{ "openapi": "3.0.3", "info": { "title": "BudAlly API (developer subset)", "version": "0.108.0", "description": "The read and draft operations of the BudAlly API, taken from platform contract 0.108.0. Drafts become proposals in the tenant approval queue; approval happens in the app, by a signed-in person. Generated by ledgerleaf-web tools/public-openapi.mjs; do not edit by hand." }, "servers": [ { "url": "https://api.budally.com" } ], "paths": { "/proposals": { "get": { "operationId": "listProposals", "parameters": [ { "description": "One proposal state.", "in": "query", "name": "state", "required": false, "schema": { "type": "string" } }, { "description": "One licence.", "in": "query", "name": "license", "required": false, "schema": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } }, { "description": "Page size, default 50.", "in": "query", "name": "limit", "required": false, "schema": { "maximum": 200, "minimum": 1, "type": "integer" } }, { "description": "Keyset cursor from nextBefore.", "in": "query", "name": "before", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProposalList" } } }, "description": "A page." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Bad query." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No active session." } }, "security": [ { "sessionCookie": [] }, { "sessionToken": [] } ], "summary": "The workspace’s proposals, newest first, with per-state counts for the queue (0.23.0)", "tags": [ "proposals" ] }, "post": { "operationId": "createProposal", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProposalCreateRequest" } } }, "description": "The write to propose, or prepared local agent_client.consent.revoke / agent.stop_all safety action. No external agent runtime is invoked.", "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Proposal" } } }, "description": "The idempotency token named an existing proposal; here it is." }, "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Proposal" } } }, "description": "Drafted, or Verified with an immutable review receipt for a local agent safety action." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "The request is malformed, OR the kind is not created here (code `kind_not_proposable_here`). **Only `money.*`** is refused, whoever sends it: a general-ledger journal is proposed through `POST /money/journals`, which resolves the period, the accounts and the balance, and this endpoint cannot validate a hand-written journal payload. Retrying cannot help. `billing.*` and `tenant.export` ARE raised here — they are dual-controlled account actions with no resolver, and an earlier version of this endpoint refused them by over-applying the money read gate, which left the billing board unable to raise anything at all." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No active session." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Current proposal and source authority is required. Immediate agent safety kinds instead require an active human with unscoped tenant.manage or membership.manage. Registered service identities cannot perform those safety actions." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No such licence in this workspace." } }, "security": [ { "sessionCookie": [] }, { "sessionToken": [] } ], "summary": "Draft a write for a second person to decide (proposal.propose), or immediately apply a prepared local agent safety action as a current human settings administrator. The server hashes the payload; an exact retry returns the same recorded proposal with 200.", "tags": [ "proposals" ] } }, "/proposals/{id}": { "get": { "operationId": "getProposal", "parameters": [ { "description": "A proposal in the caller’s workspace.", "in": "path", "name": "id", "required": true, "schema": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Proposal" } } }, "description": "The proposal." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No active session." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No money capability. A proposal whose kind is a general-ledger or billing one is a money document, so reading it needs `money.read` or `tenant.manage` — except that a `billing.*` proposal may also be read by a caller holding `proposal.propose` (whoever may raise one may read it back; founder decision 2026-10-26, F-70), and acting on one (send-back, approve, reject, execute) still needs the money capability. (Those are the READ capabilities; `POST /money/journals` requires `money.post.propose` or `tenant.manage` to PROPOSE one — an earlier version of this sentence said the two sets were the same and they are not.) `GET /proposals` and `GET /inbox` FILTER instead of refusing, and say so in `partiallyWithheld`; the single-proposal reads refuse, because there is nothing to filter." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No such proposal in this workspace." } }, "security": [ { "sessionCookie": [] }, { "sessionToken": [] } ], "summary": "One proposal with its approvals, reviews and execution summary (0.23.0)", "tags": [ "proposals" ] } }, "/proposals/{id}/read-back": { "get": { "operationId": "getProposalReadBack", "parameters": [ { "description": "A proposal in the caller’s workspace.", "in": "path", "name": "id", "required": true, "schema": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReadBack" } } }, "description": "The read-back; execution is null when nothing has run." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No active session." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No money capability. A proposal whose kind is a general-ledger or billing one is a money document, so reading it needs `money.read` or `tenant.manage` — except that a `billing.*` proposal may also be read by a caller holding `proposal.propose` (whoever may raise one may read it back; founder decision 2026-10-26, F-70), and acting on one (send-back, approve, reject, execute) still needs the money capability. (Those are the READ capabilities; `POST /money/journals` requires `money.post.propose` or `tenant.manage` to PROPOSE one — an earlier version of this sentence said the two sets were the same and they are not.) `GET /proposals` and `GET /inbox` FILTER instead of refusing and say so in `partiallyWithheld`; the single-proposal reads refuse, because there is nothing to filter." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No such proposal in this workspace." } }, "security": [ { "sessionCookie": [] }, { "sessionToken": [] } ], "summary": "What actually happened outside: the execution, its attempts, its verifications, and whether a retry is blocked because the last attempt was Indeterminate and nothing has been read back since (0.23.0)", "tags": [ "proposals" ] } }, "/ledger/packages": { "get": { "operationId": "listLedgerPackages", "parameters": [ { "description": "A licence in the caller’s workspace.", "in": "query", "name": "license", "required": true, "schema": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } }, { "description": "Substring of the tag.", "in": "query", "name": "search", "required": false, "schema": { "type": "string" } }, { "description": "Default 200.", "in": "query", "name": "limit", "required": false, "schema": { "maximum": 1000, "minimum": 1, "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LedgerPackageList" } } }, "description": "The packages." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Bad licence id or limit." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No active session." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No such licence in this workspace." } }, "security": [ { "sessionCookie": [] }, { "sessionToken": [] } ], "summary": "Packages the ledger holds events for: latest observed quantity, item, unit, event counts and source classes; most recently observed first (0.24.0)", "tags": [ "ledger" ] } }, "/ledger/packages/{tag}/events": { "get": { "operationId": "getPackageTimeline", "parameters": [ { "description": "The package tag as the state system knows it.", "in": "path", "name": "tag", "required": true, "schema": { "type": "string" } }, { "description": "A licence in the caller’s workspace.", "in": "query", "name": "license", "required": true, "schema": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PackageTimeline" } } }, "description": "The timeline." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Bad licence id or tag." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No active session." }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No such licence, or no events for that tag." } }, "security": [ { "sessionCookie": [] }, { "sessionToken": [] } ], "summary": "One tag’s events in effective order with lineage links, superseded rows kept and struck, and the running balance (0.24.0)", "tags": [ "ledger" ] } }, "/audit/trail": { "get": { "operationId": "getAuditTrail", "parameters": [ { "description": "schema.table to narrow to.", "in": "query", "name": "table", "required": false, "schema": { "type": "string" } }, { "description": "One row’s id.", "in": "query", "name": "rowId", "required": false, "schema": { "type": "string" } }, { "description": "One user.", "in": "query", "name": "actor", "required": false, "schema": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } }, { "description": "Default 100.", "in": "query", "name": "limit", "required": false, "schema": { "maximum": 500, "minimum": 1, "type": "integer" } }, { "description": "Keyset cursor from nextBefore.", "in": "query", "name": "before", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditTrail" } } }, "description": "A page of the trail." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Bad query." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No active session." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "This account does not hold ledger.read." } }, "security": [ { "sessionCookie": [] }, { "sessionToken": [] } ], "summary": "The workspace’s row history — who changed what, when, from what to what — newest first (ledger.read) (0.26.0)", "tags": [ "audit" ] } }, "/audit/chain": { "get": { "operationId": "getAuditChainStatus", "parameters": [ { "description": "YYYY-MM-DD; default 30 days ago.", "in": "query", "name": "from", "required": false, "schema": { "type": "string" } }, { "description": "YYYY-MM-DD; default today.", "in": "query", "name": "to", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditChainStatus" } } }, "description": "Chain wholeness over the range." }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "Bad dates." }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "No active session." }, "403": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "description": "This account does not hold ledger.read." } }, "security": [ { "sessionCookie": [] }, { "sessionToken": [] } ], "summary": "Whether every active day in the range has its daily anchor; the chain’s own rows are never returned (ledger.read) (0.26.0)", "tags": [ "audit" ] } } }, "components": { "schemas": { "Approval": { "properties": { "approverId": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "decidedAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "decision": { "enum": [ "approve", "reject" ], "type": "string" }, "id": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "payloadHashAtApproval": { "type": "string" }, "role": { "type": "string" }, "stale": { "type": "boolean" } }, "required": [ "id", "approverId", "role", "decision", "payloadHashAtApproval", "stale", "decidedAt" ], "type": "object" }, "AuditChainStatus": { "description": "Whether every active day in the range has its anchor. Never a row of the chain.", "properties": { "anchoredThrough": { "nullable": true, "type": "string" }, "from": { "type": "string" }, "missingAnchorDays": { "items": { "type": "string" }, "type": "array" }, "note": { "type": "string" }, "to": { "type": "string" } }, "required": [ "from", "to", "missingAnchorDays", "anchoredThrough", "note" ], "type": "object" }, "AuditTrail": { "description": "The workspace’s row history, newest first, with the audited tables this caller may not read.", "properties": { "countsByTable": { "additionalProperties": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" }, "description": "How many rows this page holds per audited table — counted AFTER both reductions, so it is what the caller can see and not what exists. Tables the caller may not read are absent entirely (see withheldTables) and rows suppressed within a readable table are not counted (see partiallyWithheld). A total that disagrees with a colleague’s is the capability difference, not a discrepancy.", "type": "object" }, "entries": { "items": { "$ref": "#/components/schemas/AuditTrailEntry" }, "type": "array" }, "nextBefore": { "format": "date-time", "nullable": true, "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "partiallyWithheld": { "description": "Tables the caller can read but from which some ROWS are suppressed, with the scope of the suppression in words. Derived from the caller’s capabilities alone, so it says nothing about whether such rows exist. Render alongside withheldTables: together they are the complete account of what this trail is not showing.", "items": { "properties": { "scope": { "description": "Which rows are suppressed, in words. Safe to show a person.", "type": "string" }, "table": { "description": "The audited table, which the caller CAN otherwise read.", "type": "string" } }, "required": [ "table", "scope" ], "type": "object" }, "type": "array" }, "withheldReason": { "description": "Why the listed tables are withheld. Constant text, safe to show a person. Do not render it when withheldTables and partiallyWithheld are both empty.", "type": "string" }, "withheldTables": { "description": "Audited tables this caller may not read, sorted. Derived only from the caller’s own capabilities, with no counts, so it discloses nothing about whether those tables have activity. Render it as \"not visible to your role\" rather than leaving the trail looking continuous.", "items": { "type": "string" }, "type": "array" } }, "required": [ "entries", "nextBefore", "countsByTable", "withheldTables", "withheldReason", "partiallyWithheld" ], "type": "object" }, "AuditTrailEntry": { "properties": { "actor": { "nullable": true, "type": "string" }, "actorName": { "nullable": true, "type": "string" }, "at": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "changed": { "items": { "properties": { "field": { "type": "string" }, "from": {}, "to": {} }, "required": [ "field", "from", "to" ], "type": "object" }, "type": "array" }, "id": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "op": { "enum": [ "INSERT", "UPDATE", "DELETE" ], "type": "string" }, "rowId": { "type": "string" }, "table": { "type": "string" } }, "required": [ "id", "table", "rowId", "op", "actor", "actorName", "at", "changed" ], "type": "object" }, "CallerApprovalRefusal": { "nullable": true, "properties": { "code": { "type": "string" }, "reason": { "type": "string" } }, "required": [ "code", "reason" ], "type": "object" }, "ErrorResponse": { "description": "Error body for any non-2xx response.", "properties": { "code": { "description": "A stable discriminator, where branching on the reason is necessary. One of: replay_same_decision, replay_other_decision, decided_by_another, payload_changed, already_in_state, not_in_required_state, loyalty_identity_strength_unknown, superseded, kind_not_proposable_here, blocked_by_freeze, approval_required, execution_pending, internal_readback_failed, invalid_remedy, license_mismatch, load_equivalency_unknown, load_not_over_cap, manifest_evidence_unknown, person_required, proposal_changed, remedy_does_not_clear_load, shift_start_blocked, stale_packet_evidence, stale_remedy, transport_unconfigured, human_action_required, inactive_person, agent_cannot_approve, license_authority_required, maker_cannot_approve, fulfilment_window_unavailable, outside_delivery_zone, outside_delivery_hours, delivery_location_excluded, purchase_limit_exceeded, verification_required, verification_name_changed, policy_role_required, policy_weakens_default, policy_draft_superseded, policy_draft_closed, policy_unstaffed, policy_not_applicable, promo_inducement_blocked, promo_not_submittable, promo_claim_over_cap, review_maker_unknown, review_check_flagged. Absent, or a value you do not recognise, means show the message. Deliberately a string and not an enum: a generated enum throws on an unknown value, so adding a code would break a pinned client instead of degrading to the message.", "type": "string" }, "error": { "description": "The HTTP reason phrase, e.g. \"Unauthorized\".", "type": "string" }, "message": { "description": "Human-readable reason. Do not parse.", "type": "string" }, "statusCode": { "description": "The HTTP status code, repeated in the body.", "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" } }, "required": [ "statusCode", "message" ], "type": "object" }, "ExecutionAttempt": { "properties": { "attemptNumber": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" }, "detail": { "nullable": true, "type": "string" }, "finishedAt": { "format": "date-time", "nullable": true, "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "httpStatus": { "maximum": 9007199254740991, "minimum": -9007199254740991, "nullable": true, "type": "integer" }, "outcome": { "enum": [ "ok", "error", "indeterminate" ], "type": "string" }, "startedAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "attemptNumber", "outcome", "httpStatus", "detail", "startedAt", "finishedAt" ], "type": "object" }, "LedgerEvent": { "properties": { "balanceAfter": { "nullable": true, "type": "number" }, "costDeltaCents": { "maximum": 9007199254740991, "minimum": -9007199254740991, "nullable": true, "type": "integer" }, "derivationVersion": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" }, "effectiveAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "eventKey": { "type": "string" }, "lateByMs": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" }, "links": { "items": { "properties": { "direction": { "enum": [ "from", "to" ], "type": "string" }, "otherKey": { "type": "string" }, "relation": { "enum": [ "supersedes", "reverses", "split_from", "merged_into", "caused_by_proposal", "true_up_of" ], "type": "string" } }, "required": [ "relation", "otherKey", "direction" ], "type": "object" }, "type": "array" }, "period": { "nullable": true, "properties": { "id": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "startsOn": { "type": "string" }, "status": { "type": "string" } }, "required": [ "id", "status", "startsOn" ], "type": "object" }, "qtyDelta": { "nullable": true, "type": "number" }, "quantity": { "nullable": true, "type": "number" }, "recordedAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "sourceClasses": { "items": { "type": "string" }, "type": "array" }, "sourceObservationIds": { "items": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "type": "array" }, "superseded": { "type": "boolean" }, "type": { "type": "string" } }, "required": [ "eventKey", "type", "quantity", "qtyDelta", "costDeltaCents", "effectiveAt", "recordedAt", "lateByMs", "derivationVersion", "sourceObservationIds", "sourceClasses", "period", "links", "superseded", "balanceAfter" ], "type": "object" }, "LedgerPackage": { "properties": { "events": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" }, "firstSeenAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "itemName": { "nullable": true, "type": "string" }, "lastEventType": { "type": "string" }, "packageType": { "nullable": true, "type": "string" }, "quantity": { "nullable": true, "type": "number" }, "quantityAsOf": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "sourceClasses": { "items": { "type": "string" }, "type": "array" }, "supersededEvents": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" }, "tag": { "type": "string" }, "unit": { "nullable": true, "type": "string" } }, "required": [ "tag", "itemName", "packageType", "unit", "quantity", "quantityAsOf", "lastEventType", "events", "supersededEvents", "firstSeenAt", "sourceClasses" ], "type": "object" }, "LedgerPackageList": { "description": "Packages the ledger holds events for, most recently observed first.", "properties": { "jurisdiction": { "type": "string" }, "licenseId": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "packages": { "items": { "$ref": "#/components/schemas/LedgerPackage" }, "type": "array" }, "total": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" } }, "required": [ "licenseId", "jurisdiction", "total", "packages" ], "type": "object" }, "PackageTimeline": { "description": "One tag’s events in effective order, with lineage links and the running balance.", "properties": { "balance": { "nullable": true, "type": "number" }, "events": { "items": { "$ref": "#/components/schemas/LedgerEvent" }, "type": "array" }, "licenseId": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "tag": { "type": "string" } }, "required": [ "licenseId", "tag", "balance", "events" ], "type": "object" }, "PartiallyWithheld": { "description": "What this list is not showing, and why. Derived from the caller’s capabilities alone, so it says nothing about whether such rows exist. Empty means nothing was filtered. When it is non-empty the counts in the same response are reduced to match, so render it beside them rather than letting a short badge read as \"none\".", "items": { "properties": { "of": { "description": "What is filtered, e.g. \"proposals\".", "type": "string" }, "scope": { "description": "Which rows are suppressed, in words. Constant text, safe to show a person.", "type": "string" } }, "required": [ "of", "scope" ], "type": "object" }, "type": "array" }, "Proposal": { "description": "A proposed write and everything that has happened to it.", "properties": { "agentCheckers": { "description": "Registered service identities among the scoped approval-capable membership pool. They are never eligible people. Classification comes from agent.client.service_identity, never a name or bearer-token class.", "items": { "$ref": "#/components/schemas/ProposalChecker" }, "type": "array" }, "approvalRefusals": { "description": "Append-only refused attempts, most recent 100; no amount or private payload is copied into these events.", "items": { "$ref": "#/components/schemas/ProposalRefusal" }, "type": "array" }, "approvals": { "items": { "$ref": "#/components/schemas/Approval" }, "type": "array" }, "callerApprovalRefusal": { "$ref": "#/components/schemas/CallerApprovalRefusal", "description": "The current server refusal for this caller, or null when the caller may record a fresh decision. Authority and exact payload are checked again on every write." }, "checkerRosterAvailable": { "description": "False when the caller is not authorised to read role assignments; empty lists must not be presented as proof that no checker exists.", "type": "boolean" }, "confidence": { "nullable": true, "type": "number" }, "createdAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "eligibleCheckers": { "description": "Who may still decide THIS proposal: members holding proposal.approve, active and able to sign in, minus the proposer and anyone who has already decided. Empty means nobody can — which is the answer for a closed proposal, and also what a caller who may not see the roster is given. Seeing it requires proposal.approve, membership.manage or