Generated file — do not edit by hand. Produced by tooling/gen-graphql-ref.py from the OSYRA edge GraphQL SDL.

Enums

87 enum(s).

ActivityOutcome

Recent-activity GraphQL schema — Edge-owned dashboard activity feed.

Unlike the auditEvents query (audit.graphql), which is a fail-closed OSY-AUDIT-NOT-WIRED projection of the unbuilt AP00005-audit service, this surface returns REAL events the Edge gateway actually observed and persisted itself into the Redis-backed capped recent-activity store (internal/activity). No new service is created; the events are the authenticated requests the audit middleware already sees, written to the Redis instance the Edge already owns.

NO STUBS / NO FABRICATED DATA: only genuinely-observed events are returned. Before any traffic, recentActivity returns an empty list — the honest result.

Scope: the workspace is derived from the caller's JWT (workspace_id claim), NEVER from input — identical defense-in-depth posture to costSavings (broker.graphql SEC-H1) and auditEvents. A token lacking workspace_id is rejected with OSY-VALID-4001. Outcome of an observed activity event. Lowercase wire values so the frontend can key a badge variant off the literal string (matches the AuditStatus lowercase-enum convention in audit.graphql).

| Value | Description | | --- | --- | | failure | | | success | |

AgentSandboxStatus

Execution-plane isolation-instance status.

| Value | Description | | --- | --- | | ABSENT | | | READY | | | RUNNING | | | TERMINATED | | | UNSPECIFIED | |

AgentSessionState

Harness-side session lifecycle state.

| Value | Description | | --- | --- | | CREATED | | | DRAINING | | | HALTED | | | PAUSED | | | RUNNING | | | UNSPECIFIED | |

ApiKeyBulkRevokeScope

| Value | Description | | --- | --- | | ORGANIZATION | | | OWNER | | | WORKSPACE | |

ApiKeyInventoryView

Explicit inventory selection. MY_KEYS is the safe default; WORKSPACE_KEYS never activates implicitly from a permission claim.

| Value | Description | | --- | --- | | MY_KEYS | | | WORKSPACE_KEYS | |

ApiKeyScope

API Keys schema (ENG-615)

Developer-facing keys: SANDBOX (24h lifetime, rolling 100 requests/24h, single-active-per-user) + TEST + LIVE (production keys). Plaintext is exposed exactly once on createApiKey / rotateApiKey responses; no read path leaks plaintext.

| Value | Description | | --- | --- | | LIVE | | | SANDBOX | | | TEST | |

AttestedLogPayloadKind

Attested-Log GraphQL Schema (AP00012 osyrastream osyra-attlog-v1 projection) — ENG-2518

Customer-facing read surface for the FORENSIC attested-log viewer: the ordered, gap-free, signature-chained sequence of osyra-attlog-v1 ATTESTED-LOG records for one agent stream, projected from AP00012 osyrastream's durable WORM cold archive (read via attlog.ReadStream). This is the console "attested log" / forensic-replay view — a bounded, newest-first list of attested-log records, each carrying the canonical SIGNED wire bytes so a consumer can re-verify OFFLINE.

Distinct from the drift trajectory (drift.graphql): that projects osyra-drift-v1 BARs (a DIFFERENT wire format + a DIFFERENT MMR). The attested log is the osyra-attlog-v1 record stream over the GetAttlogTrajectory RPC (ENG-2512 — the AP00012 source this resolver proxies, unblocking the ENG-2440 frontend viewer).

"Real-time" = the frontend POLLS this query (AP00012 has NO push/subscribe RPC for the attested log by design). The edge resolver collects AP00012's GetAttlogTrajectory server-stream into a bounded slice (≤ MaxTrajectoryItems) per call.

─────────────────────────────────────────────────────────────────────── Source-of-truth / WIRE-TRUTH: encodedRecord is the canonical signed CBOR wire (the osyra-attlog-v1 record). It is AUTHORITATIVE — the consumer (FE viewer) re-verifies the per-record Ed25519 signature + the gap-free causal-chain OFFLINE from it. The decoded scalar fields below (version / agentDid / seq / timestamp / payloadKind / recordHash / prevRecordHash) are decoded VIEWS for routing and display WITHOUT re-encoding; on any discrepancy the encodedRecord is canonical.

The MMR / causal-chain proof is exposed via the record's chain-link values, NOT a separate inclusion-proof blob: AP00012's AttlogRecordItem carries recordHash (SHA-256 over the canonical UNSIGNED body — the per-tenant record-MMR LEAF value AND the causal-chain link), prevRecordHash (the predecessor's recordHash — a successor's prevRecordHash equals its predecessor's recordHash; genesis is 32 zero bytes) and seq (the per-(tenant,stream) gap-free monotonic sequence). A consumer reconstructs the tamper-evident hash-chain from these. AP00012 itself verifies the gap-free causal-ordering chain + each record's signature while streaming; a tamper/gap verdict is surfaced as a TERMINAL error AFTER the (verified-as-far-as-possible) records — the edge propagates that verdict rather than returning a partial-success result.

─────────────────────────────────────────────────────────────────────── Tenant isolation (load-bearing): tenant is ALWAYS derived from the JWT (org-scoped tenant), NEVER from query input — defense-in-depth per ENG-777 SEC-H1; mirrors drift (drift.graphql), receipts, verifiedMemoryReceipts. AP00012 additionally enforces tenant scoping server-side: authorization is the OS-Tenant-Id ingress identity (§8.1.1 confused-deputy defense); a non-empty request tenant_id that disagrees with the authenticated tenant is OSY-DRIFT-6233. workspace is also derived from the JWT and propagated as scope metadata (defense in depth).

─────────────────────────────────────────────────────────────────────── Until OSYRASTREAM_SERVICE_ADDR is configured the resolver returns OSY-ATTLOG-NOT-WIRED via UnwiredAttestedLogService (fail-closed; NO STUBS) — same unwired-surface contract as OSY-DRIFT-NOT-WIRED / OSY-VIR-NOT-WIRED. ───────────────────────────────────────────────────────────────────── Node shapes ───────────────────────────────────────────────────────────────────── The payload-confidentiality kind of an attested-log record. Mirrors the osyra-attlog-v1 uint8 wire kind (0 = CLEARTEXT, 1 = SEALED), surfaced as a neutral enum.

| Value | Description | | --- | --- | | CLEARTEXT | The record body is recorded in the clear. | | SEALED | The record body is sealed (encrypted) per-record; payloadKeyId carries the per-record key handle. | | UNKNOWN | A forward-compat value the edge could not map to a known kind. The authoritative wire kind is in encodedRecord; NEVER fabricated. |

AuditCategory

GCP-Cloud-Audit-Logs taxonomy spine (ADR-122 envelope category). Lowercase wire values; the frontend keys its category badge map off these literals.

| Value | Description | | --- | --- | | admin_activity | | | data_read | IAM/policy/broker config + permission changes | | data_write | OME memory retrieval; broker route reads | | policy_denied | autonomous agent actions; system-initiated jobs | | system_event | OME claim emit / tombstone; billing writes | | unspecified | edge/OPA denials; blocked-by-policy |

AuditOutcome

Operation outcome (ADR-122 envelope outcome). Lowercase wire values; the frontend keys its outcome badge variant off these literals.

| Value | Description | | --- | --- | | denied | | | error | | | failure | | | success | | | unspecified | |

BillingInterval

| Value | Description | | --- | --- | | MONTHLY | | | YEARLY | |

BillingSubscriptionStatus

| Value | Description | | --- | --- | | ACTIVE | | | CANCELED | | | INCOMPLETE | | | INCOMPLETE_EXPIRED | ENG-2973: previously ABSENT from this enum, so billing's real INCOMPLETE_EXPIRED status fell through subscriptionStatusToModel's default and surfaced as ACTIVE — a paid-looking state for a subscription whose initial payment permanently failed. | | PAST_DUE | | | PAUSED | Stripe paused (trial ended with no payment method / pause_collection). A non-billing, NON-granting state. Modeled explicitly so a paused subscription is never misreported as ACTIVE. | | TRIALING | | | UNKNOWN | Fail-closed sentinel: billing reported a status the edge does not recognize. subscriptionStatusToModel maps the unknown -> UNKNOWN rather than ACTIVE, so an unrecognized upstream status can never present to clients as a healthy paid sub. | | UNPAID | |

BudgetMode

Budget enforcement mode (design §6.2 enum BudgetMode). SOFT records-and-allows (track only); HARD fail-closes at the ceiling (OSY-RATE-2015) on the money path.

| Value | Description | | --- | --- | | HARD | | | SOFT | |

BudgetPeriod

| Value | Description | | --- | --- | | DAILY | | | MONTHLY | | | WEEKLY | |

BudgetScope

FinOps GraphQL schema (ENG-2924 / parent ENG-2676).

The external BFF projection of the AP00003 billing FinOps surface (design docs/architecture/AP00003-BUDGETS-SPEND-LIMITS-FINOPS-DESIGN.md §6.2 + ADR-342). Fronts the GetCostBreakdown / ListBudgets / GetBudget / CreateBudget / UpdateBudget / DeleteBudget gRPC RPCs.

