Generated file — do not edit by hand. Produced by tooling/gen-graphql-ref.py from the OSYRA edge GraphQL SDL.

Object Types

257 object type(s).

A12crManifest

The Art-12 Conformity Record (A12CR) binding index — signed, offline-verifiable (§6.2). Every field is DATA: the purpose-map / annex flag / checkpoint are first-class A12CRManifest scalars AP00005 projects from the encoder inputs (byte-identical to the signed manifest_cbor), and a12crBound is the terminal weld. The edge NEVER decodes the signed Form-B blob and NEVER re-derives a binding — NO STUBS.

| Field | Type | Description | | --- | --- | --- | | a12crBound | String! | The terminal weld SHA-256 over manifest fields 0..4 (map key 5), lowercase hex. | | annexIii1aPresent | Boolean! | True iff the system is BIOMETRIC and the manifest carries the Annex-III(1)(a) min-field bindings (manifest map key 3 present). False in V1 (no biometric min-field feed). | | auditCheckpointCid | String! | The covering AP00005 audit-checkpoint CID binding evidence-integrity (map key 4), lowercase hex. | | fromTs | String! | RFC-3339 UTC window bounds (the epoch-ms proto ts projected to ISO for display). | | purposeMap | Art12PurposeMap! | | | systemId | String! | | | untilTs | String! | |

AIUsage

| Field | Type | Description | | --- | --- | --- | | avgLatencyMs | Int! | Average latency in milliseconds | | byModel | [ModelUsage!]! | Breakdown by model | | byProvider | [ProviderUsage!]! | Breakdown by provider | | completionTokens | String! | Total completion tokens (decimal String, bigint-safe int64; ENG-2977). | | promptTokens | String! | Total prompt tokens (decimal String, bigint-safe int64; ENG-2977). | | totalCostMicrocents | Int! | Total cost in micro-cents | | totalRequests | String! | Total requests in the period (decimal String, bigint-safe int64; ENG-2977). | | totalTokens | String! | Total tokens consumed (decimal String, bigint-safe int64; ENG-2977). |

ActiveGuardrailBundle

The active guardrail-policy bundle cascade for the caller's workspace, top-down (platform → org → workspace; absent layers omitted).

| Field | Type | Description | | --- | --- | --- | | layers | [GuardrailBundleLayer!]! | |

ActiveRoutingConfig

The resolved (cascade-merged, bounds-validated) routing config in force, plus the verified layers it was derived from.

| Field | Type | Description | | --- | --- | --- | | blockedModels | [String!]! | | | blockedProviders | [String!]! | Deny-wins union across the cascade (a child may ADD, never remove). | | canary | RoutingCanaryView | | | dynamicScore | Boolean! | | | layers | [RoutingConfigLayer!]! | Contributing verified layers, top-down (org → workspace → resource). | | modelPrefs | [RoutingModelPref!]! | | | reliability | RoutingReliabilityView! | | | resolvedSha256 | String! | Lowercase hex SHA-256(CoreDet-CBOR(merged)) — the resolved-config anchor the edge forwards to the broker (ENG-2708 provenance). | | strategy | String! | |

ActivityEvent

A single recent-activity entry — a real request the Edge observed and recorded.

| Field | Type | Description | | --- | --- | --- | | action | String! | Short action verb describing what happened (e.g. "request.completed"). | | actor | String! | Human-meaningful identity that performed the action: the authenticated user ID (JWT sub), or the OAuth client ID for service tokens. Never empty (anonymous traffic is not recorded). | | id | ID! | Unique, time-ordered identifier (also the audit event_id). GraphQL node ID. | | outcome | ActivityOutcome! | success / failure, classified from the HTTP response status. | | requestId | String | Request ID correlating this entry with the audit pipeline + logs. Null when absent. | | resource | String! | The thing acted upon — the request method + path (e.g. "POST /api/v1/chat/completions"). Real, observed; never fabricated. | | statusCode | Int | HTTP status code the Edge returned. Null/0 when not applicable. | | timestamp | String! | ISO-8601 UTC timestamp of when the Edge observed the event (e.g. "2026-06-05T14:32:00.123456789Z"). The frontend parses via new Date(timestamp).getTime() and renders relative time. |

AgentRunReceipt

The re-decidable Agent Run Receipt. encodedCbor is the COSE_Sign1 wire (base64) for offline verify.

| Field | Type | Description | | --- | --- | --- | | agentDid | String! | | | cid | String! | Content id (lowercase hex). | | contextRoot | String! | READ-gate context_root (lowercase hex, RFC-6962 MTH). | | egressDigestSet | [String!]! | Sorted-unique egress digests (lowercase hex). | | encodedCbor | String! | The signed COSE_Sign1 receipt, base64 — the offline-verifiable source of truth. | | iss | String! | | | runId | String! | | | sessionId | String! | | | tokensLimit | String! | Token budget ceiling (decimal string; 0 = unbounded). The full used/limit snapshot is in the verified encodedCbor. | | toolCallSet | [String!]! | Sorted-unique tool-call digests (lowercase hex). |

AgentRunReceiptsPage

| Field | Type | Description | | --- | --- | --- | | hasMore | Boolean! | | | nextCursor | String | | | nodes | [AgentRunReceipt!]! | |

AgentSandboxCapacity

Runtime-wide sandbox capacity (backpressure signal). Counts are decimal strings (no Int 53-bit cap).

| Field | Type | Description | | --- | --- | --- | | active | String! | | | max | String! | |

AgentSandboxState

A session's isolation instance (the console's live sandbox view).

| Field | Type | Description | | --- | --- | --- | | instanceId | String! | Adapter-specific instance handle (telemetry only). | | status | AgentSandboxStatus! | | | tier | String! | gvisor | procjail | microvm |

AgentSession

One agent run's resource view. Identity fields feed the Agent Run Receipt.

| Field | Type | Description | | --- | --- | --- | | agentDid | String! | | | envId | String! | | | id | ID! | | | iss | String! | | | runId | String! | | | sandbox | AgentSandboxState! | | | sessionId | String! | | | state | AgentSessionState! | |

AgentSessionsPage

| Field | Type | Description | | --- | --- | --- | | capacity | AgentSandboxCapacity! | | | hasMore | Boolean! | | | nextCursor | String | | | nodes | [AgentSession!]! | |

AmgateDecision

Attested-Memory-Gate decision-log GraphQL Schema (AP00011-ome ListAmgateDecisions projection) — ENG-2514 (ARC-31 / ADR-281; edge -> ENG-2421 FE)

Customer-facing read surface for the attested-memory-I/O dashboard: the paginated history of Attested-Memory-Gate decisions (admits AND denials) for the caller's workspace, projected from AP00011-ome over the ListAmgateDecisions RPC (the SANITIZED AmgateDecisionProjection — NO crypto inputs). The frontend (ENG-2421) polls this query to render the memory-I/O admission timeline.

─────────────────────────────────────────────────────────────────────── HONEST-SCOPE (ADR-177 D5, NON-NEGOTIABLE; /osyra-legal ENG-1741 gate): these are CHANNEL-ENFORCEMENT records of the memory I/O channel (input-provenance admission on READ + output-receipt binding on WRITE) — NOT cognition-control, and NOT a claim that the model only reasons over attested memory. The gate enforces what crosses the memory I/O boundary; it makes no claim about the model's internal reasoning or memory correctness.

─────────────────────────────────────────────────────────────────────── Tenant isolation (LOAD-BEARING): the workspace is ALWAYS derived from the JWT server-side — there is deliberately NO workspaceId input field (mirrors verified-memory / receipts / drift / verifyRetrieval; defense-in-depth per ENG-777 SEC-H1). OME additionally binds the workspace from the OS-Workspace-ID gRPC header server-side (server-authoritative tenancy via the ome.workspace_id GUC / RLS, ADR-051). A caller cannot probe another workspace's decision log even by guessing identifiers, because no workspace argument is exposed.

─────────────────────────────────────────────────────────────────────── Pagination: keyset (cursor) pagination, NEWEST-FIRST, mirroring ListReceipts. cursor is the opaque token returned as nextCursor on the previous page (empty for page 1); nextCursor is empty once the final page is reached. The limit is server-clamped to [1, 200] (0 → default 50). since / until are inclusive decision-time bounds (DateTime → Unix ms; an absent bound is open).

─────────────────────────────────────────────────────────────────────── Until OME_ENABLED / an OMEClient is wired the resolver returns OSY-AMGATE-NOT-WIRED via UnwiredAmgateService (fail-closed; NO STUBS — never a fabricated decision). Same unwired-surface contract as OSY-VERIFY-RETRIEVAL-NOT-WIRED. ───────────────────────────────────────────────────────────────────── Node shapes ───────────────────────────────────────────────────────────────────── A single sanitized Attested-Memory-Gate decision (the backend AmgateDecisionProjection). HONEST-SCOPE (ADR-177 D5): a CHANNEL-ENFORCEMENT record of the memory I/O channel, NOT cognition-control / memory-correctness. Carries NO crypto inputs (DCap / SignedMemoryRoot / OsyidxJmtProof) by design.

| Field | Type | Description | | --- | --- | --- | | allowed | Boolean! | True = admitted/committed; false = denied/rejected. (Both outcomes are surfaced — the dashboard renders the admission timeline, not just denials.) | | code | String! | The OSY-AMGATE-85xx band code for the outcome. | | decisionId | String! | Stable identifier for this decision row (also the keyset-pagination tie-break). | | key | String! | The memory key the operation targeted. | | op | String! | The memory I/O operation this decision gated: "READ" or "WRITE". | | reason | String! | Human-readable rationale (sanitized server-side; MUST NOT leak secrets). | | stage | String! | The decision stage name (CAPABILITY, POLICY, SOURCE_ADMISSIBILITY, ATTESTATION, TRUST_ANCHOR, COMMIT) at which the outcome was determined. | | timestamp | DateTime! | Decision timestamp (decoded from the projection's Unix-ms field). |

AmgateDecisionConnection

One page of Attested-Memory-Gate decisions. decisions is newest-first. nextCursor is the opaque keyset token for the FOLLOWING page; it is null/empty once the final page has been returned (NOT set merely because the page filled).

| Field | Type | Description | | --- | --- | --- | | decisions | [AmgateDecision!]! | | | nextCursor | String | |

ApiKey

| Field | Type | Description | | --- | --- | --- | | createdAt | DateTime! | | | expiresAt | DateTime | | | id | ID! | | | keyHint | String! | | | keyId | ID! | | | lastUsedAt | DateTime | | | name | String! | | | orgId | ID! | | | owner | ApiKeyOwner | Present only on the explicitly selected WORKSPACE_KEYS inventory after IAM re-authorizes api_keys:manage. It is absent on the self-only read. | | prefix | String! | | | quotaPerDay | Int! | 0 = no SANDBOX allowance (LIVE / TEST). SANDBOX is exactly 100 requests in a server-authoritative rolling 24h window keyed to org+workspace+user. | | revokedAt | DateTime | | | scope | ApiKeyScope! | | | updatedAt | DateTime! | | | userId | ID! | | | workspaceId | ID! | |

ApiKeyBulkRevocationPreview

| Field | Type | Description | | --- | --- | --- | | affectedCount | Int! | | | confirmationText | String! | | | operationBinding | String! | | | scope | ApiKeyBulkRevokeScope! | |

ApiKeyBulkRevocationResult

| Field | Type | Description | | --- | --- | --- | | affectedCount | Int! | | | idempotentReplay | Boolean! | | | operationId | ID! | |

ApiKeyOwner

| Field | Type | Description | | --- | --- | --- | | displayName | String! | | | userId | ID! | |

Art12PurposeMap

The Art-12(2) statutory-purpose → evidence-CID binding map (§6.2 manifest map key 2). Each CID is lowercase hex. The three lists are byte-identical to what the signed manifest_cbor commits — AP00005 projects them from the encoder's in-process inputs (the edge never decodes the signed blob).

| Field | Type | Description | | --- | --- | --- | | art12_2aRiskSubstantialMod | [String!]! | Art-12(2)(a): substantial-modification trigger evidence CIDs (lowercase hex). | | art12_2bPostMarketMonitoring | [String!]! | Art-12(2)(b): sealed post-market-monitoring PMMR CIDs (lowercase hex). | | art12_2cDeployerArt26_5 | [String!]! | Art-12(2)(c): deployer Art-26(5) monitoring evidence CIDs (lowercase hex; empty in V1). |

AttestedLogRecord

A single decoded osyra-attlog-v1 attested-log record. The encodedRecord canonical signed CBOR is the SOURCE OF TRUTH (re-verify offline); the remaining fields are decoded VIEWS for display/routing.

| Field | Type | Description | | --- | --- | --- | | agentDid | String! | Subject / agent DID this attested-log stream belongs to. | | correlationKey | String! | Cross-Evidence Correlation Key (CECK, ADR-373): the server-minted request_id joining this attested-log record to the same request/decision across the proof plane. HONESTLY "" today — AP00012 does not yet bind the CECK into the signed attested-log envelope (out-of-lane; never proximity/actor/time-joined, ADR-373 §2/§5). Same forward-contract posture as metadata above: declared now, graduates with ZERO frontend change once sourced. | | encodedRecord | String! | The canonical signed osyra-attlog-v1 CBOR wire bytes, lowercase hex. SOURCE OF TRUTH: a consumer re-verifies the per-record Ed25519 signature + the gap-free causal chain OFFLINE from this. All other fields are decoded VIEWS of it. | | metadata | JSON | Per-record custom-metadata (ENG-2843 / E6.5) — the free-form Portkey-grade key/value annotations a caller attaches to a request. The forward-compatible JSON view (the reserved metadata scalar; audit.graphql) the Console renders per row as key=value chips. HONEST SCOPE (NO STUBS): the osyra-attlog-v1 signed record body carries the nine attestation fields ONLY (version / tenantId / agentDid / seq / prevRecordHash / tUnixNs / payloadKind / payload / payloadKeyId) — it does NOT carry caller custom-metadata, and AP00012's AttlogRecordItem projects none. So this field is HONESTLY NULL today for every record (the Console shows the calm "No metadata" empty-state — never a fabricated value). It is the forward wire-contract: when the upstream record + the GetAttlogTrajectory projection graduate to carry custom-metadata (tracked with the live E2E stack, PLA-142 / ENG-2844) the resolver forwards it here with ZERO GraphQL/frontend change. | | payloadKeyId | String! | SEALED per-record key handle (empty string for CLEARTEXT records). | | payloadKind | AttestedLogPayloadKind! | Wire-format version tag — "osyra-attlog-v1" (decoded view; MUST match the encodedRecord). | | prevRecordHash | String! | Lowercase hex of the predecessor record's recordHash — the 32-byte causal hash-link. Genesis (the first record in a stream) is 32 zero bytes ("0000...0"). A verifier walks recordHash ← prevRecordHash to reconstruct the gap-free chain. | | recordHash | String! | Lowercase hex of SHA-256 over the canonical UNSIGNED record body. This is BOTH the per-tenant record-MMR LEAF value AND the causal-chain link value (a successor's prevRecordHash equals this). The tamper-evident MMR/chain anchor. | | seq | Int! | Per-(tenant, stream) gap-free monotonic sequence number. A gap in seq is a tamper/loss signal (AP00012 surfaces it as a terminal verdict while streaming). | | shredded | Boolean! | True when the record body is sealed (encrypted at rest per-record). Convenience boolean mirroring payloadKind == SEALED (the dashboard renders a lock badge). | | timestamp | DateTime! | Record timestamp (decoded from the signed body's Unix-ns field). | | version | String! | Wire-format version tag — "osyra-attlog-v1" (decoded view; MUST match the encodedRecord). |

AttestedLogTrajectory

A bounded attested-log trajectory for one agent stream. records is GUARANTEED NEWEST-FIRST: the edge sorts by record timestamp descending (records[0] is the newest) before applying the limit, so the limit always retains the most recent records. (AP00012 GetAttlogTrajectory emits oldest-first by gap-free seq; the edge re-orders for the viewer.) The list is capped — the edge drains AP00012's GetAttlogTrajectory server-stream into a bounded slice and then clamps to limit. truncated is true when MORE records genuinely existed than were returned (the server-side drain cap was hit, or more records existed than the requested limit) — the client may narrow the time range to see more. It is NOT set merely because the result filled the page.

| Field | Type | Description | | --- | --- | --- | | records | [AttestedLogRecord!]! | | | truncated | Boolean! | True when more records genuinely existed than were returned (drain cap hit or more records than the requested limit). |

AuditEventNode

One audit event — the DECODED VIEW (AuditEventView) of the signed canonical-CBOR Form B preimage. These scalars are an index projection; the authoritative signed bytes + chain-of-custody are fetched per-event via GetEventDetail (a follow-up detail pane; not surfaced in this list view). On any discrepancy the wire-truth encoded_cbor is authoritative.

| Field | Type | Description | | --- | --- | --- | | action | String! | Dotted action verb (e.g. "iam.role.grant", "ome.claim.emit"). Customer-facing. | | actorPrincipal | String! | Resolved actor ORN (the principal who acted). Customer-facing. | | category | AuditCategory! | GCP-taxonomy category of the event. | | chainKey | String! | Tenant chain identity ('org:<uuid>' | 'org:<uuid>:ws:<uuid>'). | | contentHash | String! | Lowercase hex SHA-256 of the signed Form B preimage (the chain link). | | correlationId | String! | Caller-influenced grouping hint (client X-Correlation-ID); FORGEABLE — NOT the cross-evidence join key. Empty string when absent. Use correlationKey for joins. | | correlationKey | String! | Cross-Evidence Correlation Key (CECK, ADR-373): the SERVER-MINTED, unforgeable request_id — the one authoritative key for joining this record to the same request/decision across the proof plane (receipts / witness / attested-log / drift). Empty string = pre-CECK / honest absence (never fabricated). Distinct from correlationId above. | | emitterService | String! | Emitter service identity class ('AP00001'..'AP00011') — the signer. | | id | ID! | Lowercase hex of the 16-byte UUIDv7 event id (the idempotency key + detail key). | | occurredAt | DateTime! | Emitter-asserted business time (decoded from the signed body's epoch-ms field). | | outcome | AuditOutcome! | Operation outcome. | | resourceOrn | String! | Target resource ORN; empty string when the event is not resource-scoped. | | seq | String! | Consumer-assigned monotonic position within the tenant chain (genesis 0). |

AuditEventsPage

A page of audit events + the opaque keyset continuation cursor (over ts DESC, seq DESC). nextCursor is null on the final page (clients pass it back verbatim).

| Field | Type | Description | | --- | --- | --- | | hasMore | Boolean! | | | nextCursor | String | | | nodes | [AuditEventNode!]! | | | totalCount | String! | Covering-index total estimate for the range (exact for a bounded range). |

AuditExportReceipt

Receipt for a signed .audit.zip export (ADR-123 D5). The bytes are NOT returned through GraphQL — the client follows presignedUrl (a short-TTL S3 GET) to download, then verifies the bundle offline against manifestSha256 + signedBy.

| Field | Type | Description | | --- | --- | --- | | exportId | ID! | Stable export id (first 32 hex chars of the manifest SHA). | | manifestSha256 | String! | Lowercase hex SHA-256 of the canonical-CBOR manifest (the signed-over digest); the auditor recomputes this offline and matches the platform signature. | | nEvents | String! | Count of events in the bundle (the set-completeness binding). | | presignedUrl | String! | Short-TTL (default 15 min) presigned S3 GET URL to exports/<id>.audit.zip. | | signedBy | String! | Lowercase hex of the raw 32-byte platform audit signer public key (the published verification key the auditor checks the bundle signature against). | | urlExpiresAt | DateTime! | Presigned-URL expiry (epoch-ms decoded to DateTime). |

BillingPlan

BillingPlan represents a pricing plan

| Field | Type | Description | | --- | --- | --- | | basePriceMicrocents | Int! | Pricing | | billingInterval | BillingInterval! | Monthly base price | | description | String | | | features | [String!]! | Feature flags | | id | ID! | | | includedRequests | Int | | | includedTokens | Int | Included resources | | includedUsers | Int | | | includedWorkspaces | Int | | | isCurrent | Boolean! | Is this the current plan? | | name | String! | | | requestOveragePriceMicrocents | Int | | | tokenOveragePriceMicrocents | Int | Overage pricing (micro-cents per unit) |

BillingPortalSession

BillingPortalSession is a single-use Stripe Customer Portal session (ENG-455). Sessions are valid for a short time and consumed on first navigation; after expiry the URL returns Stripe's "session expired" page.

| Field | Type | Description | | --- | --- | --- | | expiresAt | DateTime | Authoritative expiration timestamp, when the upstream provides one. ENG-1020: Stripe does NOT return an expiry on Customer Portal session creation and AP00003-billing's CreatePortalSessionResponse carries only portal_url, so Edge has no authoritative value and returns null rather than a synthesized one (NO fabricated data). The UI should re-mint on click; this becomes non-null only once the upstream supplies a real expiry. | | url | String! | Stripe-hosted portal URL. Redirect the user here. |

BillingSubscription

BillingSubscription represents a billing subscription (Named BillingSubscription to avoid conflict with GraphQL root Subscription type)

| Field | Type | Description | | --- | --- | --- | | cancelAtPeriodEnd | Boolean! | Cancellation info | | canceledAt | DateTime | | | cancellationReason | String | | | createdAt | DateTime! | Dates | | currentPeriodEnd | DateTime! | | | currentPeriodStart | DateTime! | Billing cycle | | id | ID! | | | organizationId | ID! | | | plan | BillingPlan! | Current plan | | status | BillingSubscriptionStatus! | Subscription status | | trialEnd | DateTime | | | trialStart | DateTime | Trial info | | updatedAt | DateTime! | |

Budget

One budget (design §6.2 type Budget).

| Field | Type | Description | | --- | --- | --- | | alertThresholdPcts | [Int!]! | Utilization percentages (1..100) at which an alert fires, e.g. [80, 100]. | | enabled | Boolean! | | | id | ID! | | | mode | BudgetMode! | | | scopeId | String! | The concrete scope subject (org id / workspace uuid / provider slug / api-key id). | | scopeType | BudgetScope! | | | spend | BudgetSpend! | | | usdCeilingCents | String! | Ceiling as an EXACT integer-cents string. |

BudgetSpend

Live spend snapshot for a budget's CURRENT subscription-relative period (design §6.2 type BudgetSpend).

| Field | Type | Description | | --- | --- | --- | | committedCents | String! | Settled/committed spend this period, EXACT integer-cents string. | | periodEnd | String! | | | periodStart | String! | Period start / end, Unix epoch SECONDS (ADR-001 subscription-relative), as a decimal String — bigint-safe and Y2038-proof (ENG-2977; never narrowed to a 32-bit Int, which overflows on 2038-01-19). The FE parses via Number(...). | | reservedCents | String! | Reserved-but-not-settled spend this period, EXACT integer-cents string. | | utilizationPct | Float! | Server-authoritative utilization, 0..100 (may exceed 100 for a SOFT overage); derived at the edge from (committed+reserved) / ceiling. |

BundleManifest

The decoded view of a signed bundle manifest. encodedCborB64 is the WIRE-TRUTH signed preimage; the remaining fields are informational decoded views. Byte fields are surfaced as lowercase hex; null parent layer (platform) → empty.

| Field | Type | Description | | --- | --- | --- | | abiVersion | String! | | | bundleVersion | Int! | | | cascadeLevel | CascadeLevel! | | | compilerToolchain | String! | | | createdAt | DateTime! | | | dsTag | String! | Domain-separation tag the signature is bound to ("osyra-policy-bundle-v1"). | | encodedCborB64 | String! | WIRE-TRUTH: the signed canonical-CBOR manifest, standard base64. | | keyVersion | Int! | | | parentLayerSha256 | String! | 32-byte parent-layer hash (lowercase hex; empty for the platform/root layer). | | scopeId | String! | | | sig | String! | Ed25519 signature (64 bytes) + raw signer public key (32 bytes), lowercase hex. | | signerPub | String! | | | sourceSha256 | String! | | | wasmSha256 | String! | 32-byte hashes, lowercase hex. |

BundleVersionList

The version history + active version at a scope.

| Field | Type | Description | | --- | --- | --- | | activeVersion | Int! | | | versions | [BundleManifest!]! | |

CacheSavingsPoint

ENG-3223: one bucket of the cache-savings series.

| Field | Type | Description | | --- | --- | --- | | eventCount | String! | Count of recorded cache-savings rows in the bucket (decimal String, bigint-safe). | | iso | String! | Bucket start, ISO-8601 / RFC3339 UTC. | | savedMicrocents | Int! | SUM(saved_microcents) for mechanism='cache' in the bucket, micro-cents (1 USD = 100_000_000). RAW signed delta sum — never clamped at rest. |

CacheSavingsTimeseries

ENG-3223: time-bucketed cache-savings series (cache $ over time). An EMPTY series with 0 totals is the honest "no cache savings recorded yet" state (e.g. the served model is unpriced) — never a fabricated number.

