openapi: 3.1.0
info:
  title: Sandbox Platform API
  version: 1.0.0
  description: 'Integrator-facing Sandbox API via the gateway. Guides: https://sandbox-task.turing.com/docs


    ## Correlation and LLM tracing


    Send **`x-correlation-id`** on every request to tie logs, Cloud Trace, harbor
    async jobs, and Langfuse traces to one eval run.


    | Field | Source | Langfuse |

    | --- | --- | --- |

    | `x-correlation-id` | Your client (or gateway-generated ULID if omitted) | `trace.id`
    |

    | Harbor `job_id` | Response header / poll URL | `session_id` (groups LLM generations)
    |


    The header is echoed on responses. Async jobs (`POST .../jobs/execute-tasks`)
    copy it into the Pub/Sub payload so workers and harbor subprocesses continue the
    same id.


    Platform docs: [Observability](/docs/introduction/observability).

    '
servers:
- url: http://localhost:8780
  description: Local gateway
- url: https://sandbox-dev.turing.com
  description: Development
- url: http://sandbox-preprod.turing.com
  description: Preprod
- url: https://sandbox-task.turing.com
  description: Production
paths:
  /sandbox/healthz:
    get:
      tags:
      - Gateway
      summary: Gateway aggregated health
      operationId: sandbox_healthz_sandbox_healthz_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Sandbox Healthz Sandbox Healthz Get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/v1/catalog:
    get:
      tags:
      - Gateway
      summary: Execution catalog (languages, agents, profiles)
      operationId: catalog_list_sandbox_v1_catalog_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: kind
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Kind
      responses:
        '200':
          description: Execution catalog entries
          content:
            application/json:
              schema: {}
              examples:
                agents:
                  summary: Tier-1 agents
                  value:
                    items:
                    - id: oracle
                      kind: agent
                      tier: 1
                    - id: opencode
                      kind: agent
                      tier: 1
                    count: 2
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/v1/usage/summary:
    get:
      tags:
      - Gateway
      summary: Project-scoped latency percentiles (p50/p95/p99)
      operationId: usage_summary_sandbox_v1_usage_summary_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Usage Summary Sandbox V1 Usage Summary Get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/v1/admin/quotas/{tenant}/{project}:
    get:
      tags:
      - Admin
      summary: 'Admin: inspect a tenant/project concurrency quota'
      operationId: admin_get_quota_sandbox_v1_admin_quotas__tenant___project__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: tenant
        in: path
        required: true
        schema:
          type: string
          title: Tenant
      - name: project
        in: path
        required: true
        schema:
          type: string
          title: Project
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - AdminKeyAuth: []
    put:
      tags:
      - Admin
      summary: 'Admin: create or replace a tenant/project concurrency quota'
      operationId: admin_put_quota_sandbox_v1_admin_quotas__tenant___project__put
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: tenant
        in: path
        required: true
        schema:
          type: string
          title: Tenant
      - name: project
        in: path
        required: true
        schema:
          type: string
          title: Project
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QuotaPolicyRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - AdminKeyAuth: []
    delete:
      tags:
      - Admin
      summary: 'Admin: delete a tenant/project concurrency quota'
      operationId: admin_delete_quota_sandbox_v1_admin_quotas__tenant___project__delete
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: tenant
        in: path
        required: true
        schema:
          type: string
          title: Tenant
      - name: project
        in: path
        required: true
        schema:
          type: string
          title: Project
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - AdminKeyAuth: []
  /sandbox/v1/quota:
    get:
      tags:
      - Gateway
      summary: Effective concurrency quota and current project usage
      operationId: effective_quota_sandbox_v1_quota_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/v1/providers:
    get:
      tags:
      - Gateway
      summary: Model providers this caller has a key for
      description: "Which providers the caller can actually run a model from.\n\n\
        The platform has no model catalog and deliberately does not gain one here:\
        \ it\naccepts any ``provider/model`` and leases a key for the provider at\
        \ run time,\nso the set of runnable *models* is whatever the provider serves\
        \ and not\nsomething we can enumerate without inventing a list to maintain\
        \ by hand.\n\nWhat is knowable, and what callers were actually missing, is\
        \ the provider\nhalf. Without it a UI could only offer a free-text box, and\
        \ a model naming a\nprovider with no key was accepted and then failed inside\
        \ the trial \u2014 roughly\neighty seconds of cluster time to learn that no\
        \ key could be leased. That is\nnow answerable before submitting.\n\nAnswers\
        \ for exactly the namespace a *run* by this caller would lease from:\nthe\
        \ caller's own ``tenant:project``. There is no shared fallback pool \u2014\
        \ a\nmissing key for that pair is a provisioning gap for that tenant, not\
        \ a cue\nto bill another namespace. ``source`` is always ``tenant`` when present.\n\
        \nTenancy comes from :func:`resolve_scope`, the same check the job routes\
        \ use,\nso a credential cannot read a namespace it does not hold: this answer\
        \ names\nwhich providers a tenant has provisioned, and a forged tenant header\
        \ must not\nbe able to ask on their behalf."
      operationId: list_providers_sandbox_v1_providers_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/v1/admin/credential-plane/teams:
    post:
      tags:
      - Admin
      summary: 'Admin: create team (credential plane)'
      operationId: admin_create_team_cp_sandbox_v1_admin_credential_plane_teams_post
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: true
              type: object
              title: Body
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Admin Create Team Cp Sandbox V1 Admin Credential Plane
                  Teams Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - AdminKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/v1/admin/credential-plane/keys:
    get:
      tags:
      - Admin
      summary: 'Admin: list provider key ids (no key material)'
      operationId: admin_list_keys_cp_sandbox_v1_admin_credential_plane_keys_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: namespace
        in: query
        required: true
        schema:
          type: string
          title: Namespace
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Admin List Keys Cp Sandbox V1 Admin Credential Plane
                  Keys Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - AdminKeyAuth: []
    post:
      tags:
      - Admin
      summary: 'Admin: append LLM provider key (credential plane multi-key pool)'
      operationId: admin_add_key_cp_sandbox_v1_admin_credential_plane_keys_post
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Body
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Admin Add Key Cp Sandbox V1 Admin Credential Plane
                  Keys Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - AdminKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/v1/admin/credential-plane/keys/{key_id}/rotate:
    post:
      tags:
      - Admin
      summary: 'Admin: rotate a specific provider key in the pool'
      operationId: admin_rotate_key_cp_sandbox_v1_admin_credential_plane_keys__key_id__rotate_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: key_id
        in: path
        required: true
        schema:
          type: string
          title: Key Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Body
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Admin Rotate Key Cp Sandbox V1 Admin Credential Plane
                  Keys  Key Id  Rotate Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - AdminKeyAuth: []
  /sandbox/v1/admin/credential-plane/keys/{key_id}:
    delete:
      tags:
      - Admin
      summary: 'Admin: deactivate a provider key in the pool'
      operationId: admin_delete_key_cp_sandbox_v1_admin_credential_plane_keys__key_id__delete
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: key_id
        in: path
        required: true
        schema:
          type: string
          title: Key Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Admin Delete Key Cp Sandbox V1 Admin Credential Plane
                  Keys  Key Id  Delete
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - AdminKeyAuth: []
  /sandbox/v1/admin/keyhive/teams:
    post:
      tags:
      - Admin
      summary: 'Admin: create team (legacy path; proxies credential plane)'
      operationId: admin_create_team_sandbox_v1_admin_keyhive_teams_post
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: true
              type: object
              title: Body
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Admin Create Team Sandbox V1 Admin Keyhive Teams Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - AdminKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/v1/admin/keyhive/keys:
    post:
      tags:
      - Admin
      summary: 'Admin: add LLM provider key (legacy path; proxies credential plane)'
      operationId: admin_add_key_sandbox_v1_admin_keyhive_keys_post
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: true
              type: object
              title: Body
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Admin Add Key Sandbox V1 Admin Keyhive Keys Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - AdminKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/harbor/capabilities:
    get:
      tags:
      - Harbor (compatibility)
      summary: Harbor runner capabilities
      operationId: harbor_capabilities_capabilities_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Capabilities Capabilities Get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/harbor/v1/capabilities:
    get:
      tags:
      - Harbor (compatibility)
      summary: Harbor API v1 capabilities
      operationId: harbor_versioned_capabilities_v1_capabilities_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Versioned Capabilities V1 Capabilities Get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/harbor/v1/run/datapoint:
    post:
      tags:
      - Harbor (compatibility)
      summary: Run Harbor datapoint (v1)
      operationId: harbor_run_datapoint_v1_run_datapoint_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RunDatapointRequest'
            examples:
              oracle_with_extensions:
                summary: Oracle agent with harbor_extensions
                value:
                  task_slug: example-task
                  metadata:
                    task_archive_url: https://storage.example/tasks/example-task.zip
                  agents:
                  - name: oracle
                    harbor_agent: oracle
                    harbor_extensions:
                      agent_env:
                        SANDBOX_DOCS: '1'
      responses:
        '200':
          description: Datapoint completed
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Run Datapoint V1 Run Datapoint Post
              examples:
                success:
                  summary: Succeeded datapoint
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: succeeded
                    results:
                    - agent: oracle
                      reward: 1.0
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '429':
          description: 'The project is already running its maximum number of concurrent
            jobs. Nothing was enqueued, so retrying after `Retry-After` is safe and
            cannot duplicate a run. Use `POST /jobs/execute-tasks` instead if you
