diff --git a/Makefile b/Makefile
index f769ed092..f6b4b3836 100644
--- a/Makefile
+++ b/Makefile
@@ -47,8 +47,8 @@ openapi:
 	    --output "$$output" \
 	    --outputTypes yaml --parseInternal; \
 	python3 scripts/patch-agents-openapi.py "$$output/swagger.yaml"; \
-	go run ./scripts/openapi-split $(OPENAPI_FLAGS) "$$output/swagger.yaml" "$$output/extensions.json" contracts/agents-api/core.openapi.yaml contracts/agents-api/runtime.openapi.yaml; \
-	python3 scripts/generate-public-api.py $(OPENAPI_FLAGS) --extensions "$$output/extensions.json"
+	go run ./scripts/openapi-split $(OPENAPI_FLAGS) "$$output/swagger.yaml" "$$output/extensions.json" "$$output/core.json" contracts/agents-api/core.openapi.yaml contracts/agents-api/runtime.openapi.yaml; \
+	python3 scripts/generate-public-api.py $(OPENAPI_FLAGS) --extensions "$$output/extensions.json" --core "$$output/core.json"
 
 check-sqlc:
 	python3 scripts/check-sqlc.py
diff --git a/apps/web/src/features/agents/AgentsPage.tsx b/apps/web/src/features/agents/AgentsPage.tsx
index e3f9fab0e..af7e82846 100644
--- a/apps/web/src/features/agents/AgentsPage.tsx
+++ b/apps/web/src/features/agents/AgentsPage.tsx
@@ -21,8 +21,7 @@ import { useAgentDetail } from "../resources/detail-queries";
 
 
 function coverage(summary: ProjectSummary | undefined, locale?: string): string {
-  if (!summary || summary.coverage.sessions === 0) return MISSING;
-  return formatPercent(summary.coverage.reported / summary.coverage.sessions, locale);
+  return summary ? formatPercent(summary.coverage.ratio, locale) : MISSING;
 }
 
 /**
diff --git a/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx b/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx
index df1cedf90..bfe3ab950 100644
--- a/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx
+++ b/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx
@@ -3,15 +3,14 @@ import type { ReactElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it } from "vitest";
 
-import { AgentCoreError } from "@oac/agents-client";
+import { type AdminIssuedAPIKey, type AdminProject, AgentCoreError } from "@oac/agents-client";
 import { flowError, keyFlowReducer, type KeyFlow } from "./key-flows";
 import { KeyFlowDialogs, PendingKeyNotice } from "./KeyFlowDialogs";
 import type { KeyFlowControls } from "./use-key-flow";
-import { type AdminIssuedKey, type Project } from "../../lib/admin-view";
 
-const project: Project = { id: "proj_7f3a91c2", name: "Production", status: "active", created_at: 100, archived_at: null, active_key_count: 1 };
+const project: AdminProject = { id: "proj_7f3a91c2", name: "Production", created_at: "1970-01-01T00:01:40Z", archived_at: null, active_key_count: 1 };
 const secret = "pc_live_" + "s".repeat(40);
-const issued: AdminIssuedKey = { id: "9f0e1d2c-3b4a-4c5d-8e6f-7a8b9c0d1e2f", project_id: "proj_7f3a91c2", name: "bob-laptop", prefix: "pc_live_Zq8", created_at: 300, revoked_at: null, key: secret };
+const issued: AdminIssuedAPIKey = { id: "9f0e1d2c-3b4a-4c5d-8e6f-7a8b9c0d1e2f", project_id: "proj_7f3a91c2", name: "bob-laptop", prefix: "pc_live_Zq8", created_at: "1970-01-01T00:05:00Z", revoked_at: null, key: secret };
 const controls = (flow: KeyFlow): KeyFlowControls => ({ flow, dispatch: () => undefined, submit: async () => undefined });
 // The how-to-call card under a new key reads the installation through the query cache.
 const render = (element: ReactElement) => renderToStaticMarkup(<QueryClientProvider client={new QueryClient()}>{element}</QueryClientProvider>);
diff --git a/apps/web/src/features/api-keys/ProjectDetail.tsx b/apps/web/src/features/api-keys/ProjectDetail.tsx
index 435c0d9b2..98ea1cb25 100644
--- a/apps/web/src/features/api-keys/ProjectDetail.tsx
+++ b/apps/web/src/features/api-keys/ProjectDetail.tsx
@@ -1,3 +1,4 @@
+import type { AdminAPIKey, AdminProject } from "@oac/agents-client";
 import { useQuery } from "@tanstack/react-query";
 import { Plus } from "lucide-react";
 import { useTranslation } from "react-i18next";
@@ -5,7 +6,7 @@ import { useTranslation } from "react-i18next";
 