MONEY DISCIPLINE (design §6 + ENG-1741): every USD figure is DATA sourced from the backend and crosses the wire as an EXACT integer-cents STRING (usdCeilingCents / committedCents / reservedCents / costCents) to preserve bigint precision — the console only unit-converts (cents → dollars) for display and NEVER computes or invents a figure. The backend authoritative unit is micro-cents (1 USD = 100_000_000); the edge projects micro-cents → cents (÷1_000_000) for the human surface. utilizationPct is derived at the edge from committed+reserved / ceiling (design §5(d): no float on any persisted money row).

Tenancy: org (and, for scoped reads, workspace) is ALWAYS derived from the JWT server-side (design §6.2 "workspace/org from JWT — never args"); AP00003 additionally IDOR-validates + BILLING_ROLES-gates every RPC (defense-in-depth).

NO STUBS / fail-closed: an unpriceable window returns costStatus = COST_UNAVAILABLE with NO rows (never a fabricated 0); an unwired edge returns OSY-FINOPS-NOT-WIRED — never a fabricated budget, cost row, or utilization. Budget scope granularity (design §6.2 enum BudgetScope). API_KEY is designed but gated on virtual-keys (ARC-94) backend-side.

| Value | Description | | --- | --- | | API_KEY | | | ORG | | | PROVIDER | | | WORKSPACE | |

CascadeLevel

Policy Authoring GraphQL Schema (AP00019 policy-compute) — ENG-1720 (FOLD-4)

Customer-facing HIGH-PRIVILEGE authoring surface for Policy-as-Code: author, validate, compile, publish, roll back, and dry-run org / workspace policy bundles. Projects AP00019 policy-compute's 10 authoring RPCs.

─────────────────────────────────────────────────────────────────────── SCOPE DERIVATION (load-bearing security invariant): The cascade SCOPE-ID is ALWAYS derived from the JWT session, NEVER from query/mutation input — defense-in-depth (mirrors receipts / driftTrajectory / verifiedMemoryReceipts). The ScopeInput exposes ONLY the cascade LEVEL (org | workspace); the resolver fills the scope id from the JWT:

• ORG → uc.OrgID
• WORKSPACE → uc.WorkspaceID There is intentionally NO scopeId input field. A caller cannot author into another org/workspace even by guessing identifiers.

PLATFORM EXCLUSION (load-bearing): The CascadeLevel enum exposes ONLY ORG and WORKSPACE — PLATFORM is UNREPRESENTABLE in this schema. Platform authoring / publish is governed by ADR-075's KMS N-of-M publish quorum, NOT by this console UI. The edge never sets os-platform-authority or os-approver-principal (the gRPC client type cannot even carry them). A request that somehow targets platform is rejected with OSY-POLICY-3001 server-side at the resolver.

ROLE-GATING (V1 scope-cut, enforced in the resolver):

• Read ops (getPolicy / listPolicies / validatePolicy / dryRunEvaluate / listBundleVersions): authenticated workspace member.
• Write ops (createPolicy / updatePolicy / compileBundle / publishBundle / rollbackBundle): WORKSPACE_ADMIN (or ORG_ADMIN / SUPER_ADMIN) for a workspace scope; ORG_ADMIN (or SUPER_ADMIN) for an org scope. Insufficient role → OSY-POLICY-3001 (logged).

Source-of-truth: the signed canonical-CBOR bundle manifest (encodedCborB64 / WIRE-TRUTH). The decoded manifest fields below are VIEWS; verifiers re-decode the CBOR. The edge does NOT verify signatures here — AP00019 signs; the enforcer (edge OPA-WASM)

• ome-service verify on consume.

Until POLICY_COMPUTE_ADDR is configured the resolver returns OSY-POLICY-NOT-WIRED via UnwiredPolicyAuthoringService (fail-closed; NO STUBS). ───────────────────────────────────────────────────────────────────── Enums ───────────────────────────────────────────────────────────────────── Cascade layer being authored. PLATFORM is deliberately NOT exposed — platform authoring/publish is KMS-quorum governed, never via this console.

| Value | Description | | --- | --- | | ORG | | | WORKSPACE | |

ChatRole

| Value | Description | | --- | --- | | ASSISTANT | | | SYSTEM | | | TOOL | | | USER | |

CompanySize

The company-size tap. Mirrors IAM's CompanySize enum (ENG-3253) by NAME, minus the proto's UNSPECIFIED(0) sentinel (see SignupUseCase).

| Value | Description | | --- | --- | | ENTERPRISE | 201–1000 | | LARGE | 11–50 | | MEDIUM | 2–10 | | SELF_EMPLOYED | | | SMALL | 1 | | XLARGE | 51–200 |

ComplianceFramework

Certification framework a control maps into (the prefix of a SOC2:CC6.1-style framework_ref).

| Value | Description | | --- | --- | | HIPAA | | | ISO27001 | | | SOC2 | |

ComplianceResult

Per-control verdict. DEGRADED = the collector could not complete the audit-of-record query for this control (OSY-AUDIT-7269) — NEVER a PASS. PENDING = no collector run has produced a status yet. NOT_APPLICABLE = the control is out of scope for the selected framework set. Maps compliance.v1 ControlResult (PASS/FAIL/NA/DEGRADED) + the edge-derived PENDING (a NOT_FOUND status row).

| Value | Description | | --- | --- | | DEGRADED | | | FAIL | | | NOT_APPLICABLE | | | PASS | | | PENDING | |

ComplianceScope

Compliance control-matrix GraphQL schema (ENG-2981 / ENG-2911; ARC-97 / ADR-346).

The external BFF projection of the AP00005 audit-svc compliance.v1.ComplianceControlService (design docs/architecture/COMPLIANCE-SOC2-ISO27001-HIPAA-CONTROL-MAPPING-DESIGN.md §4.4). This file wires the flagship control-MATRIX read model:

complianceControls(scope) — the registry catalog (ListControls) × the latest per-control ControlStatus (GetControlStatus), joined at the edge into a heatmap read model.

The evidence drill-down (complianceControlEvidence) is NOW declared (ENG-2982): AP00005 extended the CER projection with the RE-DERIVED signatureValid (EvidenceChainVerifier.verifyEvent == VERIFIED — a genuine COSE + covering-checkpoint re-verification, never a fabricated pass), the signed cti, and the RFC-3339 collectedAt. The evidence-pack export (exportComplianceEvidencePack) remains DELIBERATELY NOT declared: the receipt proto does not yet enumerate the packed controlIds, so it is tracked as an AP00005 backend-extension follow-up; until it lands the FE keeps its sanctioned not-wired banner (GRAPHQL_VALIDATION_FAILED "Cannot query field") for export only. NO STUBS.

Tenancy: the workspace is ALWAYS derived from the JWT server-side (no workspace argument). scope selects WORKSPACE (this tenant) vs PLATFORM (Osyra-the-org, the SOC 2 / ISO audit subject). AP00005 binds + cross-checks the scope server-side under per-tenant RLS.

CLAIM DISCIPLINE (ENG-1741 / ADR-269): every field is DATA. result is the authoritative per-control verdict; a DEGRADED control is NEVER promoted to PASS, and a control with no collector status yet is PENDING (never a fabricated PASS). PLATFORM-scope evidence is admin-gated (OSY-AUDIT-7260) until the AP00009 admin-assertion verifier lands (ENG-2903 / ENG-2034, V1.5): the edge returns an explicit degraded matrix (degraded: true + a bounded reason), NEVER a silent blank or a fabricated row. Audit subject: this tenant (WORKSPACE) vs Osyra-the-org (PLATFORM). Mirrors compliance.v1 Scope.

| Value | Description | | --- | --- | | PLATFORM | | | WORKSPACE | |

ContactSalesDomainClass

| Value | Description | | --- | --- | | CORPORATE | | | FREEMAIL | | | NOREPLY | | | UNKNOWN | |

ContactSalesGate

| Value | Description | | --- | --- | | ENTERPRISE | | | PRO | |

ContactSalesIntent

| Value | Description | | --- | --- | | CONTACT_SALES | | | REQUEST_PRO | |

ContactSalesSurface

| Value | Description | | --- | --- | | SIDEBAR_NAV | | | SSO_SETTINGS | | | UPGRADE_GATE | |

ContentBoundEnablementStatus

CONTENT_BOUND enablement admin GraphQL schema (AP00002 IAM IAMContentBoundEnablementService projection) — ENG-2565 / ENG-2563 (ARC-33; ADR-290 / ADR-247)

Admin console surface for the SIX-PART CONTENT_BOUND residency/DPA enablement gate. IAM is the authority of record: it owns the entitlement store, the identity-enforced maker/checker workflow, the six-gate ACTIVE rule, and the step-up. The edge is a THIN PASS-THROUGH — it derives the workspace from the JWT, forwards the caller's identity to IAM, and maps the response; it NEVER re-derives the maker/checker identity and NEVER re-implements the gate logic.