            would rather the platform queue the work than refuse it: the async route
            accepts the job with a `202` and lets it wait for capacity.'
          headers:
            Retry-After:
              description: Seconds to wait before retrying.
              schema:
                type: integer
                example: 5
          content:
            application/json:
              example:
                detail: 'sandbox admission denied: project_concurrency_exceeded limit=8
                  current=8'
        '504':
          description: "The run did not finish inside the synchronous wait. It has\
            \ **not** been cancelled \u2014 it is still running, and the job id is\
            \ in the response headers. Poll `GET /jobs/{job_id}`, or follow `GET /jobs/{job_id}/events`,\
            \ rather than resubmitting. Use `POST /jobs/execute-tasks` instead if\
            \ your tasks routinely run this long."
          content:
            application/json:
              example:
                detail: 'the run did not finish within 1500s and is still going. It
                  was not cancelled: poll GET /jobs/550e8400-e29b-41d4-a716-446655440000
                  for the result, or follow GET /jobs/550e8400-e29b-41d4-a716-446655440000/events.'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/jobs/execute-tasks:
    post:
      tags:
      - Harbor (compatibility)
      summary: Enqueue Harbor datapoint job (v1)
      operationId: harbor_execute_tasks_v1_jobs_execute_tasks_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Job-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: X-Sandbox-Job-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExecuteTasksRequest'
      responses:
        '202':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
                title: Response Execute Tasks V1 Jobs Execute Tasks Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/jobs/{job_id}:
    get:
      tags:
      - Harbor (compatibility)
      summary: Get job status (v1)
      operationId: harbor_get_job_v1_jobs__job_id__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Job status
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Job V1 Jobs  Job Id  Get
              examples:
                running:
                  summary: Job in progress
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: running
                    timings:
                      enqueued_at: 1753420800.12
                      started_at: 1753420802.44
                      queue_wait_ms: 2320
                    created_at: 1753420800.12
                    updated_at: 1753420802.44
                succeeded:
                  summary: Terminal job with full AHT breakdown
                  description: queue_wait_ms + run_ms == total_ms. Upstream services
                    average total_ms (or its parts) across jobs to derive AHT. The
                    same timings block is present on failed and cancelled jobs, so
                    AHT covers a realistic outcome mix.
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: succeeded
                    timings:
                      enqueued_at: 1753420800.12
                      started_at: 1753420802.44
                      finished_at: 1753420889.71
                      queue_wait_ms: 2320
                      run_ms: 87270
                      total_ms: 89590
                    created_at: 1753420800.12
                    updated_at: 1753420889.71
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/jobs/{job_id}/retry-errored-trials:
    post:
      tags:
      - Harbor (compatibility)
      summary: Retry only errored pass@k trials (v1)
      description: 'Batch-refill incomplete pass@k attempts for a terminal datapoint
        job. Counts `result.outcome.trials_detail` rows with `status=errored` and
        enqueues a **new** job with `pass_at_k=N_errored` plus `metadata.retry_of`
        / `retry_kind=errored_trials`. Completed attempts (including reward 0.0) are
        not retried. Parent archive is immutable; combine scores client-side. By default
        notifications/deliver/writeback are **not** copied (pass `include_side_effects=true`
        to keep them). Optional `Idempotency-Key` returns the same child job on repeat.
        v1: single-agent datapoints only. Requires a durable request snapshot from
        enqueue. Returns 400 when nothing errored or the snapshot/contract is missing;
        409 when the parent is still running.'
      operationId: harbor_retry_errored_trials_v1_jobs__job_id__retry_errored_trials_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: include_side_effects
        in: query
        required: false
        schema:
          type: boolean
          description: When true, copy the parent's notifications/deliver/writeback
            onto the child. Default false so a refill does not re-fire webhooks.
          default: false
          title: Include Side Effects
        description: When true, copy the parent's notifications/deliver/writeback
          onto the child. Default false so a refill does not re-fire webhooks.
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '202':
          description: Follow-up job accepted
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Retry Errored Trials V1 Jobs  Job Id  Retry Errored
                  Trials Post
              example:
                job_id: child-uuid
                retry_of: parent-uuid
                pass_at_k: 3
                retried_exceptions:
                - TerminusNoProgressError
                status: queued
        '400':
          description: Nothing to retry, multi-agent, or missing request snapshot
        '409':
          description: Parent job is not terminal
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/jobs/{job_id}/retry-provider-blocked:
    post:
      tags:
      - Harbor (compatibility)
      summary: Retry full pass@k after provider-blocked failure (v1)
      description: 'Enqueue a **new** job with the parent''s original ``pass_at_k``
        when ``result.outcome.failure_class=provider`` (quota/auth/rate-limit). Unlike
        ``retry-errored-trials``, this re-runs the full k budget with a fresh KeyHive
        lease. Sets ``metadata.retry_of`` / ``retry_kind=provider_blocked``. Optional
        ``Idempotency-Key`` returns the same child job on repeat. v1: single-agent
        datapoints only.'
      operationId: harbor_retry_provider_blocked_v1_jobs__job_id__retry_provider_blocked_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: include_side_effects
        in: query
        required: false
        schema:
          type: boolean
          default: false
          title: Include Side Effects
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '202':
          description: Follow-up job accepted
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Retry Provider Blocked V1 Jobs  Job Id  Retry Provider
                  Blocked Post
        '400':
          description: Parent is not provider-blocked or snapshot missing
        '409':
          description: Parent job is not terminal
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/jobs/{job_id}/cancel:
    post:
      tags:
      - Harbor (compatibility)
      summary: Cancel job (v1)
      operationId: harbor_cancel_job_v1_jobs__job_id__cancel_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Cancel Job V1 Jobs  Job Id  Cancel Post
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/jobs/{job_id}/events:
    get:
      tags:
      - Harbor (compatibility)
      summary: SSE job events (v1)
      operationId: harbor_job_events_v1_jobs__job_id__events_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: Last-Event-ID
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Last-Event-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Server-sent events stream
          content:
            application/json:
              schema: {}
            text/event-stream:
              examples:
                meta:
                  summary: SSE stream (meta + done)
                  value: 'event: meta\ndata: {"job_id":"550e8400-e29b-41d4-a716-446655440000"}\n\n'
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/jobs/{job_id}/artifacts:
    get:
      tags:
      - Harbor (compatibility)
      summary: List job artifacts (v1)
      operationId: harbor_list_artifacts_v1_jobs__job_id__artifacts_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response List Artifacts V1 Jobs  Job Id  Artifacts Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/jobs/{job_id}/artifacts/archive:
    get:
      tags:
      - Harbor (compatibility)
      summary: Download job archive (v1)
      operationId: harbor_download_archive_v1_jobs__job_id__artifacts_archive_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: presigned
        in: query
        required: false
        schema:
          type: boolean
          default: false
          title: Presigned
      - name: as
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Set to "json" to receive {"url": ...} instead of a 307 redirect.
            Requires presigned=true.'
          title: As
        description: 'Set to "json" to receive {"url": ...} instead of a 307 redirect.
          Requires presigned=true.'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '404':
          description: No artifact with this id in this tenancy. Job records expire,
            so this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: artifact not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/jobs/{job_id}/artifacts/test-stdout/{relative_path}:
    get:
      tags:
      - Harbor (compatibility)
      summary: Download verifier test stdout (v1)
      operationId: harbor_download_test_stdout_v1_jobs__job_id__artifacts_test_stdout__relative_path__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: relative_path
        in: path
        required: true
        schema:
          type: string
          title: Relative Path
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '404':
          description: No artifact with this id in this tenancy. Job records expire,
            so this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: artifact not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/verify-task:
    post:
      tags:
      - Harbor (compatibility)
      summary: Run Harbor verifier only (v1)
      operationId: harbor_verify_task_v1_verify_task_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyTaskRequest'
            examples:
              visible_seed_only:
                summary: Run verifier using task visible_seed/ workspace
                value:
                  task_slug: my-task
                  metadata:
                    task_archive_url: https://storage.example/tasks/my-task.zip
              with_fixture:
                summary: Overlay a workspace fixture zip before running tests/test.sh
                value:
                  task_slug: my-task
                  metadata:
                    task_archive_url: https://storage.example/tasks/my-task.zip
                  workspace_fixture_url: https://storage.example/fixtures/my-task-workspace.zip
      responses:
        '200':
          description: Datapoint completed
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Verify Task V1 Verify Task Post
              examples:
                success:
                  summary: Succeeded datapoint
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: succeeded
                    results:
                    - agent: oracle
                      reward: 1.0
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '429':
          description: 'The project is already running its maximum number of concurrent
            jobs. Nothing was enqueued, so retrying after `Retry-After` is safe and
            cannot duplicate a run. Use `POST /jobs/execute-tasks` instead if you
            would rather the platform queue the work than refuse it: the async route
            accepts the job with a `202` and lets it wait for capacity.'
          headers:
            Retry-After:
              description: Seconds to wait before retrying.
              schema:
                type: integer
                example: 5
          content:
            application/json:
              example:
                detail: 'sandbox admission denied: project_concurrency_exceeded limit=8
                  current=8'
        '504':