 import { EmptyState, HelpTip, Kpi, KpiStrip, Section, StatusDot } from "../../components/console-ui";
 import { CopyableId, RowActions } from "../../components/list-ui";
-import { formatCompact, formatDateTime, formatInteger, formatRelative } from "../../lib/format";
+import { epochSeconds, formatCompact, formatDateTime, formatInteger, formatRelative } from "../../lib/format";
 import { useConsoleNavigation } from "../../lib/console-navigation";
 import type { ConsoleView } from "../../lib/console-routes";
 import { admin } from "../../lib/projects";
@@ -14,11 +15,11 @@ import { prefixLabel } from "./key-flows";
 import { loadedFrom, projectKeysQuery, projectSummaryQuery, type Loaded } from "./project-queries";
 import { ProjectStatus } from "./ProjectStatus";
 import { WriteOperations } from "./WriteOperations";
-import { type AdminKey, type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 import { TableSkeleton } from "../../components/Skeleton";
 
 /** A project's keys, active first, from the query cache. */
-export function useProjectKeys(projectId: string | null): Loaded<AdminKey[]> & { retry: () => void } {
+export function useProjectKeys(projectId: string | null): Loaded<AdminAPIKey[]> & { retry: () => void } {
   const query = useQuery({ ...projectKeysQuery(projectId ?? ""), enabled: projectId !== null });
   const { refetch } = query;
   return { ...loadedFrom(query), retry: () => { void refetch(); } };
@@ -38,11 +39,11 @@ const assetLinks: ReadonlyArray<{ key: "agents" | "environment_templates" | "ski
  * write-operation history.
  */
 export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
-  project: Project;
+  project: AdminProject;
   keys: ReturnType<typeof useProjectKeys>;
   busy: boolean;
   onIssue: () => void;
-  onRevoke: (key: AdminKey, activeCount: number) => void;
+  onRevoke: (key: AdminAPIKey, activeCount: number) => void;
 }) {
   const { t, i18n } = useTranslation("keys");
   const { t: tCommon } = useTranslation("common");
@@ -73,8 +74,8 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
       <dl className="resource-facts" aria-label={t("detail.facts")}>
         <div><dt>{t("detail.id")}</dt><dd><CopyableId id={project.id} /></dd></div>
         <div><dt>{t("detail.status")}</dt><dd><ProjectStatus project={project} /></dd></div>
-        <div><dt>{t("detail.created")}</dt><dd>{formatDateTime(project.created_at, locale)}</dd></div>
-        {project.archived_at !== null ? <div><dt>{t("detail.archived")}</dt><dd>{formatDateTime(project.archived_at, locale)}</dd></div> : null}
+        <div><dt>{t("detail.created")}</dt><dd>{formatDateTime(epochSeconds(project.created_at), locale)}</dd></div>
+        {project.archived_at !== null ? <div><dt>{t("detail.archived")}</dt><dd>{formatDateTime(epochSeconds(project.archived_at), locale)}</dd></div> : null}
         <div>
           <dt>{t("detail.lastActive")}</dt>
           <dd title={summary?.last_active_at != null ? formatDateTime(summary.last_active_at, locale) : undefined}>{formatRelative(summary?.last_active_at, now, locale)}</dd>
@@ -117,7 +118,7 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
           <Kpi
             label={t("detail.usageFigures.coverage")}
             help={t("detail.usageFigures.coverageHelp")}
-            value={summary && !pending ? t("detail.coverageValue", { reported: formatInteger(summary.coverage.reported, locale), total: formatInteger(summary.coverage.sessions, locale) }) : "—"}