TRANSPORT (round-table ENG-2565, Option A, 7/7): this surface routes FE -> AP00001-edge GraphQL -> AP00002 IAM gRPC — the same data plane as the rest of the console (OCAR/OADR, transferWorkspaceOwnership). APPROVE_CONTENT_BOUND_ENABLEMENT is a REGULAR IAM step-up scope (edge-mintable via issueStepUpToken), NOT an AP00009 WebAuthn ceremony, so its correct transport is the edge — not the hardware-key admin gateway.

─────────────────────────────────────────────────────────────────────── Tenant isolation (load-bearing): the workspace is ALWAYS derived from the JWT (ctxkeys.WorkspaceID), NEVER from input. issue/status carry NO workspace argument; the resolver stamps uc.WorkspaceID onto the outbound IAM request and IAM tenant-guards it. For approve/revoke (enablement_id-keyed), IAM's tenant guard loads the row and rejects unless its workspace/org equals the caller's authenticated workspace/org (the enablement_id IDOR is closed server-side in IAM).

Maker/checker IDENTITY is NEVER client-asserted: there is intentionally no maker/checker/actor field on any input. IAM server-derives both identities from the authenticated principal and identity-enforces checker != maker (not a string compare).

─────────────────────────────────────────────────────────────────────── FAIL-CLOSED: until the IAM ContentBoundEnablement RPCs are reachable (IAM addr unset, or the deployed IAM predates the RPC -> gRPC UNIMPLEMENTED) the surface returns OSY-CBE-NOT-WIRED via UnwiredContentBoundEnablementService / the gRPC degrade — never a fabricated grant. The FE maps that code to its sanctioned CONTENT_BOUND FallbackBanner. A PENDING/SUSPENDED/REVOKED status and a checker!=maker rejection are DATA, surfaced faithfully — never a fabricated ACTIVE. ───────────────────────────────────────────────────────────────────── Status enum — mirrors the IAM ContentBoundEnablementStatus (ADR-290). ACTIVE iff all six gates clear AND checker != maker (IAM-enforced). UNSPECIFIED is the zero value (a not-yet-decoded status). ─────────────────────────────────────────────────────────────────────

| Value | Description | | --- | --- | | ACTIVE | | | PENDING | | | REVOKED | | | SUSPENDED | | | UNSPECIFIED | |

CostStatus

Cost-attribution status for a breakdown (design CostAttributionStatus). When the signed pricing catalog cannot price the window, the backend returns COST_UNAVAILABLE — the console shows an honest "cost unavailable" state and NEVER a fabricated 0 (design §4.2 / ADR-325 fail-closed).

| Value | Description | | --- | --- | | COST_AVAILABLE | | | COST_UNAVAILABLE | |

CuaActionVerb

The discriminant of the 8-kind action tagged union (cua-action-v1.cddl cua-action-tag).

| Value | Description | | --- | --- | | CLICK | | | DRAG | | | KEYBOARD_SHORTCUT | | | NAVIGATE | | | SCROLL | | | SELECT | | | SUBMIT_FORM | | | TYPE | | | UNSPECIFIED | |

CuaFieldKind

A typed-field classification for ASKCAP keystroke-commit gating (cua-field-kind).

| Value | Description | | --- | --- | | EMAIL | | | GENERIC | | | NUMERIC | | | PASSWORD | | | SECRET | | | UNSPECIFIED | |

CuaMouseButton

A mouse button (cua-click button).

| Value | Description | | --- | --- | | LEFT | | | MIDDLE | | | RIGHT | | | UNSPECIFIED | |

CuaNavVia

The navigation method (cua-navigate via).

| Value | Description | | --- | --- | | ADDRESS_BAR | | | BACK | | | FORWARD | | | LINK | | | RELOAD | | | UNSPECIFIED | |

CuaPolicyVerdict

The AP00019 pre-action gate verdict (design §3.3 step 3).

| Value | Description | | --- | --- | | ALLOW | | | DENY | | | STEP_UP | | | UNSPECIFIED | |

CuaRiskClass

The DERIVED reversibility-lattice class (ADR-230 D1). A total order: READ ⊏ REVERSIBLE_WRITE ⊏ IRREVERSIBLE ⊏ HIGH_VALUE_FINANCIAL. Server-DERIVED, never caller-asserted.

| Value | Description | | --- | --- | | HIGH_VALUE_FINANCIAL | | | IRREVERSIBLE | | | READ | | | REVERSIBLE_WRITE | | | UNSPECIFIED | |

CuaTimeSource

The timestamp-attestation source (cua-timestamp source).

| Value | Description | | --- | --- | | RFC3161 | | | ROUGHTIME | | | UNSPECIFIED | |

CuaVerifyStatus

The COSE_Sign1 verify-on-read status AP00018 computed for the receipt envelope.

| Value | Description | | --- | --- | | INVALID | | | PENDING | | | UNSPECIFIED | | | VERIFIED | |

DefaultProviderStatus

============================================================================= Workspace default provider (ARC-104 / ENG-3078; design docs/architecture/AP00003-WORKSPACE-DEFAULT-PROVIDER-DESIGN.md §4.1.2 · ADR-364). A billing-domain workspace setting: which provider a workspace defaults to for a given model. Same family as budgets (ADR-342 pattern): org/workspace derived from the RE-VERIFIED JWT, workspaceId args IDOR-guarded (assertWorkspaceMatchGQL), reads gated on osyra:billing::read, writes on osyra:billing::write; every resolver delegates to the AP00003 billing gRPC (ENG-3077) — NOT the IAM WorkspaceSettings scaffold (workspace.graphql), which is a deliberately-unwired IAM projection (ENG-2971 removed its write path).

Timestamps are String! ISO-8601 (finops family convention — never a DateTime scalar); money figures are fixed-point strings (billing money discipline). NO STUBS: an ineligible provider / unknown model surfaces the billing service's OSY-VALID-4041 / OSY-VALID-4042 VERBATIM (design §4.1.1) — never a fabricated default. Nothing here touches the R37 costSavings guard. Server-computed lifecycle of an open declaration. STALE = the declared provider no longer passes the §4.3.3 eligibility intersection at read time (no open SIGNED price row / dropped from the signed catalog serving set) — the stale-default UX affordance. NEVER client-supplied: the edge maps it from the billing service's server-computed eligible bit (design §4.3.3).

| Value | Description | | --- | --- | | DECLARED | | | STALE | |

DsarKind

── DSAR — the GDPR/CCPA data-subject-rights plane (ENG-2986 / ENG-2884; §4.3/§4.4/§6/§7) ──────────────

The external BFF projection of AP00005 audit-svc's compliance.v1.ComplianceDsarService (the ENG-2884 DsarOrchestrator over its OWN gRPC service, gated compliance.dsar.enabled). Five FE ops map 1:1 onto a served backend RPC and are declared here (the fifth, erasureFulfilment, was added by ENG-2998): dsarRequests(filter) — the DSAR intake queue (ListDsarRequests), a Relay connection, dsarRequest(id) — one request's status (GetDsarRequest); a cross-tenant / unknown id → null, openDsarRequest(input) — open a new subject request (OpenDsarRequest); the MAKER identity is server- derived from the JWT subject (never a client-supplied field), executeErasure(input) — the Art-17 destructive maker-checker fan-out (ExecuteErasure); the CHECKER identity is server-derived. ENG-2998: the input now carries the base64 AP00009-minted osyra-admin-approval-v1 COSE_Sign1 envelope (approvalEnvelope) — the FULL dual-control crypto artifact AP00005 verifies fail-closed (OSY-AUDIT-7300..7305) BEFORE any destructive fan-out; a missing / invalid / stale approval is a client-actionable validation error — never a phantom erasure.

Also declared (ENG-2998): erasureFulfilment(dsarId) — the persisted Art-17 EFR read-model (GetErasureFulfilment), read back AFTER the ceremony. A pure idempotent READ; a cross-tenant / unknown id, a non- erasure request, or a not-yet-fulfilled erasure → null (never a fabricated EFR).

Also declared (ENG-2998 seam 3): requestSubjectAccessExport(dsarId) — the signed Subject Access Bundle (.dsar.zip, Art-15/20; ExportSubjectAccessBundle). Previously OFF this SDL because the SAB export needed a chain_key/from_seq/to_seq the console can't supply; AP00005 now derives the tenant chain slice SERVER-side from the RLS-bound scope, so the console sends only the dsarId. Fails closed while the subject is not identity-proofed / a cross-service SAB source cannot be pulled; downloadUrl is an honest null on a transport with no native presigned GET — never a fabricated bundle.