          description: "The run did not finish inside the synchronous wait. It has\
            \ **not** been cancelled \u2014 it is still running, and the job id is\
            \ in the response headers. Poll `GET /jobs/{job_id}`, or follow `GET /jobs/{job_id}/events`,\
            \ rather than resubmitting. Use `POST /jobs/execute-tasks` instead if\
            \ your tasks routinely run this long."
          content:
            application/json:
              example:
                detail: 'the run did not finish within 1500s and is still going. It
                  was not cancelled: poll GET /jobs/550e8400-e29b-41d4-a716-446655440000
                  for the result, or follow GET /jobs/550e8400-e29b-41d4-a716-446655440000/events.'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v1/jobs/verify-task:
    post:
      tags:
      - Harbor (compatibility)
      summary: Enqueue Harbor verify-task job (v1)
      operationId: harbor_enqueue_verify_task_v1_jobs_verify_task_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Job-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: X-Sandbox-Job-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyTaskRequest'
      responses:
        '202':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
                title: Response Enqueue Verify Task V1 Jobs Verify Task Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/capabilities:
    get:
      tags:
      - Harbor
      summary: Harbor API v2 capabilities
      operationId: harbor_versioned_capabilities_v2_capabilities_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Versioned Capabilities V2 Capabilities Get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/harbor/v2/run/datapoint:
    post:
      tags:
      - Harbor
      summary: Run Harbor datapoint (v2)
      operationId: harbor_run_datapoint_v2_run_datapoint_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RunDatapointRequest'
            examples:
              oracle_with_extensions:
                summary: Oracle agent with harbor_extensions
                value:
                  task_slug: example-task
                  metadata:
                    task_archive_url: https://storage.example/tasks/example-task.zip
                  agents:
                  - name: oracle
                    harbor_agent: oracle
                    harbor_extensions:
                      agent_env:
                        SANDBOX_DOCS: '1'
      responses:
        '200':
          description: Datapoint completed
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Run Datapoint V2 Run Datapoint Post
              examples:
                success:
                  summary: Succeeded datapoint
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: succeeded
                    results:
                    - agent: oracle
                      reward: 1.0
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '429':
          description: 'The project is already running its maximum number of concurrent
            jobs. Nothing was enqueued, so retrying after `Retry-After` is safe and
            cannot duplicate a run. Use `POST /jobs/execute-tasks` instead if you
            would rather the platform queue the work than refuse it: the async route
            accepts the job with a `202` and lets it wait for capacity.'
          headers:
            Retry-After:
              description: Seconds to wait before retrying.
              schema:
                type: integer
                example: 5
          content:
            application/json:
              example:
                detail: 'sandbox admission denied: project_concurrency_exceeded limit=8
                  current=8'
        '504':
          description: "The run did not finish inside the synchronous wait. It has\
            \ **not** been cancelled \u2014 it is still running, and the job id is\
            \ in the response headers. Poll `GET /jobs/{job_id}`, or follow `GET /jobs/{job_id}/events`,\
            \ rather than resubmitting. Use `POST /jobs/execute-tasks` instead if\
            \ your tasks routinely run this long."
          content:
            application/json:
              example:
                detail: 'the run did not finish within 1500s and is still going. It
                  was not cancelled: poll GET /jobs/550e8400-e29b-41d4-a716-446655440000
                  for the result, or follow GET /jobs/550e8400-e29b-41d4-a716-446655440000/events.'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/jobs/execute-tasks:
    post:
      tags:
      - Harbor
      summary: Enqueue Harbor datapoint job (v2)
      operationId: harbor_execute_tasks_v2_jobs_execute_tasks_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Job-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: X-Sandbox-Job-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExecuteTasksRequest'
      responses:
        '202':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
                title: Response Execute Tasks V2 Jobs Execute Tasks Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/jobs/{job_id}:
    get:
      tags:
      - Harbor
      summary: Get job status (v2)
      operationId: harbor_get_job_v2_jobs__job_id__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Job status
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Job V2 Jobs  Job Id  Get
              examples:
                running:
                  summary: Job in progress
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: running
                    timings:
                      enqueued_at: 1753420800.12
                      started_at: 1753420802.44
                      queue_wait_ms: 2320
                    created_at: 1753420800.12
                    updated_at: 1753420802.44
                succeeded:
                  summary: Terminal job with full AHT breakdown
                  description: queue_wait_ms + run_ms == total_ms. Upstream services
                    average total_ms (or its parts) across jobs to derive AHT. The
                    same timings block is present on failed and cancelled jobs, so
                    AHT covers a realistic outcome mix.
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: succeeded
                    timings:
                      enqueued_at: 1753420800.12
                      started_at: 1753420802.44
                      finished_at: 1753420889.71
                      queue_wait_ms: 2320
                      run_ms: 87270
                      total_ms: 89590
                    created_at: 1753420800.12
                    updated_at: 1753420889.71
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/jobs/{job_id}/retry-errored-trials:
    post:
      tags:
      - Harbor
      summary: Retry only errored pass@k trials (v2)
      description: 'Batch-refill incomplete pass@k attempts for a terminal datapoint
        job. Counts `result.outcome.trials_detail` rows with `status=errored` and
        enqueues a **new** job with `pass_at_k=N_errored` plus `metadata.retry_of`
        / `retry_kind=errored_trials`. Completed attempts (including reward 0.0) are
        not retried. Parent archive is immutable; combine scores client-side. By default
        notifications/deliver/writeback are **not** copied (pass `include_side_effects=true`
        to keep them). Optional `Idempotency-Key` returns the same child job on repeat.
        v1: single-agent datapoints only. Requires a durable request snapshot from
        enqueue. Returns 400 when nothing errored or the snapshot/contract is missing;
        409 when the parent is still running.'
      operationId: harbor_retry_errored_trials_v2_jobs__job_id__retry_errored_trials_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: include_side_effects
        in: query
        required: false
        schema:
          type: boolean
          description: When true, copy the parent's notifications/deliver/writeback
            onto the child. Default false so a refill does not re-fire webhooks.
          default: false
          title: Include Side Effects
        description: When true, copy the parent's notifications/deliver/writeback
          onto the child. Default false so a refill does not re-fire webhooks.
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '202':
          description: Follow-up job accepted
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Retry Errored Trials V2 Jobs  Job Id  Retry Errored
                  Trials Post
              example:
                job_id: child-uuid
                retry_of: parent-uuid
                pass_at_k: 3
                retried_exceptions:
                - TerminusNoProgressError
                status: queued
        '400':
          description: Nothing to retry, multi-agent, or missing request snapshot
        '409':
          description: Parent job is not terminal
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/jobs/{job_id}/retry-provider-blocked:
    post:
      tags:
      - Harbor
      summary: Retry full pass@k after provider-blocked failure (v2)
      description: 'Enqueue a **new** job with the parent''s original ``pass_at_k``
        when ``result.outcome.failure_class=provider`` (quota/auth/rate-limit). Unlike
        ``retry-errored-trials``, this re-runs the full k budget with a fresh KeyHive
        lease. Sets ``metadata.retry_of`` / ``retry_kind=provider_blocked``. Optional
        ``Idempotency-Key`` returns the same child job on repeat. v1: single-agent
        datapoints only.'
      operationId: harbor_retry_provider_blocked_v2_jobs__job_id__retry_provider_blocked_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: include_side_effects
        in: query
        required: false
        schema:
          type: boolean
          default: false
          title: Include Side Effects
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '202':
          description: Follow-up job accepted
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Retry Provider Blocked V2 Jobs  Job Id  Retry Provider
                  Blocked Post
        '400':
          description: Parent is not provider-blocked or snapshot missing
        '409':
          description: Parent job is not terminal
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/jobs/{job_id}/cancel:
    post:
      tags:
      - Harbor
      summary: Cancel job (v2)
      operationId: harbor_cancel_job_v2_jobs__job_id__cancel_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Cancel Job V2 Jobs  Job Id  Cancel Post
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/jobs/{job_id}/events:
    get:
      tags:
      - Harbor
      summary: SSE job events (v2)
      operationId: harbor_job_events_v2_jobs__job_id__events_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: Last-Event-ID
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Last-Event-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Server-sent events stream
          content:
            application/json:
              schema: {}
            text/event-stream:
              examples:
                meta:
                  summary: SSE stream (meta + done)
                  value: 'event: meta\ndata: {"job_id":"550e8400-e29b-41d4-a716-446655440000"}\n\n'
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/jobs/{job_id}/artifacts:
    get:
      tags:
      - Harbor
      summary: List job artifacts (v2)
      operationId: harbor_list_artifacts_v2_jobs__job_id__artifacts_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response List Artifacts V2 Jobs  Job Id  Artifacts Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/jobs/{job_id}/artifacts/archive:
    get:
      tags:
      - Harbor
      summary: Download job archive (v2)
      operationId: harbor_download_archive_v2_jobs__job_id__artifacts_archive_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: presigned
        in: query
        required: false
        schema:
          type: boolean
          default: false
          title: Presigned
      - name: as
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Set to "json" to receive {"url": ...} instead of a 307 redirect.
            Requires presigned=true.'
          title: As
        description: 'Set to "json" to receive {"url": ...} instead of a 307 redirect.
          Requires presigned=true.'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '404':
          description: No artifact with this id in this tenancy. Job records expire,
