# Auth host HTTP API Source: [OpenAPI description](https://github.com/Cotal-AI/Cotal/blob/main/implementations/auth/host.openapi.json). Host-only HTTP operations of the stock auth service. These six routes exist only on the loopback listener and return 404 on the public listener. The owner-private auth-service discovery record supplies its port and exchange capability. Every operation requires the exact Authorization bearer capability, application/json and no Origin header. Requests match the exact target, so query strings and trailing slashes return 404. Bodies default to 65536 bytes. More than 30 invalid capability attempts in a rolling minute receive 429. The loopback listener also serves /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /service-endpoint-authority, /service-endpoint-host and /chat-session/open, /chat-session/bearer, /chat-session/retire. Their public request and response shapes are in the [Auth HTTP API](https://docs.cotal.ai/api/auth/). Proof operations additionally require the loopback capability. The loopback /health handler also accepts other methods. Elevated exchange views and operator host operations are loopback-only. Mesh discovery is public-listener-only. This implementation reference does not establish a stable cloud API. ## Reading the contract The [interactive reference](https://docs.cotal.ai/api/auth-host/) and [downloadable OpenAPI specification](https://docs.cotal.ai/auth-host.openapi.json) describe the same operations. Schema references in the sections below resolve inside the downloadable specification. See [API reference](/api-reference/api-reference/) for the other integration interfaces. ## Retire an interactive lifecycle ```http POST /interactive-lifecycle/retire ``` Retire one exact interactive actor lifecycle before rotating or deleting its grant. Unknown actors return 404 and a mismatched current lifecycle returns 409. Refusals before the retirement barrier begins carry outcome not-executed. A later failure without an outcome must be treated as unknown. ### Parameters No operation parameters. ### Request body The request uses the schema below. Required: yes. Content type: `application/json`. ```json { "$ref": "#/components/schemas/LifecycleTarget" } ``` ### Responses #### HTTP 200 The host decision completed. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Retirement" } ``` #### HTTP 400 Malformed JSON or invalid request fields. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 401 Missing or invalid loopback capability. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 403 An Origin header or failed authority/proof check is refused. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 404 The actor is not granted. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 405 Only POST is accepted. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 409 The requested lifecycle is not current. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 413 Request exceeds the 65536-byte body limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 415 Content-Type must be application/json. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 429 Invalid-capability attempts exceeded the rolling-minute limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP default A native refusal uses its HTTP status and may include code and outcome. Unexpected failures use the handler error classification. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` ## Activate a managed lifecycle ```http POST /managed-lifecycle/activate ``` Activate the exact host-issued lifecycle UID. accountPublicKey must name this authority or the request returns 403 before mutation. Native already-exists is 409. Native refusals preserve code, outcome and optional details. An unexpected failure returns 500 with outcome unknown. ### Parameters No operation parameters. ### Request body The request uses the schema below. Required: yes. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Activation" } ``` ### Responses #### HTTP 200 The host decision completed. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Activated" } ``` #### HTTP 400 Malformed JSON or invalid request fields. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 401 Missing or invalid loopback capability. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 403 An Origin header or failed authority/proof check is refused. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 405 Only POST is accepted. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 409 The lifecycle already exists or a native conflict was refused. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 413 Request exceeds the 65536-byte body limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 415 Content-Type must be application/json. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 429 Invalid-capability attempts exceeded the rolling-minute limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 500 Unexpected activation failure; outcome is unknown. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP default Native authority refusal classified by its error code. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` ## Retire a managed lifecycle ```http POST /managed-lifecycle/retire ``` Complete terminal retirement of an exact managed lifecycle after its grant was revoked. This host recovery door is used when the responsible remote manager is gone. ### Parameters No operation parameters. ### Request body The request uses the schema below. Required: yes. Content type: `application/json`. ```json { "$ref": "#/components/schemas/LifecycleTarget" } ``` ### Responses #### HTTP 200 The host decision completed. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Retirement" } ``` #### HTTP 400 Malformed JSON or invalid request fields. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 401 Missing or invalid loopback capability. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 403 An Origin header or failed authority/proof check is refused. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 405 Only POST is accepted. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 409 Native retirement conflict. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 413 Request exceeds the 65536-byte body limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 415 Content-Type must be application/json. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 429 Invalid-capability attempts exceeded the rolling-minute limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 500 Unexpected retirement failure. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` ## Verify a managed agent host decision ```http POST /manager-service-authority/verify-enrollment ``` Verify enrollment, retirement preparation, runtime creation or runtime status. Forward the participant request verbatim. The host derives the interactive actor scope from its own ledger; the caller cannot supply scope. ### Parameters No operation parameters. ### Request body The request uses the schema below. Required: yes. Content type: `application/json`. ```json { "type": "object", "properties": { "owner": { "type": "string", "pattern": "^u_[a-z2-7]{26}$" }, "request": { "$ref": "#/components/schemas/ManagedDecisionRequest" } }, "required": [ "owner", "request" ], "additionalProperties": false } ``` ### Responses #### HTTP 200 The host decision completed. Content type: `application/json`. ```json { "oneOf": [ { "type": "object", "properties": { "authorized": { "const": true }, "owner": { "type": "string", "pattern": "^u_[a-z2-7]{26}$" }, "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "instanceId": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "serveEpoch": { "type": "integer" } }, "required": [ "authorized", "owner", "actor", "instanceId", "serveEpoch" ] }, { "type": "object", "properties": { "authorized": { "const": true }, "v": { "const": 1 }, "kind": { "type": "string", "enum": [ "manager-managed-agent-runtime-create", "manager-managed-agent-runtime-status" ] }, "space": { "type": "string" }, "owner": { "type": "string", "pattern": "^u_[a-z2-7]{26}$" }, "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "instanceId": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "managerLifecycleUid": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "requestId": { "type": "string" }, "target": { "$ref": "#/components/schemas/LifecycleTarget" }, "state": { "type": "string", "enum": [ "reserved", "creating", "bound", "create-unknown", "closing", "closed" ] }, "readiness": { "type": "string", "enum": [ "ready", "bound-not-ready", "none" ] }, "retirementPhase": { "type": "string", "enum": [ "intent", "released", "retired", "deprovisioned", "terminal" ] } }, "required": [ "authorized", "v", "kind", "space", "owner", "actor", "instanceId", "managerLifecycleUid", "requestId", "target", "state", "readiness" ] } ] } ``` #### HTTP 400 Malformed JSON or invalid request fields. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 401 Missing or invalid loopback capability. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 403 An Origin header or failed authority/proof check is refused. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 405 Only POST is accepted. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 409 Native conflict. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 412 Native failed precondition. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 413 Request exceeds the 65536-byte body limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 415 Content-Type must be application/json. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 429 Invalid-capability attempts exceeded the rolling-minute limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` ## Verify a fresh human proof ```http POST /tool-result-human-proof/verify ``` Verify a signed password proof no older than five minutes against the authenticated session subject. The verified subject must equal subject. The owner is derived from the verified IdP proof; it is not accepted from the body. ### Parameters No operation parameters. ### Request body The request uses the schema below. Required: yes. Content type: `application/json`. ```json { "type": "object", "properties": { "idpToken": { "type": "string", "minLength": 1 }, "subject": { "type": "string", "minLength": 1 } }, "required": [ "idpToken", "subject" ], "additionalProperties": false } ``` ### Responses #### HTTP 200 The host decision completed. Content type: `application/json`. ```json { "type": "object", "properties": { "authorized": { "const": true }, "owner": { "type": "string", "pattern": "^u_[a-z2-7]{26}$" }, "sub": { "type": "string" }, "exp": { "type": "integer" }, "authTime": { "type": "integer" } }, "required": [ "authorized", "owner", "sub", "exp", "authTime" ] } ``` #### HTTP 400 Malformed JSON or invalid request fields. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 401 Missing or invalid loopback capability. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 403 An Origin header or failed authority/proof check is refused. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 405 Only POST is accepted. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 413 Request exceeds the 65536-byte body limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 415 Content-Type must be application/json. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 429 Invalid-capability attempts exceeded the rolling-minute limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` ## Issue tool result consent ```http POST /tool-result-consent/issue ``` Issue signed consent for the exact holder and target after verifying a fresh human proof. This route never returns private result content. ttlMs is bounded to 24 hours. Source parser and contract are packages/core/src/private-tool-results.ts and implementations/auth/src/tool-result-consent.ts. ### Parameters No operation parameters. ### Request body The request uses the schema below. Required: yes. Content type: `application/json`. ```json { "$ref": "#/components/schemas/ConsentRequest" } ``` ### Responses #### HTTP 200 The host decision completed. `Cache-Control`: Consent responses are not cached. Content type: `application/json`. ```json { "type": "object", "properties": { "consent": { "$ref": "#/components/schemas/Consent" } }, "required": [ "consent" ], "additionalProperties": false } ``` #### HTTP 400 Malformed input or any request-body read failure, including a body over 65536 bytes. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 401 Missing or invalid loopback capability. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 403 An Origin header or failed authority/proof check is refused. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 405 Only POST is accepted. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 409 The consent ID is already recorded. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 415 Content-Type must be application/json. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 429 Invalid-capability attempts exceeded the rolling-minute limit. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` #### HTTP 503 Consent signer is unavailable or issuance outcome is unknown. Content type: `application/json`. ```json { "$ref": "#/components/schemas/Error" } ``` ## Schemas These schemas describe the HTTP request and response wrappers. The downloadable specification includes the referenced definitions. ### Error ```json { "type": "object", "properties": { "error": { "type": "string" }, "code": { "type": "string" }, "outcome": { "type": "string", "enum": [ "not-executed", "executed", "unknown" ] }, "details": {} }, "required": [ "error" ] } ``` ### LifecycleTarget ```json { "type": "object", "properties": { "owner": { "type": "string", "pattern": "^u_[a-z2-7]{26}$" }, "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "lifecycleUid": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" } }, "required": [ "owner", "actor", "lifecycleUid" ], "additionalProperties": false } ``` ### Retirement ```json { "type": "object", "properties": { "retired": { "type": "boolean" }, "lifecycleUid": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "notStarted": { "type": "boolean" }, "alreadyRetired": { "type": "boolean" } }, "required": [ "retired", "lifecycleUid" ] } ``` ### Activation ```json { "type": "object", "properties": { "accountPublicKey": { "type": "string", "description": "Assigned account authority public key." }, "owner": { "type": "string", "pattern": "^u_[a-z2-7]{26}$" }, "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "lifecycleUid": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" } }, "required": [ "accountPublicKey", "owner", "actor", "lifecycleUid" ], "additionalProperties": false } ``` ### Activated ```json { "type": "object", "properties": { "accountPublicKey": { "type": "string", "description": "Assigned account authority public key." }, "owner": { "type": "string", "pattern": "^u_[a-z2-7]{26}$" }, "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "lifecycleUid": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "activated": { "const": true } }, "required": [ "accountPublicKey", "owner", "actor", "lifecycleUid", "activated" ], "additionalProperties": false } ``` ### ManagedDecisionRequest ```json { "oneOf": [ { "type": "object", "properties": { "v": { "const": 1 }, "kind": { "const": "manager-managed-agent-enrollment" }, "space": { "type": "string" }, "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "instanceId": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "managerLifecycleUid": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "requestId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{22,64}$" }, "registrationProof": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "serveEpoch": { "type": "integer", "minimum": 0 }, "target": { "type": "object", "properties": { "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "tokenHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "role": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" }, "label": { "type": "string", "minLength": 1, "maxLength": 256 }, "capabilities": { "type": "array", "items": { "type": "string", "minLength": 1 }, "maxItems": 64 }, "subscribe": { "type": "array", "items": { "type": "string", "minLength": 1 }, "maxItems": 64 }, "allowSubscribe": { "type": "array", "items": { "type": "string", "minLength": 1 }, "maxItems": 64 }, "allowPublish": { "type": "array", "items": { "type": "string", "minLength": 1 }, "maxItems": 64 } }, "required": [ "actor", "tokenHash" ], "additionalProperties": false }, "identities": { "type": "object", "properties": { "supervisor": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "executor": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "serve": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "goalWriter": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "sessionLedger": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false } }, "required": [ "supervisor", "executor", "serve", "goalWriter", "sessionLedger" ], "additionalProperties": false } }, "required": [ "v", "kind", "space", "actor", "instanceId", "managerLifecycleUid", "requestId", "registrationProof", "serveEpoch", "target", "identities" ], "additionalProperties": false }, { "type": "object", "properties": { "v": { "const": 1 }, "kind": { "const": "manager-managed-agent-prepare-retirement" }, "space": { "type": "string" }, "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "instanceId": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "managerLifecycleUid": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "requestId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{22,64}$" }, "registrationProof": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "serveEpoch": { "type": "integer", "minimum": 0 }, "target": { "$ref": "#/components/schemas/LifecycleTarget" }, "identities": { "type": "object", "properties": { "supervisor": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "executor": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "serve": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "goalWriter": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "sessionLedger": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false } }, "required": [ "supervisor", "executor", "serve", "goalWriter", "sessionLedger" ], "additionalProperties": false }, "opId": { "type": "string" } }, "required": [ "v", "kind", "space", "actor", "instanceId", "managerLifecycleUid", "requestId", "registrationProof", "serveEpoch", "target", "identities", "opId" ], "additionalProperties": false }, { "type": "object", "properties": { "v": { "const": 1 }, "kind": { "const": "manager-managed-agent-runtime-create" }, "space": { "type": "string" }, "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "instanceId": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "managerLifecycleUid": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "requestId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{22,64}$" }, "registrationProof": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "serveEpoch": { "type": "integer", "minimum": 0 }, "target": { "$ref": "#/components/schemas/LifecycleTarget" }, "identities": { "type": "object", "properties": { "supervisor": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "executor": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "serve": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "goalWriter": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "sessionLedger": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false } }, "required": [ "supervisor", "executor", "serve", "goalWriter", "sessionLedger" ], "additionalProperties": false } }, "required": [ "v", "kind", "space", "actor", "instanceId", "managerLifecycleUid", "requestId", "registrationProof", "serveEpoch", "target", "identities" ], "additionalProperties": false }, { "type": "object", "properties": { "v": { "const": 1 }, "kind": { "const": "manager-managed-agent-runtime-status" }, "space": { "type": "string" }, "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "instanceId": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "managerLifecycleUid": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" }, "requestId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{22,64}$" }, "registrationProof": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "serveEpoch": { "type": "integer", "minimum": 0 }, "target": { "$ref": "#/components/schemas/LifecycleTarget" }, "identities": { "type": "object", "properties": { "supervisor": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "executor": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "serve": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "goalWriter": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false }, "sessionLedger": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^U[A-Z2-7]{55}$" } }, "required": [ "id" ], "additionalProperties": false } }, "required": [ "supervisor", "executor", "serve", "goalWriter", "sessionLedger" ], "additionalProperties": false } }, "required": [ "v", "kind", "space", "actor", "instanceId", "managerLifecycleUid", "requestId", "registrationProof", "serveEpoch", "target", "identities" ], "additionalProperties": false } ], "description": "Native requests from packages/core/src/remote-manager-authority.ts. Forward verbatim; the host derives caller scope from its ledger." } ``` ### ConsentRequest ```json { "type": "object", "properties": { "id": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,200}$" }, "idpToken": { "type": "string", "minLength": 1, "maxLength": 16384 }, "subject": { "type": "string", "minLength": 1, "maxLength": 512 }, "accountPublicKey": { "type": "string" }, "holder": { "type": "object", "properties": { "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 }, "lifecycleUid": { "type": "string", "pattern": "^[a-z0-9]{26,32}$" } }, "required": [ "actor", "lifecycleUid" ], "additionalProperties": false }, "target": { "$ref": "#/components/schemas/LifecycleTarget" }, "ttlMs": { "type": "integer", "minimum": 1, "maximum": 86400000 } }, "required": [ "id", "idpToken", "subject", "accountPublicKey", "holder", "target", "ttlMs" ], "additionalProperties": false } ``` ### Consent ```json { "type": "object", "properties": { "v": { "const": 1 }, "kind": { "const": "tool-result-consent" }, "id": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,200}$" }, "space": { "type": "string" }, "target": { "$ref": "#/components/schemas/LifecycleTarget" }, "holder": { "type": "object", "properties": { "owner": { "type": "string", "pattern": "^u_[a-z2-7]{26}$" }, "actor": { "type": "string", "pattern": "^[A-Za-z0-9_]+$", "minLength": 1 } }, "required": [ "owner", "actor" ], "additionalProperties": false }, "iat": { "type": "integer", "minimum": 0 }, "exp": { "type": "integer", "minimum": 0 }, "issuer": { "type": "object", "properties": { "keyId": { "type": "string" } }, "required": [ "keyId" ], "additionalProperties": false }, "sig": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" } }, "required": [ "v", "kind", "id", "space", "target", "holder", "iat", "exp", "issuer", "sig" ], "additionalProperties": false } ```