TENANCY: identical to the PMM surface above — the workspace is ALWAYS JWT-derived (no workspace argument); the dsar_request rows are RLS-scoped server-side. Reads/opens are tenancy-only at the edge. CLAIM DISCIPLINE: every field is DATA — a request is never upgraded to FULFILLED, and the artifactCid / fulfilledAt / verifiedAt / efrCid witnesses are null until the backend actually mints/records them. The data-subject request kind (mirrors compliance.v1 DsarKind MINUS the proto zero-value UNSPECIFIED; an UNSPECIFIED wire value fails SAFE to the least-privileged ACCESS at the edge — never surfaced as the destructive ERASURE). Matches the FE DsarKind union (lib/graphql/operations/eu-compliance.ts).

| Value | Description | | --- | --- | | ACCESS | | | ERASURE | Art-15 access | | OBJECT | Art-18 | | PORTABILITY | Art-17 erasure (destructive; maker-checker) | | RECTIFICATION | Art-20 portability | | RESTRICT | Art-16 |

DsarStatus

The DSAR lifecycle (mirrors compliance.v1 DsarStatus MINUS UNSPECIFIED; an UNSPECIFIED wire value fails SAFE to BLOCKED — an unknown request is never surfaced as OPEN). Matches the FE DsarStatus union.

| Value | Description | | --- | --- | | BLOCKED | | | FULFILLED | | | IN_PROGRESS | | | OPEN | | | REJECTED | a surface could not erase / a mint was refused (fail-closed) |

DsarVerificationMethod

The subject-identity proofing method (mirrors compliance.v1 verification_method). Matches the FE DsarVerificationMethod union. Null on a DsarRequest until proofing is recorded.

| Value | Description | | --- | --- | | GOV_ID | | | OUT_OF_BAND | | | SIGNED_ATTESTATION | | | SSO_REAUTH | |

EmbeddingEncodingFormat

| Value | Description | | --- | --- | | BASE64 | | | FLOAT | |

ErasureSurface

The Art-17 erasure surfaces (mirrors compliance.v1 DsarErasureSurface MINUS UNSPECIFIED). Billing is NEVER an erasure surface (lawfully retained under Art-17(3), D5) — it appears only in the SAB access disclosure. Matches the FE ErasureSurface union.

| Value | Description | | --- | --- | | AUDIT_CRYPTOSHRED | | | OME | | | OSYRASTREAM | |

EventTransport

Delivery transport for an outbound governance-event subscription.

| Value | Description | | --- | --- | | EMAIL | | | SLACK | | | WEBHOOK | |

FindingSeverity

Severity of a validation finding.

| Value | Description | | --- | --- | | ERROR | | | INFO | | | WARNING | |

FinishReason

| Value | Description | | --- | --- | | CONTENT_FILTER | | | ERROR | | | LENGTH | | | STOP | | | TOOL_CALLS | |

HealthStatus

Broker-observed health of a model provider (AP00006 HealthStatus). UPPERCASE per the codebase enum convention (matches RoutingVerdict). The proto UNSPECIFIED is projected as UNKNOWN (a health read never fails loud on it).

| Value | Description | | --- | --- | | DEGRADED | | | HEALTHY | | | UNHEALTHY | | | UNKNOWN | |

ImpersonationAccessMode

Impersonate admin-BFF bridge GraphQL schema (AP00009 admin-gateway projection) — ENG-2799 (carve-out of ENG-2586; CEO-D4 ENG-2433 / ADR-188; sec-arch ratification ADR-359).

──────────────────────────────────────────────────────────────────────────────────────────── UNWIRED-ONLY PREVIEW SURFACE. This defines the FUTURE operator-console contract for the privileged impersonation flow; it does NOT wire it. Per ADR-359 (the AC#1 sec-arch round-table decision) the public AP00001-edge MUST NOT front the AP00009 admin gateway:

• ADR-132: AP00009 has ZERO public inbound surface (VPN-only, BeyondCorp device-cert-bound); the edge is a PUBLIC ingress, so there is by construction no network path edge → AP00009.
• ADR-188: an impersonation grant is MINTED AT AP00009 only after a 2-of-N (READ_ONLY) / 3-of-N (READ_WRITE) distinct-CISO WebAuthn hardware-key quorum + an execute-time fresh FIDO2 re-auth. Minting is categorically NOT an edge-mintable step-up (unlike APPROVE_CONTENT_BOUND_ENABLEMENT, which correctly rides the edge — see content_bound_enablement.graphql).

Therefore this surface ships with ONLY UnwiredImpersonateBridgeService and fails closed:

• IMPERSONATE_BRIDGE_ENABLED unset (default) → OSY-IMP-DISABLED (preview off)
• IMPERSONATE_BRIDGE_ENABLED=true → OSY-IMP-NOT-WIRED (preview on, transport gated on a future BeyondCorp admin-GraphQL transport + the ENG-2581 external GA pentest). There is NO wired variant on the public edge, and none may be added until Option (C) + ENG-2581 land (ADR-359 §Decision). NO STUBS — never a fabricated op, grant, notice, or revoke receipt.

──────────────────────────────────────────────────────────────────────────────────────────── CONTRACT INVARIANTS (load-bearing even while unwired — they define what a future wire may/ may not do):

• NO executeImpersonation/mint mutation and NO stepUpToken input ANYWHERE. The edge never mints a grant and never carries the WebAuthn quorum; requestImpersonation only KICKS OFF the AP00009 ceremony (returns a PENDING_APPROVAL op). The 4-eyes quorum + fresh FIDO2 happen exclusively on AP00009's hardware plane.
• The operator/approver/CISO identities are NEVER client-asserted — AP00009 server-derives them from the authenticated hardware-key principal. No actor/approver field on any input.
• Grant SECRET material (the COSE_Sign1 grant, its signature, any bearer token) is NEVER projected — only non-secret status metadata. The dsTags (osyra-admin-grant-v1 / osyra-admin-grant-revoke-v1 / osyra-admin-impersonation-action-v1) stay frozen at AP00009.
• The I5 customer impersonation-notice (activeImpersonationNotice) is TENANT-SCOPED to the caller's JWT org (NO org argument) so one org can never probe whether another is impersonated. ───────────────────────────────────────────────────────────────────── Access mode — READ_ONLY needs a 2-of-N distinct-CISO quorum; READ_WRITE needs 3-of-N (ADR-188 / ADR-133). UNSPECIFIED is the zero value (a not-yet-decoded mode). ─────────────────────────────────────────────────────────────────────

| Value | Description | | --- | --- | | READ_ONLY | | | READ_WRITE | | | UNSPECIFIED | |

ImpersonationOpStatus

───────────────────────────────────────────────────────────────────── Privileged-op lifecycle (projects the AP00009 OP_TYPE_IMPERSONATE state machine). PENDING_APPROVAL after request; APPROVED once the 4-eyes quorum clears at AP00009; ACTIVE after the execute-time fresh-FIDO2 mint (which happens ONLY at AP00009, never here); EXPIRED/REVOKED/DENIED terminal. UNSPECIFIED is the zero value. ─────────────────────────────────────────────────────────────────────

| Value | Description | | --- | --- | | ACTIVE | | | APPROVED | | | DENIED | | | EXPIRED | | | PENDING_APPROVAL | | | REVOKED | | | UNSPECIFIED | |

InvitationStatus

| Value | Description | | --- | --- | | ACCEPTED | | | EXPIRED | | | PENDING | | | REVOKED | |

InvoiceStatus

| Value | Description | | --- | --- | | DRAFT | | | OPEN | | | PAID | | | UNCOLLECTIBLE | | | VOID | |

LitigationHoldStatus

| Value | Description | | --- | --- | | active | | | released | | | unspecified | |

MemberRole

| Value | Description | | --- | --- | | ADMIN | | | MEMBER | | | OWNER | | | VIEWER | |

MemoryEventKind

Memory-events GraphQL Schema (AP00011-osymem projection — fail-closed unwired surface) ENG-779: memoryEvents query — paginated memory-engine event feed for the /memory Memory Inspector page.

Frontend contract: osyra-frontend PR #201 (lib/graphql/operations/memory.ts). Field types follow the frontend contract verbatim (String! ISO-8601, lowercase enum values) rather than the codebase's DateTime / SCREAMING_SNAKE convention. ENG-779 intentionally locks this to PR #201's schema so the Memory Inspector activates without a frontend bump; type unification is a follow-up that requires both repos to land atomically. Same precedent as ENG-775's AuditStatus (audit.graphql:5-15) and ENG-777's CostSavings (broker.graphql:30-35).

Until AP00011-osymem ships a MemoryEvents query RPC (read surface not yet wired), the resolver returns the gqlerror extension code OSY-OSYMEM-NOT-WIRED, which the frontend's memory-fallback.ts NOT_WIRED_CODES set (case-sensitive) detects and renders as <FallbackBanner kind="not-wired">. Memory-engine lifecycle event kind. Lowercase values are required — the frontend MemoryEventKind type and KIND_VARIANT badge map key off the literal lowercase strings. SDL order is significant; gqlgen preserves it on introspection, and the frontend may rely on declaration order for default sort/filter chip ordering.

| Value | Description | | --- | --- | | evict | | | expire | | | invalidate | | | read | | | write | |

ModelType

| Value | Description | | --- | --- | | AUDIO | | | CHAT | | | EMBEDDING | | | IMAGE | | | MULTIMODAL | |

OrganizationStatus

| Value | Description | | --- | --- | | ACTIVE | | | DELETED | | | SUSPENDED | |

OtccDeterminismClass

OTCC token-capital certificate-console GraphQL schema (ENG-2525 / ARC-28; ADR-265/266/267)

Customer-facing read + verify surface for the OTCC (Osyra Token-Capital Certificate) console. An OTCC certificate (otcc.v1, an AP00016 EAT receipt kind) re-decides the EXACT counterfactual benchmark-gain Δ ATTRIBUTABLE to an OWAR-attested trace-slice, offline / no-retrain. verifyTokenCapital proxies AP00011-ome's VerifyTokenCapital RPC (ENG-2524) through the edge → gRPC; the verifier re-derives Δ and the determinism class — the edge does NOT re-decide.