            so this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: artifact not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/jobs/{job_id}/artifacts/test-stdout/{relative_path}:
    get:
      tags:
      - Harbor
      summary: Download verifier test stdout (v2)
      operationId: harbor_download_test_stdout_v2_jobs__job_id__artifacts_test_stdout__relative_path__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: relative_path
        in: path
        required: true
        schema:
          type: string
          title: Relative Path
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '404':
          description: No artifact with this id in this tenancy. Job records expire,
            so this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: artifact not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/verify-task:
    post:
      tags:
      - Harbor
      summary: Run Harbor verifier only (v2)
      operationId: harbor_verify_task_v2_verify_task_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyTaskRequest'
            examples:
              visible_seed_only:
                summary: Run verifier using task visible_seed/ workspace
                value:
                  task_slug: my-task
                  metadata:
                    task_archive_url: https://storage.example/tasks/my-task.zip
              with_fixture:
                summary: Overlay a workspace fixture zip before running tests/test.sh
                value:
                  task_slug: my-task
                  metadata:
                    task_archive_url: https://storage.example/tasks/my-task.zip
                  workspace_fixture_url: https://storage.example/fixtures/my-task-workspace.zip
      responses:
        '200':
          description: Datapoint completed
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Verify Task V2 Verify Task Post
              examples:
                success:
                  summary: Succeeded datapoint
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: succeeded
                    results:
                    - agent: oracle
                      reward: 1.0
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '429':
          description: 'The project is already running its maximum number of concurrent
            jobs. Nothing was enqueued, so retrying after `Retry-After` is safe and
            cannot duplicate a run. Use `POST /jobs/execute-tasks` instead if you
            would rather the platform queue the work than refuse it: the async route
            accepts the job with a `202` and lets it wait for capacity.'
          headers:
            Retry-After:
              description: Seconds to wait before retrying.
              schema:
                type: integer
                example: 5
          content:
            application/json:
              example:
                detail: 'sandbox admission denied: project_concurrency_exceeded limit=8
                  current=8'
        '504':
          description: "The run did not finish inside the synchronous wait. It has\
            \ **not** been cancelled \u2014 it is still running, and the job id is\
            \ in the response headers. Poll `GET /jobs/{job_id}`, or follow `GET /jobs/{job_id}/events`,\
            \ rather than resubmitting. Use `POST /jobs/execute-tasks` instead if\
            \ your tasks routinely run this long."
          content:
            application/json:
              example:
                detail: 'the run did not finish within 1500s and is still going. It
                  was not cancelled: poll GET /jobs/550e8400-e29b-41d4-a716-446655440000
                  for the result, or follow GET /jobs/550e8400-e29b-41d4-a716-446655440000/events.'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/v2/jobs/verify-task:
    post:
      tags:
      - Harbor
      summary: Enqueue Harbor verify-task job (v2)
      operationId: harbor_enqueue_verify_task_v2_jobs_verify_task_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Job-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: X-Sandbox-Job-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyTaskRequest'
      responses:
        '202':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
                title: Response Enqueue Verify Task V2 Jobs Verify Task Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/run/datapoint:
    post:
      tags:
      - Harbor (compatibility)
      summary: Run Harbor datapoint (v1)
      operationId: harbor_run_datapoint_run_datapoint_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RunDatapointRequest'
            examples:
              oracle_with_extensions:
                summary: Oracle agent with harbor_extensions
                value:
                  task_slug: example-task
                  metadata:
                    task_archive_url: https://storage.example/tasks/example-task.zip
                  agents:
                  - name: oracle
                    harbor_agent: oracle
                    harbor_extensions:
                      agent_env:
                        SANDBOX_DOCS: '1'
      responses:
        '200':
          description: Datapoint completed
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Run Datapoint Run Datapoint Post
              examples:
                success:
                  summary: Succeeded datapoint
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: succeeded
                    results:
                    - agent: oracle
                      reward: 1.0
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '429':
          description: 'The project is already running its maximum number of concurrent
            jobs. Nothing was enqueued, so retrying after `Retry-After` is safe and
            cannot duplicate a run. Use `POST /jobs/execute-tasks` instead if you
            would rather the platform queue the work than refuse it: the async route
            accepts the job with a `202` and lets it wait for capacity.'
          headers:
            Retry-After:
              description: Seconds to wait before retrying.
              schema:
                type: integer
                example: 5
          content:
            application/json:
              example:
                detail: 'sandbox admission denied: project_concurrency_exceeded limit=8
                  current=8'
        '504':
          description: "The run did not finish inside the synchronous wait. It has\
            \ **not** been cancelled \u2014 it is still running, and the job id is\
            \ in the response headers. Poll `GET /jobs/{job_id}`, or follow `GET /jobs/{job_id}/events`,\
            \ rather than resubmitting. Use `POST /jobs/execute-tasks` instead if\
            \ your tasks routinely run this long."
          content:
            application/json:
              example:
                detail: 'the run did not finish within 1500s and is still going. It
                  was not cancelled: poll GET /jobs/550e8400-e29b-41d4-a716-446655440000
                  for the result, or follow GET /jobs/550e8400-e29b-41d4-a716-446655440000/events.'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/jobs/execute-tasks:
    post:
      tags:
      - Harbor (compatibility)
      summary: Enqueue Harbor datapoint job (v1)
      operationId: harbor_execute_tasks_jobs_execute_tasks_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Job-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: X-Sandbox-Job-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExecuteTasksRequest'
      responses:
        '202':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
                title: Response Execute Tasks Jobs Execute Tasks Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/jobs/{job_id}:
    get:
      tags:
      - Harbor (compatibility)
      summary: Get job status (v1)
      operationId: harbor_get_job_jobs__job_id__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Job status
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Job Jobs  Job Id  Get
              examples:
                running:
                  summary: Job in progress
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: running
                    timings:
                      enqueued_at: 1753420800.12
                      started_at: 1753420802.44
                      queue_wait_ms: 2320
                    created_at: 1753420800.12
                    updated_at: 1753420802.44
                succeeded:
                  summary: Terminal job with full AHT breakdown
                  description: queue_wait_ms + run_ms == total_ms. Upstream services
                    average total_ms (or its parts) across jobs to derive AHT. The
                    same timings block is present on failed and cancelled jobs, so
                    AHT covers a realistic outcome mix.
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: succeeded
                    timings:
                      enqueued_at: 1753420800.12
                      started_at: 1753420802.44
                      finished_at: 1753420889.71
                      queue_wait_ms: 2320
                      run_ms: 87270
                      total_ms: 89590
                    created_at: 1753420800.12
                    updated_at: 1753420889.71
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/jobs/{job_id}/retry-errored-trials:
    post:
      tags:
      - Harbor (compatibility)
      summary: Retry only errored pass@k trials (v1)
      description: 'Batch-refill incomplete pass@k attempts for a terminal datapoint
        job. Counts `result.outcome.trials_detail` rows with `status=errored` and
        enqueues a **new** job with `pass_at_k=N_errored` plus `metadata.retry_of`
        / `retry_kind=errored_trials`. Completed attempts (including reward 0.0) are
        not retried. Parent archive is immutable; combine scores client-side. By default
        notifications/deliver/writeback are **not** copied (pass `include_side_effects=true`
        to keep them). Optional `Idempotency-Key` returns the same child job on repeat.
        v1: single-agent datapoints only. Requires a durable request snapshot from
        enqueue. Returns 400 when nothing errored or the snapshot/contract is missing;
        409 when the parent is still running.'
      operationId: harbor_retry_errored_trials_jobs__job_id__retry_errored_trials_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: include_side_effects
        in: query
        required: false
        schema:
          type: boolean
          description: When true, copy the parent's notifications/deliver/writeback
            onto the child. Default false so a refill does not re-fire webhooks.
          default: false
          title: Include Side Effects
        description: When true, copy the parent's notifications/deliver/writeback
          onto the child. Default false so a refill does not re-fire webhooks.
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '202':
          description: Follow-up job accepted
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Retry Errored Trials Jobs  Job Id  Retry Errored Trials
                  Post
              example:
                job_id: child-uuid
                retry_of: parent-uuid
                pass_at_k: 3
                retried_exceptions:
                - TerminusNoProgressError
                status: queued
        '400':
          description: Nothing to retry, multi-agent, or missing request snapshot
        '409':
          description: Parent job is not terminal
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/jobs/{job_id}/retry-provider-blocked:
    post:
      tags:
      - Harbor (compatibility)
      summary: Retry full pass@k after provider-blocked failure (v1)
      description: 'Enqueue a **new** job with the parent''s original ``pass_at_k``
        when ``result.outcome.failure_class=provider`` (quota/auth/rate-limit). Unlike
        ``retry-errored-trials``, this re-runs the full k budget with a fresh KeyHive
        lease. Sets ``metadata.retry_of`` / ``retry_kind=provider_blocked``. Optional
        ``Idempotency-Key`` returns the same child job on repeat. v1: single-agent
        datapoints only.'
      operationId: harbor_retry_provider_blocked_jobs__job_id__retry_provider_blocked_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: include_side_effects
        in: query