+            value={summary && !pending ? t("detail.coverageValue", { reported: formatInteger(summary.coverage.measured_sessions, locale), total: formatInteger(summary.coverage.total_sessions, locale) }) : "—"}
           />
         </KpiStrip>
       </Section>
@@ -132,7 +133,7 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
           </span>
         ) : null}</>}
         help={t("detail.keysHelp")}
-        actions={project.status === "active" ? (
+        actions={project.archived_at === null ? (
           <button className="button outline" type="button" onClick={onIssue} disabled={busy}>
             <Plus size={14} aria-hidden="true" />{t("actions.issue")}
           </button>
@@ -145,7 +146,7 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
         ) : !keys.value.length && !unknownUsage ? (
           <EmptyState
             title={t("detail.noKeys")}
-            action={project.status === "active" ? <button className="button outline" type="button" onClick={onIssue} disabled={busy}>{t("actions.issue")}</button> : undefined}
+            action={project.archived_at === null ? <button className="button outline" type="button" onClick={onIssue} disabled={busy}>{t("actions.issue")}</button> : undefined}
           />
         ) : (
           <div className="table-frame">
@@ -177,13 +178,13 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
                       <td>
                         <span className="key-status">
                           <StatusDot tone={revoked ? "neutral" : "ok"} label={revoked ? t("detail.keyStatus.revoked") : t("detail.keyStatus.active")} />
-                          {revoked ? <span className="key-status-date">{formatDateTime(key.revoked_at, locale)}</span> : null}
+                          {revoked ? <span className="key-status-date">{formatDateTime(epochSeconds(key.revoked_at), locale)}</span> : null}
                         </span>
                       </td>
-                      <td className="key-nowrap">{formatDateTime(key.created_at, locale)}</td>
+                      <td className="key-nowrap">{formatDateTime(epochSeconds(key.created_at), locale)}</td>
                       {keyUsage(byKey?.get(key.id))}
                       <td className="actions-cell">
-                        {!revoked && project.status === "active" ? (
+                        {!revoked && project.archived_at === null ? (
                           <RowActions>
                             <button className="text-action danger" type="button" aria-label={t("actions.revokeLabel", { name: key.name })} disabled={busy} onClick={() => onRevoke(key, activeCount)}>
                               {t("actions.revoke")}
@@ -210,7 +211,7 @@ export function ProjectDetail({ project, keys, busy, onIssue, onRevoke }: {
         )}
       </Section>
 
-      {project.status === "active" ? <ProjectHowToCall /> : null}
+      {project.archived_at === null ? <ProjectHowToCall /> : null}
 
       <WriteOperations projectId={project.id} keys={keys.value} />
     </>
diff --git a/apps/web/src/features/api-keys/ProjectStatus.tsx b/apps/web/src/features/api-keys/ProjectStatus.tsx
index f0a979e42..83ed957f6 100644
--- a/apps/web/src/features/api-keys/ProjectStatus.tsx
+++ b/apps/web/src/features/api-keys/ProjectStatus.tsx
@@ -1,12 +1,12 @@
+import type { AdminProject } from "@oac/agents-client";
 import { useTranslation } from "react-i18next";
 
 
 import { StatusDot } from "../../components/console-ui";
-import { type Project } from "../../lib/admin-view";
 