| Field | Type | Description | | --- | --- | --- | | granularity | UsageGranularity! | | | series | [CacheSavingsPoint!]! | | | totalEventCount | String! | | | totalSavedMicrocents | Int! | Range totals: savedMicrocents = SUM over the range (micro-cents); eventCount = count of recorded rows (decimal String, bigint-safe int64). |

CanarySpec

The deterministic cohort-split parameters for a canary deployment. The cohort assignment is RE-DECIDABLE from these committed inputs (not a truth claim about the variant). When routingBundleCid is present the AP00019 signed routing bundle owns the split; otherwise this inline form is the AP00011-local fallback.

| Field | Type | Description | | --- | --- | --- | | baselineCid | String! | The control template content hash, lowercase hex. | | candidateCid | String! | The variant-under-test template content hash, lowercase hex. | | routingBundleCid | String | The AP00019 routing bundle that owns the split, lowercase hex; null = inline split. | | splitBps | Int! | Candidate traffic in basis points (0..10000). |

ChatCompletionChunk

Individual chunk from a streaming response

| Field | Type | Description | | --- | --- | --- | | delta | ChatDelta! | The content delta for this chunk | | finishReason | FinishReason | Why the model stopped generating (only on final chunk) | | id | ID! | Unique completion ID (same across all chunks in a stream) | | index | Int! | Chunk index in the stream (0-based) | | model | String! | The model being used | | usage | TokenUsage | Token usage (only on final chunk) |

ChatCompletionResponse

| Field | Type | Description | | --- | --- | --- | | finishReason | FinishReason! | Why the model stopped generating | | id | ID! | Unique completion ID | | latencyMs | Int! | Request latency in milliseconds | | message | ChatMessage! | The generated message | | model | String! | Model used for the completion | | provider | String! | Provider that served this request | | toolCalls | [ToolCall!] | Tool calls if any were made | | usage | TokenUsage! | Token usage for this completion |

ChatDelta

Content delta in a streaming chunk

| Field | Type | Description | | --- | --- | --- | | content | String | Content fragment | | role | ChatRole | Role (only in first chunk) | | toolCalls | [ToolCallDelta!] | Tool call fragments (for function calling) |

ChatMessage

| Field | Type | Description | | --- | --- | --- | | content | String! | | | name | String | | | role | ChatRole! | |

CheckoutSession

CheckoutSession is a Stripe Checkout session for a plan upgrade (ENG-2659).

| Field | Type | Description | | --- | --- | --- | | expiresAt | DateTime | Authoritative expiration timestamp, when the upstream provides one. ENG-1020 precedent: AP00003-billing's CreateCheckoutSessionResponse carries only {checkout_url, session_id}, so Edge has no authoritative Stripe expiry and returns null rather than a synthesized one (NO fabricated data). Becomes non-null once AP00003 surfaces the Stripe Session's expires_at (ENG-2659 follow-up). | | sessionId | String! | Stripe Checkout session id (cs_...). | | sessionUrl | String! | Stripe-hosted checkout URL. Redirect the user here. |

ComplianceControlMatrix

The control-matrix read model for one scope.

| Field | Type | Description | | --- | --- | --- | | controls | [ComplianceControlStatus!]! | | | degraded | Boolean! | True when the matrix is INCOMPLETE and the console must render an explicit notice rather than treat it as a complete posture — today the sole edge trigger is a truncated catalog (the near-dead page-loop bound). The PLATFORM admin-gate is NOT surfaced here: it is a typed OSY-AUDIT-7260 error the FE classifies as platform-gated. NEVER a silent blank. | | degradedReason | String | | | registryVersion | String! | The active control-registry version id (compliance_registry_version) this matrix was computed against — sourced from the backend ListControls version_id, NOT the registry digest. | | scope | ComplianceScope! | |

ComplianceControlStatus

Latest ControlStatus for one control in the selected scope, joined with its registry entry (title + framework mapping come from the registry catalog; result/timestamps from the collector status).

| Field | Type | Description | | --- | --- | --- | | collectedAt | String | RFC-3339 UTC of the latest collector run for this control; null when PENDING. | | collectorVersion | String | The collector build that produced the status; null when PENDING. | | controlId | String! | | | degradedReason | String | Bounded reason string when result === DEGRADED; null otherwise. (No per-control reason is carried on the compliance.v1 ControlStatus wire today, so this is currently always null — never a fabrication.) | | evidenceRef | String | Opaque pointer to the proving evidence (chain-key + seq range); null when PENDING (no status yet). | | frameworkRefs | [ComplianceFrameworkRef!]! | All framework controls this mechanism proves. | | result | ComplianceResult! | | | scope | ComplianceScope! | | | title | String! | The prose Osyra mechanism name (registry osyra_control). |

ComplianceEvidenceRecord

One collected CER in a control's evidence history (the ENG-2982 drill-down), decoded read-only from its SYSTEM_EVENT in the WORM audit-of-record. Every field is DATA from AP00005 — the edge invents nothing.

| Field | Type | Description | | --- | --- | --- | | collectedAt | String | RFC-3339 UTC the CER was collected (the SYSTEM_EVENT ts); null when absent. | | collectorVersion | String | The collector build that produced the CER; null when absent. | | controlId | String! | | | cti | String! | The SIGNED CER content id: hex(SHA-256(CanonicalCbor(encoded_cbor))), 32 bytes. NEVER null. | | eventId | String! | The SYSTEM_EVENT id (uuid) this CER rode. | | evidenceRef | String | Opaque pointer into the audit-of-record (chain-key + seq range); null when the CER carries no ref. | | frameworkRefs | [ComplianceFrameworkRef!]! | All framework controls this CER attests, parsed from the registry <framework>:<controlRef> refs. | | note | String | Bounded verdict-code note (e.g. OSY-AUDIT-7271 for a DEGRADED run); null otherwise. No PII. | | periodId | String! | The ISO week the collector run covered (e.g. "2026-W27"). | | result | ComplianceResult! | The collector verdict for this run. DEGRADED is NEVER promoted to PASS. | | scope | ComplianceScope! | | | seq | Int! | The CER's seq in its tenant hash-chain. (int64 surfaced as Int; platform-wide widening = ENG-2977.) | | signatureValid | Boolean! | AP00005 re-derived this CER's chain + covering-checkpoint signature over its proving range and it VERIFIED. An unsealed (freshness-lag) or integrity/signature/inclusion-failed CER is false — this is a genuine re-verification result, NEVER a fabricated pass. |

ComplianceFrameworkRef

One framework control reference a mechanism satisfies (e.g. SOC2 · CC6.1), parsed at the edge from a <framework>:<controlRef> registry framework_ref.

| Field | Type | Description | | --- | --- | --- | | controlRef | String! | | | framework | ComplianceFramework! | |

Connector

A single ingestion connector + its real per-workspace status.

| Field | Type | Description | | --- | --- | --- | | displayName | String! | Human-readable connector name for the console. | | id | ID! | Stable connector id (e.g. the source descriptor). | | lastWindowEnd | String | End (Unix seconds) of the most recent covered window for this connector; null if never covered. | | recentGaps | String! | Count of recent coverage gaps observed for this connector. | | status | String! | CONNECTED | DEGRADED | NOT_CONNECTED — the real per-(ws,connector) status. |

ContentBoundEnablement

───────────────────────────────────────────────────────────────────── The entitlement record (metadata-only; no regulated cleartext — design §7). Projects the IAM ContentBoundEnablementResponse. kms_key_arn (gate 2) is REQUEST-ONLY and intentionally NOT echoed back in the record. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | approverChecker | String! | Gate 5: ORN of the checker (server-recorded); empty until ACTIVE. | | approverMaker | String! | Gate 5: ORN of the maker (server-recorded from the authenticated maker). | | dlpProfileId | String! | Gate 6: the DLP profile id. | | dpaReference | String! | Gate 3: the DPA document reference. | | enabledAt | String! | Unix seconds the grant became ACTIVE, as a decimal String; "0" until ACTIVE. String (not Int) to avoid the GraphQL Int 32-bit overflow on int64 epochs (house style — cf. receipts.graphql enabledAt / AP00022 startUnix/endUnix; the 2038 ceiling). | | enablementId | String! | IAM enablement id (e.g. "cbe_..."). | | legalSignoffRef | String! | Gate 4: the /osyra-legal sign-off record id. | | orgId | String! | The owning org (server-derived). | | residencyRegion | String! | Gate 1 (INVARIANT): the pinned residency region (ADR-290 data residency; distinct from the workspace/data-plane region). | | status | ContentBoundEnablementStatus! | The six-gate status. ACTIVE only when IAM judged all six gates clear AND checker != maker. | | workspaceId | String! | The workspace the grant is scoped to. |

CostBreakdown

A cost breakdown over one dimension (design §6.2 type CostBreakdown).

| Field | Type | Description | | --- | --- | --- | | costStatus | CostStatus! | | | dimension | String! | The dimension the rows are grouped by (echoes the request: provider/model/workspace). | | provenance | PricingProvenance | SET iff costStatus == COST_AVAILABLE. | | rows | [CostBreakdownRow!]! | Ranked by cost desc; EMPTY on COST_UNAVAILABLE (fail-closed, never fabricated). |

CostBreakdownRow

One row of a cost breakdown (design §6.2 type CostBreakdownRow).

| Field | Type | Description | | --- | --- | --- | | costCents | String! | EXACT integer-cents string for the row's spend (bigint-safe). | | key | String! | The dimension key — a provider slug, a model id, or a workspace id. | | requests | String! | requests/tokens: decimal String, bigint-safe int64 (ENG-2977 — a heavy org's window-summed counts realistically exceed 2^31; never narrowed to 32-bit Int). | | tokens | String! | SUM(prompt+completion) tokens metered for the key over the window. |

CostEstimate

CostEstimate is the projection of the broker's EstimateCostResponse (ENG-3042). Token counts cross the wire as decimal Strings (bigint-safe int64, ENG-2977); the estimate itself is Int microcents (matches RoutingDecision.estimatedCostMicrocents); the per-million-token prices stay decimal USD Strings — $30/M is 3,000,000,000 microcents, which overflows the GraphQL 32-bit Int, so the broker's exact decimal string passes through.

| Field | Type | Description | | --- | --- | --- | | estimatedCostMicrocents | Int! | Estimated total cost in microcents — millionths of a cent (1 USD = 100_000_000 microcents). Always >= 0. | | estimatedInputTokens | String! | Estimated input tokens. Decimal String, bigint-safe (ENG-2977). | | estimatedOutputTokens | String! | Estimated output tokens (heuristic, bounded by maxTokens when supplied). Decimal String, bigint-safe (ENG-2977). | | inputPricePerMillionUsd | String! | Input-token price per million tokens, exact decimal USD string (e.g. "30.00"). String because the microcent projection overflows Int32. | | model | String! | Model the estimate was computed for. | | outputPricePerMillionUsd | String! | Output-token price per million tokens, exact decimal USD string. | | provider | String! | Provider that serves the model (e.g. "openai"). |

CostSavings

CostSavings is the projection of the broker's cost-optimization metrics for the calling workspace and time window.

ENG-1035: field types now follow the codebase convention — Int microcents for money (matches ModelUsage.costMicrocents; avoids float money rounding) and the DateTime scalar for instants (matches User.createdAt et al.). This supersedes the ENG-777 interim lock to PR #200's Float-USD / String-ISO frontend shape; the frontend re-vendors this SDL + regenerates in the same merge window. See docs/decisions/ENG-1035-broker-type-unification.md.

| Field | Type | Description | | --- | --- | --- | | actualMicrocents | Int! | What the workspace actually spent after routing, in microcents. | | baselineMicrocents | Int! | What the workspace would have spent on the priciest-baseline model for the same prompts, in microcents. | | periodEnd | DateTime! | Exclusive end of the reporting window. | | periodStart | DateTime! | Inclusive start of the reporting window. | | routedAwayPercent | Float! | Percentage of requests routed off the workspace's default model. 0-100. | | savedMicrocents | Int! | Savings: baselineMicrocents - actualMicrocents. Always >= 0. Microcents — millionths of a cent (1 USD = 100_000_000 microcents), matching the codebase's microcentsPerUsd convention. | | window | String! | Window resolved by the resolver after default + whitelist normalization. Always one of "7d", "30d", "90d". |

Coverage

The coverage/gap summary for the caller's workspace (optionally one window).

| Field | Type | Description | | --- | --- | --- | | coveragePct | Float! | SERVER-DERIVED coverage percentage: covered / (covered + gapped) * 100. | | covered | String! | Number of covered windows. | | freshness | String | The most recent coverage emitted_at (Unix seconds); null if none. | | gapped | String! | Number of gapped windows. | | gaps | [CoverageGap!]! | The gap ledger (bounded list of the windows that are not covered). |

CoverageGap

A coverage gap — a window AP00022 expected to cover but did not (or covered with a fault).

| Field | Type | Description | | --- | --- | --- | | connectorId | ID! | The connector the gap is attributed to. | | reason | String! | Why the window is gapped (AP00022-supplied reason). | | window | CoverageWindow! | The window the gap covers. |

CoverageWindow

Ingestion connector console GraphQL schema (AP00022 IngestionService projection) — ENG-2509

Customer-facing READ surface for the ENG-2499 connector frontend: the connector catalog + per-connector ingestion status, the coverage/gap summary (the "are we capturing everything?" dashboard), and the per-window receipt bundle a regulator re-verifies offline. Projected from AP00022-osyra-ingestion-svc's IngestionService READ RPCs (ListConnectors / GetCoverage / GetWindowReceipts).

SERVER-DERIVED TRUTH: coverage_pct is re-derived SERVER-SIDE by AP00022 from the stored coverage receipts + the gap ledger — never trusted off the client. The receipt bundle bytes are what AP00022 actually emitted (AP00022 holds no signing key; it only READS). NO STUBS: never a fabricated connector, coverage, or receipt.

─────────────────────────────────────────────────────────────────────── Tenant isolation (load-bearing — the ENG-2499 confidentiality invariant): the workspace is ALWAYS derived from the JWT (ctxkeys.WorkspaceID), NEVER from query input. There is intentionally NO ws/workspace argument on any field below — a caller cannot name a workspace. The resolver stamps the JWT workspace onto the outbound AP00022 request body (req.Ws), which is the SOLE scope AP00022 enforces (it scopes by req.GetWs(), not metadata). This mirrors the same JWT-derived-scope discipline as drift / receipts / auditEvents.

─────────────────────────────────────────────────────────────────────── Until INGESTION_SERVICE_ADDR is configured the resolver returns OSY-INGEST-NOT-WIRED via UnwiredIngestionService (fail-closed; NO STUBS) — same unwired-surface contract as OSY-AGENTRT-NOT-WIRED / OSY-DRIFT-NOT-WIRED. A half-open time window [start, end). Unix seconds. The same shape AP00022 uses to key a coverage window.

| Field | Type | Description | | --- | --- | --- | | endUnix | String! | Window end (Unix seconds, exclusive). | | startUnix | String! | Window start (Unix seconds, inclusive). |

CreateApiKeyResult

| Field | Type | Description | | --- | --- | --- | | apiKey | ApiKey! | | | idempotentReplay | Boolean! | ENG-3220: true when this response is an idempotent REPLAY of a prior create that carried the same Idempotency-Key header (no new credential was minted; plaintextKey is empty). A first/normal create leaves this false. Only the createApiKey mutation can set it true; rotateApiKey always returns false. | | plaintextKey | String! | Plaintext key — returned ONCE, never persisted, never readable again. EMPTY on an idempotent replay (idempotentReplay=true): the one-time secret was returned on the ORIGINAL create and is never re-derivable. |

CuaAction

The DECODED 8-kind action as a flat projection keyed by verb. Only the fields relevant to verb are populated (the console re-keys it to a per-verb discriminated union). Every payload is NON-PII: a type action carries only charCount + fieldKind; submit/select carry lowercase-hex digests, never values.

| Field | Type | Description | | --- | --- | --- | | at | CuaPoint | click / type / scroll / submitForm / select target point. | | button | CuaMouseButton | click button. | | charCount | Int | type character count (the typed text is NEVER on the wire — only keystrokeCommit). | | chord | [String!] | keyboardShortcut chord tokens (in order). | | clicks | Int | click count. | | dx | Int | scroll delta x. | | dy | Int | scroll delta y. | | fieldKind | CuaFieldKind | type field-kind hint. | | formDigest | String | submitForm RFC-6962 MTH over the canonical submitted form (lowercase hex, 32-byte). | | from | CuaPoint | drag start point. | | optionDigest | String | select commitment over the chosen option (lowercase hex, 32-byte). | | to | CuaPoint | drag end point. | | toOrigin | String | navigate target RFC-6454 origin. | | verb | CuaActionVerb! | | | via | CuaNavVia | navigate method. |

CuaActionReceipt

The console-facing projection of one signed cua-action receipt (ADR-229 D6). encodedCbor is the authoritative COSE_Sign1 wire (base64) for offline re-verify; the remaining fields are the AP00018-decoded display summary. Every 32-byte commitment is lowercase hex; the nullable hash slots (consentWitness / priorReceiptHash / keystrokeCommit) are null when the receipt carries the wire null.

| Field | Type | Description | | --- | --- | --- | | action | CuaAction! | pos 9 — the action (8-kind tagged union). | | agentDid | String! | pos 3 — CLAIMED acting agent DID. | | capabilityAttest | String! | pos 12 — hash of the OAP-PCE/OAEC envelope that authorized (lowercase hex). | | consentWitness | String | pos 13 — hash of an ASKCAP consent receipt, or null (Art-14 human-in-loop). | | decision | CuaPolicyVerdict! | The AP00019 pre-action gate verdict recorded for this action. | | domDiffMerkle | String! | pos 10 — RFC-6962 MTH over the canonical DOM-delta (lowercase hex). | | encodedCbor | String! | The signed COSE_Sign1 receipt, base64 — the offline-verifiable source of truth. | | keystrokeCommit | String | pos 16 — BLAKE3(keystroke-bytes) commitment, ASKCAP-gated (lowercase hex), or null. | | policyBundleRef | String! | The SHA-256 of the AP00019 policy bundle this action was gated under (lowercase hex). | | postScreenshotCid | String! | pos 8 — BLAKE3(canonical-PNG(post-frame)) (lowercase hex). | | preScreenshotCid | String! | pos 7 — BLAKE3(canonical-PNG(pre-frame)) (lowercase hex). | | priorReceiptHash | String | pos 15 — 32-byte chain link to the prior receipt (lowercase hex), or null at genesis (step 0). | | receiptId | String! | Content id of the signed COSE_Sign1 envelope (lowercase hex) — the row key. | | riskClass | CuaRiskClass! | pos 5 — DERIVED reversibility class (never caller-asserted). | | runCid | String! | pos 4 — run content-address binding the action to its agent run (lowercase hex). | | selector | CuaSelector! | pos 11 — ≥2-of-4 target selector. | | sessionId | String! | pos 1 — anti-transplant per-session id (lowercase hex). | | stepNumber | Int! | pos 2 — per-session monotone strictly-increasing causal index. | | timestamp | CuaTimestamp! | pos 14 — RFC-3161 TSA / Roughtime attestation. | | urlOrigin | String! | pos 6 — RFC-6454 origin the action targeted. | | verifyStatus | CuaVerifyStatus! | The COSE_Sign1 verify-on-read status. |

CuaActionReceiptsPage

| Field | Type | Description | | --- | --- | --- | | hasMore | Boolean! | | | nextCursor | String | | | nodes | [CuaActionReceipt!]! | |

CuaBBox

A bounding box (int32; NO float) — one of the ≥2-of-4 selector slots.

| Field | Type | Description | | --- | --- | --- | | h | Int! | | | w | Int! | | | x | Int! | | | y | Int! | |

CuaPoint

A viewport-relative integer coordinate pair (NO float on the wire; int32 range).

| Field | Type | Description | | --- | --- | --- | | x | Int! | | | y | Int! | |

CuaReDecision

The outcome of re-deciding ONE receipt (ENG-2462 replay engine; ADR-230 D4) — the OSYRA re-decision differentiator. It is RE-DECIDED over the pinned body, not a recorded verdict read back.

| Field | Type | Description | | --- | --- | --- | | chainLinkVerified | Boolean! | Whether priorReceiptHash linked to the prior receipt (chain integrity). | | driftCode | String | OSY-CUA reason code on a mismatch (e.g. OSY-CUA-7907 replay-redecision-drift), or null on a clean reproduction. | | matches | Boolean! | True when recorded == re-decided AND the chain link verified (no drift). | | reDecidedDecision | CuaPolicyVerdict! | The verdict the replay engine re-derived over the pinned body. | | recordedDecision | CuaPolicyVerdict! | The originally-recorded verdict pinned in the receipt. |

CuaRoleName

An ARIA role + accessible name — one of the ≥2-of-4 selector slots.

| Field | Type | Description | | --- | --- | --- | | name | String! | | | role | String! | |

CuaSelector

The ≥2-of-4 ambiguous-target mitigation tuple (cua-selector, T-8). At least 2 of {css, xpath, rolename, bbox} are present; an unset slot is null.

| Field | Type | Description | | --- | --- | --- | | bbox | CuaBBox | | | css | String | | | rolename | CuaRoleName | | | xpath | String | |

CuaTimestamp

A verifiable time attestation (cua-timestamp).

| Field | Type | Description | | --- | --- | --- | | source | CuaTimeSource! | | | tokenCid | String! | BLAKE3/CID over the external TSA/Roughtime token, bound not stored (lowercase hex). | | unixMs | String! | The attested wall-clock instant as unix milliseconds (decimal string; no Int 53-bit cap). |

DecisionPreview

An authoring decision preview (dry-run).

| Field | Type | Description | | --- | --- | --- | | decision | String! | "ALLOW" | "DENY" | "IMPLICIT_DENY". | | matched | [String!]! | Identifiers of the rule(s)/statement(s) that matched. | | reason | String! | |

DomainVerification

The status of a domain-ownership verification challenge (ADR-368 §5 / ENG-3111). The challenge lives on the registrable-domain APEX (eTLD+1). The dnsRecord* / roleEmail fields are populated ONLY by requestDomainVerification (the sole challenge issuer); a checkDomainVerification poll returns the status WITHOUT re-emitting challenge material.

| Field | Type | Description | | --- | --- | --- | | dnsRecordName | String | DNS_TXT issue only (_osyra-challenge.<apex>); null on a poll. | | dnsRecordValue | String | DNS_TXT issue only (osyra-domain-verify=<public nonce>); null on a poll. | | domain | String! | The registrable-domain APEX the challenge lives on. | | expiresAt | String | RFC3339 UTC — challenge TTL. Null when not applicable. | | method | String! | DNS_TXT | EMAIL | SSO. | | registrableDomain | String! | eTLD+1 (== domain for an apex row). | | roleEmail | String | EMAIL issue only (<role>@<apex>); null on a poll. | | status | String! | PENDING | VERIFIED | FAILED | EXPIRED | REVOKED. | | verificationId | ID! | | | verifiedAt | String | RFC3339 UTC — set once VERIFIED. Null while unverified. |

DriftPoint

A single decoded drift point (one per-window BAR), surfaced with neutral, trade-secret-safe field names.

| Field | Type | Description | | --- | --- | --- | | agentDid | String! | Subject / agent DID the drift point was measured for. | | anchorCid | String! | Lowercase hex of the MMR/JMT anchor CID committing this point (empty string when the point has not yet been anchored). The dashboard renders this as the tamper-evident anchor link. | | attestorDid | String! | Streaming-attestor DID that produced the point. | | baselineAxes | TrustAxes! | The baseline trust axes the drift score is measured against. | | correlationKey | String! | Cross-Evidence Correlation Key (CECK, ADR-373): the server-minted request_id joining this drift point to the same request/decision across the proof plane. HONESTLY "" today — AP00012 does not yet bind the CECK into the signed BAR/drift envelope (out-of- lane; never proximity/actor/time-joined, ADR-373 §2/§5). Declared for a stable Evidence Explorer contract; graduates with ZERO frontend change once sourced. | | driftBudget | Int! | The configured drift budget for this window's deployment. A drift score above the budget is the headline dashboard signal. | | driftScore | Int! | The drift score for this window: integer 0-1530 (higher = more drift from baseline). Decoded from the signed body. Neutral product name — NOT the internal operator/vector notation. | | timestamp | DateTime! | Window-end timestamp (decoded from the signed body's Unix-ns field). | | trustAxes | TrustAxes! | The 6 trust axes measured this window (current values, "hexagon_t"). | | validUntil | DateTime! | Point validity horizon (decoded from the signed body's epoch-seconds field). | | verification | DriftVerification! | Authoritative AP00012-computed verification status for this point. |

DriftTrajectory

A bounded trajectory of decoded drift points for one agent. points is GUARANTEED NEWEST-FIRST: the edge sorts by window-end timestamp descending (points[0] is the newest) before applying the limit, so the limit always retains the most recent window. (AP00012 GetTrajectory emits oldest-first per T-DRIFT-2; the edge re-orders for the dashboard.) The list is capped — the edge drains AP00012's GetTrajectory server-stream into a bounded slice and then clamps to limit. truncated is true when MORE points genuinely existed than were returned (the server-side drain cap was hit, or more decoded points existed than the requested limit) — the client may narrow the time range to see more. It is NOT set merely because the result filled the page.