        required: false
        schema:
          type: boolean
          default: false
          title: Include Side Effects
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '202':
          description: Follow-up job accepted
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Retry Provider Blocked Jobs  Job Id  Retry Provider
                  Blocked Post
        '400':
          description: Parent is not provider-blocked or snapshot missing
        '409':
          description: Parent job is not terminal
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/jobs/{job_id}/cancel:
    post:
      tags:
      - Harbor (compatibility)
      summary: Cancel job (v1)
      operationId: harbor_cancel_job_jobs__job_id__cancel_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Cancel Job Jobs  Job Id  Cancel Post
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/jobs/{job_id}/events:
    get:
      tags:
      - Harbor (compatibility)
      summary: SSE job events (v1)
      operationId: harbor_job_events_jobs__job_id__events_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: Last-Event-ID
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Last-Event-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Server-sent events stream
          content:
            application/json:
              schema: {}
            text/event-stream:
              examples:
                meta:
                  summary: SSE stream (meta + done)
                  value: 'event: meta\ndata: {"job_id":"550e8400-e29b-41d4-a716-446655440000"}\n\n'
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/jobs/{job_id}/artifacts:
    get:
      tags:
      - Harbor (compatibility)
      summary: List job artifacts (v1)
      operationId: harbor_list_artifacts_jobs__job_id__artifacts_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response List Artifacts Jobs  Job Id  Artifacts Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/jobs/{job_id}/artifacts/archive:
    get:
      tags:
      - Harbor (compatibility)
      summary: Download job archive (v1)
      operationId: harbor_download_archive_jobs__job_id__artifacts_archive_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: presigned
        in: query
        required: false
        schema:
          type: boolean
          default: false
          title: Presigned
      - name: as
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Set to "json" to receive {"url": ...} instead of a 307 redirect.
            Requires presigned=true.'
          title: As
        description: 'Set to "json" to receive {"url": ...} instead of a 307 redirect.
          Requires presigned=true.'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '404':
          description: No artifact with this id in this tenancy. Job records expire,
            so this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: artifact not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/jobs/{job_id}/artifacts/test-stdout/{relative_path}:
    get:
      tags:
      - Harbor (compatibility)
      summary: Download verifier test stdout (v1)
      operationId: harbor_download_test_stdout_jobs__job_id__artifacts_test_stdout__relative_path__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: relative_path
        in: path
        required: true
        schema:
          type: string
          title: Relative Path
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '404':
          description: No artifact with this id in this tenancy. Job records expire,
            so this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: artifact not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/verify-task:
    post:
      tags:
      - Harbor (compatibility)
      summary: Run Harbor verifier only (v1)
      operationId: harbor_verify_task_verify_task_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyTaskRequest'
            examples:
              visible_seed_only:
                summary: Run verifier using task visible_seed/ workspace
                value:
                  task_slug: my-task
                  metadata:
                    task_archive_url: https://storage.example/tasks/my-task.zip
              with_fixture:
                summary: Overlay a workspace fixture zip before running tests/test.sh
                value:
                  task_slug: my-task
                  metadata:
                    task_archive_url: https://storage.example/tasks/my-task.zip
                  workspace_fixture_url: https://storage.example/fixtures/my-task-workspace.zip
      responses:
        '200':
          description: Datapoint completed
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Verify Task Verify Task Post
              examples:
                success:
                  summary: Succeeded datapoint
                  value:
                    job_id: 550e8400-e29b-41d4-a716-446655440000
                    status: succeeded
                    results:
                    - agent: oracle
                      reward: 1.0
        '404':
          description: No job with this id in this tenancy. Job records expire, so
            this is also the answer for a job that has aged out.
          content:
            application/json:
              example:
                detail: job not found
        '429':
          description: 'The project is already running its maximum number of concurrent
            jobs. Nothing was enqueued, so retrying after `Retry-After` is safe and
            cannot duplicate a run. Use `POST /jobs/execute-tasks` instead if you
            would rather the platform queue the work than refuse it: the async route
            accepts the job with a `202` and lets it wait for capacity.'
          headers:
            Retry-After:
              description: Seconds to wait before retrying.
              schema:
                type: integer
                example: 5
          content:
            application/json:
              example:
                detail: 'sandbox admission denied: project_concurrency_exceeded limit=8
                  current=8'
        '504':
          description: "The run did not finish inside the synchronous wait. It has\
            \ **not** been cancelled \u2014 it is still running, and the job id is\
            \ in the response headers. Poll `GET /jobs/{job_id}`, or follow `GET /jobs/{job_id}/events`,\
            \ rather than resubmitting. Use `POST /jobs/execute-tasks` instead if\
            \ your tasks routinely run this long."
          content:
            application/json:
              example:
                detail: 'the run did not finish within 1500s and is still going. It
                  was not cancelled: poll GET /jobs/550e8400-e29b-41d4-a716-446655440000
                  for the result, or follow GET /jobs/550e8400-e29b-41d4-a716-446655440000/events.'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/jobs/verify-task:
    post:
      tags:
      - Harbor (compatibility)
      summary: Enqueue Harbor verify-task job (v1)
      operationId: harbor_enqueue_verify_task_jobs_verify_task_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: Idempotency-Key
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Idempotency-Key
      - name: X-Sandbox-Job-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: X-Sandbox-Job-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyTaskRequest'
      responses:
        '202':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
                title: Response Enqueue Verify Task Jobs Verify Task Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/harbor/api-versions:
    get:
      tags:
      - Harbor
      summary: List Harbor API versions
      operationId: harbor_api_versions_api_versions_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Api Versions Api Versions Get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/agent/v1/agents:
    get:
      tags:
      - Agent Runtime
      summary: List Agents
      description: Tier 1 catalog entries plus Harbor AgentFactory agents (deduped).
      operationId: agent_list_agents_v1_agents_get
      responses:
        '200':
          description: "Catalog \u222A Harbor factory agents"
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response List Agents V1 Agents Get
              examples:
                agents:
                  summary: Agent registry
                  value:
                    agents:
                    - id: oracle
                      display_name: Oracle
                      source: catalog
                    - id: opencode
                      display_name: OpenCode
                      source: catalog
                    count: 2
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/agent/capabilities:
    get:
      tags:
      - Agent Runtime
      summary: List agents (catalog-backed)
      operationId: agent_capabilities_capabilities_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Capabilities Capabilities Get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/agent/v1/runs:
    post:
      tags:
      - Agent Runtime
      summary: Start Agent Run
      operationId: agent_start_agent_run_v1_runs_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AgentRunBody'
            examples:
              adhoc_run:
                summary: Ad-hoc agent run with agent_options
                value:
                  agent_id: opencode
                  instruction: List files in the workspace root.
                  model: anthropic/claude-sonnet-4-5
                  agent_options:
                    agent_env:
                      SANDBOX_DOCS: '1'
              oracle_validate_a_task:
                summary: "Oracle validating a task \u2014 needs a tree carrying solution/solve.sh"
                value:
                  agent_id: oracle
                  instruction: Validate that this task is solvable.
                  workspace:
                    archive_url: https://example.com/tasks/my-task.zip
              opencode_plan:
                summary: OpenCode plan via opencode.json default_agent (not Harbor
                  --mode)
                value:
                  agent_id: opencode
                  instruction: Propose a plan to fix the failing test
                  model: anthropic/claude-sonnet-4-5
                  agent_options:
                    opencode_agent: plan
                    agent_env:
                      SANDBOX_DOCS: '1'
      responses:
        '202':
          description: Run accepted
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Start Agent Run V1 Runs Post
              examples:
                accepted:
                  summary: Queued agent run
                  value:
                    job_id: agent-run-550e8400
                    status: queued
                    agent_id: opencode
                    message: run accepted
                    status_url: /sandbox/agent/v1/runs/agent-run-550e8400
                    events_url: /sandbox/agent/v1/runs/agent-run-550e8400/events
        '400':
          description: The agent's preconditions are not satisfied by this request
          content:
            application/json:
              examples:
                model_required:
                  summary: 'Agent has requires_model: true and no model was sent'
                  value:
                    detail: agent opencode requires model
                reference_solution_required:
                  summary: 'Agent has requires_reference_solution: true, but the task
                    would be synthesized from the instruction'
                  value:
                    detail: agent oracle applies a task's reference solution, so it
                      needs a task that has one; this request would run against a
                      task synthesized from the instruction, which cannot. Pass workspace.archive_url
                      pointing at a task tree containing solution/solve.sh, or choose
                      an agent that solves the instruction itself
                unknown_agent:
                  summary: Agent id is not in the execution catalog
                  value:
                    detail: 'unknown catalog entry: agent/''nope'''
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/agent/v1/runs/{job_id}:
    get:
      tags:
      - Agent Runtime
      summary: Agent run status
      description: 'Status, timings and result for one agent run.


