                        `json:"capture_operation"`
	Arguments           []ReviewTransitionArgument                    `json:"arguments"`
	ProviderTask        *ReviewProviderTask                           `json:"provider_task,omitempty"`
	Submission          *ReviewTransitionSubmission                   `json:"submission,omitempty"`
	ArtifactSubject     *reviewtransaction.ArtifactSubject            `json:"artifact_subject,omitempty"`
	CandidateDiff       *reviewtransaction.FrozenCandidateDiff        `json:"candidate_diff,omitempty"`
	BaseTree            string                                        `json:"base_tree,omitempty"`
	CandidateTree       string                                        `json:"candidate_tree,omitempty"`
	ChangedPathManifest *[]reviewtransaction.ChangedPathManifestEntry `json:"changed_path_manifest,omitempty"`
	ValidationRequest   *reviewtransaction.TargetedValidationRequest  `json:"validation_request,omitempty"`
}

type ReviewTransitionSubmission struct {
	OperationToken string                            `json:"operation_token"`
	ArgumentTokens []string                          `json:"argument_tokens"`
	Value          *ReviewTransitionSubmissionValue  `json:"value,omitempty"`
	Values         []ReviewTransitionSubmissionValue `json:"values,omitempty"`
}

type ReviewTransitionSubmissionValue struct {
	Slot                 string   `json:"slot"`
	Domain               string   `json:"domain"`
	Schema               string   `json:"schema,omitempty"`
	Minimum              int      `json:"minimum,omitempty"`
	Maximum              int      `json:"maximum,omitempty"`
	AllowedValues        []string `json:"allowed_values,omitempty"`
	SubstitutionLocation int      `json:"substitution_location"`
}

type ReviewUnachievableLensSlot struct {
	Lens          string                         `json:"lens"`
	SelectedOrder int                            `json:"selected_order"`
	SubjectHash   string                         `json:"subject_hash"`
	Reason        string                         `json:"reason"`
	Detail        string                         `json:"detail,omitempty"`
	Withdraw      ReviewUnachievableLensWithdraw `json:"withdraw"`
}

type ReviewUnachievableLensWithdraw struct {
	Operation string                     `json:"operation"`
	Command   string                     `json:"command"`
	Arguments []ReviewTransitionArgument `json:"arguments"`
	Binding   ReviewTransitionBinding    `json:"binding"`
}

type ReviewValidateResult struct {
	Schema  string                        `json:"schema"`
	Result  reviewtransaction.GateResult  `json:"result"`
	Allowed bool                          `json:"allowed"`
	Action  string                        `json:"action"`
	Reason  string                        `json:"reason"`
	Context reviewtransaction.GateContext `json:"context"`
	// Delivery names what governs delivery when the answer is not the receipt
	// itself. It is an additive, omitted-by-default extension of
	// gentle-ai.review-gate-result/v1: every projection that already shipped
	// keeps its exact field set, and only a candidate that is unmanaged by the
	// user's own choice carries the extra token. It never carries an approval.
	Delivery reviewtransaction.RDDDelivery `json:"delivery,omitempty"`
	// Relation and Next are Wave 5 (Gate Cutover) Slice 3's additive wire
	// projection of NativeGateEvaluation's own new fields (gate.go): omitted
	// by default, so every existing consumer's exact field set is unchanged,
	// and populated only where attachGateVerdictRelation (compact_gate.go)
	// could classify the denial this slice -- currently the "changed"
	// relation only (see that function's own doc comment for why the rest
	// is not wired yet).
	Relation reviewtransaction.CandidateRelation `json:"relation,omitempty"`
	Next     *reviewtransaction.GateNextStep     `json:"next,omitempty"`
}

type ReviewerResultPayloadError struct {
	Code    string
	Message string
}

type ShellInstallSelection struct {
	Request   shellinstaller.UserInstallRequest
	Confirmed bool
}

type SyncFlags struct {
	Agents             []string
	Skills             []string
	SDDMode            string
	StrictTDD          bool
	IncludePermissions bool
	IncludeTheme       bool
	Scope              string
	DryRun             bool

	OpenCodeBackgroundSubagents    string
	OpenCodeBackgroundSubagentsSet bool

	PiBackgroundSubagents    string
	PiBackgroundSubagentsSet bool
	// contains filtered or unexported fields
}

type SyncResult struct {
	Agents    []model.AgentID
	Selection model.Selection
	Plan      pipeline.StagePlan
	Execution pipeline.ExecutionResult
	Verify    verify.Report
	DryRun    bool
	// NoOp is true when no managed asset changes were needed:
	// either no agents were discovered/provided, or all managed assets
	// were already current (idempotent re-sync).
	NoOp bool
	// FilesChanged is the number of deduplicated managed file paths
	// whose persisted content or existence changed during this sync.
	// Zero means all assets were already current.
	FilesChanged int
	// ChangedFiles lists deduplicated absolute paths of managed files
	// processed during this sync. Paths appear once even when multiple
	// components touch the same file. It is nil when no files changed.
	ChangedFiles  []string
	ManualActions []string
	// DryRunStops lists refusals a dry-run found that the real sync would stop
	// on before writing anything.
	DryRunStops []string

	Background              OpenCodeBackgroundResolution
	BackgroundPolicyEnabled bool

	PiBackground PiBackgroundResolution

	// SkippedAgents lists selected agents this sync deliberately did not
	// touch, each with the actionable reason. A non-empty list makes the sync
	// partial: the returned error is a *PartialSyncError.
	SkippedAgents []SyncSkippedAgent
}

type SyncSkippedAgent struct {
	Agent model.AgentID
	// Part names the skipped part of the agent; empty means the whole agent.
	Part   string
	Reason string
}

type TelemetryPolicyResult struct {
	Schema    string           `json:"schema"`
	Operation string           `json:"operation"`
	Enabled   bool             `json:"enabled"`
	Source    telemetry.Source `json:"source"`
	Reason    string           `json:"reason"`
}

type TelemetryStatusResult struct {
	Schema            string             `json:"schema"`
	Operation         string             `json:"operation"`
	Enabled           bool               `json:"enabled"`
	Source            string             `json:"source"`
	InstallID         string             `json:"install_id"`
	NoticeShown       bool               `json:"notice_shown"`
	Endpoint          string             `json:"endpoint"`
	LastInstallSentAt string             `json:"last_install_sent_at,omitempty"`
	LastHeartbeatAt   string             `json:"last_heartbeat_at,omitempty"`
	LastFailureAt     string             `json:"last_failure_at,omitempty"`
	BackoffUntil      string             `json:"backoff_until,omitempty"`
	Counters          telemetry.Counters `json:"counters"`
}

type TelemetryTriggerResult struct {
	Schema   string `json:"schema"`
	Decision string `json:"decision"`
	Source   string `json:"source"`
}

type UninstallFlags struct {
	Agents     []string
	Components []string
	All        bool
	Yes        bool
}

type UninstallOpenCodePluginFlags struct {
	PluginID model.OpenCodeCommunityPluginID
	Yes      bool
}