| Field | Type | Description | | --- | --- | --- | | points | [DriftPoint!]! | | | truncated | Boolean! | True when more points genuinely existed than were returned (drain cap hit or more decoded points than the requested limit). |

DriftVerification

Authoritative cryptographic verification status of a single drift point, computed by AP00012's VerifyBAR RPC (which resolves the per-tenant session key INTERNALLY — the edge does NOT hold it). valid is the full signature + structural-invariant + freshness + anchor pass/fail; failureReasons carries the OSY-DRIFT-* code(s) on failure (empty on success). The edge-side display decode never substitutes for this status.

| Field | Type | Description | | --- | --- | --- | | anchorOk | Boolean! | Whether the point's anchor membership check passed (when an anchor proof was supplied; otherwise reflects the server's anchor evaluation). | | driftActual | Int! | The actual measured drift the point exhibited (server-authoritative). | | driftBudget | Int! | The drift budget the point was checked against (server-authoritative). | | failureReasons | [String!]! | OSY-DRIFT-* code(s) explaining a failed verification (empty on success). | | monotonicityOk | Boolean! | Whether the trust-axes monotonicity invariant held for this point. | | valid | Boolean! | |

DsarConnection

The DSAR intake-queue read model — a Relay connection over ListDsarRequests. Reuses PmmPageInfo.

| Field | Type | Description | | --- | --- | --- | | edges | [DsarRequestEdge!]! | | | pageInfo | PmmPageInfo! | |

DsarRequest

One data-subject request (the dsar_request row projection, §5 V8). Epoch-ms timestamps are projected to RFC-3339 UTC strings; the CID witnesses are lowercase hex, null until minted.

| Field | Type | Description | | --- | --- | --- | | artifactCid | String | SAB .dsar.zip manifest CID OR EFR CID (lowercase hex); null until fulfilled. | | ccpaDoNotSell | Boolean! | | | dsarId | String! | | | dueAt | String! | receivedAt + statutory window (default 30d), RFC-3339 UTC — drives the T-72h due badge. | | fulfilledAt | String | RFC-3339 UTC when fulfilled; null while unfulfilled (never a fabricated timestamp). | | kind | DsarKind! | | | receivedAt | String! | The statutory clock start (RFC-3339 UTC). | | status | DsarStatus! | | | subjectRef | String! | Opaque subject identifier (resolved to per-surface scopes server-side, §4.4). | | verificationMethod | DsarVerificationMethod | Subject-proofing method; null until proofed (never a fabricated method). | | verifiedAt | String | RFC-3339 UTC when proofing was recorded; null ⇒ export/erasure fail closed (4020). |

DsarRequestEdge

One edge in the DSAR intake-queue connection. cursor is a per-row opaque marker (base64 of the dsarId); continuation uses pageInfo.endCursor (the backend page token), not the per-edge cursor.

| Field | Type | Description | | --- | --- | --- | | cursor | String! | | | node | DsarRequest! | |

EfrSubjectBinding

The subject-binding tuple welded into the EFR (§6.4 field 1). NO billing leg (lawfully retained, D5).

| Field | Type | Description | | --- | --- | --- | | auditActorOrn | String! | | | omeDataClass | String! | | | streamScope | String! | |

EfrSurfaceReceipt

One per-surface OERASER erasure receipt reference (§6.4 field 3).

| Field | Type | Description | | --- | --- | --- | | oeraserCid | String! | The minted OERASER receipt CID (lowercase hex). | | surface | ErasureSurface! | |

EligibleDefaultProvider

One eligible provider for a model (design §4.1.2 type EligibleDefaultProvider). The picker enumeration — the server-side anti-gaming bound (§4.3.3). Prices are global signed list-price catalog data (org-less by ADR-167 §7); the auth on the eligibleDefaultProviders query gates the workspace surface, not the price data.

| Field | Type | Description | | --- | --- | --- | | inputPerMTokens | String! | | | outputPerMTokens | String! | fixed-point string (billing money convention) | | pricingVersion | Int! | fixed-point string int64 on the wire; same resolver-side overflow guard as version. | | provider | String! | |

EmailChangeResult

Result of an email-change operation (ENG-2729). Deliberately MINIMAL + enumeration-neutral: a single success flag with NO field that could leak account existence or token state. On the initiate path success is always true (IAM is enumeration-neutral); on confirm/cancel a failure surfaces as a UNIFORM GraphQL error, never as success=false-with-detail.

| Field | Type | Description | | --- | --- | --- | | success | Boolean! | |

Embedding

| Field | Type | Description | | --- | --- | --- | | dimensions | Int! | Number of dimensions | | index | Int! | Index of this embedding in the request | | vector | String! | The embedding vector (as JSON array string for efficiency) |

EmbeddingResponse

| Field | Type | Description | | --- | --- | --- | | embeddings | [Embedding!]! | The generated embeddings | | id | ID! | Unique request ID | | latencyMs | Int! | Request latency in milliseconds | | model | String! | Model used | | provider | String! | Provider that served this request | | usage | EmbeddingUsage! | Token usage |

EmbeddingUsage

| Field | Type | Description | | --- | --- | --- | | estimatedCostMicrocents | Int! | Estimated cost in USD (micro-cents) | | totalTokens | Int! | ENG-2977: per-request count backing the OpenAI-compatible REST usage object; bounded and integer-contracted — stays Int! (see TokenUsage scope note). |

ErasureFulfilment

The composed Art-17 Erasure Fulfilment Record (the EFR projection, §6.4). Every field is DATA AP00005 minted / projected. efrCid / efrBound are null while pending (never an empty-hex or fabricated CID); a BLOCKED erasure never returns this (executeErasure fails closed with a validation error instead).

| Field | Type | Description | | --- | --- | --- | | dsarId | String! | | | efrBound | String | Terminal weld over the EFR fields (lowercase hex); null while pending (deferred read-model). | | efrCid | String | The minted EFR EAT receipt CID (lowercase hex); null while pending mint / no surface erased. | | subjectBinding | EfrSubjectBinding! | | | surfaceList | [ErasureSurface!]! | The ENUMERATED surfaces this EFR claims coverage over (sorted+unique); an unknown wire surface is dropped. | | surfaceReceipts | [EfrSurfaceReceipt!]! | |

EvalReceipt

EvalReceipt is the re-decidable eval receipt minted by submitEvalRun. eatWireB64 / carrierB64 are the offline-re-derivable artifacts a relying party feeds to verifyEvalReceipt (or verifies wholly offline).

| Field | Type | Description | | --- | --- | --- | | carrierB64 | String | The base64-standard-encoded detached eat-disclosure-v1 carrier (the re-decide input). NULL on reject. | | claimFence | String! | The externally-safe claim-discipline attestation text (always present — on success AND on reject). | | ctiHex | String | The receipt id (lowercase hex of the CWT cti). NULL on reject. | | eatWireB64 | String | The base64-standard-encoded signed oev.v1 EAT envelope ("osyra-eat-v1"). NULL on reject. | | minted | Boolean! | True iff AP00016 minted a signed receipt (the submit succeeded). False on a fail-closed reject (reason). | | modelId | String | The model the run was attributed to (echoed for display; vendor-neutral). NULL on reject. | | nCorrect | String | The grader's Σ verdict over the committed suite (uint64 as String) — the "scored nCorrect / nItems" figure. NOT a capability claim (claim-fence). NULL on reject. | | nItems | String | The committed item count (uint64 as String). NULL on reject. | | reason | String! | "" on success; an OEV_/EVAL_ fail-closed reject reason otherwise (NOTHING was signed). | | suiteCidHex | String | The bound committed-suite digest (lowercase hex) — the "MY committed eval" anchor. NULL on reject. |

EvalReceiptVerdict

EvalReceiptVerdict is the offline re-decision of an eval receipt (AP00016 VerifyEnvelope over oev.v1).

| Field | Type | Description | | --- | --- | --- | | accepted | Boolean! | True iff the signature verified AND the OEV re-decider accepted (the recomputed roots match the signed body under the pinned scorer + the disclosed witnesses) AND the nonce was fresh. False on any fail-closed reject — a tampered receipt, a suite-swap, a stale epoch, an absent transcript (the RED state). | | ctiHex | String! | The receipt id (lowercase hex of the CWT cti). | | reason | String! | "ok" on accept; an OEV_* / OSY-EAT-57xx reject reason otherwise. | | receiptKind | String! | The dispatched EAT receipt_kind ("oev.v1"). Surfaced so the console confirms it re-decided an eval receipt. |

EventSubscription

One outbound governance-event subscription (registry row projection).

| Field | Type | Description | | --- | --- | --- | | createdAt | DateTime! | | | destinationUrl | String! | Destination URL (https-only, SSRF-validated at registration by billing). | | enabled | Boolean! | false = disabled (kept for audit; the dispatcher skips it). | | eventTypes | [String!]! | Wire event-type filter strings this subscription receives. | | id | ID! | | | transport | EventTransport! | Delivery transport. SLACK/EMAIL are registry-accepted but dispatcher-HELD in V1.5 (honest state — rows exist, deliveries wait for the transport). | | updatedAt | DateTime! | |

ExportMemoryArchivePayload

───────────────────────────────────────────────────────────────────── Payloads ───────────────────────────────────────────────────────────────────── exportMemoryArchive result. The signed OMP archive (WIRE-TRUTH) is returned base64; archiveId + itemCount are decoded views for display.

| Field | Type | Description | | --- | --- | --- | | archiveB64 | String! | The signed OMP archive (osyra-omp-archive-v1), STANDARD base64. THE signing surface — verify the Ed25519 archive signature over the decoded bytes. | | archiveId | String! | Lowercase hex of the 32-byte SHA-256 archive id (decoded view). | | itemCount | Int! | Number of memory items in the archive (decoded view). |

GatedMemoryReadPayload

| Field | Type | Description | | --- | --- | --- | | admitted | Boolean! | True iff the read was admitted by the gate. | | decision | AmgateDecision! | | | valueB64 | String | The committed value bytes, base64-encoded; present iff admitted. |

GatedMemoryWritePayload

| Field | Type | Description | | --- | --- | --- | | committed | Boolean! | True iff the write was committed; a denied write is a PROVABLE NO-OP. | | decision | AmgateDecision! | The structured gate decision (reuses the sanitized amgate decision projection). | | epoch | String! | The post-commit durable sequence_no (int64 as String — §D2 emit-after-commit; int64 is String to avoid the GraphQL Int 53-bit overflow, like receipt epoch). |

GuardrailBundleLayer

One verified cascade layer of the active guardrail-policy bundle.

| Field | Type | Description | | --- | --- | --- | | activeDetectorSet | [String!]! | The default-OFF gate: ONLY detectorIds named here run (ENG-2691). | | aggregationRule | String! | Verdict aggregation rule identifier (e.g. severity-max). | | bundleVersion | Int! | Monotonic signed bundle version for this (cascadeLevel, scopeId). | | cascadeLevel | String! | Cascade position: platform / org / workspace (child overrides parent; deny-wins composition happens in the enforcer, layers shown verbatim). | | effectiveAt | DateTime! | Publish timestamp of the signed layer. | | perDetectorThresholds | [GuardrailDetectorThresholds!]! | Per-detector score→action ladders. | | policySha256 | String! | Lowercase hex SHA-256(CoreDet-CBOR(policy)) — the bundle CID anchor. | | scopeId | String! | | | signerKeyVersion | Int! | Signing key version under the (cascadeLevel, scopeId) cascade authority (ADR-075 keying; the signer identity is the allowlisted authority for the scope — key material is never on the wire). |

GuardrailCutpoint

───────────────────────────────────────────────────────────────────── Guardrail-policy bundle projection (ENG-2810 / ARC-58, ENG-2689)

Read projection of the ACTIVE signed AP00019 guardrail-policy bundle (dsTag osyra-guardrail-policy-v1) for the caller's JWT workspace — which detectors are active, their score→action cutpoint ladders, and the bundle provenance (policy_sha256 anchor / version / signer key).

IDOR-safety: the workspace is derived from the VALIDATED JWT ctx, never from input (there is no workspace argument by design).

NO-STUBS: until the AP00019 guardrail-bundle read surface ships (distribution is a gated later step of ENG-2689; the gRPC ActiveBundleSet carries policy + routing-config kinds only today), the production binding is UnwiredGuardrailService → the typed OSY-GUARDRAIL-NOT-WIRED gqlerror the console maps to the sanctioned FallbackBanner. A null result from a WIRED binding means "no bundle published for this workspace" — an honest empty, distinct from not-wired. ───────────────────────────────────────────────────────────────────── One score→action cutpoint: at/above thresholdMilli (0..1000 milli-score, no float) the detector's recommended action escalates to action (0 LOG_ONLY / 1 REDACT / 2 RETRY / 3 FALLBACK / 4 DENY — the OGVR ladder).

| Field | Type | Description | | --- | --- | --- | | action | Int! | | | thresholdMilli | Int! | |

GuardrailDetectorThresholds

A detector's score→action ladder (cutpoints ascending by threshold AND severity — monotone, enforced at bundle verify; below the first cutpoint the action is LOG_ONLY).

| Field | Type | Description | | --- | --- | --- | | cutpoints | [GuardrailCutpoint!]! | | | detectorId | String! | |

HistogramBucket

| Field | Type | Description | | --- | --- | --- | | count | Int! | | | le | Float! | Right edge of the bucket (inclusive). Buckets are half-open: (prevLe, le]. |

ImpersonationNotice

───────────────────────────────────────────────────────────────────── The I5 customer impersonation-notice (transparency surface). Projects the AP00009 fail-closed customer notification: the impersonated org's admins see that their org is (or was) under operator impersonation. NON-SECRET metadata only; scoped to the caller's JWT org. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | accessMode | ImpersonationAccessMode! | READ_ONLY or READ_WRITE. | | activeSince | String! | Unix seconds the impersonation became active, as a decimal String. | | expiresAt | String! | Unix seconds the impersonation expires, as a decimal String. | | justification | String! | The business justification (shown to the customer for transparency). | | opId | String! | The op backing this notice. | | operatorOrn | String! | ORN of the operator (server-recorded at AP00009). | | targetOrgId | String! | The org under impersonation (== the caller's JWT org; echoed for display). | | targetWorkspaceId | String | Optional workspace scope (null = org-wide). |

ImpersonationOp

───────────────────────────────────────────────────────────────────── The privileged-op status projection (non-secret metadata only; NO grant/token material). Projects the AP00009 op record for the operator console's status panel. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | accessMode | ImpersonationAccessMode! | READ_ONLY (2-of-N) or READ_WRITE (3-of-N). | | expiresAt | String! | Unix seconds the op/grant expires, as a decimal String ("0" until known/ACTIVE). | | justification | String! | The business justification recorded with the request (audit-bound). | | opId | String! | AP00009 op id (e.g. "impop_..."). | | quorumCollected | Int! | Distinct-CISO approvals collected so far (server-counted at AP00009; never client-asserted). | | quorumRequired | Int! | Approvals required for accessMode (2 for READ_ONLY, 3 for READ_WRITE). | | requestedAt | String! | Unix seconds the op was requested, as a decimal String ("0" if unknown). String (not Int) to avoid the GraphQL Int 32-bit overflow on int64 epochs (house style — cf. content_bound_enablement.graphql). | | requestedByOrn | String! | ORN of the requesting operator (server-derived from the authenticated principal at AP00009). | | status | ImpersonationOpStatus! | The op lifecycle status. | | targetOrgId | String! | The customer org the operator requested to impersonate into. | | targetWorkspaceId | String | Optional workspace scope within the target org (null = org-wide). |

ImpersonationRevokeReceipt

───────────────────────────────────────────────────────────────────── Revoke receipt — the acknowledgement of a revoke request (non-secret). The authoritative revoke is performed at AP00009; the edge would only project the resulting status. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | opId | String! | The op that was revoked. | | revokedAt | String! | Unix seconds the revoke was recorded, as a decimal String. | | status | ImpersonationOpStatus! | The resulting status (REVOKED on success — surfaced faithfully, never fabricated). |

ImportMemoryArchivePayload

importMemoryArchive result. admitted is the verify-admit verdict; on a refusal reason + errorCode carry the OSY-OMP-65xx / OSY-MEM-5254 code (a non-empty target is the most common refusal — use mergeMemoryArchives for a verified union).

| Field | Type | Description | | --- | --- | --- | | admitted | Boolean! | True iff the archive verified and was admitted into the (empty) target. | | archiveId | String! | Lowercase hex of the 32-byte archive id (decoded view). | | errorCode | String | The canonical OSY-* code on a refusal (e.g. OSY-MEM-5254 non-empty target, OSY-OMP-65xx verify failure); empty/null on success. Lets the client classify the refusal without parsing reason. | | itemCount | Int! | Number of memory items the archive carried (decoded view). | | reason | String! | Human-readable reason on a refusal; empty on success. |

InclusionProof

A JMT inclusion proof for a prompt claim leaf (consumed by lib/osyidx for the in-browser signed-version-badge verify). NULLABLE + currently ALWAYS NULL on this read path: the ListClaims + GetClaimBody RPCs the surface is served over return the sanitized projection + raw body, but NO JMT witness/proof bytes — so the edge will NOT fabricate one (NO STUBS). When AP00011 exposes a claim-inclusion witness (a Prove/GetDerivationChain projection), the proof fields below are populated and the resolver maps them. Until then the field is null and the FE verifies the badge via its own lib/osyidx path.

| Field | Type | Description | | --- | --- | --- | | leafKey | String! | The leaf's position key within the tree. | | root | String! | 32-byte JMT root the leaf is proven against, lowercase hex. | | siblings | [String!]! | Ordered sibling-hash path (lowercase hex), leaf -> root. |

InferenceReceiptVerdict

Standalone inference OIR receipt re-decision (ENG-2566 / ADR-284 V1.5).

The SERVER-AUTHORITATIVE re-decision of a STANDALONE OIR (Osyra Inference Receipt) COSE_Sign1 ("osyra-oir-v1", ADR-142) by AP00016's verifier-of-record. DISTINCT from the two sibling surfaces:

• projectInferenceReceipt (ENG-2551): a DISPLAY-ONLY, sanitized server projection — never a verdict.
• the FE offline verifyOirReceipt (ENG-2552): the relying party's own offline RFC-9338 verify under the server-published oirTrustAnchors. This leg asks AP00016 to re-decide the receipt via oir.ReDecide under the CONFIG-PINNED OIR anchors (the SAME set GetOirTrustAnchors publishes — publish == trust) and DURABLY PERSIST the accepted receipt for the workspace receipt list. It is the authoritative server verdict the dedicated V1.5 RPC was deferred to in ENG-2551's projectInferenceReceipt note.

FAIL-CLOSED: AP00016 re-decides REJECT (accepted=false) under an empty/drifted anchor, a forged/stale/ downgraded receipt, or a cross-tenant ws — NEVER a fabricated accept. An unreachable verifier / unwired surface is an OSY-OIR-NOT-WIRED error (REJECT), never a green verdict. The workspace is JWT-derived (NEVER from input) — AP00016 re-checks it equals the OIR's SIGNED ws (cross-tenant defense).

HONEST-SCOPE (ADR-142 / ADR-177 D5 / ENG-1741): the re-decision binds WHICH inference ran under WHICH gateway-signed folded policy/cap digests — NOT the correctness, safety, or truthfulness of the output.

| Field | Type | Description | | --- | --- | --- | | accepted | Boolean! | True iff AP00016 re-decided the standalone OIR ACCEPT under the config-pinned anchors (every wire + policy leg). False on any fail-closed reject (anchor drift, forged/stale/downgraded receipt, cross-tenant). | | modelId | String | The model the receipt declares (decoded view) — NULL on reject. | | oirIdHex | String | The re-decided OIR id (lowercase hex of the 16-byte UUIDv7) — the durable-list / GetReceipt key. NULL on reject (an unauthenticated receipt's fields are never surfaced). | | reason | String! | "ok" on accept; an "OIR_*: detail" reject reason otherwise (the verifier's bounded, non-oracle string). | | tsUnixMs | String | The receipt's emitted_at Unix ms (uint64 as String to avoid the GraphQL Int 53-bit overflow) — NULL on reject. |

InferenceServedBy

Reports which backend executed the inference (the engine is intentionally not reported — ADR-127).

| Field | Type | Description | | --- | --- | --- | | backendClass | String! | Backend class: VLLM / BEDROCK / CUSTOM_GPU (or UNSPECIFIED). | | poolId | String! | Concrete pool that executed the request. |

InferenceStreamChunk

One StreamExecute server-stream frame projected to GraphQL. usage / finishReason / virId are populated on the TERMINAL chunk only.

| Field | Type | Description | | --- | --- | --- | | delta | String! | Token text for this chunk. | | finishReason | FinishReason | Why generation stopped (only on the terminal chunk). | | servedBy | InferenceServedBy | The backend class + pool that served the request. | | usage | TokenUsage | Token usage (only on the terminal chunk). | | virId | String | AP00016 VIR receipt id, hex-encoded (only on the terminal chunk; empty when fail-open free tier). |

Invitation

| Field | Type | Description | | --- | --- | --- | | createdAt | DateTime! | | | email | String! | | | expiresAt | DateTime! | | | id | ID! | | | invitedBy | User! | | | role | MemberRole! | | | status | InvitationStatus! | |

Invoice

Invoice represents a billing invoice

| Field | Type | Description | | --- | --- | --- | | createdAt | DateTime! | Dates | | currency | String! | Currency (ISO 4217) | | discountMicrocents | Int! | | | dueDate | DateTime! | | | id | ID! | | | invoiceNumber | String! | Invoice number for reference | | lineItems | [InvoiceLineItem!]! | Line items | | organizationId | ID! | | | paidAt | DateTime | | | paymentMethodId | ID | Payment info | | paymentMethodLast4 | String | | | pdfUrl | String | Download URL (time-limited) | | periodEnd | DateTime! | | | periodStart | DateTime! | Billing period | | status | InvoiceStatus! | Invoice status | | subtotalMicrocents | Int! | Amounts in micro-cents | | taxMicrocents | Int! | | | totalMicrocents | Int! | |

InvoiceConnection

| Field | Type | Description | | --- | --- | --- | | edges | [InvoiceEdge!]! | | | pageInfo | PageInfo! | | | totalAmount | Int! | |

InvoiceEdge

| Field | Type | Description | | --- | --- | --- | | cursor | String! | | | node | Invoice! | |

InvoiceLineItem

| Field | Type | Description | | --- | --- | --- | | description | String! | | | id | ID! | | | model | String | Optional metadata | | quantity | Int! | | | totalMicrocents | Int! | | | unitPriceMicrocents | Int! | | | workspaceId | ID | |

IssueVirtualKeyPayload

───────────────────────────────────────────────────────────────────── Issue response (proto IssueVirtualKeyResponse). alias is the FULL bearer credential osv_<scope>_<vkid>.<secret> — PLAINTEXT, returned ONCE, never queryable again. The console reveals it once and discards it. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | alias | String! | | | aliasHint | String! | | | notAfter | String! | | | vkid | String! | |

LMeetNode

Algebra-operator witness sub-record. Only the operator string, the hex SHA-256 digest of the monotonicity proof bytes, and the composition path are exposed — raw proof bytes are AC2 secrets-denylist.

| Field | Type | Description | | --- | --- | --- | | compositionPath | [String!]! | Upstream receipt IDs (hex SHA-256) composed by ⊓_imitation. | | monotonicityProofSha | String! | Hex SHA-256 of the monotonicity proof; NEVER the raw bytes. | | operator | String! | Operator identifier (e.g. "imitation-meet"). |

LitigationHoldReceipt

Receipt for a placed/released litigation hold (ADR-123 D8). A hold freezes the range past the 7-yr retention clock; it mutates metadata only, never an event.

| Field | Type | Description | | --- | --- | --- | | caseRef | String! | | | chainKey | String! | | | fromSeq | String! | | | holdId | ID! | | | placedAt | DateTime! | | | placedBy | String! | | | status | LitigationHoldStatus! | | | toSeq | String! | |

LoopRecurrence

One observed OBCA per-(workspace, LoopFingerprint) recurrence row (ENG-2623 / ADR-301). Carries ONLY data the runtime actually observed at run completion — NO fabricated fields. agent_did is DELIBERATELY ABSENT (the LoopFingerprint excludes it; ADR-301 §3).

| Field | Type | Description | | --- | --- | --- | | disclosedLineage | [String!]! | The DISCLOSED ordered tool-call lineage commitments (lowercase hex, in execution order) the fingerprint binds to. Order is load-bearing: A→B→A ≠ A→B ≠ B→A. | | lastSeenUnixNs | String! | The runtime monotonic-clock reading at the most recent observation (decimal string, unix ns). A runtime clock value for ordering/recency — NOT a wall-clock attestation. | | loopFingerprint | String! | The 32-byte LoopFingerprint (lowercase hex) over the ORDERED, committed tool-call lineage. The Console keys rows on it. | | recurrenceCount | String! | How many times this exact (workspace, ordered-lineage) loop has recurred across runs (first occurrence = 1). Decimal string (no Int 53-bit cap). rho = loopBase*(count-1). | | stepCount | Int! | The number of reason-act-observe steps in the run that LAST produced this fingerprint. Observability context, NOT a fingerprint input. | | workspace | String! | The JWT-derived, non-rotatable tenant the fingerprint was observed under (the ONLY identity input to the LoopFingerprint). |