tenant.manage: the list is the workspace’s role assignments, so it is a privileged read on a route that otherwise is not. Show it to say who an approval is waiting on; never treat an empty list as \"nobody holds the capability\".", "items": { "properties": { "roles": { "items": { "type": "string" }, "minItems": 1, "type": "array" }, "userId": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } }, "required": [ "userId", "roles" ], "type": "object" }, "type": "array" }, "evidenceSnapshotHash": { "type": "string" }, "execution": { "nullable": true, "properties": { "attempts": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" }, "id": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "state": { "type": "string" }, "verifiedAt": { "format": "date-time", "nullable": true, "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "id", "state", "attempts", "verifiedAt" ], "type": "object" }, "id": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "idempotencyToken": { "type": "string" }, "kind": { "description": "The proposal kind. See ProposalKind for the known vocabulary; historical rows may carry a kind outside it.", "maxLength": 120, "minLength": 1, "type": "string" }, "licenseId": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "payload": { "additionalProperties": {}, "type": "object" }, "payloadHash": { "type": "string" }, "preconditions": { "items": {}, "type": "array" }, "proposedByAgentRun": { "format": "uuid", "nullable": true, "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "proposedByUserId": { "format": "uuid", "nullable": true, "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "reviews": { "items": { "$ref": "#/components/schemas/ProposalReview" }, "type": "array" }, "ruleVersions": { "items": { "type": "string" }, "type": "array" }, "state": { "enum": [ "Proposed", "Reviewed", "Approved", "Revalidating", "Executing", "Executed", "Verified", "Indeterminate", "Superseded", "PartiallyExecuted", "Compensating", "Settled", "Returned", "Rejected" ], "type": "string" }, "target": { "type": "string" }, "updatedAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "id", "licenseId", "kind", "target", "payload", "payloadHash", "evidenceSnapshotHash", "preconditions", "idempotencyToken", "ruleVersions", "proposedByUserId", "proposedByAgentRun", "confidence", "state", "createdAt", "updatedAt", "eligibleCheckers", "agentCheckers", "checkerRosterAvailable", "callerApprovalRefusal", "approvalRefusals", "approvals", "reviews", "execution" ], "type": "object" }, "ProposalChecker": { "properties": { "roles": { "items": { "type": "string" }, "minItems": 1, "type": "array" }, "userId": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } }, "required": [ "userId", "roles" ], "type": "object" }, "ProposalCreateRequest": { "description": "Draft a write for a second person to decide, or immediately apply a supported single-person local safety action (agent_client.consent.revoke, agent.stop_all). No external agent runtime is invoked.", "properties": { "evidenceSnapshotHash": { "maxLength": 200, "minLength": 1, "type": "string" }, "idempotencyToken": { "description": "The caller's token for this draft. A retried POST with the same token returns the proposal already recorded under it, and answers 200 where the first send answered 201 — the status is the signal, and there is no `created` field on the response. The token names the SEND, not the bytes: if the payload differs from the one first sent under this token the recorded proposal is still returned and the new bytes are IGNORED, not refused — a 409 here would hard-fail an offline outbox on the one send it is replaying. Read payload and payloadHash off the response rather than assuming they are what you sent, and use a new token for a changed payload. Canonical integration and legal-hold drafts (connection.consent.send, data_use.kill_switch.set vault.legal_hold.lift and loyalty.program.*) require the same maker, licence, kind, target and payload on replay; a different binding is refused. Agent safety actions (agent_client.consent.revoke and agent.stop_all) also bind evidence, preconditions and rule versions exactly, apply immediately on create, and recover the original Verified receipt on an exact authenticated replay.", "maxLength": 200, "minLength": 1, "pattern": "^(?!journal:)[^\\u0000]*(?![\\s\\S])", "type": "string" }, "kind": { "$ref": "#/components/schemas/ProposalKind" }, "licenseId": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "payload": { "additionalProperties": {}, "type": "object" }, "preconditions": { "items": {}, "type": "array" }, "ruleVersions": { "items": { "type": "string" }, "type": "array" }, "target": { "maxLength": 60, "minLength": 1, "type": "string" } }, "required": [ "licenseId", "kind", "target", "payload", "evidenceSnapshotHash", "idempotencyToken" ], "type": "object" }, "ProposalKind": { "description": "Every kind a proposal may have, grouped by what approving one DOES. metrc.