─────────────────────────────────────────────────────────────────────── 🛑 CLAIM-DISCIPLINE (ENG-1741, NON-NEGOTIABLE; /osyra-legal gate) 🛑 An OTCC certificate attributes a counterfactual benchmark Δ to an ATTESTED trace-slice. It does NOT, and this surface MUST NEVER imply, that "the model is better". The pole is ATTRIBUTE-GAIN = bound∘re-execute (a derived pole, not a verdict on model quality). Two non-attributable states are surfaced EXPLICITLY and must be rendered as such by the console — never hidden behind a green Δ:

• SLICE_SELF_DECLARED: the trace-slice's origin is NOT third-party attested (no OWAR attested-origin substrate from ARC-29). Δ is NOT attributable to an attested slice — "gain ≠ attributable".
• DEGENERATE_ABLATION: the ablation is well-posedness-degenerate (zero-coverage slice, OR all-members-empty-ablation — the two-sided well-posedness fence). Δ is meaningless — "gain ≠ good". A certificate may be cryptographically valid (signature + re-decision verify) AND still be non-attributable — attributable is a SEPARATE bit from accepted.

─────────────────────────────────────────────────────────────────────── BACKEND-DATA GAP (honest; the console FallbackBanners the whole surface today): The VerifyTokenCapital RPC (ENG-2524) is NOT yet present in the vendored ome-proto (the OTCC ENG tree 2519→2524 is Backlog; ARC-28 merged DESIGN + ADRs

• CDDL wire-STRUCTURE freeze only — golden SHAs/KAT are CANDIDATE). So this surface is fail-closed: the resolver returns OSY-OTCC-NOT-WIRED via UnwiredOtccService (NO STUBS — never a fabricated certificate, verdict, Δ, or determinism class). The schema is the REAL contract; when ENG-2524 publishes the RPC + a wired OMEClient lands, swap UnwiredOtccService for the gRPC-backed impl WITHOUT changing this SDL, and the console lights up.

─────────────────────────────────────────────────────────────────────── Tenant isolation (LOAD-BEARING): the workspace is ALWAYS JWT-derived (ctxkeys.WorkspaceID) — NO workspaceId input field anywhere below (mirrors receipts / amgate / oadr; defense-in-depth per ENG-777 SEC-H1). The resolver stamps it onto the AP00011-ome request; the server RLS-scopes by it. ───────────────────────────────────────────────────────────────────── Enums (string-literal unions on the FE per the codegen convention) ───────────────────────────────────────────────────────────────────── The two-tier determinism class of the re-derived Δ (ADR-244):

• EXACT: re-derived via ODRE batch-invariant kernels — Δ is reproducible bit-for-bit (V2.0 / HOLD-BUILD until ODRE graduates).
• TOLERANCE: re-derived within a numeric tolerance ε (the dense path ships TOLERANCE today) — toleranceEpsilonPpm carries ε in PPM.

| Value | Description | | --- | --- | | EXACT | | | TOLERANCE | |

OtccSliceAttestationStatus

The attestation status of the trace-slice the Δ is attributed to. ATTESTED is the ONLY status under which Δ is attributable; SELF_DECLARED is the explicit non-attributable state (no OWAR attested-origin substrate).

| Value | Description | | --- | --- | | ATTESTED | The slice origin is third-party attested (OWAR attested-origin substrate from ARC-29). Δ is attributable to the attested slice. | | SELF_DECLARED | The slice origin is NOT third-party attested. Δ is NOT attributable to an attested slice — surfaced explicitly (SLICE_SELF_DECLARED). NEVER hidden. |

PaymentMethodType

| Value | Description | | --- | --- | | BANK_ACCOUNT | | | CARD | | | INVOICE | |

PlanTier

============================================================================ Enums

Plan tier identifying the subscription level a workspace is bound to. Source of truth for paid-tier metadata is the Billing service; this enum is the public input surface used at signup and on /api/v1/billing/checkout.

| Value | Description | | --- | --- | | ENTERPRISE | | | FREE | | | PRO | | | STARTER | |

PmmWindowStatus

EU AI Act post-conformity (Art-72 post-market-monitoring) GraphQL schema (ENG-2987 / ENG-2888; ARC-101 / ADR-349).

The external BFF projection of the AP00005 audit-svc compliance.v1.CompliancePmmService (design docs/architecture/EU-AI-ACT-POSTCONFORMITY-ADVANCED-GDPR-DESIGN.md §6.1 / §7.2). This file wires the ONE PMM read whose FE contract maps 1:1 onto a served backend RPC:

pmmWindows(systemId) — the closed/open post-market-monitoring reporting windows for a registered high-risk system (ListPmmWindows), projected as a Relay connection.

Three PMM reads whose FE contract maps 1:1 onto a served backend RPC are declared here: pmmWindows(systemId) — the window list (ListPmmWindows), pmmRecord(windowId) — the ENG-2984 per-window disclosure-body drill-down (GetPmmr): the annex-III class, the model/policy binding refs, the re-derived integer aggregates, and the incident flags AP00005 PERSISTS at seal (body fields 1/3/4/6/7). AP00005 reads them from the sealed pmm_window row — the edge never fetches+decodes the WORM disclosure blob and never re-derives a count. art12Record(systemId, — the ENG-2985 Art-12(2) conformity-record binding index (GetArt12Record): from, until) the purpose-map (2a/2b/2c evidence CIDs), the Annex-III(1)(a)-present flag, and the covering audit-checkpoint CID. AP00005 surfaces these as first-class A12CRManifest scalars projected from the SAME in-process inputs it feeds the manifest encoder (map keys 2 / 3-presence / 4) — byte-identical to the signed manifest_cbor. The edge never decodes the signed Form-B blob, never re-derives.

The rest of the ENG-2888 eu-compliance console is DELIBERATELY NOT declared here — its FE contract requires fields the backend cannot yet prove without fabrication (NO STUBS):

• DSAR tab — ENG-2884 built the DsarOrchestrator but exposes NO gRPC service → ENG-2986. Until that backend extension lands, those FE fields resolve to GRAPHQL_VALIDATION_FAILED "Cannot query field", which the console's classifyEuComplianceError treats as not-wired (its own "Coming soon" banner) — never a fabricated record.

TENANCY: the workspace is ALWAYS derived from the JWT server-side (no workspace argument); systemId is filtered + RLS-scoped by AP00005 (ScopeContextServerInterceptor binds the GUC from the transport-authenticated workspace). Reads are tenancy-only at the edge (RequireAuth + a workspace claim; NO per-field HasPermission — mirrors the AuditEvents / complianceControls projections).

CLAIM DISCIPLINE (ENG-1741 / LEGAL-ART12 §5): every field is DATA — signed, re-derivable evidence. A window is never upgraded to SEALED, and the pmmrCid / disclosureCid / sealedAt witness pointers are null until the window actually seals (never a fabricated CID or timestamp). The post-market-monitoring reporting-window lifecycle. Mirrors compliance.v1 PmmWindowStatus MINUS the proto's zero-value UNSPECIFIED — an UNSPECIFIED wire value fails SAFE to BLOCKED at the edge (an unknown/never-sealed window is NEVER surfaced as OPEN, which would imply an active healthy window). The three values match the FE PmmWindowStatus union (lib/graphql/operations/eu-compliance.ts).

| Value | Description | | --- | --- | | BLOCKED | The mint was refused (non-re-derivable / partial), or the status is unknown (fail-safe); never sealed. | | OPEN | Assembled but not yet sealed — no PMMR minted. | | SEALED | A re-derivable PMMR was minted + WORM-stored; the pmmrCid / disclosureCid / sealedAt are set. |

PolicySourceFormat

Authored source language.

| Value | Description | | --- | --- | | IAM_JSON | | | REGO | |

PrivateEndpointAuthKind

| Value | Description | | --- | --- | | API_KEY_HEADER | | | AWS_SIGV4 | | | BEARER | | | MTLS_CLIENT_CERT | | | NONE | | | UNSPECIFIED | |

PrivateEndpointKind

Private-endpoints console GraphQL schema (AP00006 model-broker PrivateEndpointRegistryService projection) — ENG-2989 / ENG-2917 (ARC-96; ADR-341 §6.4; design AP00006-AP00008-PRIVATE-SELFHOSTED-LLM-ROUTING-DESIGN.md §5.1/§6.4).

A private endpoint is a tenant-registered private / self-hosted inference backend (on-prem vLLM, SageMaker, Vertex, Azure-private) the broker may route to. AP00006 is the authority of record: the DB-backed registry, Postgres RLS tenant isolation, the maker/checker four-eyes lifecycle (register → pending_approval → approve → active), and the LIVE reachability preflight. The edge is a THIN PASS-THROUGH — it derives the tenant + caller identity from the validated JWT and POPULATES the proto CallerContext{organization_id, workspace_id, principal, scopes, request_id} on EVERY request (AP00006 binds those fields into its RLS GUCs; they are NEVER request-body inputs on this surface).