LoopRecurrencesPage

| Field | Type | Description | | --- | --- | --- | | nodes | [LoopRecurrence!]! | |

Member

| Field | Type | Description | | --- | --- | --- | | id | ID! | | | joinedAt | DateTime! | | | organization | Organization! | | | role | MemberRole! | | | user | User! | |

MemoryEventNode

| Field | Type | Description | | --- | --- | --- | | actor | String! | Display name of the agent / service that fired the event — user email, service principal, or system tag (e.g. "osymem", "broker", "gateway"). | | bytes | Int | Size of the claim body in bytes, when applicable. Null for events that do not touch a body (e.g. expire, invalidate). | | claimKey | String! | The osyra.claim key the event targeted (e.g. "policy/v1/route-default"). | | claimKind | String! | The osyra.claim kind (e.g. "osyra.claim.policy.v1"). Frontend uses this to pick a renderer for the claim body. | | id | ID! | | | kind | MemoryEventKind! | | | occurredAt | String! | ISO-8601 UTC timestamp (e.g. "2026-05-13T14:32:00.000Z"). Frontend parses via new Date(occurredAt).getTime() and renders relative time. | | summary | String | Optional short human-readable summary (one-line). Null when AP00011 has no summary for the event (e.g. expire, evict). |

MemoryEventsPage

| Field | Type | Description | | --- | --- | --- | | hasMore | Boolean! | | | nextCursor | String | Opaque pagination cursor for the next page; null when hasMore is false. Cursor format is gateway-internal; clients pass it back verbatim. Currently always null (fail-closed unwired surface). Format will be defined when AP00011-osymem ships. | | nodes | [MemoryEventNode!]! | |

MergeMemoryArchivesPayload

mergeMemoryArchives result. Emits the merged OMP archive (live winners), the EAT-hosted Merge Receipt (the offline-re-decidable proof), the anchored merge root, and the surfaced-contradiction audit set.

| Field | Type | Description | | --- | --- | --- | | contradictions | [SurfacedContradiction!]! | The surfaced-contradiction audit set produced by the merge. | | mergeReceiptB64 | String! | The EAT-hosted Merge Receipt (COSE_Sign1, receipt_kind OMMP-2/OMMP-N), STANDARD base64 — the offline-re-decidable proof. Feed it back to verifyMergeReceipt. | | mergeRoot | String! | Lowercase hex of the anchored merge root (== merged archive id), decoded view. | | mergedArchiveB64 | String! | The merged OMP archive (live winners), STANDARD base64 — the signing surface. |

MfaEnrollment

| Field | Type | Description | | --- | --- | --- | | backupCodes | [String!]! | | | qrCodeUrl | String! | | | secret | String! | |

MlBomDownload

───────────────────────────────────────────────────────────────────── ML-BOM download (ENG-2583 / ADR-269 D1) ───────────────────────────────────────────────────────────────────── The regulator-shaped CycloneDX-1.7 ML-BOM AP00016 projected from a VERIFIED oadr.v1 receipt (EU AI Act Art-53(1)(d) PROVIDER-ASSISTANCE — NOT "required by" the Act; ADR-269). The BOM is a DETERMINISTIC projection that CITES the OADR receipt CID (BOM→OADR); it is computed by AP00016 (verify-then-project), NEVER fabricated by the edge. This is the live data path for the FE supply-chain ML-BOM download button (the FallbackBanner is dropped on this path once wired).

FAIL-CLOSED: on any reject (unverifiable envelope, non-oadr.v1 kind, cross-tenant ws, missing disclosure carrier, or an unconfigured attestor-registry snapshot) mlBomB64 is empty (null) and reason carries the AP00016 code — the client must NOT render a hollow BOM. accepted is true ONLY when a real BOM was projected.

| Field | Type | Description | | --- | --- | --- | | accepted | Boolean! | Whether AP00016 verified-then-projected a real BOM (true ⇒ mlBomB64 is non-empty). | | mediaType | String | The CycloneDX-1.7 JSON media type, e.g. "application/vnd.cyclonedx+json; version=1.7". Null on reject. | | mlBomB64 | String | The CycloneDX-1.7 ML-BOM JSON, base64-standard-encoded, for the client download. Null on any fail-closed reject (NO STUBS — never a hollow regulator artifact). | | reason | String! | "ok" on success, or the AP00016 reject reason (e.g. "OADR_WS_MISMATCH", an OSY-EAT-/OSY-VIR- re-decision code, or "ml-bom projection unavailable" when the attestor registry is unconfigured). | | receiptKind | String! | The dispatched EAT receipt-kind discriminator — "oadr.v1" for a supply-chain admission receipt. |

Model

============================================================================ Model and Usage Types

| Field | Type | Description | | --- | --- | --- | | available | Boolean! | Whether the model is available in this workspace. Real-derived: membership in the broker's ListSupportedModels response == available (non-null on purpose). | | capabilities | ModelCapabilities | Capabilities. NULLABLE (ENG-2971): not carried by the broker's model list. | | contextWindow | Int | Context window size in tokens. NULLABLE (ENG-2971): not carried by the broker. | | id | ID! | Model identifier (e.g., "gpt-4", "claude-3-opus") | | inputCostPer1K | Int | Cost per 1K input tokens (micro-cents). NULLABLE (ENG-2971): the broker does not surface pricing — null is honest, a fabricated 0 would misprice a model. | | maxOutputTokens | Int | Maximum output tokens. NULLABLE (ENG-2971): not carried by the broker. | | name | String! | Display name | | outputCostPer1K | Int | Cost per 1K output tokens (micro-cents). NULLABLE (ENG-2971): see inputCostPer1K. | | price | ModelPrice | ENG-3058 — per-model published token pricing, batch-joined from Billing's signed model-pricing catalog (GetModelPricing, ADR-167) keyed by (provider, model). NULLABLE: a model with NO pricing row resolves to null — an honest 'unpriced', NEVER a fabricated $0 (a zero would misprice the model; a NO-STUBS violation). Requires provider to be resolved (the pricing key); a model whose provider the edge could not attribute is left unpriced. | | provider | String | Model provider (e.g., "openai", "anthropic", "google"). NULLABLE (ENG-2971): the broker's ListSupportedModels RPC returns model IDs only — no per-model metadata — so the resolver leaves this unset and it marshals as honest null. Non-null here would force a fabricated "" (a NO-STUBS violation). Becomes non-null again when a broker per-model-metadata RPC lands. | | type | ModelType | Model type. NULLABLE (ENG-2971): not carried by the broker's model list. |

ModelCapabilities

| Field | Type | Description | | --- | --- | --- | | chat | Boolean! | | | completion | Boolean! | | | embedding | Boolean! | | | functionCalling | Boolean! | | | jsonMode | Boolean! | | | streaming | Boolean! | | | vision | Boolean! | |

ModelPrice

───────────────────────────────────────────────────────────────────── ENG-3058 — per-model published token pricing (the wire projection of Billing's ai.osyra.model.cost.ModelPricing, served over GetModelPricing / ADR-167).

NO FLOAT ON THE WIRE: every price is a fixed-point DECIMAL STRING (mirrors the source BigDecimal) so microcent reconciliation never loses precision through a JS float — NEVER a GraphQL Float. Per-MILLION-token prices. Each price field is nullable: a source that does not publish that dimension (e.g. no cache pricing) surfaces null rather than a fabricated 0. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | asOf | String | RFC-3339 UTC activation instant of this price row (ModelPricing.effective_date); null if absent. | | cacheReadPerMillion | String | Price per 1,000,000 cache-READ (cached-input) tokens; null when the source has no cache pricing. | | cacheWritePerMillion | String | Price per 1,000,000 cache-WRITE tokens; null — the current signed catalog does not yet publish a cache-write dimension (honest null, never a fabricated 0; the P1 signed-catalog substrate adds it). | | currency | String! | ISO-4217 currency of every price above (e.g. "USD"). Non-null: a priced row always carries a currency. | | inputPerMillion | String | Price per 1,000,000 input (prompt) tokens, decimal string (e.g. "3.00"). | | outputPerMillion | String | Price per 1,000,000 output (completion) tokens, decimal string (e.g. "15.00"). | | signatureVerified | Boolean! | Whether a cryptographic signature over this price was VERIFIED before it was served. REAL as of ADR-362 / money-funnel P1+P2: Billing verifies the row's signed COSE_Sign1 envelope + byte-identity (fail-closed OSY-VALID-4015 under enforcement) and reports the verdict on the wire; the edge projects it (ModelPricing.signature_verified) rather than hardcoding false. A price is never claimed 'signature-verified' unless Billing actually verified one. | | source | String | Provenance source of the number (ModelPricing.source, e.g. "pricing-published-v1"). ADR-362 / money-funnel P1+P2: populated by Billing ONLY on a row whose signed COSE_Sign1 envelope verified; null on an unverified/unsigned row (honest, never fabricated). |

ModelUsage

| Field | Type | Description | | --- | --- | --- | | costMicrocents | Int! | | | model | String! | | | requests | String! | requests/tokens: decimal String, bigint-safe int64 (ENG-2977). | | tokens | String! | |

ModelUsageBreakdown

| Field | Type | Description | | --- | --- | --- | | cacheHits | String! | ENG-3223: per-model cache-HIT count (decimal String, bigint-safe int64). Hit rate = cacheHits / requests — the source of TopModel.cacheHitPct (previously a hardcoded 0). Real SUM(cache_hit) over usage_events for this (model, provider). | | costMicrocents | Int! | | | model | String! | | | provider | String! | | | requests | String! | requests/tokens: decimal String, bigint-safe int64 (ENG-2977). | | tokens | String! | |

OadrAdmissionReceipt

A persisted OADR admission receipt's signed wire (WIRE-TRUTH), surfaced base64-standard for client-side independent verification / export, and the verifier-recomputed verdict. The edge does NOT decode the opaque body — the body fields are re-derived only inside AP00016's re-decision; the customer-facing artifact is the signed envelope + the authoritative verdict.

| Field | Type | Description | | --- | --- | --- | | encodedCborB64 | String! | The canonical signed EAT envelope (WIRE-TRUTH), base64-standard-encoded, for client-side independent verification / export. | | id | ID! | Stable id = lowercase hex of the receipt CTI. The GetReceipt key. | | verification | OadrAdmissionVerdict! | The authoritative AP00016-recomputed admission verdict for this persisted envelope. |

OadrAdmissionVerdict

OADR supply-chain admission GraphQL schema (AP00016 verifier-svc VerifyEnvelope / GetReceipt projection) — ENG-2582 (ARC-29)

Customer-facing surface for the ENG-2531 supply-chain-compliance dashboard: re-verify (offline-style, without trusting the issuer's bytes) an Attested-Data-Origin Admission Receipt (oadr.v1) — the EAT receipt that re-decides a model derivation's training-data parents each carry a third-party origin attestation signed by a key DISTINCT from the trainer, and that the committed derivation is the honest fold of those attested parents (self-declared origin is INADMISSIBLE by construction). This unblocks the live data path of the FE supply-chain surface, which currently runs on a sanctioned FallbackBanner.

AUTHORITATIVE VERDICT: verifyOadrAdmission proxies AP00016's VerifyEnvelope RPC — the verifier holds the L5 verifier-of-record posture and the per-tenant key; the edge does NOT re-decide. The signed oadr.v1 discriminator + opaque body live INSIDE the COSE_Sign1 EAT envelope (dsTag "osyra-eat-v1"); the per-parent OriginAttestation records ride the detached UNSIGNED eat-disclosure-v1 Class-B carrier (disclosed, carrier key 1 == "oadr.v1") and are trusted SOLELY by the verifier re-deriving each e_cid against the signed body. NO STUBS: the verdict is whatever AP00016 actually computed; never a fabricated admission.

─────────────────────────────────────────────────────────────────────── Tenant isolation (load-bearing): the workspace is ALWAYS derived from the JWT (ctxkeys.WorkspaceID), NEVER from input. There is intentionally NO ws/workspace argument on any field below — a caller cannot name a workspace. The resolver stamps the JWT workspace onto the outbound AP00016 request (req.Ws); AP00016 then rejects the verify unless that ws equals the SIGNED workspace claim (OI-1) in the envelope (cross-tenant → OADR_WS_MISMATCH / accepted=false). For the receipt lookup AP00016 RLS-scopes by req.Ws and returns NotFound non-informatively for both wrong-tenant and absent ids (no cross-tenant existence oracle). Mirrors the JWT-derived-scope discipline of receipts / ingestion / drift.

─────────────────────────────────────────────────────────────────────── FAIL-CLOSED: when the verifier is unreachable / unverifiable the surface returns an ERROR (REJECT) — never a green verdict. A malformed envelope, a re-decider rejection, a cross-tenant ws, or an unknown kind all surface as accepted=false with the OADR_* / OSY-EAT-* reason. Until VIR_SERVICE_ADDR is configured the resolver returns OSY-OADR-NOT-WIRED via UnwiredOadrAdmissionService (fail-closed; NO STUBS) — the FE keeps its sanctioned supply-chain FallbackBanner on this code. ───────────────────────────────────────────────────────────────────── Verdict shape ───────────────────────────────────────────────────────────────────── The authoritative admission verdict computed by AP00016's VerifyEnvelope re-decision. accepted is true ONLY when the issuer signature verifies AND the kind's re-decider accepted AND the single-use nonce was fresh + burned. On any failure accepted is false and reason carries the OADR_* / OSY-EAT-57xx / OSY-VIR-56xx code + detail (the edge surfaces it verbatim — these are the verifier's bounded, non-oracle reason strings).

| Field | Type | Description | | --- | --- | --- | | accepted | Boolean! | Whether the OADR admission re-decision accepted the envelope (the supply-chain gate). | | cti | String! | The receipt id (CWT cti) as lowercase hex; the stable lookup key for oadrAdmissionReceipt. Empty when the envelope did not decode far enough to surface it. | | reason | String! | "ok" on success, or the verifier's failure reason code + detail (e.g. "OADR_PARENT_SELF_DECLARED", "OADR_ECID_MISMATCH", "OADR_WS_MISMATCH"). | | receiptKind | String! | The dispatched EAT receipt-kind discriminator the verifier decoded — "oadr.v1" for a supply-chain admission receipt. Empty until the claim set decodes. |

OadrReceiptPage

A page of oadr.v1 admission-receipt summaries plus the opaque continuation cursor. nextPageToken is null on the final page; clients pass it back verbatim as after. The cursor is OPAQUE and carries NO AUTHORITY — AP00016 re-scopes every page by the JWT-derived workspace server-side, so a leaked/forged cursor can never widen visibility. Newest-first ordering (emitted-at DESC, cti tiebreak) is enforced server-side by AP00016.

| Field | Type | Description | | --- | --- | --- | | items | [OadrReceiptSummary!]! | | | nextPageToken | String | |

OadrReceiptSummary

───────────────────────────────────────────────────────────────────── List projection (ENG-2651) ───────────────────────────────────────────────────────────────────── Lightweight oadr.v1 admission-receipt list row — the decoded views AP00016 persisted at mint time (ListOadrReceipts). SUMMARY-ONLY: it deliberately omits the signed EAT wire and the verdict (keeps the list cheap); the full envelope + the authoritative re-verified verdict are fetched via oadrAdmissionReceipt(cti). WIRE-TRUTH: on any discrepancy the canonical signed envelope wins over these convenience projections.

| Field | Type | Description | | --- | --- | --- | | contentHashHex | String! | served_artifact_cid as lowercase hex — the oadr.v1 body's signed key-5 view. | | cti | ID! | Receipt CTI as lowercase hex (32 bytes → 64 hex chars) — the oadrAdmissionReceipt(id) lookup key. | | emittedAtMs | String! | Mint time, Unix milliseconds. Surfaced as a decimal string because uint64 ms overflows GraphQL Int (mirrors tsUnixMs on the inference-receipt surfaces). | | signer | String! | Per-workspace verifier-of-record issuer DID. | | subject | String! | deriving_org — the oadr.v1 body's signed key-4 view. |

OcarCounterpartyView

OCAR trust-mode verification GraphQL schema (AP00016 verifier-svc VerifyEnvelope projection) — ENG-2586 / ENG-2505 (ARC; ADR-182)

Customer-facing surface for the ENG-2506 FE OCAR console: re-verify (relying-party, without trusting the host's bytes) a signed host EAT envelope together with its DETACHED OCAR co-sign bundle (ocar-cosign-v1) in the OCAR TRUST-MODE — the per-counterparty N-of-M co-sign surface. AP00016 admits the host receipt ONLY if >= threshold DISTINCT allowlisted counterparties co-signed the SAME action root the host body projects (fail-closed on fabrication / cross-tenant / threshold-unmet). The verdict is whatever AP00016 actually computed — NO STUBS, never a fabricated admission or co-sign tally.

AUTHORITATIVE VERDICT: verifyOcarTrustMode proxies AP00016's VerifyEnvelope RPC — the verifier holds the L5 verifier-of-record posture, the pinned counterparty allowlist, and the threshold (VIR_OCAR_COUNTERPARTY_ALLOWLIST / VIR_OCAR_THRESHOLD). The edge does NOT re-decide. The OCAR co-sign bundle rides the detached ocar_cosign_bundle field; it carries NO issuer signature and never enters the envelope signature or the single-use nonce burn — its sole integrity binding is the verifier recomputing the action root.

─────────────────────────────────────────────────────────────────────── Tenant isolation (load-bearing): the workspace is ALWAYS derived from the JWT (ctxkeys.WorkspaceID), NEVER from input. There is intentionally NO ws/workspace argument on the field below — a caller cannot name a workspace. The resolver stamps the JWT workspace onto the outbound AP00016 request (req.Ws); AP00016 then rejects the verify unless that ws equals the SIGNED workspace claim (OI-1) in the envelope (cross-tenant → accepted=false). Mirrors the JWT-derived-scope discipline of OADR admission / receipts.

─────────────────────────────────────────────────────────────────────── FAIL-CLOSED: when the verifier is unreachable / unverifiable the surface returns an ERROR (REJECT) — never a green verdict. A malformed envelope, a host-receipt rejection, a cross-tenant ws, or a threshold-unmet co-sign tally all surface as accepted=false with the OSY-OCAR-* / OSY-EAT-* reason. Until VIR_SERVICE_ADDR is configured the resolver returns OSY-OCAR-NOT-WIRED via UnwiredOcarVerificationService (fail-closed; NO STUBS) — the FE keeps its sanctioned OCAR FallbackBanner on this code. ───────────────────────────────────────────────────────────────────── Per-counterparty view ───────────────────────────────────────────────────────────────────── One allowlisted counterparty's co-sign result over the host action root, as AP00016 computed it in the OCAR trust-mode gate. ACCEPT-ONLY: the verifier emits these rows only on the admit path (never on a reject), so a populated counterparties is itself part of the green signal.

| Field | Type | Description | | --- | --- | --- | | coSignValid | Boolean! | Whether this counterparty's detached co-sign signature verified. | | observedCid | String! | The 32-byte action root this counterparty co-signed, lowercase hex. | | observedCidMatches | Boolean! | Whether observedCid equals the action root the host body projects (a mismatch is a fail-closed non-admit — a counterparty co-signing a DIFFERENT action never counts). | | receiverId | String! | The pinned-allowlist counterparty (receiver) id that produced this co-sign. |

OcarPinnedReceiver

OCAR trust-config write-path GraphQL schema (AP00016 verifier-svc OcarTrustConfigService projection) — ENG-2654 / ENG-2852 (ADR-337, with the CEO D7/D2 amendment)

The per-relying-party (per-workspace) OCAR counterparty allowlist + threshold ADMIN plane: the config the ENG-2586 read surface (verifyOcarTrustMode) verifies against. A SEPARATE AP00016 gRPC service from the verify data plane (ADR-337 §D3) so the admin plane's authz posture is separable. Query + three maker-checker-gated mutations.

─────────────────────────────────────────────────────────────────────── Tenant isolation (load-bearing): the workspace is ALWAYS derived from the JWT (ctxkeys.WorkspaceID), NEVER from input. There is intentionally NO ws/workspace argument on any field below — a caller cannot name a workspace. The resolver stamps the JWT workspace onto the outbound AP00016 request (req.Ws) and the authenticated actor ORN (req.Actor); the maker/checker identities are EDGE-STAMPED, never client-asserted (ADR-337 §D4).

─────────────────────────────────────────────────────────────────────── Authz (ADR-337 §D4): every mutation requires (a) a WORKSPACE_ADMIN / ORG_ADMIN / SUPER_ADMIN role at the caller's workspace scope (fail-closed on absence), AND (b) a REGULAR IAM step-up (scope CONFIGURE_OCAR_TRUST_MODE) whose ADR-145 operationBinding the edge RE-DERIVES from the resolver's OWN input (never trusted from state) so a captured token cannot be replayed onto a different config change. The edge verifies+consumes the step-up (obtaining the single-use jti) and forwards ws/actor/step_up_jti to AP00016.

─────────────────────────────────────────────────────────────────────── Maker-checker (ADR-337 §D7): STRENGTHENING changes (raise threshold, add a receiver, the initial SET) apply IMMEDIATELY under a single admin's step-up. WEAKENING changes (lower threshold, remove a receiver, CLEAR) land as a PENDING op (pending=true) requiring a DISTINCT SECOND admin to approve via promoteOcarTrustConfig — a distinct step-up session whose approver ORN MUST differ from the maker's actor (AP00016 enforces 7727).

ADR-182 D7 CAVEAT: a threshold of 1 is a single-counterparty co-sign gate — it proves ONE allowlisted counterparty co-signed, NOT an N-of-M quorum. It is a valid config (>=1), but the security property it asserts is materially weaker than threshold>=2; the console surfaces this to the operator. All OCAR config diagnostics (OSY-OCAR-7720..7727) are UNSIGNED admin codes — none enters a signed preimage (ADR-182 §9).

─────────────────────────────────────────────────────────────────────── FAIL-CLOSED: until VIR_SERVICE_ADDR is configured the resolvers return OSY-OCAR-CONFIG-NOT-WIRED via UnwiredOcarTrustConfigService (NO STUBS — never a fabricated config or applied verdict). A CAS/version conflict (expectedVersion no longer current) surfaces as a DISTINCT retryable OSY-OCAR-7723 error the FE can detect and re-fetch+retry. ───────────────────────────────────────────────────────────────────── Read shapes (ADR-337 §D6: int64 rendered as String! — no GraphQL Int 32-bit ceiling) ───────────────────────────────────────────────────────────────────── One pinned counterparty in the APPLIED config: its stable id + its Ed25519 public key (lowercase hex, 64 chars / 32 bytes).

| Field | Type | Description | | --- | --- | --- | | publicKeyHex | String! | The counterparty's Ed25519 public key as 64-char lowercase hex (32 bytes). | | receiverId | String! | |

OcarTrustConfig

The APPLIED per-workspace OCAR trust config (the shared payload returned by every RPC). Null from the query means no config has ever been set for the workspace.

| Field | Type | Description | | --- | --- | --- | | configCid | String! | The APPLIED chain-head config CID, lowercase hex. | | pending | Boolean! | ADR-337 §D7: true when a WEAKENING op is awaiting a DISTINCT second admin's approval. | | receivers | [OcarPinnedReceiver!]! | The APPLIED pinned counterparty set (empty after an applied clear). | | threshold | Int! | The APPLIED N (minimum DISTINCT valid allowlisted co-signers required to admit). 0 when none. | | updatedAt | String! | Unix seconds of the last applied change. Decimal int64. | | updatedBy | String! | The actor ORN that produced the applied config. | | version | String! | Latest config version — strictly monotone across SET and CLEAR (ADR-337 §D2). Decimal int64. |

OcarVerificationVerdict

───────────────────────────────────────────────────────────────────── Verdict shape ───────────────────────────────────────────────────────────────────── The authoritative OCAR trust-mode verdict computed by AP00016's VerifyEnvelope re-decision. accepted is true ONLY when the host issuer signature verifies AND the host kind's re-decider accepted AND the single-use nonce was fresh + burned AND the OCAR gate met threshold. On any failure accepted is false and reason carries the OSY-OCAR-* / OSY-EAT-57xx / OSY-VIR-56xx code + detail (surfaced verbatim — the verifier's bounded, non-oracle reason strings).

| Field | Type | Description | | --- | --- | --- | | accepted | Boolean! | Whether the OCAR trust-mode re-decision admitted the envelope (host re-decision AND co-sign threshold both met). | | counterparties | [OcarCounterpartyView!]! | The per-counterparty co-sign rows. ACCEPT-ONLY: empty on any reject (the verifier never emits rows on reject). Non-null list — empty, never null. | | cti | String! | The host receipt id (CWT cti) as lowercase hex. Empty when the envelope did not decode far enough to surface it. | | distinctValid | Int! | The number of DISTINCT valid allowlisted counterparties that co-signed the SAME host action root (the tally compared against threshold). 0 when OCAR mode was not engaged. | | hostAccepted | Boolean! | The post-host OCAR gate verdict (the host body re-decided before the co-sign tally ran). False when OCAR mode was not engaged or the host receipt failed before the gate. | | presented | Int! | The number of co-sign rows presented in the bundle. 0 when OCAR mode was not engaged. | | reason | String! | "ok" on success, or the verifier's failure reason code + detail (e.g. "OCAR_THRESHOLD_UNMET (OSY-OCAR-7707)", a host OSY-EAT-/OSY-VIR- re-decision code). | | receiptKind | String! | The dispatched EAT receipt-kind discriminator the verifier decoded for the host body. Empty until the claim set decodes. | | threshold | Int! | The configured N (minimum DISTINCT valid allowlisted co-signers required to admit). 0 when OCAR mode was not engaged. |

OcnpRevokedLease

OCNP leases-console GraphQL schema (ENG-2491 / ARC-23 / ADR-242)

Customer-facing read + control surface for the OCNP (Osyra Capability-Negotiation Protocol) leases console. The OCNP backend is the edge Admit gate (ENG-2488, internal/middleware/ocnp.go) + the AP00016 re-decider (ENG-2489) + the ENG-2490 VC-Status revoke feed (internal/ocnp/revoker.go).