* writes to the state system and must then be executed with POST /proposals/{id}/execute (see ExecutableProposalKind; metrc.package.adjust and metrc.package.finish have an execution path, and execute answers 409 naming the kind for destroy and return). metrc.package.finish is minted only by POST /sales-recon/package-finish (POST /proposals answers 400 kind_not_proposable_here). transfer.receive is a person accepting an inbound package, and is internal. money.* is a general-ledger write and is NOT proposable here: POST /proposals answers 400 kind_not_proposable_here, because the payload must be resolved by POST /money/journals. billing.* and tenant.export are dual-controlled account actions. data_use.kill_switch.set turns a data-use kill switch OFF (payload {level, target, on: false}); approving it applies the change at once, and the proposer must hold tenant.manage. count.*, task.* and evidence.* are the offline outbox kinds (see OutboxProposalKind): they have no execution path, so approving one records the decision and nothing leaves the platform. agent_client.consent.revoke and agent.stop_all are single-person local safety actions: prepare exact platform {clientId,reason} or {reason} payloads, then create immediately applies the local record and returns a Verified immutable review receipt. No external credential or runtime action is claimed. agent_tool.access.set, agent_registry.publish and agent_client.scope.set require canonical preparation and two distinct current qualified people; approval applies only typed local configuration, independently reads it back and returns Verified with an immutable receipt. agent_calls.export requires an actual registered typed call producer, actual licence scope and bounded source preparation; two distinct current human proposal holders approve immutable local Postgres bytes with an actual audit witness and Verified receipt. Phase 1 has no producer and preparation returns SOURCE_UNAVAILABLE; legacy unbound calls are excluded and coverage remains unknown. The P3 wallet, treasury, trip remedy, packet exception, manifest and shift-float kinds have an explicit execute stage (ExecutableProposalKind). Current authoritative source evidence and scoped human approval are required; missing canonical sources or transport refuse before an attempt. A valid kind alone never means an operation is ready or completed. This is the vocabulary a client may SEND; a proposal READ back may carry a kind outside it, because historical rows stay readable.", "enum": [ "menu.publish", "order.match.pick", "order.mark_orphan", "order.hand_over", "channel.retry", "channel.conflict.resolve", "storefront.required_text.apply", "menu.thresholds.tighten", "storefront.theme.publish", "metrc.package.adjust", "metrc.package.finish", "metrc.package.destroy", "metrc.package.return", "transfer.receive", "money.journal.post", "money.journal.reverse", "billing.ach.retry", "billing.payment_method.change", "billing.plan.change", "tenant.export", "data_use.kill_switch.set", "connection.consent.send", "vault.legal_hold.lift", "loyalty.program.publish", "loyalty.program.pause", "loyalty.accounting.method", "loyalty.interlicense.policy", "cash.count.review", "loyalty.points.adjust", "loyalty.members.export", "loyalty.product_source.certify", "loyalty.product_source.revoke", "loyalty.recipient_source.certify", "loyalty.recipient_source.revoke", "campaign.copy.accept", "campaign.schedule", "wallet.break.close", "wallet.limit.raise", "wallet.fees.publish", "wallet.unfreeze", "treasury.transfer.net", "trip.split", "trip.order.move", "packet.seal.exception", "manifest.push", "shift.float.issue", "price.change", "promo.rule.change", "promo.budget.recommend", "price.floor.configure", "promo.agreement.approve", "promo.claim.approve", "count.submit", "count.line.record", "task.rule.decide", "evidence.attach", "agent_tool.access.set", "agent_registry.publish", "agent_client.consent.revoke", "agent_client.scope.set", "agent.stop_all", "agent_calls.export" ], "type": "string" }, "ProposalList": { "properties": { "counts": { "additionalProperties": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" }, "description": "Every proposal in the workspace by state, for the queue's badges — REDUCED by the same money filter as `proposals`, so a caller with no money capability sees badges that exclude money and billing kinds. partiallyWithheld says so; do not render