─────────────────────────────────────────────────────────────────────── MAKER / CHECKER (four-eyes, design §6.3 — load-bearing):

• register / update / retire require the MAKER scope osyra:llm:private-endpoint:register
• approve requires the DISTINCT CHECKER scope osyra:llm:private-endpoint:approve AND the approver principal MUST differ from the creator — enforced SERVER-SIDE in AP00006 (+ a DB CHECK). The edge does NOT pre-check approver != maker: the broker's typed rejection is surfaced faithfully, never precheck-masked.
• list / get / testPrivateEndpointReachability require osyra:llm:private-endpoint:read (the scope strings are the AP00002 ScopeProjection private-endpoint -> llm special-case projections — verified against ScopeProjection.java, ENG-2899).

SECRET DISCIPLINE: authSecretRef is an opaque POINTER into the tenant's secret manager — NEVER the secret — and is INPUT-ONLY (not readable back through this surface; same discipline as the virtual-keys SecretRefInput). caCertFingerprint is the SHA-256(SPKI) pin as lowercase hex — a public value, not a secret.

FAIL-CLOSED: until the AP00006 registry RPCs are reachable (a deployed broker predating the registry, or PRIVATE_ENDPOINT_ENABLED off server-side -> gRPC UNIMPLEMENTED) the surface returns OSY-PRIVATE-ENDPOINT-NOT-WIRED — the ENG-2917 console keeps its sanctioned FallbackBanner. NO STUBS: never a fabricated endpoint, approval, or "connected" reachability verdict; an UNREACHABLE / guard-rejected preflight is DATA, surfaced faithfully. ───────────────────────────────────────────────────────────────────── Enums mirror the proto (ai.osyra.privateendpoint.v1). UNSPECIFIED is the honest projection of a proto value this edge build cannot decode (forward-compat — the FE renders a plain label, ENG-2917 convention); it is REJECTED on input (fail-closed, never defaulted). ─────────────────────────────────────────────────────────────────────

| Value | Description | | --- | --- | | AZURE_PRIVATE | | | ONPREM_VLLM | | | SAGEMAKER | | | UNSPECIFIED | | | VERTEX | |

PrivateEndpointProtocol

| Value | Description | | --- | --- | | AZURE_PRIVATE_OPENAI | | | OPENAI_CHAT | | | OPENAI_RESPONSES | | | SAGEMAKER_INVOKE | | | UNSPECIFIED | | | VERTEX_PREDICT | |

PrivateEndpointStatus

Lifecycle (proto PrivateEndpointStatus): register -> PENDING_APPROVAL -> approve -> ACTIVE (or UNREACHABLE when the approve-time LIVE preflight fails); retire -> RETIRED (soft, never a hard delete).

| Value | Description | | --- | --- | | ACTIVE | | | DRAFT | | | PENDING_APPROVAL | | | RETIRED | | | UNREACHABLE | | | UNSPECIFIED | |

QuarantineClass

Per-fact quarantine routing class decided at OME pre-signing time by the broker's imitation-distance vs. budget gate. Wire shape: 3-class uint8 enum at internal/mguard/types.go:18-25 (clean=0, shadow=1, block=2). Surfaced as UPPERCASE string for GraphQL ergonomics + FE literal-type alignment.

| Value | Description | | --- | --- | | BLOCK | distance > 2×budget; blocked at the broker, redaction receipt emitted. | | CLEAN | distance ≤ budget; forwarded to production LLM unmodified. | | SHADOW | distance ∈ (budget, 2×budget]; routed to shadow LLM (emits signed quarantine_gate_receipt). |

RoutingVerdict

Routing verdict emitted by a dry-run policy evaluation.

ENG-1035: UPPERCASE per the codebase enum convention (matches FinishReason / HealthStatus). The frontend's TypeScript union regenerates to the UPPERCASE literals when it re-vendors this SDL. See docs/decisions/ENG-1035-broker-type-unification.md.

| Value | Description | | --- | --- | | ALLOW | | | DENY | | | TRANSFORM | |

SecretRefBackend

───────────────────────────────────────────────────────────────────── External secret-manager backend the SecretRef points into (input-only). local-file is intentionally absent — rejected fail-closed for virtual keys (design §2 / OSY-VALID-4019). ─────────────────────────────────────────────────────────────────────

| Value | Description | | --- | --- | | AWS_SECRETS_MANAGER | | | HASHICORP_VAULT | |

SignupUseCase

The use-case tap. Mirrors IAM's SignupUseCase enum (ENG-3253) by NAME, minus the proto's UNSPECIFIED(0) sentinel — a skipped tap is expressed by OMITTING the field (input) or by a null value (output), never by an UNSPECIFIED literal.

| Value | Description | | --- | --- | | COST_OPTIMIZATION | | | GOVERNANCE_COMPLIANCE | | | MULTI_PROVIDER_ROUTING | | | OBSERVABILITY_ANALYTICS | | | OTHER | | | SECURITY_ZERO_TRUST | |

SsoConfigStatus

Enterprise SAML 2.0 SSO config surface (ENG-776).

Backed by AP00002-iam-service IAMOrganizationService.GetSsoConfig + UpdateSsoConfig RPCs (PR osyra-ai/AP00002-iam-service#11). The frontend <SsoTab> component (ENG-534) already imports against this exact SDL — DO NOT change field names or enum literals without coordinating with AP00010-frontend/lib/graphql/operations/sso.ts.

Authorization at the Edge resolver: • caller has admin or owner role → else OSY-POLICY-3001 • ctxkeys.EffectiveTier == "ENTERPRISE" → else OSY-POLICY-3001 (resource "sso_config:requires_enterprise"). TierResolutionMiddleware (ENG-936) populates this from billing-service GetEffectiveTier. • step-up re-auth token bound to UPDATE_SSO_CONFIG scope (mutation only) → else OSY-AUTH-1041 (missing) / OSY-AUTH-1042 (verify failed, no enumeration of cause per ENG-617 acceptance)

Frontend treats a null query result as "no config yet" — the empty-state form is rendered. IAM returns absent config on GetSsoConfigResponse; this resolver translates that to a GraphQL null.

| Value | Description | | --- | --- | | unconfigured | |

SsoRole

| Value | Description | | --- | --- | | admin | |

StepUpScope

Scope of a step-up token — exactly one sensitive operation. The minted token is bound to the chosen scope and cannot be replayed on a different one.

| Value | Description | | --- | --- | | APPROVE_CONTENT_BOUND_ENABLEMENT | ENG-2563 / ADR-290 D1 — the second-person checker re-authenticates with this step-up before approving a CONTENT_BOUND enablement (PENDING -> ACTIVE). The minted token is bound (operationBinding) to the enablement id so it cannot be replayed against a different enablement, and it enforces that the approval is a distinct step-up session from the maker's request. | | CHANGE_BILLING_EMAIL | Reserved-only — billing email is owned by the Stripe Customer Portal (createBillingPortalSession). No native mutation consumes this scope. | | CHANGE_EMAIL | Gates initiateEmailChange (Wave 3 — ENG-2729 / ADR-314 §2): minted via issueStepUpToken, presented on the X-Osyra-Step-Up-Token header, verified + consumed (single-use) before the email change begins. | | CHANGE_PASSWORD | | | CONFIGURE_OCAR_TRUST_MODE | ENG-2654 / ENG-2852 / ADR-337 — gates every OCAR per-workspace trust-config mutation (setOcarTrustConfig / clearOcarTrustConfig / promoteOcarTrustConfig). The minted token is bound (operationBinding) to a content-digest of the SPECIFIC config op so a captured token cannot be replayed onto a different config change; the edge RE-DERIVES that binding from its own request and forwards it as the expected_operation_binding on verify. Canonical wire scope: configure-ocar-trust-mode. | | CREATE_API_KEY_AFTER_24H_SESSION | | | DELETE_ORG | | | DELETE_WORKSPACE | | | DISABLE_MFA | | | EMERGENCY_REVOKE_ORG_API_KEYS | | | LINK_SOCIAL | Enforced at the REST social-link routes (internal/social/handler.go), not GraphQL. | | REVOKE_API_KEY | ENG-2076 / ADR-144 — resource-management scopes. | | REVOKE_OWNER_API_KEYS | | | REVOKE_WORKSPACE_API_KEYS | | | ROTATE_API_KEY | | | TRANSFER_ORG_OWNERSHIP | | | TRANSFER_WORKSPACE_OWNERSHIP | Reserved (enum only); ownership-transfer enforcement is ENG-2092. | | UNLINK_SOCIAL | | | UPDATE_SSO_CONFIG | |

TraceFeedbackVerdict

Signed Trace-Feedback Annotation (otfa.v1) — ENG-2933 (write) + ENG-2934 (read); ADR-353 / ARC-79.

Portkey ships thumbs-up/down feedback on a trace as a MUTABLE database row: forgeable (anyone who can write the table can attribute feedback to anyone), non-attributable (no cryptographic "who"), and re-writable (no history, no anti-rollback). Osyra replaces that liability with EVIDENCE: a signed, attributable, tamper-evident, offline-re-decidable EAT receipt (kind "otfa.v1") minted by the AP00016 Verifier-of-Record. WHO annotated (author_id) + on WHICH workspace (ws) are edge-stamped from the validated JWT — NEVER from input (the unforgeable-attribution invariant, ADR-353 D3).