─────────────────────────────────────────────────────────────────────── WHAT IS QUERYABLE (honest scope — NO STUBS):

• ocnpRevokedLeases: the workspace's CURRENTLY-REVOKED lease set, read from the SAME authoritative NANDA VC-Status feed the Admit gate consults (revoker.RevokedLeasesForWorkspace → feed.RevokedSetForWorkspace). This is the one enumerable per-workspace lease source.
• revokeOcnpLease: revoke one or more leases through the SINGLE ENG-2490 revoke authority (revoker.Publish — the SAME wire the Admit gate's cross-replica invalidation rides). There is exactly ONE revoke path; this mutation does NOT open a second store.

WHAT IS NOT QUERYABLE (a real backend-data gap — the console FallbackBanners it):

• There is NO active-lease list-source. The Admit gate is per-request: a lease arrives in-band as an opaque CN-CBC envelope (X-Osyra-OCNP-Lease header) and the per-(lease_id, op) budget lives as a Redis counter key that is NOT enumerable by workspace. So the console's "active leases" view renders a sanctioned FallbackBanner (NO STUBS — never a fabricated active lease). When a list-source lands (a lease registry / budget index), add an ocnpActiveLeases query here; the console lights it up.

─────────────────────────────────────────────────────────────────────── Tenant isolation (LOAD-BEARING): the workspace is ALWAYS derived from the JWT (ctxkeys.WorkspaceID) server-side — there is deliberately NO workspaceId input field on any field below (mirrors receipts / amgate / drift; defense-in-depth per ENG-777 SEC-H1). The revoke mutation stamps the JWT workspace onto the RevokeEvent.Workspace (per-workspace invalidation, R7 attribution) — a caller cannot revoke or read another workspace's leases even by guessing lease ids.

─────────────────────────────────────────────────────────────────────── FAIL-CLOSED: until the OCNP gate is enabled (OCNP_ENABLED) and the ENG-2490 revoker is wired, the resolver returns OSY-OCNP-NOT-WIRED via UnwiredOcnpService (NO STUBS — never a fabricated lease or revoke receipt). The FE keeps its sanctioned FallbackBanner on this code. ───────────────────────────────────────────────────────────────────── Node shapes ───────────────────────────────────────────────────────────────────── A single currently-revoked OCNP lease, read from the authoritative VC-Status feed. Carries NO crypto inputs (no CN-CBC envelope, no DID keys, no C_eff budgets) by design — only the lease_id, revoke instant, and audit reason.

| Field | Type | Description | | --- | --- | --- | | leaseId | ID! | The kernel C.3 lease_id (SHA-256 hex) — stable identifier + the value the revoke mutation takes. | | reason | String! | Audit-only revocation reason (key-compromise, superseded, terminated, …). Empty when the feed omits it. NOT used for any enforcement decision. | | revokedAt | DateTime | RFC-3339 instant the revocation was issued (the feed's authoritative revoke time). Null when the feed omits a per-entry revokedAt. |

OcnpRevokedLeaseConnection

One snapshot of the workspace's revoked lease set. asOf is the feed's snapshot instant (when the revoked view was computed); leases is the set of currently-revoked leases (may be empty — an honest empty, never fabricated).

| Field | Type | Description | | --- | --- | --- | | asOf | DateTime | The RFC-3339 instant the feed computed this revoked snapshot. Null when the feed does not stamp one. | | leases | [OcnpRevokedLease!]! | |

OirModelKey

OIR trust-anchor publish (ENG-2546 L3 / ADR-284). The frontend verifyOirReceipt resolves the gateway + per-model Ed25519 verification keys from THIS query — proxied verbatim from the AP00016 GetOirTrustAnchors RPC — to verify an OIR receipt OFFLINE under the SAME anchors the verifier's KindOIR re-decider trusts (publish == trust). The keys are NEVER read from the receipt body, and are NOT IAM's P-256 platform anchors (type-incompatible). Workspace-independent: the anchors are relying-party-pinned (global), not per-tenant.

HONEST-SCOPE (ADR-177 D5 / ENG-1741): publishing PUBLIC verification keys — NOT a claim about model cognition. One pinned per-model OIR countersignature key.

| Field | Type | Description | | --- | --- | --- | | modelId | String! | The model identifier the countersigning key is pinned to (e.g. "claude-opus-4.5"). | | publicKeyHex | String! | The model's pinned Ed25519 countersignature public key, hex-encoded (64 hex chars / 32 bytes). |

OirReceiptProjection

Inference OIR receipt projection (ENG-2551 / N4, Option C — round-table 2026-06-23).

A SERVER-SIDE SANITIZED projection of an inference OIR receipt's DISPLAY fields. This is NOT an authoritative verdict and NEVER a re-decide: the edge decodes ONLY the safe display fields from the OIR COSE payload (model, workspace, declared-context count, timestamp). The AUTHORITATIVE check is the frontend's OFFLINE RFC-9338 verify (verifyOirReceipt, ENG-2552) under the server-PUBLISHED oirTrustAnchors — conformance-proven decision-equivalent to the server re-decide (AP00016 oir_conformance_test.go). The dedicated server re-decide RPC + durable list are V1.5 (ENG-2566). NEVER surfaces digests / keys / policy bytes (MH-11).

HONEST-SCOPE (ADR-177 D5 / ENG-1741): a sanitized display projection — NOT a claim about model cognition.

| Field | Type | Description | | --- | --- | --- | | contextCount | Int | The declared attested-context cardinality (display only). NULL if invalid. | | locusTag | String! | Honest provenance: this is a server-decoded DISPLAY projection; the authoritative verification is the offline RFC-9338 verify under the server-published oirTrustAnchors. | | modelId | String | The model the receipt declares (display only). NULL if the receipt is structurally invalid. | | oirB64 | String! | The receipt echoed back verbatim — the FE verifies THIS offline under oirTrustAnchors (the authoritative check), never trusting the server projection below. | | tsUnixMs | String | The receipt timestamp (Unix ms, uint64 as String to avoid the GraphQL Int 53-bit overflow). NULL if invalid. | | wellFormed | Boolean! | Whether the receipt is a structurally well-formed OIR COSE_Sign1 (a SHAPE check, NOT a crypto verdict — a well-formed receipt can still fail the offline signature verify). | | workspaceId | String | The workspace the receipt self-commits (display only). NULL if invalid. |

OirTrustAnchors

| Field | Type | Description | | --- | --- | --- | | epochFloor | String! | The relying-party currency epoch floor (uint64 as String). | | gatewayKeyHex | String | The pinned gateway COSE_Sign1 Ed25519 public key, hex-encoded (64 hex chars). NULL when OIR verification is NOT configured on the verifier — the frontend detects "OIR verify unavailable" and does not attempt a verify under a null key (NO STUBS — never a fabricated key). | | minVerFloor | String! | The relying-party anti-rollback min_ver floor the offline verify enforces (uint64 as String to avoid the GraphQL Int 53-bit overflow). | | modelKeys | [OirModelKey!]! | The pinned per-model countersignature keys (sorted by modelId, deterministic). |

OrgOwnershipTransferResult

| Field | Type | Description | | --- | --- | --- | | createdAt | String! | | | newOwnerId | ID! | | | orgId | ID! | | | previousOwnerId | ID! | | | status | String! | | | transferId | ID! | |

OrgQuotaStatus

OrgQuotaStatus represents the full quota status for an organization

| Field | Type | Description | | --- | --- | --- | | periodEnd | DateTime! | Billing period end (ISO-8601 UTC timestamp, e.g. "2026-08-01T00:00:00Z"). ENG-3144 #4: standardized on ISO-8601 (was a Unix-epoch Int). Note the HTTP X-Quota-Reset response header remains epoch seconds (a distinct wire contract). | | periodStart | DateTime! | Billing period start (ISO-8601 UTC timestamp, e.g. "2026-07-01T00:00:00Z"). ENG-3144 #4: standardized on ISO-8601 to match usage + billingSubscription (was a Unix-epoch Int, forcing clients to branch on field shape). | | plan | String! | Current plan code (FREE, PRO, ENTERPRISE) | | planName | String! | Current plan display name | | requests | QuotaUsage! | Monthly API requests quota | | users | QuotaUsage! | User quota | | workspaces | QuotaUsage! | Workspace quota |

Organization

Organization types and related operations

| Field | Type | Description | | --- | --- | --- | | createdAt | DateTime! | | | description | String | ENG-2969 ("re-add for real" of the ENG-2967-removed phantom fields): free-text organization description + logo URL, now backed by REAL IAM columns (organizations.description / organizations.logo_url, migration V0137) and mapped VERBATIM from IAM OrganizationResponse.description / .logo_url. NULLABLE: absent when unset (the resolver leaves them nil rather than fabricating a value). | | id | ID! | | | invitations | [Invitation!] | | | logoUrl | String | | | members | [Member!] | | | name | String! | | | owner | User | Related entities. These are resolved on demand from IAM (field resolvers, W7 O3). They are NULLABLE: a relation IAM has not yet wired (org-level members/owner/invitations RPCs) returns null for THAT field without nulling the entire Organization object — the previous non-null typing meant one unpopulated relation collapsed the whole org to null. workspaces is fully wired and returns real data; the list ELEMENTS remain non-null. | | plan | String! | | | slug | String! | | | status | OrganizationStatus! | | | updatedAt | DateTime! | | | workspaces | [Workspace!] | |

OtccCertificate

A persisted/uploaded OTCC token-capital certificate. The signed wire is the WIRE-TRUTH (base64-standard) for client-side independent verification + export; the corpus reference is the .ome bundle the console exports (osyra.otcc.{ensemble,member,benchmark} ClaimKinds).

| Field | Type | Description | | --- | --- | --- | | benchmark | String! | The benchmark this certificate's Δ is measured against (e.g. a benchmark id / corpus CID). Display-only; the authoritative binding is inside the signed body. | | encodedCborB64 | String! | The canonical signed EAT envelope (WIRE-TRUTH), base64-standard-encoded, for client-side independent verification / export. | | id | ID! | Stable id = lowercase hex of the certificate CTI (the otccCertificate lookup key). | | verification | OtccVerification! | The authoritative AP00016-recomputed verdict for this certificate. |

OtccCorpusBundle

The .ome corpus bundle export for a certificate — the signed bundle bytes (base64-standard) the console offers as a download. The bundle carries the osyra.otcc.{ensemble,member,benchmark} corpus claims a third party re-derives the Δ from. NO STUBS: an empty/zero-byte bundle is never fabricated — when the corpus is unavailable the resolver fails closed.

| Field | Type | Description | | --- | --- | --- | | bundleB64 | String! | The signed .ome corpus bundle bytes, base64-standard-encoded. | | certificateId | ID! | The certificate id this bundle belongs to. | | claimCount | Int! | Number of corpus claims in the bundle (ensemble + member + benchmark). |

OtccVerification

───────────────────────────────────────────────────────────────────── Node shapes ───────────────────────────────────────────────────────────────────── The authoritative AP00016-recomputed OTCC verdict for a certificate. accepted is the cryptographic + re-decision verdict; attributable is the SEPARATE claim-discipline bit (a valid certificate may still be non-attributable). The edge surfaces whatever AP00016 actually computed — NO STUBS, never a fabricated Δ or class.

| Field | Type | Description | | --- | --- | --- | | accepted | Boolean! | Whether the issuer signature verified AND the OTCC re-decider re-derived a consistent Δ. FAIL-CLOSED: false on any verify failure with reason set. | | attributable | Boolean! | True ONLY when the ablation is well-posed AND the slice is ATTESTED. When false, nonAttributableReason carries WHY (SLICE_SELF_DECLARED or DEGENERATE_ABLATION). 🛑 The console MUST NOT present a non-attributable Δ as a model-quality claim. attributable == false does NOT mean the certificate is invalid (it may still be accepted). | | deltaPpm | String! | The re-derived counterfactual benchmark-gain Δ, in PPM (parts-per-million, int64 — NO float; ROUND_HALF_EVEN score-quantization per ADR-266). Signed: a negative Δ is a real attributed regression. Meaningful ONLY when attributable is true (else it is a degenerate/non-attributable value the console must label as such). | | determinismClass | OtccDeterminismClass! | The determinism class of deltaPpm (EXACT vs TOLERANCE(ε)). | | nonAttributableReason | String! | When attributable is false: the explicit non-attributable reason — "SLICE_SELF_DECLARED" (origin not third-party attested) or "DEGENERATE_ABLATION" (zero-coverage or all-members-empty-ablation; the two-sided well-posedness fence). Empty when attributable is true. | | reason | String! | "ok" on success, or the verifier's failure reason code + detail (e.g. "OSY-OTCC-89xx ..."). | | sliceAttestationStatus | OtccSliceAttestationStatus! | The attestation status of the attributed trace-slice. SELF_DECLARED is the explicit non-attributable state (SLICE_SELF_DECLARED). | | toleranceEpsilonPpm | String! | When determinismClass = TOLERANCE, the tolerance ε in PPM; "0" for EXACT. |

OterExposureProjection

The decoded exposure decision of one signed oter.v1 receipt.

| Field | Type | Description | | --- | --- | --- | | candidateCount | Int! | Size of the committed candidate tool universe (|C|) — the "of 1,043". | | embeddingModelId | String! | Embedding model the similarity was computed under (provenance). | | policyBundleCid | String | Lowercase hex of the 32-byte policy bundle CID that forced/blocked exposures; null when all-zero (no policy overlay was active). | | quantizationProfile | String! | Pinned quantization profile id (provenance). | | receiptId | ID! | Stable id = lowercase hex of the 16-byte VIR id (the GetReceipt key). | | selected | [OterSelectedTool!]! | The exposure decision — every tool the agent saw, in canonical order. | | selectedCount | Int! | Number of tools actually exposed to the agent (|selected|) — the "18". | | thresholdQ | Int! | Integer Q15 cosine cut-off the selection was run at. Raw quantized integer — NO float conversion on the wire. | | topK | Int! | Top-K selection bound (K). | | ws | String! | The SIGNED workspace binding (always equals the caller's JWT workspace — the projection fail-closes on any mismatch). |

OterSelectedTool

Tool-exposure receipt projection (oter.v1) — ENG-2723 / ADR-327 D9.

Server-side projection of a SIGNED oter.v1 tool-exposure receipt persisted by AP00016 (the L5 Verifier-of-Record): "the agent saw {selectedCount} of {candidateCount} tools". The edge decodes the signed EAT body via the canonical public decoder (osyra-verify/oter — the same module AP00016 itself re-decides with) and projects the exposure decision for the console audit surface. The projection NEVER synthesizes a value: every field below is derivable ONLY from the signed body bytes AP00016 persisted.

Tenant isolation (load-bearing): workspace is ALWAYS derived from the JWT (ctxkeys.WorkspaceID), never from query input — defense-in-depth per ENG-777 SEC-H1; and the envelope's SIGNED ws claim is pinned to the requesting workspace before projection (mirrors the ENG-2802 ogvr enrichment).

NO-FLOAT-ON-WIRE (ADR-310 D4 family law): scores/threshold are integer Q15 cosines rendered AS-IS. No float conversion happens on this wire — clients render the raw quantized integers (the ORS no-float discipline). One exposed tool from the signed selection (oter-selected, ADR-327 D8).

| Field | Type | Description | | --- | --- | --- | | rank | Int! | 0-based position in the canonical exposed ordering. | | scoreQ | Int! | Integer Q15 cosine similarity score committed by the signer, range [-32768, 32767]. Rendered as-is — NO float conversion on the wire (ORS no-float law). | | source | Int! | Exposure provenance: 0 SIMILARITY (score >= threshold, within top-K) / 1 POLICY_FORCED_ALWAYS (member of the force-always set; exposed regardless of score — ADR-327 D7/D8: forced rows are NOT similarity hits). | | toolCid | String! | Lowercase hex of the 32-byte tool CID (member of the committed candidate tool-set root). |

PageInfo

Connection types for pagination

| Field | Type | Description | | --- | --- | --- | | endCursor | String | | | hasNextPage | Boolean! | | | hasPreviousPage | Boolean! | | | startCursor | String | | | totalCount | Int! | |

PaymentMethod

PaymentMethod represents a saved payment method

| Field | Type | Description | | --- | --- | --- | | bankLast4 | String | | | bankName | String | Bank account details (if type is BANK_ACCOUNT) | | cardBrand | String | Card details (if type is CARD) | | cardExpMonth | Int | | | cardExpYear | Int | | | cardLast4 | String | | | createdAt | DateTime! | | | id | ID! | | | isDefault | Boolean! | Status | | type | PaymentMethodType! | |

PendingInvitation

A not-yet-accepted workspace invitation, as listed for a workspace admin.

| Field | Type | Description | | --- | --- | --- | | createdAt | DateTime! | | | email | String! | | | expiresAt | DateTime! | | | invitationId | ID! | | | invitedBy | ID! | The user id of the inviter (raw; the console resolves a display name lazily — surfacing a User here would be an N+1 over the list). | | role | MemberRole | Reverse-mapped from the IAM workspace role id; null when absent or unmappable (the OWNER/ADMIN role ids collapse, so this surfaces ADMIN). |

PmmPageInfo

Relay-style page-info for the PMM windows connection. endCursor is the AP00005 opaque page token (compliance.v1 ListPmmWindowsResponse.next_cursor); the FE feeds it back as after for continuation. Named PmmPageInfo (not PageInfo) to avoid colliding with the existing top-level PageInfo type.

| Field | Type | Description | | --- | --- | --- | | endCursor | String | | | hasNextPage | Boolean! | |

PmmWindow

One post-market-monitoring window (the pmm_window row projection, design §5 V7). Epoch-ms bounds are projected to RFC-3339 UTC strings; the CID witnesses are lowercase hex, null until the window SEALS.

| Field | Type | Description | | --- | --- | --- | | disclosureCid | String | CID of the detached WORM pmmr-disclosure blob (lowercase hex); null until SEALED. | | fromTs | String! | RFC-3339 UTC window bounds (the epoch-ms proto ts projected to ISO for display). | | pmmrCid | String | The minted PMMR EAT receipt CID (lowercase hex); null until SEALED (never a fabricated CID). | | sealedAt | String | RFC-3339 UTC of seal; null while OPEN / BLOCKED (never a fabricated timestamp). | | status | PmmWindowStatus! | | | substantialModFlag | Boolean! | Art-26§2 substantial-modification candidate flag (a human/legal confirms; not an automatic filing). | | systemId | String! | | | untilTs | String! | | | windowId | String! | |

PmmWindowConnection

The PMM windows read model for one high-risk system — a Relay connection over ListPmmWindows.

| Field | Type | Description | | --- | --- | --- | | edges | [PmmWindowEdge!]! | | | pageInfo | PmmPageInfo! | |

PmmWindowEdge

One edge in the PMM windows connection. cursor is a per-row opaque marker (base64 of the windowId); continuation uses pageInfo.endCursor (the backend page token), not the per-edge cursor.

| Field | Type | Description | | --- | --- | --- | | cursor | String! | | | node | PmmWindow! | |

PmmrAggregates

The re-derivable integer aggregates carried in the minted PMMR body field 6 (§6.1), read from the sealed pmm_window row (persisted as-minted at seal). NOT re-derived at the edge. Counts are bigint-safe decimal STRINGS (the ENG-2623 Long convention — a JS number cannot hold a > 2^53 count without precision loss); maxDriftL1Milli is a bounded integer (cddl 0..1530).

| Field | Type | Description | | --- | --- | --- | | driftBudgetBreaches | String! | Count of drift leaves over the declared budget. | | maxDriftL1Milli | Int! | Max re-derived milli-L1 drift over the disclosed BAR leaves (0..1530). | | nDecisions | String! | |decisionEvidenceCids| (sorted, unique) — Art-12(2) decision-evidence commitments. | | nDenied | String! | |deniedLeaves| (sorted, unique) — policy-denied audit leaves. | | nErasures | String! | |oeraserCids| (sorted, unique) — OERASER erasure receipts. |

PmmrDetail

The per-window PMMR disclosure-body detail (ENG-2984) — the console pmmRecord drill-down. Every field is DATA read from the sealed pmm_window row (the disclosure-body scalars AP00005 persisted at seal from the minted PMMR body); the edge never decodes the WORM blob and never re-derives an aggregate. pmmRecord is NULL unless the window is SEALED with a disclosure body — never a partial/fabricated record.

| Field | Type | Description | | --- | --- | --- | | aggregates | PmmrAggregates! | | | annexIiiCategory | String! | Pinned Annex-III class governing the metric set (body field 1). | | disclosureCid | String! | CID of the detached WORM disclosure blob (lowercase hex, body field-5 disclosure-cid). | | disclosureUrl | String | Short-lived presigned WORM GET for the disclosure blob so an auditor can re-derive (§7.3); null when the object-store presign seam is not wired (an honest null, never a fabricated URL). | | fromTs | String! | RFC-3339 UTC window bounds (the epoch-ms proto ts projected to ISO for display). | | incidentFlags | PmmrIncidentFlags! | | | modelBindingRef | String! | Declared model+version+config binding at window seal (body field 3). | | pmmrCid | String! | The minted PMMR EAT receipt CID (lowercase hex) — always set on a SEALED window. | | policyBundleRef | String! | Declared AP00019 signed bundle ref+version carrying the drift budget (body field 4). | | systemId | String! | | | untilTs | String! | | | windowId | String! | |

PmmrIncidentFlags

The Art-73 / Art-26§2 incident flags carried in the minted PMMR body field 7 (§6.1).

| Field | Type | Description | | --- | --- | --- | | seriousIncident | Boolean! | Art-73 serious-incident candidate (a human/legal confirms; not an automatic filing). | | substantialModCandidate | Boolean! | Art-26§2 substantial-modification candidate (the as-minted auto-detected flag). |

Policy

An authored policy source document.

| Field | Type | Description | | --- | --- | --- | | authorPrincipal | String! | ORN of the authoring principal (server-recorded). | | createdAt | DateTime! | | | policyId | String! | | | scope | PolicyScope! | | | source | String! | Raw authored source (Rego or IAM-JSON text). | | sourceFormat | PolicySourceFormat! | | | version | Int! | |

PolicyConnection

A page of policy source documents.

| Field | Type | Description | | --- | --- | --- | | deniedCount(sinceTs: DateTime, untilTs: DateTime) | String! | ENG-2633 (governance-posture strip, ruling D2) — the AUDIT-DERIVED "in violation" posture. The policy-authoring service (AP00019) owns NO evaluation/violation state, and inventing one would be fabricated state (the NO-STUBS failure mode the 2026-06-25 gate refused). The fact that DOES exist is the DENY-decision stream in the AP00005 audit-of-record: deniedCount is the EXACT count of policy-denial audit DECISION EVENTS in [sinceTs, untilTs] (category = policy_denied), read from the audit store's existing exact-count surface (total_count is exact for a bounded range). NO new AP00019 persistence, NO new AP00016 involvement. HONEST SCOPE: this counts DENY decision EVENTS, NOT distinct policies — the audit event carries no policy_id, so distinct-policy granularity needs an AP00005 distinct aggregate (a documented follow-up). FE label discipline: "N with denials in window" (or "in violation" with a tooltip defining it as >=1 DENY decision in window). Serialized as String (uint64). Field RESOLVER — the audit RPC runs ONLY when selected. Returns OSY-AUDIT-NOT-WIRED until AUDIT_SERVICE_ADDR is set. NB: totalCount (the policy-row denominator) is deliberately NOT here — it is AP00019's cheap half (ruling D2, a COUNT over its own policy rows added to the list RPC), a separate leg outside the AP00016+edge scope of ENG-2633's build. | | nextPageToken | String! | | | policies | [Policy!]! | |