        Reads the same durable record the worker writes and the harbor job route

        serves, so the two surfaces cannot disagree about a run.'
      operationId: agent_get_agent_run_v1_runs__job_id__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Current state of the run
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Agent Run V1 Runs  Job Id  Get
              examples:
                running:
                  summary: Still running
                  value:
                    job_id: agent-run-550e8400
                    status: running
                    timings:
                      enqueued_at: 1785124565.5
                      started_at: 1785124573.5
                succeeded:
                  summary: Finished; `completion` reports whether the agent did the
                    work
                  value:
                    job_id: agent-run-550e8400
                    status: succeeded
                    result:
                      job_id: agent-run-550e8400
                      status: succeeded
                      agent_id: opencode
                      completion:
                        status: completed
                        trials:
                          ran: 1
                          errored: 0
                          completed: 1
                    timings:
                      queue_wait_ms: 7940
                      run_ms: 112873
        '404':
          description: No run with this id in this tenancy
          content:
            application/json:
              examples:
                unknown:
                  summary: Unknown run
                  value:
                    detail: 'unknown agent run: agent-run-550e8400'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/agent/v1/runs/{job_id}/events:
    get:
      tags:
      - Agent Runtime
      summary: SSE agent run events
      description: "Follow a run's phases as they happen.\n\nThe same stream generator\
        \ the harbor route uses, over the same event log \u2014\nan agent run and\
        \ a datapoint run are narrated by one mechanism, so this is a\nsecond entrance\
        \ to it rather than a second copy of it."
      operationId: agent_agent_run_events_v1_runs__job_id__events_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: job_id
        in: path
        required: true
        schema:
          type: string
          title: Job Id
      - name: Last-Event-ID
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Last-Event-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Server-sent events. A `meta` frame arrives immediately, then
            one `phase` frame per phase transition, then `done`. Reconnect with `Last-Event-ID`
            to resume rather than replay.
          content:
            application/json:
              schema: {}
            text/event-stream:
              examples:
                phases:
                  summary: Following a run
                  value: 'id: 0

                    event: meta

                    data: {"job_id":"agent-run-550e8400"}


                    id: 1

                    event: status

                    data: {"event":"status","status":"running"}


                    id: 2

                    event: phase

                    data: {"event":"phase","phase":"materialize","state":"started"}


                    id: 4

                    event: phase

                    data: {"event":"phase","phase":"agent","state":"started","model":"anthropic/claude-sonnet-4-5"}