CLAIM-DISCIPLINE (ADR-081 / ADR-353 D7 — the LOAD-BEARING fence): an otfa.v1 receipt attests only that the named principal signed this categorical opinion under its key. It makes NO correctness/endorsement claim about the subject and does NOT assert the author is an independent/verified reviewer. Console copy: "feedback signed by <principal>", never "verified reviewer".

TENANCY: the workspace is ALWAYS JWT-derived server-side. The mutation input carries NO workspace/author field — both come from the JWT; a supplied ws/author is IGNORED (defense-in-depth, tested).

FAIL-CLOSED (NO STUBS): subject not in the ws attested index → mint REFUSED at the edge (never annotate an unknown subject); AP00016 unavailable / unwired → the mutation fails closed (the row is a CACHE of the receipt — there is nothing to write without a receipt); redaction pipeline down → comment dropped to null, categorical feedback still mints (degrade, not block).

| Value | Description | | --- | --- | | THUMBS_DOWN | | | THUMBS_UP | |

TraceSubjectKind

| Value | Description | | --- | --- | | RECEIPT_CTI | An AP00016 receipt's cti/CID. | | SPAN | A sub-span within a trace. | | TRACE | An attestation/ingestion-plane trace CID. |

UsageGranularity

Bucket size for usageTimeseries.

| Value | Description | | --- | --- | | DAY | | | HOUR | | | MONTH | | | WEEK | |

UserStatus

| Value | Description | | --- | --- | | ACTIVE | | | DELETED | | | INACTIVE | | | PENDING | | | PENDING_VERIFICATION | IAM's real enum for an email-unverified, login-blocked account (ENG-3023): projected FAITHFULLY (no more truncation to PENDING). PENDING is retained for back-compat with older IAM builds that emitted the short form — the edge never re-truncates PENDING_VERIFICATION. | | SUSPENDED | |

Verdict

Verified Memory GraphQL Schema (AP00011-ome receipt projection)

ENG-1070 (VM-6.5) — verdict scalar (THIS STORY) ENG-928 (VM-6) — Verified Memory dashboard frontend (consumer) VM-6.1 — verifiedMemoryReceipts paginated list (separate ticket; unwired-wired below) VM-6.2 — verifiedMemoryHistogram aggregated buckets (separate ticket; unwired-wired below) VM-6.3 — exportVerifiedMemoryAudit mutation (separate ticket; not in this PR)

Source-of-truth: AP00010-frontend/lib/graphql/operations/verified-memory.ts AP00010-frontend/lib/verified-memory/verdict.ts (presentation mapping) AP00010-frontend/lib/verified-memory/fixtures.ts (golden test inputs)

Normative spec: docs/architecture/adr/ADR-050-verified-memory-verdict-derivation.md Wire-format ref: docs/architecture/adr/ADR-039-verified-memory-receipt-format.md (ENG-910) Wire freeze: docs/architecture/adr/ADR-046-ome-file-format-v1.md (.ome v1.0 — KAT byte-frozen)

Until AP00011-OME ships the receipt-store query RPCs (VM-6.1/6.2/6.3), the resolvers return the gqlerror extension code OSY-VERIFIED-MEMORY-NOT-WIRED, which the frontend's lib/hooks/verified-memory-fallback.ts NOT_WIRED_CODES set (case- insensitive) classifies and renders as <FallbackBanner kind="not-wired"> on /verified-memory. Mirrors the OSY-AUDIT-NOT-WIRED + OSY-OME-NOT-WIRED + OSY-BROKER-NOT-WIRED fail-closed unwired surface pattern.

=================================================================== Enum-casing convention: UPPERCASE

PASS/WARN/QUARANTINE/FAIL and CLEAN/SHADOW/BLOCK are UPPERCASE here, which INVERTS the lowercase convention in audit.graphql (allow/deny/ cached/signed), memory.graphql (write/read/expire/evict/invalidate), and broker.graphql (RoutingVerdict allow/deny/transform).

Why UPPERCASE for verified-memory: the frontend's typed Verdict and QuarantineClass are TypeScript STRING-LITERAL UNIONS (verified-memory.ts: 47, 55), declared UPPERCASE: export type Verdict = 'PASS' | 'WARN' | 'QUARANTINE' | 'FAIL'; export type QuarantineClass = 'CLEAN' | 'SHADOW' | 'BLOCK'; The meta-rule "follow the frontend contract verbatim" (audit.graphql:5-15) is the tiebreaker — the frontend shipped UPPERCASE literals first, and inverting the FE would be a much larger blast radius than inverting three SDL files. ADR-050 §Consequences/Negative documents the trade-off explicitly. ───────────────────────────────────────────────────────────────────── Enums ───────────────────────────────────────────────────────────────────── Per-receipt server-computed verdict. Surfaced on every VerifiedMemoryReceiptNode. Derived from receipt_verified + RetrievedFacts[].quarantine_class per ADR-050 §Decision:

precedence (strict): FAIL > QUARANTINE > WARN > PASS

1. receipt_verified=false (any reason) OR receipt undecodable → FAIL
2. ∃ fact with quarantine_class=BLOCK → QUARANTINE
3. ∃ fact with quarantine_class=SHADOW → WARN
4. otherwise (all CLEAN, or facts empty) → PASS

The verdict is server-computed because client-side derivation would mis-color a paginated dashboard view (a BLOCK or SHADOW fact on page 2 of the same receipt's facts list must not be invisible from page 1). Computation lives at internal/mguard/verdict.go (Go reference impl).

| Value | Description | | --- | --- | | FAIL | Receipt verification rejected OR receipt undecodable. rose/destructive tone, XCircle icon. Distinct from QUARANTINE by icon + label copy. | | PASS | All facts CLEAN; receipt verified. moss/success tone, CheckCircle2 icon. | | QUARANTINE | ≥1 BLOCK fact (regardless of others); receipt verified. rose/destructive tone, ShieldAlert icon. | | WARN | ≥1 SHADOW fact, no BLOCK; receipt verified. amber/warning tone, AlertTriangle icon. |

VirtualKeyStatus

Virtual-Keys console GraphQL schema (AP00002 IAM IAMVirtualKeyService projection) — ENG-2979 / ENG-2898 (ARC-94; ADR-340; design docs/architecture/AP00002-AP00006-VIRTUAL-KEYS-SECRET-REFERENCES-DESIGN.md §7.2).

A virtual key is a managed, revocable, scoped alias over a provider credential carrying its own budget + rate-limit + model-allow-list (the Portkey table-stakes primitive). IAM is the authority of record: pointer-custody of the SecretRef, the KMS-HMAC alias digest, the durable revocation floor, the per-vkid budget binding (ENG-2892). The edge is a THIN PASS-THROUGH — it forwards the caller's identity to IAM, derives the workspace/org from the JWT, validates the workspaceId filter == the JWT workspace, and maps the response.

─────────────────────────────────────────────────────────────────────── SECRET DISCIPLINE (proto invariants / design §7.2 — load-bearing):

• The virtual-key ALIAS (osv_<scope>_<vkid>.<secret>) is the FULL bearer credential. It is returned PLAINTEXT ONCE on issue (and on rotate WITH rotateAlias) and is NEVER persisted or re-queryable. The list read exposes only aliasHint (last-4 of the <secret> segment) + the public, non-secret vkid — NEVER the alias. The edge passes the alias through to the caller and NEVER logs/caches/re-queries it.
• NO raw PROVIDER secret ever crosses this wire — the customer's provider key lives only in their external secret manager; the SecretRefInput carries a POINTER (uri + version), never the secret. local-file is intentionally absent from SecretRefBackend (rejected fail-closed).
• The service-to-service ResolveVirtualKey RPC is DELIBERATELY NOT projected here: it is broker-identity-only (mTLS) and returns the SecretRef pointer + COSE grant bytes; surfacing it on the browser-facing edge would be a credential-resolution bypass.

─────────────────────────────────────────────────────────────────────── NO FLOAT ON THE WIRE (proto BudgetEnvelope.limit_micros = int64): budgets are int64 micros carried as a DECIMAL STRING (bigint-safe; the ENG-2623 convention) so a large ceiling never loses precision through a 32-bit GraphQL Int / a JS number. limitMicros "0" = unlimited (soft-track).

Tenancy: workspaceId on the read is VALIDATED == the JWT workspace at the edge — it is a filter, NEVER a tenant selector. Every write RPC derives the workspace/org from the JWT server-side (proto invariant: there is NO workspace field on any write request); IAM tenant-guards every call.