-export function ProjectStatus({ project }: { project: Project }) {
+export function ProjectStatus({ project }: { project: AdminProject }) {
   const { t } = useTranslation("keys");
-  return project.status === "archived"
+  return project.archived_at !== null
     ? <StatusDot tone="neutral" label={t("status.archived")} />
     : <StatusDot tone="ok" label={t("status.active")} />;
 }
diff --git a/apps/web/src/features/api-keys/ProjectsPage.tsx b/apps/web/src/features/api-keys/ProjectsPage.tsx
index 01cf722cc..cd8f91f8e 100644
--- a/apps/web/src/features/api-keys/ProjectsPage.tsx
+++ b/apps/web/src/features/api-keys/ProjectsPage.tsx
@@ -1,3 +1,4 @@
+import type { AdminAPIKey, AdminProject } from "@oac/agents-client";
 import { useIsFetching, useQuery, useQueryClient } from "@tanstack/react-query";
 import { ArrowLeft, FolderKanban, Plus } from "lucide-react";
 import { useCallback, useEffect, useMemo, useState } from "react";
@@ -10,7 +11,7 @@ import { ListToolbar, listSummary, NameCell, RowActions, SearchField } from "../
 import { Modal } from "../../components/Modal";
 import { useFailureToast } from "../../components/Toast";
 import { useConsoleIntent, useConsoleNavigation } from "../../lib/console-navigation";
-import { formatDateTime, formatInteger, formatRelative } from "../../lib/format";
+import { epochSeconds, formatDateTime, formatInteger, formatRelative } from "../../lib/format";
 import { admin, useProjects } from "../../lib/projects";
 import { activeKeyNames, archiveKeyCount, flowError, isAbort, isArchiveConfirmed, isUsableName, matchesProject, normalizeName, prefixLabel, projectNameProblem, type FlowError } from "./key-flows";
 import { FlowErrorMessage, KeyFlowDialogs, NameField, PendingKeyNotice } from "./KeyFlowDialogs";
@@ -22,18 +23,17 @@ import { projectsQuery } from "../../lib/queries";
 import { ProjectStatus } from "./ProjectStatus";
 import { useKeyFlow } from "./use-key-flow";
 import "./api-keys.css";
-import { type AdminKey, archiveProject, createProject, type Project, renameProject, revokeKey } from "../../lib/admin-view";
 import { TableSkeleton } from "../../components/Skeleton";
 
 type Dialog =
   /** `thenIssue`: Getting started continues from the new project to its first key. */
   | { kind: "create"; name: string; thenIssue?: boolean }
-  | { kind: "rename"; project: Project; name: string }
+  | { kind: "rename"; project: AdminProject; name: string }
   /** `typed`: the project name, required while it has active keys. */
-  | { kind: "archive"; project: Project; typed: string }
-  | { kind: "revoke"; project: Project; key: AdminKey; activeCount: number };
+  | { kind: "archive"; project: AdminProject; typed: string }
+  | { kind: "revoke"; project: AdminProject; key: AdminAPIKey; activeCount: number };
 
-const manageable = (project: Project) => project.status === "active";
+const manageable = (project: AdminProject) => project.archived_at === null;
 
 /**
  * Platform › Projects and keys. A project owns the assets shared by all of
@@ -58,7 +58,7 @@ export function ProjectsPage() {
   useEffect(() => { setSelectedId(params.id ?? null); }, [params]);
 