                    id: 5

                    event: phase

                    data: {"event":"phase","phase":"agent","state":"finished","duration_ms":112873}


                    event: done

                    data: {"job_id":"agent-run-550e8400","status":"succeeded"}


                    '
        '404':
          description: No run with this id in this tenancy. The stream is refused
            rather than opened, so a mistyped id fails immediately instead of looking
            like a run that is slow to start.
          content:
            application/json:
              example:
                detail: 'unknown agent run: agent-run-550e8400'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/agent/agents/{agent_id}:
    get:
      tags:
      - Agent Runtime
      summary: Get Agent
      operationId: agent_get_agent_agents__agent_id__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: agent_id
        in: path
        required: true
        schema:
          type: string
          title: Agent Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AgentOut'
        '404':
          description: "No agent with this id. Agents come from the catalog, so an\
            \ id that worked before can disappear when a catalog entry is disabled\
            \ \u2014 list `/agents` rather than hardcoding one."
          content:
            application/json:
              example:
                detail: 'unknown agent: claude'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/agent/agents:
    post:
      tags:
      - Agent Runtime
      summary: Register Agent
      operationId: agent_register_agent_agents_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RegisterRequest'
        required: true
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AgentOut'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/codeedit/v1/languages:
    get:
      tags:
      - CodeEdit
      summary: List Languages
      operationId: codeedit_list_languages_v1_languages_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response List Languages V1 Languages Get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
  /sandbox/codeedit/v1/executions:
    post:
      tags:
      - CodeEdit
      summary: Execute
      operationId: codeedit_execute_v1_executions_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExecutionRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Execute V1 Executions Post
        '413':
          description: Submitted files exceed the total payload limit.
          content:
            application/json:
              example:
                detail: files total 1048576 bytes exceeds 524288
        '429':
          description: 'The project is already running its maximum number of concurrent
            executions. This is backpressure, not failure: the work was never started,
            so retrying after the interval in `Retry-After` is safe and will not duplicate
            anything. The limit is per project, so spreading load across projects
            raises it; a single client should cap its own concurrency rather than
            rely on retries.'
          headers:
            Retry-After:
              description: Seconds to wait before retrying.
              schema:
                type: integer
                example: 1
          content:
            application/json:
              example:
                detail: project_concurrency_exceeded limit=6 current=6
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1:
    get:
      tags:
      - Sandboxes
      summary: List Sandboxes
      operationId: sandboxes_list_sandboxes_v1_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response List Sandboxes V1 Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
      - Sandboxes
      summary: Create Sandbox
      operationId: sandboxes_create_sandbox_v1_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSandboxRequest'
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}:
    get:
      tags:
      - Sandboxes
      summary: Get Sandbox
      operationId: sandboxes_get_sandbox_v1__sandbox_id__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Sandbox V1  Sandbox Id  Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    delete:
      tags:
      - Sandboxes
      summary: Destroy Sandbox
      operationId: sandboxes_destroy_sandbox_v1__sandbox_id__delete
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '204':
          description: Successful Response
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/stop:
    post:
      tags:
      - Sandboxes
      summary: Stop Sandbox
      operationId: sandboxes_stop_sandbox_v1__sandbox_id__stop_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Stop Sandbox V1  Sandbox Id  Stop Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/start:
    post:
      tags:
      - Sandboxes
      summary: Start Sandbox
      operationId: sandboxes_start_sandbox_v1__sandbox_id__start_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Start Sandbox V1  Sandbox Id  Start Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/events:
    get:
      tags:
      - Sandboxes
      summary: SSE sandbox lifecycle events
      operationId: sandboxes_sandbox_events_v1__sandbox_id__events_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: Last-Event-ID
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Last-Event-Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/viewer:
    get:
      tags:
      - Sandboxes
      summary: Mint viewer URL or proxy Selkies UI
      operationId: sandboxes_sandbox_viewer_v1__sandbox_id__viewer_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/viewer/start:
    post:
      tags:
      - Sandboxes
      summary: Start Viewer
      operationId: sandboxes_start_viewer_v1__sandbox_id__viewer_start_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Start Viewer V1  Sandbox Id  Viewer Start Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/viewer/stop:
    post:
      tags:
      - Sandboxes
      summary: Stop Viewer
      operationId: sandboxes_stop_viewer_v1__sandbox_id__viewer_stop_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
                title: Response Stop Viewer V1  Sandbox Id  Viewer Stop Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/exec:
    post:
      tags:
      - Sandboxes
      summary: Exec Sandbox
      operationId: sandboxes_exec_sandbox_v1__sandbox_id__exec_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExecRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Exec Sandbox V1  Sandbox Id  Exec Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/files:
    get:
      tags:
      - Sandboxes
      summary: Get File
      operationId: sandboxes_get_file_v1__sandbox_id__files_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: path
        in: query
        required: true
        schema:
          type: string
          minLength: 1
          title: Path
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    put:
      tags:
      - Sandboxes
      summary: Put File
      operationId: sandboxes_put_file_v1__sandbox_id__files_put
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: path
        in: query
        required: true
        schema:
          type: string
          minLength: 1
          title: Path
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: string
              contentMediaType: application/octet-stream
              title: Body
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
                title: Response Put File V1  Sandbox Id  Files Put
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    delete:
      tags:
      - Sandboxes
      summary: Delete File
      operationId: sandboxes_delete_file_v1__sandbox_id__files_delete
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: path
        in: query
        required: true
        schema:
          type: string
          minLength: 1
          title: Path
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '204':
          description: Successful Response
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/capture:
    post:
      tags:
      - Sandboxes
      summary: Capture Sandbox
      operationId: sandboxes_capture_sandbox_v1__sandbox_id__capture_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Capture Sandbox V1  Sandbox Id  Capture Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/artifacts:
    get:
      tags:
      - Sandboxes
      summary: List Sandbox Artifacts
      operationId: sandboxes_list_sandbox_artifacts_v1__sandbox_id__artifacts_get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: kind
        in: query
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Kind
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          maximum: 200
          minimum: 1
          default: 50
          title: Limit
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response List Sandbox Artifacts V1  Sandbox Id  Artifacts Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/artifacts/{capture_id}:
    get:
      tags:
      - Sandboxes
      summary: Get Sandbox Artifact
      operationId: sandboxes_get_sandbox_artifact_v1__sandbox_id__artifacts__capture_id__get
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: capture_id
        in: path
        required: true
        schema:
          type: string
          title: Capture Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Sandbox Artifact V1  Sandbox Id  Artifacts  Capture
                  Id  Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/{sandbox_id}/verify:
    post:
      tags:
      - Sandboxes
      summary: Verify Sandbox
      operationId: sandboxes_verify_sandbox_v1__sandbox_id__verify_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: sandbox_id
        in: path
        required: true
        schema:
          type: string
          title: Sandbox Id
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Verify Sandbox V1  Sandbox Id  Verify Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /sandbox/sandboxes/v1/_reap:
    post:
      tags:
      - Sandboxes
      summary: Reap Sandboxes
      description: 'Operator hook: stop/destroy idle sandboxes for this scope.'
      operationId: sandboxes_reap_sandboxes_v1__reap_post
      parameters:
      - $ref: '#/components/parameters/CorrelationId'
      - name: X-Sandbox-Project-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: 'Project to bill and rate-limit this request against. Validated
            against the credential: a project-scoped token may only name its own project,
            and gets 403 otherwise. Defaults to the token''s project when omitted.'
          title: X-Sandbox-Project-Id
        description: 'Project to bill and rate-limit this request against. Validated
          against the credential: a project-scoped token may only name its own project,
          and gets 403 otherwise. Defaults to the token''s project when omitted.'
      - name: X-Sandbox-Tenant-Id
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: Tenant for this request. Must match the credential's tenant
            when the credential carries one.
          title: X-Sandbox-Tenant-Id
        description: Tenant for this request. Must match the credential's tenant when
          the credential carries one.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Reap Sandboxes V1  Reap Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-Api-Key
      description: Break-glass or service API key
    KeyHiveBearer:
      type: http
      scheme: bearer
      description: KeyHive team token for multi-tenant runs
    KeycloakBearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Keycloak service token
    AdminKeyAuth:
      type: apiKey
      in: header
      name: X-Sandbox-Admin-Key
      description: Credential-plane provisioning key (SANDBOX_ADMIN_API_KEYS). Required
        by /sandbox/v1/admin/* and accepted nowhere else. Deliberately separate from
        the consumer API key so a consumer credential cannot mint tokens for other
        tenants.
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    QuotaPolicyRequest:
      properties:
        max_concurrent:
          type: integer
          minimum: 1.0
          title: Max Concurrent
      type: object
      required:
      - max_concurrent
      title: QuotaPolicyRequest
      description: Admin request to set one project or tenant-default concurrency
        limit.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    DatapointAgentBody:
      properties:
        name:
          type: string
          title: Name
          description: Logical agent label in the datapoint result
        harbor_agent:
          type: string
          title: Harbor Agent
          description: Harbor agent id (catalog or factory)
        model:
          anyOf:
          - type: string
          - type: 'null'
          title: Model
          description: LLM model override
        pass_at_k:
          type: integer
          minimum: 1.0
          title: Pass At K
          default: 1
        params:
          additionalProperties: true
          type: object
          title: Params
          description: Per-request agent kwargs forwarded to Harbor as ``--ak key=value``.
            Merged with ``harbor_extensions.agent_kwargs`` (extensions win on conflict).
        harbor_extensions:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Harbor Extensions
          description: "Harbor passthrough: agent_env (--ae), agent_kwargs (--ak),\
            \ sandbox (-e), n_concurrent, custom_agent_import. When harbor_agent is\
            \ opencode: opencode_agent sets default_agent in opencode.json (plan |\
            \ build); opencode_config deep-merges an allowlisted subset of opencode.json\
            \ (agent, permission, tools, model, small_model, subagent_depth, instructions,\
            \ command, mcp) \u2014 e.g. a custom agent.review subagent."
      type: object
      required:
      - name
      - harbor_agent
      title: DatapointAgentBody
    DeliverSpec:
      properties:
        agent_run_zip:
          anyOf:
          - $ref: '#/components/schemas/PresignedDeliverable'
          - type: 'null'
          description: Upload agent outputs as a single zip after the run.
      additionalProperties: false
      type: object
      title: DeliverSpec
      description: "v2 customer delivery \u2014 maps to staged_zip writeback internally."
    ExecuteTasksRequest:
      properties:
        task_slug:
          type: string
          title: Task Slug
        agents:
          items:
            $ref: '#/components/schemas/DatapointAgentBody'
          type: array
          maxItems: 8
          minItems: 1
          title: Agents
          description: One or more agents to run against the same materialized task
            (max 8).
        metadata:
          additionalProperties: true
          type: object
          title: Metadata
        artifacts:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          title: Artifacts
        sandbox:
          anyOf:
          - type: string
          - type: 'null'
          title: Sandbox
        notifications:
          anyOf:
          - items:
              additionalProperties: true
              type: object
            type: array
          - type: 'null'
          title: Notifications
        writeback:
          anyOf:
          - $ref: '#/components/schemas/HarborTaskWritebackSpec'
          - type: 'null'
        deliver:
          anyOf:
          - $ref: '#/components/schemas/DeliverSpec'
          - type: 'null'
        require_verifier_evidence:
          anyOf:
          - type: boolean
          - type: 'null'
          title: Require Verifier Evidence
          description: "Whether outcome.valid_for_scoring requires the verifier to\
            \ have produced a machine-readable test report. Defaults to true: a verifier\