PolicyFinding

A single validation/lint finding with its source span.

| Field | Type | Description | | --- | --- | --- | | code | String! | Structured OSY-POLICY-* code for the finding. | | message | String! | | | severity | FindingSeverity! | | | sourceSpan | String! | Source span "line:col-line:col" (empty when not localizable). |

PolicyScope

───────────────────────────────────────────────────────────────────── Node shapes ───────────────────────────────────────────────────────────────────── A resolved scope (level + the JWT-derived id), echoed back on responses so the console can render which scope an object belongs to.

| Field | Type | Description | | --- | --- | --- | | level | CascadeLevel! | | | scopeId | String! | |

PricingProvenance

Signed-pricing provenance for a breakdown (design §6.2 type PricingProvenance).

| Field | Type | Description | | --- | --- | --- | | catalogSignatureRef | String | The signed pricing-catalog CID the figures were priced against (ADR-325); null only for a genuine zero-usage period (no rows contributed). |

PrivateEndpoint

───────────────────────────────────────────────────────────────────── One tenant-registered private endpoint (proto PrivateEndpoint; RLS-scoped server-side). authSecretRef is DELIBERATELY absent (input-only pointer custody). Timestamps are RFC-3339 UTC strings; nullable fields are null when the wire value is unset (honest empty, never a fabricated epoch date). ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | approvedBy | String | Checker principal ORN; null until approved (approvedBy != createdBy, four-eyes). | | authKind | PrivateEndpointAuthKind! | | | baseUrl | String! | https absolute (onprem/azure) | SageMaker endpoint name. | | caCertFingerprint | String | SHA-256(SPKI) pin, lowercase hex; null when absent (SageMaker cloud-native TLS). | | createdAt | String! | | | createdBy | String! | Maker principal ORN. | | displayName | String! | | | id | ID! | endpoint_id (uuidv7). | | kind | PrivateEndpointKind! | | | lastPreflightAt | String | RFC-3339 UTC of the last LIVE preflight; null if never run. | | lastPreflightResult | String | Outcome mnemonic of the last LIVE preflight (OK / SSRF_REJECT / TLS_FAIL / CA_MISMATCH / UNREACHABLE / CAPABILITY_MISMATCH); null if never run. | | modelIds | [String!]! | The model_ids this endpoint serves (the route key). | | networkBindingRef | String! | Names a network binding PROVISIONED for the caller's (org,workspace); server-validated. | | protocol | PrivateEndpointProtocol! | | | residencyRegion | String! | Declared data-residency region (provenance + policy pin). | | retiredAt | String | RFC-3339 UTC; set iff status == RETIRED, else null. | | status | PrivateEndpointStatus! | | | updatedAt | String! | |

PromptDeployment

The active-version POINTER for a labeled environment — a single prompt.deployment.v1 signed claim. Switching the active version (publish / canary / rollback / relabel) is a NEW signed claim; "rollback" is forward motion to a re-pointed pointer.

| Field | Type | Description | | --- | --- | --- | | canary | CanarySpec | Present iff intent == "canary". | | claimId | ID! | The OME deployment-claim id (16-byte UUIDv7), lowercase hex. | | effectiveTs | String! | Unix milliseconds the pointer becomes authoritative, as a String (BigInt-safe). | | environment | String! | The labeled rollout target: prod | staging | canary | x-<tenant-label>. | | intent | String! | The declared provenance of WHY: publish | canary | rollback | relabel. | | priorCid | String | The content hash this pointer REPLACES, lowercase hex; null for the first deployment of the environment. | | slug | String! | | | targetCid | String! | The prompt.template.v1 content hash now ACTIVE in this environment, lowercase hex. | | targetSemver | String! | The author semver of targetCid (denormalized). |

PromptDiff

A source-level diff between two prompt template versions (addressed by content hash). The edge returns BOTH sources verbatim; the client renders the diff (no server-side diff algorithm — keeps the surface a pure, re-derivable projection).

| Field | Type | Description | | --- | --- | --- | | fromCid | String! | | | fromSource | String! | | | toCid | String! | | | toSource | String! | |

PromptPartial

A partial/include referenced BY CONTENT ADDRESS (never a mutable name) — the {{> handle}} token resolves to another prompt.template.v1 claim's content hash.

| Field | Type | Description | | --- | --- | --- | | handle | String! | | | templateCid | String! | 32-byte content_hash of the referenced template claim, lowercase hex. |

PromptTemplateVersion

One immutable version of a prompt template family — a single prompt.template.v1 signed claim. contentHash is the cryptographic version identity (the render- preimage SHA-256); semver is author-asserted provenance only.

| Field | Type | Description | | --- | --- | --- | | claimId | ID! | The OME claim id (16-byte UUIDv7), lowercase hex — the version's claim leaf. | | contentHash | String! | 32-byte SHA-256 of the render preimage (the version identity), lowercase hex. | | engine | String! | The frozen render dialect selector (osyra.render.mustache-lite.v1). | | inclusionProof | InclusionProof | JMT inclusion proof — see InclusionProof: nullable, currently always null on the ListClaims/GetClaimBody read path (no witness on the wire). | | parents | [ID!]! | Lineage edge(s): prior template-version claim id(s), lowercase hex. Empty for the v1 genesis of a family. | | partials | [PromptPartial!]! | | | semver | String! | Author-asserted "MAJOR.MINOR.PATCH" version label. | | signer | String! | The issuer (signer) DID URI of the claim. | | slug | String! | Workspace-unique human handle ([a-z0-9._-]). | | source | String! | The raw template source text (UTF-8, LF-normalized). | | templateId | ID! | The template FAMILY id (stable across versions), lowercase hex. | | ts | String! | Unix milliseconds the claim was created, as a String (BigInt-safe). | | variables | [PromptVar!]! | |

PromptVar

Prompt-management ClaimKinds READ surface (ENG-2717 / ARC-60; ADR-326) — the AP00011 prompt.template.v1 + prompt.deployment.v1 signed-claim family projected through the edge federated GraphQL subgraph (ENG-613).

A prompt template is NOT a mutable DB row: it is a per-workspace Ed25519-signed OME claim riding the existing osyra-ome-claim-v1 Form B envelope, JMT-committed. Every edit / publish / rollback is a NEW signed claim; history is immutable. This file carries the READ surface (ENG-2717) AND the sign/publish/rollback WRITE mutations (ENG-2805; design §4.1) — served over the OME SignAndInsert fused atomic RPC (single SERIALIZABLE transaction; no signed-but-not-inserted race window).

Read path: GraphQL -> edge gRPC -> AP00011-ome (internal-only mTLS) -> real JMT. The 3 queries below are served over the EXISTING ListClaims + GetClaimBody RPCs (no new OME RPC): ListClaims yields the sanitized claim projections (claim id, parents, signer/issuer DID, content hash, ts); GetClaimBody returns the raw canonical-CBOR Form B body which the edge decodes (read-only) into the typed prompt template / deployment. NO STUBS — until prompt claims exist in a workspace the queries return an empty history / null deployment, never a fabricated version; until OME is wired the resolver returns OSY-PROMPT-NOT-WIRED.

────────────────────────────────────────────────────────────────────────── Tenant isolation (load-bearing): the workspaceId argument on the queries below is for SDL fidelity with the design doc ONLY. The resolver IGNORES it and ALWAYS derives the workspace from the JWT (RequireAuth -> uc.WorkspaceID), stamping it onto the outbound OME os-workspace-id header. A caller can NEVER read another workspace's prompt claims by naming a workspaceId (orgidvet / IDOR defense — mirrors the receipts / OCAR resolvers). ────────────────────────────────────────────────────────────────────────── A declared template variable ({{name}}). required + default drive the deterministic mustache-lite render (CDDL prompt-template-v1 §2). default is present iff required == false (the body group's type-consistent default).

| Field | Type | Description | | --- | --- | --- | | default | String | The declared default, rendered as text; null for a required variable. | | name | String! | | | required | Boolean! | | | type | String! | "string" | "number" | "bool" | "json" (the frozen template-var type vocabulary). |

ProviderCatalogEntry

ProviderCatalogEntry is the projection of one provider's identity + signed- registry provenance (AP00006 ProviderCatalogEntry, ENG-2789 / ADR-323). It is a sibling of ProviderHealth: the Console joins the two lists by providerId to render provenance columns next to the runtime-health columns.

| Field | Type | Description | | --- | --- | --- | | displayName | String! | Human-readable display name. | | providerId | String! | Stable provider identifier (e.g. "openai", "anthropic"). Join key with ProviderHealth.providerId. | | registryInfo | ProviderRegistryInfo | Signed-registry provenance. Present ONLY when specBorn — an absent value honestly means no signed-registry provenance exists (NO-STUBS, ADR-323 D7). | | specBorn | Boolean! | true = instantiated from the signed ProviderSpec registry (verified COSE_Sign1 bundle); false = a hand-written adapter or an inert registry. registryInfo is non-null iff specBorn is true. | | supportedModels | [String!]! | Model identifiers this provider serves (spec-instantiated). May be empty. |

ProviderHealth

ProviderHealth is the projection of one spec-instantiated provider's identity and broker-observed health (AP00006 ProviderHealthInfo, ENG-2699 / ARC-61). Every metric is the broker's own observation over its recent window — the Edge reflects, it does not recompute. See the providerHealth query for the trust-edge policy-filter caveat (catalog, not entitlement).

| Field | Type | Description | | --- | --- | --- | | avgLatencyMs | Float! | Mean observed latency in milliseconds over the broker's recent window. | | displayName | String! | Human-readable display name. | | errorCount | Int! | Errors observed in the broker's recent window. | | lastCheck | DateTime | Instant of the broker's most recent health check; null if never checked. | | lastError | String | Most recent observed error message; null when none. Broker-provided — AP00006 is responsible for ensuring it carries no sensitive upstream detail (host/URL). | | providerId | String! | Stable provider identifier (e.g. "openai", "anthropic"). | | requestCount | Int! | Requests observed in the broker's recent window. | | status | HealthStatus! | Broker-observed health status. | | successRate | Float! | Fraction of recent requests that succeeded, 0.0–1.0. | | supportedModels | [String!]! | Model identifiers this provider serves (spec-instantiated). May be empty. |

ProviderRegistryInfo

ProviderRegistryInfo is the signed-registry provenance a spec-born provider serves under (AP00006 ProviderRegistryInfo, ENG-2789 / ADR-323). Ties the catalog to the verifiable signed-registry story.

| Field | Type | Description | | --- | --- | --- | | cascadeLevel | String! | Cascade level the serving spec resolved from (ADR-077): "platform" | "org" | "workspace". | | normalizerId | String! | Response-normalizer wire value that shapes this provider's served output (e.g. "openai.chat.response.identity"). | | registryDigestHex | String! | Lowercase hex of the 32-byte manifest.specs_sha256 of the signed registry bundle in force, verified at boot (fail-closed) before any spec is used. Empty string only if the broker sent a zero-length digest (a broker bug the Console surfaces rather than hides). | | registryVersion | Int! | manifest.registry_version — monotonic per cascade, the human-orderable companion to registryDigestHex. |

ProviderUsage

| Field | Type | Description | | --- | --- | --- | | costMicrocents | Int! | | | provider | String! | | | requests | String! | requests/tokens: decimal String, bigint-safe int64 (ENG-2977). | | tokens | String! | |

PublicPlan

One public pricing tier projected from the ENFORCED billing catalog (ENG-3124). Every allowance is the enforced value read from osyra_billing.plan_limits via billing ListPlans — never marketing copy. A null allowance means the tier has NO enforced ceiling for that dimension (unbounded); an absent plan_limits row is reported as null, NEVER fabricated as a finite number.

| Field | Type | Description | | --- | --- | --- | | auditRetentionDays | Int | Enforced audit-log retention in days (limit_type AUDIT_RETENTION_DAYS). null = unbounded. | | billingPeriod | String! | Billing period of this SKU row (verbatim from billing, e.g. MONTH / YEAR). | | code | String! | Stable plan code (e.g. FREE, STARTER, PRO, ENTERPRISE) — the FE's join key. | | currency | String! | ISO-4217 currency of priceCents (e.g. USD). | | includedRequests | Int | Enforced included API requests per enforcement period (limit_type MAX_API_REQUESTS). null = no enforced request ceiling. | | includedUsers | Int | Enforced seat/member ceiling (limit_type MAX_USERS). null = unbounded. | | includedWorkspaces | Int | Enforced workspace ceiling (limit_type MAX_WORKSPACES). null = unbounded. | | name | String! | Human-readable tier name (display name, falling back to name then code). | | priceCents | Int! | List price for this SKU row in whole cents (billing price_cents), paired with billingPeriod so the FE derives monthly/annual + any annual discount from the enforced SKU rather than a hardcoded percentage. |

PublishReceipt

A receipt for a publish or rollback transition.

| Field | Type | Description | | --- | --- | --- | | fromVersion | Int! | | | publishedAt | DateTime! | | | scope | PolicyScope! | | | toVersion | Int! | |

QuotaStatus

| Field | Type | Description | | --- | --- | --- | | currentSpendMicrocents | Int! | Current spend in micro-cents | | exceeded | Boolean! | Whether quota is exceeded | | monthlyLimitMicrocents | Int | Monthly spend limit in micro-cents | | percentageUsed | Float! | Percentage used (0-100) | | resetDate | DateTime! | Reset date |

QuotaUsage

QuotaUsage represents usage for a single quota type

| Field | Type | Description | | --- | --- | --- | | exceeded | Boolean! | Whether limit is exceeded | | limit | Int! | Maximum allowed (-1 for unlimited) | | percentage | Float! | Percentage used (0-100) | | used | Int! | Current usage count | | warning | Boolean! | Whether at warning threshold (80%) |

ReachabilityReport

───────────────────────────────────────────────────────────────────── The REAL result of a LIVE reachability preflight (proto ReachabilityReport; ENG-2988 / ADR-341 §6.4). reachable is authoritative; the observed* fields are the probe's OWN observations of the live endpoint — NEVER a fabricated "connected". An unreachable / TLS-fail / pin-mismatch / guard-rejected / not-yet-enabled probe yields reachable=false with an honest result token (PENDING_LIVE_PROBE when the PLA-169 live path is not yet enabled). ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | handshakeMs | Int! | Measured TLS-handshake latency in ms; 0 when no live dial completed. | | observedCaFingerprint | String | SHA-256(SPKI) the peer actually presented, lowercase hex; null when not observed. | | observedModelIds | [String!]! | Model ids the probe observed the endpoint advertise; empty when not enumerated. | | reachable | Boolean! | | | result | String! | |

Receipt

Full single-receipt detail view (the /receipts/{id} detail pane). All hash / id byte fields are surfaced lowercase-hex; the canonical signed envelope is additionally surfaced base64 (encodedCborB64) for client-side independent verification / export.

| Field | Type | Description | | --- | --- | --- | | contentSha | String! | Lowercase hex SHA-256 of the canonical intent body (content binding). | | correlationKey | String! | Cross-Evidence Correlation Key (CECK, ADR-373): the server-minted request_id that joins this record to the same request/decision across the proof plane. HONESTLY "" for every row today — AP00016 does not yet bind the CECK into the signed VIR envelope (out-of-lane; the Edge must NOT proximity/actor/time-join one, ADR-373 §2/§5). The field is declared so the Evidence Explorer contract is stable; it graduates to a real value with ZERO GraphQL/frontend change once the upstream producer sources it. | | encodedCborB64 | String! | The canonical signed VIR envelope (WIRE-TRUTH), base64-standard-encoded, for client-side independent verification / export. | | id | ID! | Stable id = lowercase hex of the 16-byte VIR id (UUIDv7). The GetReceipt key. | | intent | ReceiptIntent | Economic-intent projection; null when the receipt carries no intent map OR when verification failed (AP1-143: unverified economic intent is never rendered as data — check verification.valid). | | merkleRoot | String! | Lowercase hex of the originating-envelope root (all-zero hex when standalone). | | oaecCapability | String! | Capability identifier the receipt was projected under. Customer-facing label. | | signerDid | String! | L5 Verifier-of-Record attestor DID that signed the receipt. | | sourceKind | String! | Source-protocol discriminator (e.g. "osyra.vir.src.acp.v1"). Customer-facing. | | subjectDid | String! | Subject / agent DID the receipt was emitted for. | | timestamp | DateTime! | Emission timestamp (decoded from the signed body's Unix-ms field). | | trustFloor | String! | Trust floor for experimental sources; empty string for reserved-trust. | | verification | ReceiptVerification! | Authoritative AP00016-computed verification status. |

ReceiptConnection

───────────────────────────────────────────────────────────────────── Connection (pagination) ───────────────────────────────────────────────────────────────────── A page of receipt summaries plus the opaque continuation token. nextPageToken is the empty string on the final page (clients pass it back verbatim to fetch the next page). Newest-first ordering is enforced server-side by AP00016.

| Field | Type | Description | | --- | --- | --- | | invalidCount(sinceTs: DateTime, untilTs: DateTime) | String! | | | nextPageToken | String! | | | nodes | [ReceiptSummary!]! | | | totalCount(sinceTs: DateTime, untilTs: DateTime) | String! | ENG-2633 (governance-posture strip, ruling D1) — the EXACT windowed COUNT over PERSISTED receipt verdicts, projected from AP00016 GetReceiptStats. totalCount is the count of receipts emitted within [sinceTs, untilTs]; invalidCount is the subset whose verdict was INVALID at verification time (verify-on-write — a later key revocation does NOT retroactively flip a persisted verdict; the receipt detail view's on-demand re-verify is the live check). Both are exact COUNTs over facts AP00016 already owns — never estimates, never fabricated (invalidCount is an honest exact 0 while all persist paths are valid-by-construction). Serialized as String (the counts are uint64 > GraphQL Int32; mirrors AuditEventsPage.totalCount). Window: inclusive emitted-at [sinceTs, untilTs]; null = open on that side (typically the strip passes the same 24h/7d/30d window it lists over). Field RESOLVERS — the GetReceiptStats RPC runs ONLY when the field is selected. Returns OSY-VIR-NOT-WIRED until VIR_SERVICE_ADDR is configured. |

ReceiptIntent

Receipts GraphQL Schema (AP00016 verifier-svc VIR projection) — ENG-1717 (FOLD-1)

Customer-facing read surface for Verifier-Intent-Receipts (VIR): the signed economic-intent attestations the edge originates via AP00016 (the L5 Verifier-of-Record). This is the console "receipt viewer" projection — a paginated list + a single-receipt detail view with authoritative crypto verification status.

Source-of-truth: the canonical signed VIR envelope (encoded_cbor / WIRE-TRUTH) persisted by AP00016. The fields below are DECODED VIEWS (internal/vir/verify.go DecodeForDisplay); on any discrepancy the encoded_cbor (returned verbatim as encodedCborB64) is authoritative.

─────────────────────────────────────────────────────────────────────── Tenant isolation (load-bearing): the workspace is ALWAYS derived from the JWT (ctxkeys.WorkspaceID), NEVER from query input — defense-in-depth per ENG-777 SEC-H1; mirrors verifiedMemoryReceipts (verified_memory.graphql), auditEvents, memoryEvents. The AP00016 server additionally enforces workspace scope server-side and returns NotFound non-informatively for both wrong-tenant and truly-absent ids (no cross-tenant existence oracle).

─────────────────────────────────────────────────────────────────────── Customer-facing naming only — NO algebra operators / internal jargon. (e.g. "trustFloor", "sourceKind" — not ⊕_drift / OAEC / VIR internals.)

Until VIR_SERVICE_ADDR is configured the resolver returns OSY-VIR-NOT-WIRED via UnwiredReceiptService (fail-closed; NO STUBS) — same unwired-surface contract as OSY-VERIFIED-MEMORY-NOT-WIRED. ───────────────────────────────────────────────────────────────────── Node shapes ───────────────────────────────────────────────────────────────────── A single VIR receipt's economic-intent projection (decoded view of the signed intent body). Monetary amounts are integer minor-units serialized as String to avoid the GraphQL Int 32-bit overflow on large settlements. Null on a receipt that carries no intent map, and ALSO null when the receipt's verification FAILED (AP1-143): unverified economic intent is never rendered as data — check Receipt.verification.valid; the signed wire stays in encodedCborB64 for forensic inspection.

| Field | Type | Description | | --- | --- | --- | | amount | String | Settlement amount in integer minor-units, as a decimal String (no float rounding; no Int overflow). Example: "2500" = 25.00 of a 2-dp currency. | | currency | String | ISO-4217-style currency / asset ticker the amount is denominated in. | | expiry | DateTime | Intent expiry (decoded from Unix-ms in the signed body). | | paymentId | String | Originating payment / intent identifier from the source protocol. | | recipient | String | Payee identifier (DID / merchant id) from the source protocol. | | settlementAsset | String | Settlement asset (may differ from the quote currency, e.g. "USD" vs "USDC"). |

ReceiptSummary

Lightweight list-row projection. Deliberately omits intent / verification / encoded bytes (keeps the list cheap); the detail view fetches the full Receipt via the receipt(id:) query.

| Field | Type | Description | | --- | --- | --- | | contentSha | String! | Lowercase hex SHA-256 of the canonical intent body. | | correlationKey | String! | Cross-Evidence Correlation Key (CECK, ADR-373): the server-minted request_id joining this receipt to the same request/decision across the proof plane. HONESTLY "" today — AP00016 does not yet bind the CECK into the signed VIR envelope (out-of-lane; never proximity/actor/time-joined). Declared for a stable Evidence Explorer contract. | | id | ID! | Stable id = lowercase hex of the 16-byte VIR id (UUIDv7). | | ogvrDecidedAction | Int | ENG-2802 — OGVR summary projection (ONLY populated when sourceKind is "ogvr.v1"; null for every other kind AND when the signed body could not be fetched+decoded — an honest absence, never a fabricated value). Decoded SERVER-SIDE from the signed EAT receipt body (osyra-verify/ogvr strict decoder) so the timeline can triage by severity without N client fetches. Decided action: 0 LOG_ONLY / 1 REDACT / 2 RETRY / 3 FALLBACK / 4 DENY (ogvr-v1.cddl key 10 — the policy-map severity-max). | | ogvrMaxScore | Int | Highest committed detector milli-score (0..1000, no float) across the receipt's verdicts — the severity signal for sorting/scanning. | | signerDid | String! | L5 Verifier-of-Record attestor DID. | | sourceKind | String! | Source-protocol discriminator. Customer-facing. | | subjectDid | String! | Subject / agent DID. | | timestamp | DateTime! | Emission timestamp. |

ReceiptVerification

Authoritative cryptographic verification status of a receipt, computed by AP00016's VerifyReceipt RPC (which holds the per-workspace signing key — the edge does NOT). valid is the full-chain signature + freshness + content binding pass/fail; reason carries the OSY-VIR-* code on failure (empty on success). The edge-side DecodeForDisplay is presentation-only and never substitutes for this status.

| Field | Type | Description | | --- | --- | --- | | reason | String! | | | valid | Boolean! | |

ResendVerificationEmailResult

Result of a resend-verification request (ENG-664) success is ALWAYS true: the operation is enumeration-neutral, so it never reveals whether the address exists, was already verified, or a send failed.

| Field | Type | Description | | --- | --- | --- | | success | Boolean! | |

RetrievedFactNode

───────────────────────────────────────────────────────────────────── Node shapes ───────────────────────────────────────────────────────────────────── Single retrieved-fact entry within a receipt's facts[] array. Sanitized projection of internal/mguard/types.go:62-73 RetrievedFact. AC2 secrets denylist: writeScopeBiscuit + writeJmtInclusionProof are NEVER exposed.

| Field | Type | Description | | --- | --- | --- | | ageSeconds | Int! | Seconds elapsed since OME JMT insertion. | | factId | String! | SHA-256 of the source ClaimKind preimage, lowercase hex. | | imitationBudget | Float! | Tenant policy cap ∈ [0, 1]. | | imitationDistance | Float! | Cosine distance to fleet baseline ∈ [0, 1]. | | quarantineClass | QuarantineClass! | OME-decided routing class (CLEAN / SHADOW / BLOCK). | | similarityScore | Float! | Raw vector similarity ∈ [-1, 1] (auditor field). | | tombstoneAbsent | Boolean! | True if the fact was not tombstoned at retrieval time. | | writeCapabilityDid | String! | DID of the write-capability holder at storage time. |

RevokeOcnpLeaseResult

The result of a revokeOcnpLease mutation. The revoke is issued through the single ENG-2490 authority (revoker.Publish); subscriberCount is the number of edge replicas that received the cross-replica invalidation (Redis PUBLISH semantics) — propagation is observable: a value ≥ 1 means at least one gate replica eagerly marked the lease(s) revoked. leaseIds echoes the revoked set.

| Field | Type | Description | | --- | --- | --- | | leaseIds | [ID!]! | The lease_ids this revoke targeted (echoed from input). | | revokedAt | DateTime! | RFC-3339 instant the revoke was issued (the authoritative revocation time that anchors propagation). | | subscriberCount | Int! | Number of edge gate replicas that received the revoke event (PUBLISH subscriber count). 0 is valid: it means no replica is currently subscribed (TTL/feed-only deployment) — the revoke still lands via the feed + TTL. |

RevokeVirtualKeyPayload

Revoke response (proto RevokeVirtualKeyResponse).

| Field | Type | Description | | --- | --- | --- | | revokedAt | String! | RFC-3339 UTC the key was revoked. | | vkid | String! | |

RotateVirtualKeyPayload

Rotate response (proto RotateVirtualKeyResponse). alias (plaintext-once, full bearer credential) is present ONLY when the request set rotateAlias=true (leaked-alias case); a plain secret-version rotation returns null (nothing to re-copy).

| Field | Type | Description | | --- | --- | --- | | alias | String | | | grantSerial | String! | | | vkid | String! | |

RoutingCanaryVariant

One deterministic canary cohort variant (ADR-322 D3): weights sum to 100; cohort assignment is the FROZEN bucket formula over the committed salt.

| Field | Type | Description | | --- | --- | --- | | modelPref | RoutingModelPref | Optional per-variant routing override. | | variantId | String! | | | weight | Int! | |

RoutingCanaryView

The canary spec committed in the signed config (null when the resolved cascade carries no conditional decision).

| Field | Type | Description | | --- | --- | --- | | saltHex | String! | Lowercase hex of the committed cohort salt — needed by an auditor to re-derive bucket = U64BE(SHA-256(LP(cohort_key) ‖ salt)[0:8]) % 100. | | variants | [RoutingCanaryVariant!]! | |

RoutingConfigLayer

One verified cascade layer (provenance for the diff view).

| Field | Type | Description | | --- | --- | --- | | bundleVersion | Int! | | | cascadeLevel | String! | | | configSha256 | String! | Lowercase hex SHA-256(CoreDet-CBOR(config)) — the ADR-322 D7 anchor. | | scopeId | String! | |

RoutingDecision

RoutingDecision is the projection of the broker's dry-run routing + policy evaluation for the Policy Lab playground (ENG-778).