   // After a key is issued (or its outcome is uncertain), re-read the project and its keys.
-  const keyChanged = useCallback((project: Project) => {
+  const keyChanged = useCallback((project: AdminProject) => {
     void invalidateProjects(queryClient, { projectId: project.id });
   }, [queryClient]);
   const controls = useKeyFlow(keyChanged);
@@ -138,17 +138,17 @@ export function ProjectsPage() {
     setDialogError(null);
     try {
       if (current.kind === "create") {
-        const project = await createProject(normalizeName(current.name));
+        const project = await admin.createProject({ name: normalizeName(current.name) });
         // The project page opens anew and finds the project in the list at once;
         // the re-read below confirms it. The key dialog follows as its intent.
         queryClient.setQueryData(projectsQuery.queryKey, (list) => (list && !list.some((entry) => entry.id === project.id) ? [...list, project] : list ?? [project]));
         navigate("projects", { id: project.id }, current.thenIssue ? "issue-key" : undefined);
       } else if (current.kind === "rename") {
-        await renameProject(current.project.id, normalizeName(current.name));
+        await admin.renameProject(current.project.id, { name: normalizeName(current.name) });
       } else if (current.kind === "archive") {
-        await archiveProject(current.project.id);
+        await admin.archiveProject(current.project.id);
       } else {
-        await revokeKey(current.project.id, current.key.id);
+        await admin.revokeAPIKey(current.project.id, current.key.id);
       }
       setDialog(null);
     } catch (error) {
@@ -260,7 +260,7 @@ export function ProjectsPage() {
                         </th>
                         <td><ProjectStatus project={project} /></td>
                         <td className="numeric">{formatInteger(project.active_key_count, locale)}</td>
-                        <td className="key-nowrap">{formatDateTime(project.created_at, locale)}</td>
+                        <td className="key-nowrap">{formatDateTime(epochSeconds(project.created_at), locale)}</td>
                         <td className="key-nowrap" title={lastActive !== null ? formatDateTime(lastActive, locale) : undefined}>{formatRelative(lastActive, now, locale)}</td>
                         <td className="actions-cell" onClick={(event) => event.stopPropagation()}>
                           {manageable(project) ? (
diff --git a/apps/web/src/features/api-keys/WriteOperations.tsx b/apps/web/src/features/api-keys/WriteOperations.tsx
index 03f41c3a1..378e61c30 100644
--- a/apps/web/src/features/api-keys/WriteOperations.tsx
+++ b/apps/web/src/features/api-keys/WriteOperations.tsx
@@ -1,3 +1,4 @@
+import { type AdminAPIKey, type AdminKeyProvenance, type AdminResourceType, adminResourceTypes } from "@oac/agents-client";
 import { useInfiniteQuery } from "@tanstack/react-query";
 import { History } from "lucide-react";
 import { useCallback, useMemo, useState } from "react";
@@ -7,28 +8,22 @@ import { useTranslation } from "react-i18next";
 import { useFailureToast } from "../../components/Toast";
 import { EmptyState, Section } from "../../components/console-ui";
 import { CopyableId, ListToolbar, listSummary } from "../../components/list-ui";
-import { formatDateTime, shortId } from "../../lib/format";
+import { epochSeconds, formatDateTime, shortId } from "../../lib/format";
 import { admin } from "../../lib/projects";
 import { prefixLabel } from "./key-flows";
 import { writeOperationsQuery } from "./project-queries";
-import { type AdminKey, type KeyRef, type OwnerResourceType, ownerResourceTypes } from "../../lib/admin-view";
 import { TableSkeleton } from "../../components/Skeleton";
 import { ConsoleSelect } from "../../components/console-select";
 
-export const operationActions = ["create", "update", "delete", "send_events", "upload_file", "upload_version", "update_default_version"] as const;
-type OperationAction = (typeof operationActions)[number];
+const isType = (value: string): value is AdminResourceType => (adminResourceTypes as readonly string[]).includes(value);
 