            \ that writes a reward without collecting any test proves nothing, and\
            \ with no report there is no way to tell the difference. Set false when\
            \ the task uses a shell verifier you trust and you want to score on its\
            \ reward alone \u2014 the rewards themselves are returned either way,\
            \ and the job still succeeds. Deployment-wide override: SANDBOX_HARBOR_REQUIRE_VERIFIER_EVIDENCE=false."
      type: object
      required:
      - task_slug
      - agents
      title: ExecuteTasksRequest
    HarborTaskWritebackSpec:
      properties:
        enabled:
          type: boolean
          title: Enabled
          default: true
        destination:
          $ref: '#/components/schemas/WritebackDestination'
        mode:
          type: string
          enum:
          - in_place_overwrite
          - versioned_suffix
          - staged_zip
          title: Mode
          default: in_place_overwrite
        include_paths:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          title: Include Paths
        include_run_outputs:
          type: boolean
          title: Include Run Outputs
          default: true
        include_judge_outputs:
          type: boolean
          title: Include Judge Outputs
          default: false
        deliverable_files:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          title: Deliverable Files
        deliverable_destination_prefix:
          type: string
          title: Deliverable Destination Prefix
          default: outputs/{label}/
        missing_deliverable_is_failure:
          type: boolean
          title: Missing Deliverable Is Failure
          default: true
        include_telemetry:
          type: boolean
          title: Include Telemetry
          default: false
        deliverables_only:
          type: boolean
          title: Deliverables Only
          default: false
      additionalProperties: false
      type: object
      required:
      - destination
      title: HarborTaskWritebackSpec
    PresignedDeliverable:
      properties:
        url:
          type: string
          minLength: 1
          title: Url
          description: Presigned PUT (or POST) URL.
        method:
          type: string
          enum:
          - PUT
          - POST
          title: Method
          default: PUT
        headers:
          additionalProperties:
            type: string
          type: object
          title: Headers
        key:
          type: string
          title: Key
          description: Logical artifact name in writeback outcomes.
          default: agent_run.zip
      additionalProperties: false
      type: object
      required:
      - url
      title: PresignedDeliverable
      description: One presigned HTTP upload target.
    PresignedPut:
      properties:
        key:
          type: string
          title: Key
          description: Relative path under the destination root. The writeback step
            matches files to URLs by this key.
        url:
          type: string
          minLength: 1
          title: Url
        method:
          type: string
          enum:
          - PUT
          - POST
          title: Method
          default: PUT
        headers:
          additionalProperties:
            type: string
          type: object
          title: Headers
      additionalProperties: false
      type: object
      required:
      - key
      - url
      title: PresignedPut
      description: One presigned write target, keyed by relative path within the destination.
    RunDatapointRequest:
      properties:
        task_slug:
          type: string
          title: Task Slug
        agents:
          items:
            $ref: '#/components/schemas/DatapointAgentBody'
          type: array
          maxItems: 8
          minItems: 1
          title: Agents
          description: One or more agents to run against the same materialized task
            (max 8).
        metadata:
          additionalProperties: true
          type: object
          title: Metadata
        artifacts:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          title: Artifacts
        sandbox:
          anyOf:
          - type: string
          - type: 'null'
          title: Sandbox
        notifications:
          anyOf:
          - items:
              additionalProperties: true
              type: object
            type: array
          - type: 'null'
          title: Notifications
        writeback:
          anyOf:
          - $ref: '#/components/schemas/HarborTaskWritebackSpec'
          - type: 'null'
        deliver:
          anyOf:
          - $ref: '#/components/schemas/DeliverSpec'
          - type: 'null'
        require_verifier_evidence:
          anyOf:
          - type: boolean
          - type: 'null'
          title: Require Verifier Evidence
          description: "Whether outcome.valid_for_scoring requires the verifier to\
            \ have produced a machine-readable test report. Defaults to true: a verifier\
            \ that writes a reward without collecting any test proves nothing, and\
            \ with no report there is no way to tell the difference. Set false when\
            \ the task uses a shell verifier you trust and you want to score on its\
            \ reward alone \u2014 the rewards themselves are returned either way,\
            \ and the job still succeeds. Deployment-wide override: SANDBOX_HARBOR_REQUIRE_VERIFIER_EVIDENCE=false."
      type: object
      required:
      - task_slug
      - agents
      title: RunDatapointRequest
    RunRequest:
      properties:
        task_dir:
          type: string
          title: Task Dir
          description: Harbor Class-A task directory path (absolute or relative),
            must resolve under SANDBOX_HARBOR_JOBS_DIR
        agent:
          type: string
          title: Agent
          description: Harbor --agent id (e.g. oracle, claude-code, codex)
        model:
          anyOf:
          - type: string
          - type: 'null'
          title: Model
          description: LiteLLM model string for -m
        n_attempts:
          type: integer
          minimum: 1.0
          title: N Attempts
          default: 1
        sandbox:
          anyOf:
          - type: string
          - type: 'null'
          title: Sandbox
          description: Sandbox driver hint
          default: docker
        job_id:
          anyOf:
          - type: string
          - type: 'null'
          title: Job Id
      type: object
      required:
      - task_dir
      - agent
      title: RunRequest
      description: Request to execute a harbor-format task directory.
    RunResponse:
      properties:
        job_id:
          anyOf:
          - type: string
          - type: 'null'
          title: Job Id
        agent:
          type: string
          title: Agent
        result:
          additionalProperties: true
          type: object
          title: Result
      type: object
      required:
      - job_id
      - agent
      - result
      title: RunResponse
    VerifyTaskRequest:
      properties:
        task_slug:
          type: string
          title: Task Slug
        metadata:
          additionalProperties: true
          type: object
          title: Metadata
        workspace_fixture_url:
          anyOf:
          - type: string
          - type: 'null'
          title: Workspace Fixture Url
        sandbox:
          anyOf:
          - type: string
          - type: 'null'
          title: Sandbox
      type: object
      required:
      - task_slug
      title: VerifyTaskRequest
    WritebackDestination:
      properties:
        url:
          anyOf:
          - type: string
            minLength: 1
          - type: 'null'
          title: Url
          description: Destination root URL (``s3://``, ``gs://``, or presigned PUT
            for ``staged_zip``). Optional when ``presigned_writes`` fully specifies
            targets.
        presigned_writes:
          anyOf:
          - items:
              $ref: '#/components/schemas/PresignedPut'
            type: array
          - type: 'null'
          title: Presigned Writes
        storage_connector_id:
          anyOf:
          - type: integer
          - type: 'null'
          title: Storage Connector Id
      additionalProperties: false
      type: object
      title: WritebackDestination
    AgentOut:
      properties:
        id:
          type: string
          title: Id
        display_name:
          type: string
          title: Display Name
        requires_model:
          type: boolean
          title: Requires Model
        mcp_adapter:
          anyOf:
          - type: string
          - type: 'null'
          title: Mcp Adapter
        air_gap_capable:
          type: boolean
          title: Air Gap Capable
          default: false
        requires_reference_solution:
          type: boolean
          title: Requires Reference Solution
          default: false
      type: object
      required:
      - id
      - display_name
      - requires_model
      title: AgentOut
    AgentRunBody:
      properties:
        agent_id:
          type: string
          minLength: 1
          title: Agent Id
        instruction:
          type: string
          minLength: 1
          title: Instruction
        model:
          anyOf:
          - type: string
          - type: 'null'
          title: Model
        workspace:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Workspace
        sandbox_id:
          anyOf:
          - type: string
            minLength: 1
          - type: 'null'
          title: Sandbox Id
          description: Existing long-lived sandbox for a continuing, ungraded agent
            loop. Only agents whose catalog integration is `sandbox` may attach. The
            sandbox must be running and owned by this tenant/project.
        pass_at_k:
          type: integer
          minimum: 1.0
          title: Pass At K
          description: Agent Runtime is ungraded and normally runs once. Values above
            1 are rejected when sandbox_id is set; use Harbor pass_at_k for fresh
            attempts.
          default: 1
        agent_options:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Agent Options
          description: "Executor options for this run: agent_env, agent_kwargs, sandbox,\
            \ n_concurrent, custom_agent_import. When agent_id is opencode: opencode_agent\
            \ sets default_agent in opencode.json (plan | build); opencode_config\
            \ deep-merges an allowlisted subset of opencode.json (agent, permission,\
            \ tools, model, small_model, subagent_depth, instructions, command, mcp)\
            \ \u2014 e.g. a custom agent.review subagent. Accepted as `harbor_extensions`\
            \ (deprecated) for backwards compatibility."
      type: object
      required:
      - agent_id
      - instruction
      title: AgentRunBody
    RegisterRequest:
      properties:
        id:
          type: string
          minLength: 1
          title: Id
        display_name:
          anyOf:
          - type: string
          - type: 'null'
          title: Display Name
        requires_model:
          type: boolean
          title: Requires Model
          default: true
        mcp_adapter:
          anyOf:
          - type: string
          - type: 'null'
          title: Mcp Adapter
        air_gap_capable:
          type: boolean
          title: Air Gap Capable
          default: false
        requires_reference_solution:
          type: boolean
          title: Requires Reference Solution
          default: false
      type: object
      required:
      - id
      title: RegisterRequest
    ExecutionRequest:
      properties:
        language:
          type: string
          minLength: 1
          title: Language
        files:
          additionalProperties:
            type: string
          type: object
          title: Files
        stdin:
          anyOf:
          - type: string
          - type: 'null'
          title: Stdin
        limits:
          anyOf:
          - $ref: '#/components/schemas/ResourceLimits'
          - type: 'null'
      type: object
      required:
      - language
      title: ExecutionRequest
    ResourceLimits:
      properties:
        wall_time_ms:
          type: integer
          maximum: 30000.0
          minimum: 100.0
          title: Wall Time Ms
          default: 5000
        memory_mb:
          type: integer
          maximum: 1024.0
          minimum: 32.0
          title: Memory Mb
          default: 256
        pids:
          type: integer
          maximum: 512.0
          minimum: 4.0
          title: Pids
          default: 64
        output_bytes:
          type: integer
          maximum: 2097152.0
          minimum: 1024.0
          title: Output Bytes
          default: 1048576
        filesystem_mb:
          type: integer
          maximum: 512.0
          minimum: 4.0
          title: Filesystem Mb
          default: 64
      additionalProperties: false
      type: object
      title: ResourceLimits
    CreateSandboxRequest:
      properties:
        profile:
          type: string
          minLength: 1
          title: Profile
          default: sandboxes-default
        source:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Source
        autostop_sec:
          anyOf:
          - type: number
          - type: 'null'
          title: Autostop Sec
        ttl_sec:
          anyOf:
          - type: number
          - type: 'null'
          title: Ttl Sec
        linked_job_id:
          anyOf:
          - type: string
          - type: 'null'
          title: Linked Job Id
      type: object
      title: CreateSandboxRequest
    ExecRequest:
      properties:
        command:
          items:
            type: string
          type: array
          minItems: 1
          title: Command
        cwd:
          anyOf:
          - type: string
          - type: 'null'
          title: Cwd
        timeout_sec:
          anyOf:
          - type: number
          - type: 'null'
          title: Timeout Sec
        env:
          anyOf:
          - additionalProperties:
              type: string
            type: object
          - type: 'null'
          title: Env
      type: object
      required:
      - command
      title: ExecRequest
    VerifyRequest:
      properties:
        require_verifier_evidence:
          type: boolean
          title: Require Verifier Evidence
          default: false
      type: object
      title: VerifyRequest
  parameters:
    CorrelationId:
      name: x-correlation-id
      in: header
      required: false
      description: End-to-end correlation id for this eval run. When set, the gateway
        and downstream services honor it verbatim in logs, Cloud Trace span attributes,
        async job payloads, and Langfuse trace.id. When omitted, the gateway generates
        a ULID and echoes it on the response.
      schema:
        type: string
      example: eval-run-2026-07-21-abc123
security:
- ApiKeyAuth: []
- KeyHiveBearer: []
- KeycloakBearer: []
tags:
- name: Gateway
  description: Catalog, health, usage
- name: Harbor
  description: Run a benchmark task and collect its results. Use these paths for new
    integrations.
- name: Harbor (compatibility)
  description: "Older Harbor paths, still supported for existing callers. `/v1` returns\
    \ TerminalBench-shaped fields, and paths without a version resolve to `/v1`. Same\
    \ operations as Harbor otherwise \u2014 prefer `/v2` when you can choose."
- name: Agent Runtime
  description: Ad-hoc LLM agent runs
- name: CodeEdit
  description: Code execution without LLM
- name: Admin
  description: Credential plane administration