a short badge as “none”. A `/** */` comment here does not reach the published document; only .describe() does.", "type": "object" }, "nextBefore": { "format": "date-time", "nullable": true, "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "partiallyWithheld": { "$ref": "#/components/schemas/PartiallyWithheld" }, "proposals": { "items": { "$ref": "#/components/schemas/Proposal" }, "type": "array" } }, "required": [ "proposals", "nextBefore", "counts", "partiallyWithheld" ], "type": "object" }, "ProposalRefusal": { "properties": { "action": { "enum": [ "approve", "reject", "send_back", "execute" ], "type": "string" }, "actorId": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "at": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "code": { "type": "string" }, "id": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "reason": { "type": "string" } }, "required": [ "id", "actorId", "action", "code", "reason", "at" ], "type": "object" }, "ProposalReview": { "properties": { "action": { "enum": [ "send_back", "comment" ], "type": "string" }, "createdAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "id": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "note": { "type": "string" }, "payloadHashAtReview": { "type": "string" }, "reviewerId": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } }, "required": [ "id", "reviewerId", "action", "note", "payloadHashAtReview", "createdAt" ], "type": "object" }, "ReadBack": { "description": "What actually happened outside: the execution, its attempts, and the read-backs that prove it.", "properties": { "agentCheckers": { "items": { "$ref": "#/components/schemas/ProposalChecker" }, "type": "array" }, "approvalRefusals": { "items": { "$ref": "#/components/schemas/ProposalRefusal" }, "type": "array" }, "approvals": { "items": { "$ref": "#/components/schemas/Approval" }, "type": "array" }, "callerApprovalRefusal": { "$ref": "#/components/schemas/CallerApprovalRefusal" }, "checkerRosterAvailable": { "type": "boolean" }, "eligibleCheckers": { "items": { "$ref": "#/components/schemas/ProposalChecker" }, "type": "array" }, "execution": { "description": "Null when nothing has been executed yet.", "nullable": true, "properties": { "attempts": { "maximum": 9007199254740991, "minimum": -9007199254740991, "type": "integer" }, "externalRef": { "nullable": true, "type": "string" }, "id": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "lastAttempt": { "allOf": [ { "$ref": "#/components/schemas/ExecutionAttempt" } ], "nullable": true }, "retryBlocked": { "type": "boolean" }, "startedAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "state": { "type": "string" }, "updatedAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "verifications": { "items": { "$ref": "#/components/schemas/Verification" }, "type": "array" }, "verifiedAt": { "format": "date-time", "nullable": true, "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" } }, "required": [ "id", "state", "attempts", "externalRef", "verifiedAt", "startedAt", "updatedAt", "lastAttempt", "verifications", "retryBlocked" ], "type": "object" }, "payloadHash": { "type": "string" }, "proposalId": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "proposalState": { "enum": [ "Proposed", "Reviewed", "Approved", "Revalidating", "Executing", "Executed", "Verified", "Indeterminate", "Superseded", "PartiallyExecuted", "Compensating", "Settled", "Returned", "Rejected" ], "type": "string" }, "proposedByAgentRun": { "format": "uuid", "nullable": true, "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "proposedByUserId": { "format": "uuid", "nullable": true, "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } }, "required": [ "proposalId", "proposalState", "proposedByUserId", "proposedByAgentRun", "payloadHash", "eligibleCheckers", "agentCheckers", "checkerRosterAvailable", "callerApprovalRefusal", "approvalRefusals", "approvals", "execution" ], "type": "object" }, "Verification": { "properties": { "checkSpec": { "additionalProperties": {}, "type": "object" }, "id": { "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" }, "observed": { "additionalProperties": {}, "type": "object" }, "observedAt": { "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$", "type": "string" }, "passed": { "type": "boolean" } }, "required": [ "id", "passed", "observedAt", "checkSpec", "observed" ], "type": "object" } }, "securitySchemes": { "sessionCookie": { "description": "Browser session cookie set by Ory Kratos at sign-in.", "in": "cookie", "name": "ory_kratos_session", "type": "apiKey" }, "sessionToken": { "description": "Ory Kratos session token, for installed apps.", "scheme": "bearer", "type": "http" } } } }