ENG-1035: field types now follow the codebase convention — Int microcents for money and UPPERCASE enum values (matches FinishReason / HealthStatus). This supersedes the interim lock to the frontend's Float-USD / lowercase-enum shape; the frontend re-vendors this SDL + regenerates in the same merge window. See docs/decisions/ENG-1035-broker-type-unification.md.

| Field | Type | Description | | --- | --- | --- | | chosenModel | String! | Selected model identifier in "<provider>/<model>" form (e.g. "openai/gpt-4o-mini"). | | estimatedCostMicrocents | Int! | Estimated total cost for the dry-run input + projected output, in microcents — millionths of a cent (1 USD = 100_000_000 microcents). Always >= 0. | | estimatedInputTokens | String! | Estimated input tokens after any policy-driven transformation (e.g. PII redactions). Computed without invoking the model. Decimal String, bigint-safe int64 (ENG-2977 — never narrowed to 32-bit Int). | | estimatedOutputTokens | String! | Estimated output tokens. Heuristic, not authoritative. Decimal String, bigint-safe int64 (ENG-2977). | | matchedPolicies | [String!]! | Names of every policy rule that matched and contributed to the verdict. Empty when no policies applied. | | rationale | String! | Short human-readable explanation of why this model was selected and the verdict was reached. Safe to render directly to the user. | | transformNotes | String | Human-readable notes describing the transformation when verdict = transform. Null otherwise. | | verdict | RoutingVerdict! | Routing verdict: ALLOW / DENY / TRANSFORM. |

RoutingModelPref

───────────────────────────────────────────────────────────────────── Routing-config read projection (ENG-2710 / ARC-59, ADR-322)

Read view of the ACTIVE, VERIFIED signed routing/reliability config cascade for the caller's JWT workspace — the same fail-static store the request-level reliability enforcer consumes (ENG-2708), so the console shows EXACTLY what is enforced, never a parallel decode.

IDOR-safety: workspace derived from the VALIDATED JWT ctx; no workspace argument by design.

Wire status: REAL data whenever routing-config sync is enabled (ROUTING_CONFIG_SYNC_ENABLED) and a verified cascade is held. Sync disabled → typed OSY-ROUTING-CONFIG-NOT-WIRED. Wired but no verified cascade for this workspace → null (honest empty). A held-but-degraded cascade (chain broken / bounds invalid) → OSY-ORCR-10802 (fail-static — the enforcer is running boot defaults and the console says so honestly).

The authoring WRITE surface is GitOps/CLI-only in this phase (ADR-322 design §7 child story 7); this is the read/diff/preview half, with routingDecision (broker.graphql) as the honest dry-run. ───────────────────────────────────────────────────────────────────── An ordered model-preference entry (child-overrides-parent on merge).

| Field | Type | Description | | --- | --- | --- | | modelId | String! | | | providerId | String! | | | weight | Int | 0..100 routing weight; null = engine default (absent on the wire). |

RoutingReliabilityView

The request-level reliability knobs in force (applied at the edge, ENG-2708; forwarded to the broker as trusted metadata).

| Field | Type | Description | | --- | --- | --- | | loadBalance | String! | | | maxRetries | Int! | | | onStatus | [Int!]! | | | retryBackoffMs | Int! | | | timeoutMs | Int! | |

SabExportReceipt

The Subject Access Bundle export receipt (ENG-2998 seam 3 — the .dsar.zip, Art-15/20). Every field is DATA AP00005 minted: manifestSha256 is the SAB manifest content id (lowercase hex; the export signature covers it), nAuditEvents is the exported subject-scoped audit-slice size, and downloadUrl / urlExpiresAt carry the short-lived presigned WORM GET — null when the WORM transport has no native signed URL (an honest null, same gate as pmmRecord.disclosureUrl; never a fabricated/broken URL).

| Field | Type | Description | | --- | --- | --- | | downloadUrl | String | Short-lived presigned WORM GET for the signed .dsar.zip; null when presigning is unsupported. | | exportId | String! | | | manifestSha256 | String | SHA-256(manifest.cbor) — lowercase hex; null only on a defensive empty wire value. | | nAuditEvents | Long! | | | urlExpiresAt | String | RFC-3339 UTC expiry of downloadUrl; null when downloadUrl is null. |

SendTestEventResult

| Field | Type | Description | | --- | --- | --- | | accepted | Boolean! | true when the test event was accepted into the delivery outbox (the POST itself is asynchronous, at-least-once with backoff + DLQ). | | eventId | String! | The minted test event's id — correlate it against the received webhook. |

Session

| Field | Type | Description | | --- | --- | --- | | createdAt | DateTime! | | | id | ID! | | | ipAddress | String | | | isCurrent | Boolean! | | | lastActiveAt | DateTime! | | | userAgent | String | |

SignUpOrganization

Organization info returned after signup

| Field | Type | Description | | --- | --- | --- | | id | ID! | | | name | String! | | | orgCode | String! | | | status | OrganizationStatus! | |

SignUpResult

============================================================================ Response Types

Result of successful signup

| Field | Type | Description | | --- | --- | --- | | accessToken | String! | JWT tokens for immediate authentication | | expiresIn | Int! | | | organization | SignUpOrganization! | | | refreshToken | String! | | | user | SignUpUser! | Created entities | | workspace | SignUpWorkspace! | |

SignUpUser

User info returned after signup

| Field | Type | Description | | --- | --- | --- | | email | String! | | | emailVerified | Boolean! | | | firstName | String! | | | id | ID! | | | lastName | String! | | | status | UserStatus! | | | userCode | String! | |

SignUpWorkspace

Workspace info returned after signup

| Field | Type | Description | | --- | --- | --- | | id | ID! | | | name | String! | | | status | WorkspaceStatus! | | | workspaceCode | String! | |

SignupProfile

The persisted profile projection — mirrors IAM's SignupProfileResponse. useCase and companySize are NULLABLE (null = never answered / proto UNSPECIFIED); updatedAt is the ISO-8601 instant of the last write (empty string if never).

| Field | Type | Description | | --- | --- | --- | | companySize | CompanySize | | | updatedAt | String! | | | useCase | SignupUseCase | |

SlugAvailabilityResult

ADR-368 §6a — customer-facing slug availability + domain-ownership verification + vanity claim (ENG-3114 IAM half MERGED; edge half ENG-3230).

Every operation below is org-scoped: the caller's org_id is derived from the JWT context AT IAM (SecurityContextUtil.getOrgId()) — NEVER from a request field — mirroring the SSO / ownership-transfer confused-deputy defense. The edge is a thin pass-through: it requires an authenticated caller and forwards the bearer; all authz and the slug/domain state machine live in IAM (AP00002). The slug is a DISPLAY ALIAS over the immutable org_code/UUID and is NEVER an authz principal (ADR-368 §2.5). Result of a slug-availability check. R7 (ADR-368) — NO EXISTENCE ORACLE: this type carries ONLY a uniform boolean. available is false for a taken, reserved (BLOCK / GATE-without-verified-domain), OR syntactically-invalid slug alike — the caller cannot tell WHICH, so an authenticated caller cannot enumerate which brand skeletons exist. The edge deliberately surfaces no distinguishing reason/error here.

| Field | Type | Description | | --- | --- | --- | | available | Boolean! | True only when the authenticated org could claim the slug right now (valid + free + not BLOCK + any GATE match backed by a verified domain). |

SsoConfig

| Field | Type | Description | | --- | --- | --- | | certificatePem | String! | | | defaultRole | SsoRole! | | | entityId | String! | | | groupMappings | [SsoGroupMapping!]! | | | lastLoginAt | String | | | ssoUrl | String! | | | status | SsoConfigStatus! | | | updatedAt | String! | |

SsoGroupMapping

| Field | Type | Description | | --- | --- | --- | | idpGroup | String! | | | role | SsoRole! | |

StepUpToken

| Field | Type | Description | | --- | --- | --- | | expiresAt | String! | ISO-8601 expiry (UTC). | | jti | ID! | JWT jti for correlation. | | scope | StepUpScope! | Scope this token is bound to (mirrors the request). | | token | String! | Compact-serialization JWT to present back as X-Osyra-Step-Up-Token. |

SubmitContactSalesRequestResult

| Field | Type | Description | | --- | --- | --- | | accepted | Boolean! | | | domainClass | ContactSalesDomainClass! | | | requestId | ID! | The same canonical UUIDv7 that was propagated to IAM. | | routedToFounder | Boolean! | | | schedulingUrl | String! | HTTPS scheduling URL configured by IAM; blank means honest async-only mode. |

SubmitTraceFeedbackPayload

| Field | Type | Description | | --- | --- | --- | | annotationVersion | Int! | The minted monotonic annotation_version for this (ws, subject, author) triple (latest+1). | | receipt | TraceFeedbackReceipt! | The signed otfa.v1 receipt (evidence). The console renders it + a "verify" affordance. |

SurfacedContradiction

Portable Memory (OMP / OMMP) GraphQL Schema — ENG-2347 (epic ENG-2287)

Customer-facing BFF for the AP00011-ome OMP/OMMP portable-memory verbs (ome.v1.OMEService.{ExportArchive,ImportArchive,MergeArchives,VerifyMergeReceipt}, ENG-2346). It lets a workspace export its memory as a cross-vendor, signed, re-importable archive (OMP, dsTag osyra-omp-archive-v1), import / verify-admit such an archive, MERGE ≥2 archives under a verified union, and offline-re-decide the EAT-hosted Merge Receipt (OMMP) that proves a merge.

─────────────────────────────────────────────────────────────────────── Tenant isolation (LOAD-BEARING): the workspace is ALWAYS derived from the JWT (ctxkeys.WorkspaceID), NEVER from operation input — defense-in-depth per ENG-777 SEC-H1; mirrors verifiedMemoryReceipts (verified_memory.graphql), receipts (receipts.graphql), auditEvents, memoryEvents. There is deliberately NO workspaceId field anywhere in this schema. The OME server additionally binds the workspace server-side (OS-Workspace-ID header → ome.workspace_id GUC) and signs with the workspace's KMS key — the edge never trusts a client-supplied tenant.

─────────────────────────────────────────────────────────────────────── Wire transport (DECISION, ENG-2347): the OMP archive + the EAT Merge Receipt are bit-exact canonical-CBOR signing surfaces (the WIRE-TRUTH). They are carried over GraphQL as STANDARD base64 strings (*B64), consistent with how the signed VIR envelope is exposed as encodedCborB64 (receipts.graphql) and the signed policy bundle manifest as encodedCborB64 (policy.graphql). The edge base64-decodes inputs and base64-encodes byte outputs at the resolver boundary; it never decodes the CBOR itself — the structured fields below are the SERVER's decoded views.

─────────────────────────────────────────────────────────────────────── Re-decision outcomes are DATA, not GraphQL errors: importMemoryArchive.admitted and verifyMergeReceipt.valid carry the verify/re-decide verdict in the payload (with reason + errorCode), so a false verdict reaches the client cleanly rather than as a top-level GraphQL error. A top-level GraphQL error is reserved for transport/auth/validation faults (unauthenticated, missing workspace claim, malformed base64, oversized input, the service-not-wired / RPC-unavailable path, and the ExportArchive UNIMPLEMENTED-server-side path → OSY-SERVER-9050). ───────────────────────────────────────────────────────────────────── Shared node shapes ───────────────────────────────────────────────────────────────────── A surfaced merge contradiction (decoded view of an ommp-audit-entry): the LOSING assertion kept as a tombstone plus the loser→winner supersededBy edge. Returned by mergeMemoryArchives (the produced audit set) and by verifyMergeReceipt (the INDEPENDENTLY-recomputed echo on a valid re-decision). Mirrors ome.v1.SurfacedContradiction.

| Field | Type | Description | | --- | --- | --- | | predicate | String! | The predicate (attribute) under contradiction. | | subject | String! | The subject the contradicting assertions are about. | | supersededBy | String! | The winning item's id (loser → winner edge), lowercase hex. | | tombstoneOrigin | String! | The loser's origin vendor (the merge tiebreak axis). | | tombstoneValue | String! | The loser's canonical_text (the value kept as a tombstone). |

TerminationReceipt

Agent Termination Receipt — the DECODED VIEW of the signed COSE_Sign1 receipt (workflow.v1.TerminationReceipt; cddl/term-receipt-v1.cddl). encodedCborB64 is the WIRE TRUTH (base64 of the canonical Form B COSE_Sign1 bytes); the scalar fields below are DOCUMENTARY views for human inspection. Verifiers (AP00016) re-decode encodedCborB64 — NEVER trust sigHex.

| Field | Type | Description | | --- | --- | --- | | agentDid | String! | | | budget | WorkflowBudgetState! | | | encodedCborB64 | String! | WIRE TRUTH: base64 (std padded) of the canonical Form B COSE_Sign1 receipt bytes. The client verifies this offline (or via AP00016) — the scalar views above are convenience for the human reviewer. | | epoch | String! | | | iss | String! | | | outstandingActionsMerkleHex | String! | | | policyCidHex | String! | | | receiptId | ID! | AP00007 metadata id (UUIDv7); NOT in the signed preimage. | | riskTier | WorkflowRiskTier! | | | sessionBindingHex | String! | | | sigHex | String! | NON-AUTHORITATIVE decoded view of the outer Ed25519 sig (64-byte hex). NEVER a verification input; AP00016 re-extracts from encodedCborB64. | | stateHashHex | String! | | | stopReasonClass | WorkflowStopReasonClass! | | | stopReasonDetailHex | String! | | | timing | WorkflowTimingWitness! | | | version | Int! | | | watchdogChain | [WorkflowWatchdogWitness!]! | | | watchdogPlacement | WorkflowWatchdogPlacement! | | | watchdogTier | WorkflowWatchdogTier! | |

TokenUsage

| Field | Type | Description | | --- | --- | --- | | completionTokens | Int! | Output tokens generated | | estimatedCostMicrocents | Int! | Estimated cost in USD (micro-cents) | | promptTokens | Int! | ENG-2977 scope note: these are PER-COMPLETION counts, bounded by the model context window (well under 2^31) — NOT unbounded window aggregates — and they back the OpenAI-compatible REST usage object where integer token counts are part of the external contract. They deliberately stay Int! (unlike the usage AGGREGATES on AIUsage/ModelUsage/billing/finops, which widen to bigint-safe String). Input tokens consumed | | totalTokens | Int! | Total tokens (prompt + completion) |

ToolCall

| Field | Type | Description | | --- | --- | --- | | function | ToolFunction! | | | id | ID! | | | type | String! | |

ToolCallDelta

Tool call delta for streaming

| Field | Type | Description | | --- | --- | --- | | function | ToolFunctionDelta | Function call fragment | | id | String | Tool call ID (only in first chunk for this tool) | | index | Int! | Tool call index | | type | String | Tool type (only in first chunk for this tool) |

ToolFunction

| Field | Type | Description | | --- | --- | --- | | arguments | String! | | | name | String! | |

ToolFunctionDelta

Function call delta for streaming

| Field | Type | Description | | --- | --- | --- | | arguments | String | Arguments fragment (accumulate across chunks) | | name | String | Function name (only in first chunk for this tool) |

TopModel

TopModel is one row of the provider/model usage mix for the dashboard's "Provider mix" widget. Field shape follows the frontend contract verbatim (osyra-frontend lib/graphql/operations/billing.ts TopModelGql): costUsd is a Float in whole US dollars (converted from billing micro-cents) and cacheHitPct is a 0-100 percentage.

| Field | Type | Description | | --- | --- | --- | | cacheHitPct | Float! | | | costUsd | Float! | | | model | String! | | | provider | String! | | | requests | String! | requests/tokens: decimal String, bigint-safe int64 (ENG-2977). | | tokens | String! | |

TopWorkspace

ENG-2072: one ranked workspace in the org-wide topWorkspaces result. Counts + tokens from billing's per-event store; workspaceName resolved from IAM. NO cost (deferred to ENG-2075 — when per-workspace cost lands, add costMicrocents here to match WorkspaceUsage).

| Field | Type | Description | | --- | --- | --- | | requests | String! | requests/tokens: decimal String, bigint-safe int64 (ENG-2977). | | tokens | String! | | | workspaceId | ID! | | | workspaceName | String! | |

TraceFeedbackAnnotation

One projected signed annotation. The scalar fields are a DECODED VIEW of the signed body; on any discrepancy the receipt (eatWireB64) is authoritative — the browser re-decides it offline.

| Field | Type | Description | | --- | --- | --- | | annotationVersion | Int! | | | authorId | String! | The signing principal the feedback is attributed to (DID/ORN) — decoded from the signed body. | | createdAt | DateTime! | | | hasComment | Boolean! | True iff the signed body carries a comment_digest (the plaintext is off-wire; only its presence shows). | | rating | Int! | 0 = no star rating; else 1..5. | | receipt | TraceFeedbackReceipt! | The verifiable otfa.v1 receipt (verify-on-read source-of-truth). | | subjectCid | ID! | | | subjectKind | TraceSubjectKind! | | | verdict | TraceFeedbackVerdict! | |

TraceFeedbackReceipt

The verifiable otfa.v1 EAT receipt carried by every annotation. eatWireB64 is the SOURCE OF TRUTH — the browser re-decides it OFFLINE (verify-on-read, the family discipline); the projected annotation row is a rebuildable cache over it.

| Field | Type | Description | | --- | --- | --- | | ctiHex | String! | The receipt id (lowercase hex of the CWT cti = SHA-256(kind || 0x00 || canonical body)). | | eatWireB64 | String! | The base64-standard-encoded signed otfa.v1 EAT envelope ("osyra-eat-v1"). The offline-re-derivable artifact a relying party feeds to osyra-verify. NEVER empty on a returned annotation. | | receiptKind | String! | The dispatched EAT receipt_kind ("otfa.v1"). |

TrustAxes

Drift GraphQL Schema (AP00012 osyrastream BAR projection) — ENG-1719 (FOLD-3)

Customer-facing read surface for the BAR drift dashboard: the per-window behavioral-drift trajectory of an agent, projected from AP00012 osyrastream's signed Behavioral Attestation Records (BARs). This is the console "drift trajectory" view — a bounded, newest-window-bearing list of decoded drift points, each with its AUTHORITATIVE cryptographic verification status.

"Real-time" = the frontend POLLS this query (AP00012 has NO push/subscribe RPC by design). The edge resolver collects AP00012's GetTrajectory server-stream into a bounded slice (≤ MaxTrajectoryItems) per call.

Source-of-truth: the canonical signed BAR (canonical_cbor / WIRE-TRUTH) persisted by AP00012. The DriftPoint fields below are DECODED VIEWS (internal/bar/decode.go DecodeBARForDisplay); on any discrepancy the canonical_cbor is authoritative. The per-point verification status is computed AUTHORITATIVELY by AP00012's VerifyBAR RPC (the edge holds no per-tenant session key — display-decode is presentation-only).

─────────────────────────────────────────────────────────────────────── Tenant isolation (load-bearing): tenant + workspace are ALWAYS derived from the JWT (ctxkeys.WorkspaceID / org-scoped tenant), NEVER from query input — defense-in-depth per ENG-777 SEC-H1; mirrors receipts (receipts.graphql), verifiedMemoryReceipts, auditEvents. AP00012 additionally enforces tenant scoping server-side: a BAR's signed tenant_id must match the os-tenant-id header (header/body routing mismatch → OSY-DRIFT-6231), and the §8.1.1 confused-deputy defense (the tenant-resolving verify path requiring os-tenant-id) is OSY-DRIFT-6233. Within-tenant workspace scoping is enforced by the request body's workspace_path (set from the JWT workspace), which the edge populates so an empty value cannot wildcard across the tenant's workspaces.

─────────────────────────────────────────────────────────────────────── Customer-facing naming ONLY — NO algebra-operator names / internal jargon. The wire/kernel notation (the streaming-attestation operator, the meet operator, "drift_vector") is deliberately NOT surfaced. We expose neutral product vocabulary: "drift score", "drift budget", "trust axes".