FAIL-CLOSED: until the IAM IAMVirtualKeyService RPCs are reachable (IAM addr unset, or the deployed IAM predates the RPC -> gRPC UNIMPLEMENTED) the surface returns OSY-VK-NOT-WIRED via UnwiredVirtualKeyService / the gRPC degrade — never a fabricated key. A REVOKED key and a validation rejection are DATA, surfaced faithfully — never a fabricated ACTIVE or alias. ───────────────────────────────────────────────────────────────────── Lifecycle status. Mirrors the IAM VirtualKeyStatus (ADR-340). FAIL-CLOSED: the edge presents ACTIVE only when IAM affirmatively reports ACTIVE; proto UNSPECIFIED (a not-yet-decoded status) or REVOKED both project to REVOKED — a key we cannot confirm ACTIVE is never displayed as usable. ─────────────────────────────────────────────────────────────────────

| Value | Description | | --- | --- | | ACTIVE | | | REVOKED | |

WarehouseSinkKind

Warehouse egress destination-registry GraphQL schema (PLA-95 / ADR-335).

The external BFF projection of AP00005 audit-svc's warehouse.v1.WarehouseDestinationRegistryService — the config surface the shipped Console warehouse tab reads/writes (where a tenant's signed audit/OIR evidence egresses to: their own S3 / ClickHouse / BigQuery). AP00005 is the AUTHORITY OF RECORD: the warehouse_destinations rows, the per-tenant RLS, the minted per-destination STS ExternalId, and the live delivery health (from the merged egress_cursor / egress_dlq tables). The edge is a THIN PROJECTION — it lists / reads / creates / toggles / deletes registry rows; it carries NO delivery or verify logic (that is the merged WarehouseSink + COSE_Sign1 + frozen-manifest loop AP00005 owns).

Six FE ops map 1:1 onto a served backend RPC and are wired here: warehouseDestinations → ListWarehouseDestinations (the registry list, a Relay connection), warehouseDeliveryHealth(id) → GetWarehouseDeliveryHealth (one destination's live delivery position), warehouseEgressIdentity → GetWarehouseEgressIdentity (the global Osyra egress principal the customer's IAM role trust policy must admit), createWarehouseDestination → CreateWarehouseDestination (register + MINT the per-destination ExternalId; BYO-creds only), setWarehouseDestinationEnabled → SetWarehouseDestinationEnabled (flip the delivery-enabled flag), deleteWarehouseDestination → DeleteWarehouseDestination (remove a destination).

TENANCY: the workspace is ALWAYS JWT-derived (no workspace argument); the warehouse_destinations rows are RLS-scoped server-side (ScopeContextServerInterceptor binds the GUC from the transport-authenticated workspace). READS are tenancy-only at the edge (RequireAuth + a workspace claim). WRITES (create / toggle / delete) are ADMIN-CLASS — the warehouse egress config governs where signed evidence flows — so they are additionally scope-gated (warehouseScopeAdmin) BEFORE the RPC, fail-closed to Forbidden, AND re-checked server-side (never rely on the UI gate alone).

FAIL-CLOSED (NO STUBS): an unwired backend / a deployed audit-svc predating the service / the registry disabled server-side (warehouse.registry.enabled=false) degrades to OSY-WAREHOUSE-NOT-WIRED so the console renders its sanctioned "not yet available" banner — never a fabricated destination, ExternalId, health snapshot, or principal ARN. A BigQuery create (deferred WIF seam) or an unconfigured egress identity is a client-actionable precondition error; a malformed config is a validation error; an unknown / cross-tenant id → null (reads) or a false delete. Which warehouse adapter a destination lands through. Mirrors warehouse.v1 WarehouseSinkKind MINUS the proto zero-value UNSPECIFIED (an UNSPECIFIED wire value on a read is dropped/never surfaced; on a create the enum is required). Matches the FE WarehouseSinkKind union.

| Value | Description | | --- | --- | | BIGQUERY | | | CLICKHOUSE | | | S3 | |

WitnessVerdict

Witness-events GraphQL Schema (AP00011 Receipt-Lattice witness feed — wired via ENG-2073) ENG-780: witnessEvents query — workspace-scoped projection of AP00011-osymem's signed-claim / Receipt-Lattice witness-events feed, powering the frontend Witness Auditor (lib/graphql/operations/witnesses.ts, app/(dashboard)/witnesses).

Field set + types match the frontend contract (osyra-frontend PR #201 witnesses.ts) verbatim; ENG-1909 re-included the codegen-validated op once Edge served this surface. WitnessVerdict is a CLOSED enum {valid,invalid, pending,sealed}; operator is an OPEN set typed String (not enum) so a lattice operator added in a later paper revision never fails GraphQL parsing and the FE renders an unknown operator as "⊕ <name>" without crashing.

ENG-2073 wired the resolver to AP00011-ome's ListWitnessEvents RPC (a projection over the signed-claim store). The resolver returns the gqlerror extension code OSY-WITNESS-NOT-WIRED — which the frontend's witness fallback classifier renders as a not-wired banner — only when AP00011-ome is unreachable / OME disabled / pre-GA. Witness verdict — CLOSED set. Lowercase values match the frontend WitnessVerdict type. SDL order is significant (gqlgen preserves it on introspection).

| Value | Description | | --- | --- | | invalid | | | pending | | | sealed | | | valid | |

WorkflowApprovalDecision

HITL decision verb for decideWorkflowApproval.

| Value | Description | | --- | --- | | APPROVE | | | REJECT | |

WorkflowObservationType

Watchdog co-witness observation kind (workflow.v1.ObservationType).

| Value | Description | | --- | --- | | DRAIN_OBSERVED | | | HALT_OBSERVED | | | HEARTBEAT_MISS | | | STOP_SIGNAL_ACK | | | UNSPECIFIED | |

WorkflowRiskTier

Risk tier — the matrix key for watchdog placement/tier minima (workflow.v1.RiskTier).

| Value | Description | | --- | --- | | HIGH | | | LOW | | | MEDIUM | | | UNSPECIFIED | |

WorkflowStatus

Workflow console GraphQL Schema — AP00007 workflow-svc projection (ENG-2044 / EPIC ENG-2034).

Read-and-narrow projection over workflow.v1.WorkflowService (the Pillar-5 Durable AI Workflow Orchestration control-plane). Surfaces the customer-facing workflow console: the run timeline (workflowRuns / workflowRun), the HITL approval queue + approve/reject decision (workflowPendingApprovals / decideWorkflowApproval), and the Agent Termination Receipt viewer (terminationReceipt).

Source-of-truth: docs/architecture/AP00007-WORKFLOW-SERVICE-DESIGN.md §4.1/§4.3 + ADR-124/125/126/137. Wire contract: docs/architecture/proto/workflow/v1/workflow.proto (vendored at the edge as api/proto/workflow/v1/workflow.proto for the bridge).

WIRE TRUTH (load-bearing): the ONE signed artifact AP00007 emits is the Agent Termination Receipt — canonical-CBOR Form B + COSE_Sign1, index-0 dsTag osyra-term-receipt-v1. TerminationReceipt.encodedCborB64 is that wire truth; the decoded scalar fields (and sigHex) are DOCUMENTARY VIEWS. Verification is AP00016's job (the verifier-of-record); this console NEVER trusts the scalar sig/views — it renders the decoded views for human inspection + exposes the CBOR for offline verification.

Tenant isolation (load-bearing): the run namespace is bound from the JWT (OS-Workspace-ID) at the AP00007 interceptor — the edge derives workspace from the JWT, never from input; no type here carries a workspaceId field by construction. The workflowId is a CONSUMER-assigned dedup key scoped to the tenant namespace.

Scope gating: workflowRuns / workflowRun / workflowPendingApprovals / terminationReceipt require the workflow:read JWT scope; decideWorkflowApproval requires workflow:approve. The edge fail-closes on the scope BEFORE the RPC; AP00007 re-checks server-side.

Until WORKFLOW_SERVICE_ADDR is configured the resolver returns OSY-WORKFLOW-NOT-WIRED via UnwiredWorkflowService (fail-closed; NO STUBS — never fabricated runs/receipts). Engine-projected run status (workflow.v1.WorkflowStatus). The kill-switch 4-state machine is carried separately in currentState.

| Value | Description | | --- | --- | | CANCELLED | | | COMPLETED | | | FAILED | | | RUNNING | | | TERMINATED | | | UNSPECIFIED | |

WorkflowStopReasonClass

Kill-switch reason taxonomy (workflow.v1.StopReasonClass; design §4.3.2).

| Value | Description | | --- | --- | | CRASH | | | GRACEFUL | | | POLICY_VIOLATION | | | RESOURCE_EXHAUSTED | | | SECURITY_INCIDENT | | | UNSPECIFIED | | | WATCHDOG_TRIGGERED | |

WorkflowWatchdogPlacement

Topological independence of the watchdog attestor (workflow.v1.WatchdogPlacement).

| Value | Description | | --- | --- | | CROSS_AZ | | | CROSS_CLOUD | | | SAME_CLUSTER | | | UNSPECIFIED | |

WorkflowWatchdogTier

Trust-domain diversity tier of the watchdog attestor (workflow.v1.WatchdogTier).

| Value | Description | | --- | --- | | CUSTOMER | | | NOTARY | | | OSYRA | | | UNSPECIFIED | |

WorkspaceRole

| Value | Description | | --- | --- | | ADMIN | | | DEVELOPER | | | VIEWER | |

WorkspaceStatus

| Value | Description | | --- | --- | | ACTIVE | | | DELETED | | | SUSPENDED | |