Until OSYRASTREAM_SERVICE_ADDR is configured the resolver returns OSY-DRIFT-NOT-WIRED via UnwiredDriftService (fail-closed; NO STUBS) — same unwired-surface contract as OSY-VIR-NOT-WIRED / OSY-VERIFIED-MEMORY-NOT-WIRED. ───────────────────────────────────────────────────────────────────── Node shapes ───────────────────────────────────────────────────────────────────── The 6 trust axes measured per window (each 0-255; higher = more-trusted). Neutral product names — these are "trust axes", not an algebra hexagon.

| Field | Type | Description | | --- | --- | --- | | attestation | Int! | | | capability | Int! | | | freshness | Int! | | | purpose | Int! | | | scope | Int! | | | spend | Int! | |

Usage

Usage represents resource usage for billing

| Field | Type | Description | | --- | --- | --- | | byModel | [ModelUsageBreakdown!]! | Breakdown by model | | byUser | [UserUsageBreakdown!]! | Breakdown by user | | byWorkspace | [WorkspaceUsage!]! | Breakdown by workspace | | completionTokens | String! | | | periodEnd | DateTime! | | | periodStart | DateTime! | Time period | | promptTokens | String! | | | quotaStatus | QuotaStatus | Current period quota status | | scope | String! | ENG-2104: the grain these metrics were computed at — "workspace" when the query carried a workspaceId, otherwise "organization". Lets the consumer disambiguate a workspace-scoped response from an org-level one. | | totalCostMicrocents | Int! | Cost in micro-cents (1/1,000,000 of a dollar) | | totalRequests | String! | API usage. Decimal Strings, bigint-safe int64 (ENG-2977 — a heavy org's window-summed counts realistically exceed 2^31; never narrowed to 32-bit Int). | | totalTokens | String! | |

UsageExportUrl

ENG-2074: result of getUsageExportUrl — a short-TTL pre-signed GET URL to the generated usage CSV plus its RFC3339 UTC expiry.

| Field | Type | Description | | --- | --- | --- | | expiresAt | String! | | | url | String! | |

UsageSavings

UsageSavings is the per-workspace cost-savings aggregate over a window (ENG-747). Every figure is the customer's OWN measured data: actualCostUsd is their real spend, baselineCostUsd is what the same traffic would have cost on the gpt-4 baseline, and savingsPct is computed from those two (0 when they routed to gpt-4 directly). No marketing "50-70%" claim is implied — these are factual per-customer numbers (ENG-1741 claim-substantiation gate). An empty window yields all zeros, which is the honest result, not an error.

| Field | Type | Description | | --- | --- | --- | | actualCostUsd | Float! | | | baselineCostUsd | Float! | | | from | DateTime! | | | requestCount | String! | Request count over the window, decimal String (bigint-safe int64; ENG-2977). | | savingsPct | Float! | | | savingsUsd | Float! | | | to | DateTime! | | | workspaceId | ID! | |

UsageTimeseries

Time-bucketed usage series (counts/tokens + cache-hit % + per-bucket cost).

| Field | Type | Description | | --- | --- | --- | | granularity | UsageGranularity! | | | series | [UsageTimeseriesPoint!]! | | | totals | UsageTimeseriesTotals! | |

UsageTimeseriesPoint

One bucket of the usage series. Counts/tokens plus per-bucket cost (ENG-1939) plus per-bucket cache-hit count (ENG-3223).

| Field | Type | Description | | --- | --- | --- | | cacheHits | String! | ENG-3223: per-bucket cache-HIT count (decimal String, bigint-safe int64). The per-bucket cache-MISS count is the honest derivation requests - cacheHits; the hit RATE is cacheHits / requests. Real SUM(cache_hit) over usage_events. | | costMicrocents | Int! | ENG-1939: SUM of metered inference cost in the bucket, in microcents (1 USD = 100_000_000; matches WorkspaceUsage.costMicrocents). Each summed figure is the recorded factual per-request cost (model_pricing list-price × the request's prompt/completion tokens, computed at meter time) — no price is invented. 0 when no metered inference cost fell in the bucket. | | iso | String! | Bucket start, ISO-8601 / RFC3339 UTC (e.g. 2026-06-05T13:00:00Z). | | requests | String! | requests/tokens: decimal String, bigint-safe int64 (ENG-2977). | | tokens | String! | |

UsageTimeseriesTotals

Range-wide totals for usageTimeseries.

| Field | Type | Description | | --- | --- | --- | | cacheHitPct | Float! | Cache-hit ratio over the whole range, 0..100. | | cacheHits | String! | ENG-3223: raw range-total cache-HIT count (decimal String, bigint-safe int64; equals the sum of the series' cacheHits). Whole-range miss = requests - cacheHits. Lets the KPI tiles render exact hit/miss counts without recomputing from cacheHitPct. | | costMicrocents | Int! | ENG-1939: SUM of all metered inference cost across the whole range, in microcents (1 USD = 100_000_000). Equals the sum of the series' costs. | | requests | String! | requests/tokens: decimal String, bigint-safe int64 (ENG-2977). | | tokens | String! | |

User

User types and related operations

| Field | Type | Description | | --- | --- | --- | | avatarUrl | String | IdP/OAuth-attested avatar only (provider-supplied). Currently null until the read path surfaces the social-link avatar; user-set avatar is deferred post-V1 (ENG-1840). | | createdAt | DateTime! | | | displayName | String | Derived server-side from first + last name (read-only; see UpdateProfileInput). Not a separately-stored field — there is no user-settable display name (ENG-1840 V1 scope). | | email | String! | | | emailVerified | Boolean! | | | firstName | String | | | id | ID! | | | lastLoginAt | DateTime | | | lastName | String | | | mfaEnabled | Boolean! | | | organizations | [Organization!] | Related entities. This field is nullable because it is protected by the independent organizations:read permission. A denied nested read must surface a field-level typed error without null-propagating authorized self-profile data from me (ENG-3329). | | status | UserStatus! | | | updatedAt | DateTime! | |

UserConnection

| Field | Type | Description | | --- | --- | --- | | edges | [UserEdge!]! | | | pageInfo | PageInfo! | |

UserEdge

| Field | Type | Description | | --- | --- | --- | | cursor | String! | | | node | User! | |

UserUsageBreakdown

| Field | Type | Description | | --- | --- | --- | | cacheHits | String! | ENG-3223: per-user cache-HIT count (decimal String, bigint-safe int64). Hit rate = cacheHits / requests ("better user"). Real SUM(cache_hit) over usage_events. | | costMicrocents | Int! | | | email | String | | | requests | String! | requests/tokens: decimal String, bigint-safe int64 (ENG-2977). | | tokens | String! | | | userId | ID! | | | userName | String | |

ValidationReport

The result of validating a candidate source document.

| Field | Type | Description | | --- | --- | --- | | findings | [PolicyFinding!]! | | | ok | Boolean! | |

VerifiedMemoryHistogram

| Field | Type | Description | | --- | --- | --- | | buckets | [HistogramBucket!]! | | | budgetP50 | Float! | P50 imitation_budget across the filtered set — guideline line in FE chart. | | budgetP99 | Float! | P99 imitation_budget — block-zone guideline at 2× P99 in FE chart. | | totalCount | Int! | |

VerifiedMemoryReceiptNode

Top-level Verified Memory receipt as surfaced to the dashboard. Sanitized projection of the inner MGuardRetrievalReceipt (internal/mguard/types.go:94-108) plus envelope timestamp (OsyraReceiptEnvelopeV1.emitted_at_unix_ms / types.go:113-123).

Explicitly excluded (AC2 secrets denylist):

• sig, signerPub (Ed25519 receipt signature + pubkey)
• envSig, envSignerPub (envelope signature + pubkey)
• outer envelope innerPayload CBOR bytes (carries inner receipt + sigs)
• writeScopeBiscuit, writeJmtInclusionProof (per fact)
• lMeet.monotonicityProof raw bytes (only hex digest exposed)
• quarantineGateReceipt (signed redaction artifact; server-only)

| Field | Type | Description | | --- | --- | --- | | denyReason | String | Optional human-readable deny reason from the verifier chain. Populated when verdict=FAIL (from VerifyOutcome.DenyReason); null otherwise. | | emittedAt | String! | ISO-8601 emission timestamp from envelope.emitted_at_unix_ms. | | facts | [RetrievedFactNode!]! | | | id | ID! | Stable id = lowercase hex SHA-256 of the outer envelope bytes. | | lMeet | LMeetNode! | | | omeJmtAnchor | String! | Hex of the 32-byte OME JMT anchor (commitment, not a secret). Post-ENG-907 rename (osymem → ome). Coordinated with FE rename ticket. | | purposeDid | String! | | | queryCommit | String! | Hex of the 32-byte query commitment. | | receiptVerified | Boolean! | Strict boolean from VerifyOutcome.Verified — the full crypto chain pass/fail. Separate from verdict because the FE renders both: the verdict drives badge color/icon; receiptVerified drives the detail-pane chain-of-custody section. | | retrieverDid | String! | | | verdict | Verdict! | Server-computed verdict scalar (ENG-1070 / VM-6.5). Derived per ADR-050; never client-derived. | | workspaceDid | String! | |

VerifiedMemoryReceiptsConnection

───────────────────────────────────────────────────────────────────── Connection + Histogram types ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | hasMore | Boolean! | | | nextCursor | String | Opaque pagination cursor for the next page; null when hasMore is false. Cursor format is gateway-internal; clients pass it back verbatim. | | nodes | [VerifiedMemoryReceiptNode!]! | | | totalCount | Int! | |

VerifyMergeReceiptPayload

verifyMergeReceipt result. valid is the offline re-decision verdict: OME independently recomputes the merge over the supplied input archives and FORCES the receipt's claimed digests/counts to equal the recomputation (acceptance is never a trusted verdict). A false verdict + reason/errorCode is DATA, not a GraphQL error.

| Field | Type | Description | | --- | --- | --- | | errorCode | String | The canonical OSY-* code on a failed re-decision; empty/null when valid. Lets the client classify the failure without parsing reason. | | reason | String! | The OSY-EAT-639x code on a failed re-decision (replay / forgery / wrong-kind / substituted-input); empty on a valid re-decision. | | recomputedContradictions | [SurfacedContradiction!]! | The INDEPENDENTLY-recomputed audit set on a valid re-decision (echo). | | valid | Boolean! | True iff the COSE_Sign1 verifies, the content-addressed nonce binds, the input ids match, and the recomputed live+audit digests/counts equal the receipt's claim. |

VerifyRetrievalHit

───────────────────────────────────────────────────────────────────── Result shapes ───────────────────────────────────────────────────────────────────── One per-hit accept/reject record (the backend OsyidxDecision trace).

| Field | Type | Description | | --- | --- | --- | | admitted | Boolean! | True iff every per-hit leg held (member, content-bound, policy-allowed). | | itemId | String! | The memory item identifier (a UUID per the OME claim model). | | reason | String! | The descriptive reason string (the leg that failed, or the admit string). | | reasonCode | String! | The precise OSY-OSYIDX-84xx band code (OSY-OSYIDX-8430 when admitted). |

VerifyRetrievalResult

The re-decision result (the backend OsyidxReDecision) plus the manifest commitments decoded from the osyidx body for the FE viewer.

| Field | Type | Description | | --- | --- | --- | | admittedItemIds | [String!]! | The item_ids of admitted (sound) hits, in body order. | | hwmAfter | String! | The consumer high-water-mark after (== hwmBefore on a non-fresh/forged manifest; monotone, never rewinds) (64-bit, string). | | hwmBefore | String! | The consumer high-water-mark before this re-decision (64-bit, string). | | indexId | String! | The authenticated index identifier (the high-water-mark domain). | | manifestAccepted | Boolean! | manifestSig AND fresh — a SUPERSET of "any hit admitted". A fresh authentic manifest sets it (and advances hwmAfter) even if every hit's per-hit legs fail. A rollback / forged manifest leaves it false + hwmAfter == hwmBefore. | | manifestReason | String! | The manifest-stage outcome (admit string, or the 8401/8402/8400 reason). | | manifestRoot | String! | The radix-16 index root committed in the manifest (lowercase hex). | | manifestVer | String! | The index version (sequence) the receipt's manifest commits (64-bit, string). | | trace | [VerifyRetrievalHit!]! | The full per-hit decision trace, positionally aligned with the receipt hits. |

VirtualKey

───────────────────────────────────────────────────────────────────── One virtual key — METADATA only (proto VirtualKey). NEVER carries the alias plaintext; aliasHint is the last-4 of the <secret> segment and vkid is the public, non-secret id used for audit / receipt correlation. ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | aliasHint | String! | Last-4 of the <secret> segment — a display hint, NEVER the alias. | | budget | VirtualKeyBudget! | | | issuedAt | String! | RFC-3339 UTC. | | modelAllowList | [String!]! | Empty => deny-all (never a wildcard); the models this key may call. | | provider | String! | The provider this key fronts (proto provider_id). | | rateLimit | VirtualKeyRateLimit! | | | revokedAt | String | RFC-3339 UTC; set iff status === REVOKED, else null. | | scope | String! | | | status | VirtualKeyStatus! | | | vkid | String! | The public, non-secret virtual-key id (also embedded in the alias). |

VirtualKeyBudget

───────────────────────────────────────────────────────────────────── Per-key spend ceiling (proto BudgetEnvelope). limitMicros is int64 micros as a decimal String ("0" = unlimited/soft-track). hard true = deny on exceed; false = track + flag (ADR-004 soft). ─────────────────────────────────────────────────────────────────────

| Field | Type | Description | | --- | --- | --- | | hard | Boolean! | | | limitMicros | String! | | | period | String! | |

VirtualKeyRateLimit

Per-key rate ceiling (proto RateLimit).

| Field | Type | Description | | --- | --- | --- | | rpm | Int! | | | tpm | Int! | |

WarehouseBigQueryConfig

The NON-SECRET BigQuery destination config (Workload-Identity-Federation based; no stored SA-JSON key).

| Field | Type | Description | | --- | --- | --- | | dataset | String! | | | projectId | String! | | | table | String! | |

WarehouseClickHouseConfig

The NON-SECRET ClickHouse destination config. The customer's password is NEVER carried — secretRef is a pointer the delivery-time SecretResolver seam resolves; the edge only ever sees the ref.

| Field | Type | Description | | --- | --- | --- | | database | String! | | | endpoint | String! | | | secretRef | String! | | | table | String! | | | username | String! | |

WarehouseDeleteResult

The delete result (mirrors DeleteWarehouseDestinationResponse). deleted=false when the id is not visible under the bound tenant (idempotent delete; never a cross-tenant reveal).

| Field | Type | Description | | --- | --- | --- | | deleted | Boolean! | |

WarehouseDeliveryHealth

One destination's LIVE delivery-health snapshot (from the merged egress_cursor / egress_dlq tables). A destination that has never delivered reports delivered=false with the genesis cursor — an honest "no deliveries yet", never a fabricated success. Counts are bigint-safe decimal STRINGS (the ENG-2623 Long convention — a JS number cannot hold a > 2^53 sequence/count without precision loss). lastDeliveryAt is RFC-3339 UTC; null (never a fabricated timestamp) until the first batch commits.

| Field | Type | Description | | --- | --- | --- | | cursorSeq | String! | chain_seq of the last committed row ("-1" at genesis), decimal string. | | cursorTsMs | String! | business ts of the last committed row, epoch-ms decimal string ("0" at genesis). | | delivered | Boolean! | | | destinationId | String! | | | dlqDepth | String! | count of dead-lettered (permanently unroutable) rows, decimal string. | | lastDeliveryAt | String | RFC-3339 UTC of the last cursor advance; null at genesis. |

WarehouseDestination

One registered warehouse destination (the warehouse_destinations row projection). externalId is the minted per-destination confused-deputy nonce (rendered so the console can show the trust-policy snippet) — NOT a secret. Timestamps are RFC-3339 UTC.

| Field | Type | Description | | --- | --- | --- | | config | WarehouseDestinationConfig! | | | createdAt | String! | | | destinationId | String! | | | displayName | String! | | | enabled | Boolean! | | | externalId | String! | The minted per-destination STS ExternalId (non-secret nonce the customer pins in sts:ExternalId). | | sinkKind | WarehouseSinkKind! | | | updatedAt | String! | | | workspaceId | String! | "" for an org-level destination. |

WarehouseDestinationConfig

The kind-discriminated destination config. Exactly the arm matching the destination's sinkKind is non-null.

| Field | Type | Description | | --- | --- | --- | | bigquery | WarehouseBigQueryConfig | | | clickhouse | WarehouseClickHouseConfig | | | s3 | WarehouseS3Config | |

WarehouseDestinationConnection

The registry read model — a Relay connection over ListWarehouseDestinations.

| Field | Type | Description | | --- | --- | --- | | edges | [WarehouseDestinationEdge!]! | | | pageInfo | WarehousePageInfo! | |

WarehouseDestinationEdge

One edge in the destinations connection. cursor is a per-row opaque marker (base64 of the destinationId); continuation uses pageInfo.endCursor (the backend page token), not the per-edge cursor.

| Field | Type | Description | | --- | --- | --- | | cursor | String! | | | node | WarehouseDestination! | |

WarehouseEgressIdentity

The GLOBAL Osyra egress identity the customer's IAM role trust policy must admit (not tenant-scoped): the principal ARN (as the trust-policy Principal) + the STS session-name prefix (so the customer can trace Osyra egress sessions in their CloudTrail).

| Field | Type | Description | | --- | --- | --- | | principalArn | String! | | | sessionNamePrefix | String! | |

WarehousePageInfo

Relay-style page-info for the warehouse destinations connection. Named WarehousePageInfo (not PageInfo) to avoid colliding with the top-level PageInfo type. endCursor is the AP00005 opaque page token.

| Field | Type | Description | | --- | --- | --- | | endCursor | String | | | hasNextPage | Boolean! | |

WarehouseS3Config

The NON-SECRET S3 destination config. BYO-credentials: no AWS access key is ever carried — the trust binding is the customer's roleArn plus the minted per-destination externalId (on WarehouseDestination).

| Field | Type | Description | | --- | --- | --- | | bucket | String! | | | endpoint | String! | "" = real AWS; an http(s) endpoint override targets self-host / MinIO / LocalStack. | | prefix | String! | | | region | String! | | | roleArn | String! | "" = the default provider chain; an ARN = the customer role the egress adapter STS-AssumeRoles into. |

WindowReceiptCounts

Per-window interaction counts carried in a coverage receipt.

| Field | Type | Description | | --- | --- | --- | | fail | String! | | | invalid | String! | | | normErrors | String! | | | pass | String! | | | total | String! | |

WindowReceipts

The per-window receipt bundle — what a regulator re-verifies offline. All byte fields are hex-encoded.

| Field | Type | Description | | --- | --- | --- | | counts | WindowReceiptCounts! | Per-window interaction counts (total / pass / fail / invalid / norm-errors). | | coverageCti | String! | The coverage receipt CTI (hex); empty when not found. | | emittedAt | String | The window's coverage receipt emitted_at (Unix seconds); null when not found. | | found | Boolean! | Whether a coverage receipt exists for this (ws, window). | | policyDigest | String! | The policy digest in force for this window (hex). | | receiptsRoot | String! | Merkle root over the per-interaction receipts (hex). | | redecisionCtis | [String!]! | The per-interaction re-decision CTIs (hex) a regulator can re-verify. | | skippedRoot | String! | Merkle root over the skipped/excluded interactions (hex). |

WitnessEventNode

| Field | Type | Description | | --- | --- | --- | | claimKind | String! | The osyra.claim kind the witness attests (e.g. "osyra.claim.policy.v1"). | | correlationKey | String! | Cross-Evidence Correlation Key (CECK, ADR-373): the server-minted request_id joining this witness event to the same request/decision across the proof plane. HONESTLY "" today — AP00011 does not yet bind the CECK into the signed witness envelope (out-of- lane; never proximity/actor/time-joined, ADR-373 §2/§5). Declared for a stable Evidence Explorer contract; graduates with ZERO frontend change once sourced. | | id | ID! | | | inputHash | String! | Hex SHA-256 of the operator input (the pre-image the witness binds). | | notes | String | Optional one-line human-readable note; null when none. | | occurredAt | String! | ISO-8601 UTC timestamp (e.g. "2026-05-13T14:32:00.000Z"). | | operator | String! | The lattice operator that produced the witness (OPEN set, e.g. "settle", "route", "prov", "eval"). Typed String for forward-compat; the FE renders an unknown operator as "⊕ <name>". | | outputHash | String! | Hex SHA-256 of the operator output (the post-image the witness binds). | | signer | String! | The signer that attested the witness — KMS key alias or DID. | | verdict | WitnessVerdict! | |

WitnessEventsPage

| Field | Type | Description | | --- | --- | --- | | hasMore | Boolean! | | | nextCursor | String | Opaque pagination cursor for the next page; null when hasMore is false. Carries microsecond-precision keyset state (ENG-2073) so same-millisecond rows are not skipped/duplicated across pages. | | nodes | [WitnessEventNode!]! | |

WorkflowApproval

A pending HITL approval projected from the workflow's pendingApprovals query (QueryWorkflow query_name="pendingApprovals"). The query-result JSON shape is owned by AP00007 (the proto leaves QueryWorkflowResponse.result as opaque bytes); the edge decodes it forward-permissively into this minimal view. Empty/missing fields degrade gracefully (never fabricated).

| Field | Type | Description | | --- | --- | --- | | approvalId | ID! | | | requestedAt | DateTime | When the approval was requested (null when the upstream omits it). | | summary | String! | Human-readable summary of what is awaiting approval (the gate label). |

WorkflowBudgetState

Decoded view of the budget_state map in the signed receipt preimage (workflow.v1.BudgetState). All counters are String! (uint64).

| Field | Type | Description | | --- | --- | --- | | actionsLimit | String! | | | actionsUsed | String! | | | tokensLimit | String! | | | tokensUsed | String! | | | wallNsLimit | String! | | | wallNsUsed | String! | |

WorkflowRun

One workflow run — the DescribeWorkflow / ListWorkflows status projection (workflow.v1.WorkflowDescription). uint64 fields are String! (no GraphQL Int 53-bit overflow). Timestamps decode epoch-ms → DateTime.

| Field | Type | Description | | --- | --- | --- | | closedAt | DateTime | Null while the run is still open (closed_at_unix_ms == 0). | | currentState | String! | Current step / kill-switch state name (§4.3.2). | | historyLength | String! | Engine event-history length (decimal String — uint64). | | namespace | String! | | | runId | ID! | | | startedAt | DateTime! | | | status | WorkflowStatus! | | | versionMarkers | [String!]! | getVersion changeIds present in history (ADR-125). | | workflowId | ID! | | | workflowType | String! | |

WorkflowRunsPage

A page of workflow runs + the opaque continuation cursor. nextCursor is null on the final page (clients pass it back verbatim).

| Field | Type | Description | | --- | --- | --- | | hasMore | Boolean! | | | nextCursor | String | | | nodes | [WorkflowRun!]! | |

WorkflowSignalResult

Result of a HITL approve/reject signal (SignalWorkflow signal_name="approval"). SignalWorkflow has an empty response; accepted reflects a successful enqueue of the decision signal (the run consumes it asynchronously).

| Field | Type | Description | | --- | --- | --- | | accepted | Boolean! | | | approvalId | ID! | | | decision | WorkflowApprovalDecision! | | | workflowId | ID! | |

WorkflowTimingWitness

Decoded view of the 4-state transition wall-clock timestamps in ns (workflow.v1.TimingWitness). String! (uint64 ns).

| Field | Type | Description | | --- | --- | --- | | drainingAtNs | String! | | | haltedAtNs | String! | | | proofAtNs | String! | | | stoppingAtNs | String! | |

WorkflowWatchdogWitness

Decoded view of an inner watchdog co-witness record (workflow.v1.WatchdogWitness). signatureHex is a NON-AUTHORITATIVE decoded view of the inner COSE_Sign1 sig — verification is AP00016's job over the encoded CBOR.

| Field | Type | Description | | --- | --- | --- | | agentStateWitnessHex | String! | | | observationTsNs | String! | | | observationType | WorkflowObservationType! | | | sessionBindingHex | String! | | | signatureHex | String! | NON-AUTHORITATIVE decoded view of the inner Ed25519 sig (64-byte hex). | | tier | WorkflowWatchdogTier! | | | watchdogDid | String! | | | watchdogEpoch | String! | |

Workspace

Workspace types and related operations

| Field | Type | Description | | --- | --- | --- | | createdAt | DateTime! | | | description | String | ENG-2969: free-text description + logo URL, backed by REAL IAM columns (workspaces.description / workspaces.logo_url, migration V0137) and mapped VERBATIM from IAM WorkspaceResponse.description / .logo_url. NULLABLE: absent when unset. | | displayName | String | ENG-1840: human-friendly display name (IAM WorkspaceResponse.display_name). Null when unset. | | id | ID! | | | logoUrl | String | | | members | [WorkspaceMember!]! | Related entities | | name | String! | | | noStore | Boolean | PLA-94 (Wave-C / C-edge-read): the persisted workspace-level no_store privacy baseline, surfaced READ-only so the Console toggle (C-FE) can hydrate its current state. Mapped VERBATIM from IAM WorkspaceResponse.no_store (field 10, a plain always-present bool defaulting false) — NEVER a hardcoded default. NULLABLE in the GraphQL contract for forward-compat, but the resolver always sets the real value (the gRPC source is a definite bool), so it is non-null in practice. | | organization | Organization! | | | organizationId | ID! | Organization reference - can use organizationId directly or nested organization | | settings | WorkspaceSettings | Workspace settings. NULLABLE on purpose: the settings projection is not yet wired to IAM, so the resolver returns null (honest empty-state) rather than a fabricated object. Were this NON-NULL (WorkspaceSettings!), a null would propagate UP and collapse the ENTIRE Workspace to null — so selecting settings on an otherwise-healthy workspace would nuke the whole record. | | slug | String! | | | status | WorkspaceStatus! | | | updatedAt | DateTime! | |

WorkspaceDefaultProvider

One workspace default-provider declaration (design §4.1.2 type WorkspaceDefaultProvider). Identity columns are immutable server-side; the edge only projects them.

| Field | Type | Description | | --- | --- | --- | | declaredBy | ID | lowercase hex, 64 chars | | model | String! | | | provider | String! | | | rowCid | String! | null = open declaration | | status | DefaultProviderStatus! | user uuid — SERVER-derived from the re-verified JWT, never an input Server-computed (from the eligibility intersection at read time) — one query, not N+1, for the stale-default UX. Never client-supplied. | | validFrom | String! | | | validTo | String | ISO-8601 (finops family convention) | | version | Int! | Monotonic setting-change counter per (workspace, model). int64 on the wire; GraphQL Int is 32-bit, so the resolver applies an int64→Int overflow guard — a value exceeding MaxInt32 is surfaced as an error, NEVER silently truncated. |

WorkspaceMember

| Field | Type | Description | | --- | --- | --- | | id | ID! | | | joinedAt | DateTime! | | | role | WorkspaceRole! | | | user | User! | | | workspace | Workspace! | |

WorkspaceOwnershipTransferResult

| Field | Type | Description | | --- | --- | --- | | completedAt | String! | | | newOwnerId | ID! | | | previousOwnerId | ID! | | | status | String! | | | workspaceId | ID! | |

WorkspaceSettings

| Field | Type | Description | | --- | --- | --- | | allowedModels | [String!]! | | | budgetLimit | Float | | | budgetPeriod | BudgetPeriod | | | defaultModel | String | | | maxTokensPerRequest | Int | |

WorkspaceUsage

| Field | Type | Description | | --- | --- | --- | | cacheHits | String! | ENG-3223: per-workspace cache-HIT count (decimal String, bigint-safe int64). Hit rate = cacheHits / requests ("better workspace"). Real SUM(cache_hit). | | costMicrocents | Int! | | | requests | String! | requests/tokens: decimal String, bigint-safe int64 (ENG-2977). | | tokens | String! | | | workspaceId | ID! | | | workspaceName | String! | |