-const isType = (value: string): value is OwnerResourceType => (ownerResourceTypes as readonly string[]).includes(value);
-const isAction = (value: string): value is OperationAction => (operationActions as readonly string[]).includes(value);
-
-/** The recorded key of a write: its name, else its prefix; "unknown" when none was recorded. */
-export function OperationKey({ value }: { value: KeyRef | null }) {
+/** The recorded key of a write, by name. */
+export function OperationKey({ value }: { value: AdminKeyProvenance }) {
   const { t } = useTranslation("keys");
-  if (!value) return <span className="table-muted">{t("operations.unknownKey")}</span>;
   const revoked = value.revoked_at !== null;
   return (
-    <span className={revoked ? "operation-key revoked" : "operation-key"} title={[value.prefix ? prefixLabel(value.prefix) : null, revoked ? t("detail.keyStatus.revoked") : null].filter(Boolean).join(" · ") || undefined}>
-      {value.name ?? prefixLabel(value.prefix)}
+    <span className={revoked ? "operation-key revoked" : "operation-key"} title={[prefixLabel(value.prefix), revoked ? t("detail.keyStatus.revoked") : null].filter(Boolean).join(" · ")}>
+      {value.name}
     </span>
   );
 }
@@ -37,11 +32,11 @@ export function OperationKey({ value }: { value: KeyRef | null }) {
  * Every successful write made in one project, newest first, with cursor
  * paging (`next_cursor`). Filters go to Core; nothing is inferred.
  */
-export function WriteOperations({ projectId, keys }: { projectId: string; keys: readonly AdminKey[] | null }) {
+export function WriteOperations({ projectId, keys }: { projectId: string; keys: readonly AdminAPIKey[] | null }) {
   const { t, i18n } = useTranslation("keys");
   const { t: tCommon } = useTranslation("common");
   const locale = i18n.resolvedLanguage;
-  const [type, setType] = useState<OwnerResourceType | "">("");
+  const [type, setType] = useState<AdminResourceType | "">("");
   const [keyId, setKeyId] = useState("");
   const query = useInfiniteQuery(writeOperationsQuery(projectId, { keyId, type }));
   const { data, fetchNextPage, hasNextPage, isFetchingNextPage, refetch } = query;
@@ -55,8 +50,7 @@ export function WriteOperations({ projectId, keys }: { projectId: string; keys:
     void fetchNextPage();
   }, [fetchNextPage, hasNextPage, isFetchingNextPage]);
 
-  const actionLabel = (action: string) => (isAction(action) ? t(`operations.actions.${action}`) : action);
-  const typeLabel = (value: string) => (isType(value) ? t(`operations.types.${value}`) : value);
+  const typeLabel = (value: AdminResourceType) => t(`operations.types.${value}`);
 
   useFailureToast(Boolean(entries) && query.isRefetchError && !query.isFetching, t("operations.failed"), "write-operations-refresh");
   useFailureToast(moreFailed, t("operations.moreFailed"), "write-operations-more");
@@ -89,9 +83,9 @@ export function WriteOperations({ projectId, keys }: { projectId: string; keys:
             <tbody>
               {entries.map((entry) => (
                 <tr key={entry.id}>
-                  <td className="operations-time">{formatDateTime(entry.created_at, locale)}</td>
+                  <td className="operations-time">{formatDateTime(epochSeconds(entry.created_at), locale)}</td>
                   <td><OperationKey value={entry.api_key} /></td>
-                  <td>{actionLabel(entry.action)}</td>
+                  <td>{t(`operations.actions.${entry.action}`)}</td>
                   <td>{typeLabel(entry.resource_type)}</td>
                   <td>
                     <span className="operations-resource">
@@ -136,7 +130,7 @@ export function WriteOperations({ projectId, keys }: { projectId: string; keys:
           onChange={(value) => setType(isType(value) ? value : "")}
           options={[
             { value: "", label: t("operations.allTypes") },
-            ...ownerResourceTypes.map((value) => ({ value, label: typeLabel(value) })),
+            ...adminResourceTypes.map((value) => ({ value, label: typeLabel(value) })),
           ]}
         />
       </ListToolbar>
diff --git a/apps/web/src/features/api-keys/key-flows.test.ts b/apps/web/src/features/api-keys/key-flows.test.ts
index 1c167af1e..085e63a55 100644
--- a/apps/web/src/features/api-keys/key-flows.test.ts
+++ b/apps/web/src/features/api-keys/key-flows.test.ts
@@ -1,6 +1,5 @@
-import { AgentCoreError } from "@oac/agents-client";
+import { type AdminAPIKey, type AdminIssuedAPIKey, type AdminProject, AgentCoreError } from "@oac/agents-client";
 import { describe, expect, it } from "vitest";
-import { type AdminIssuedKey, type AdminKey, type Project } from "../../lib/admin-view";
 
 import {
   activeKeyNames,
@@ -19,10 +18,11 @@ import {
   type KeyFlowEvent,
 } from "./key-flows";
 
-const project: Project = { id: "proj_7f3a91c2", name: "Production", status: "active", created_at: 100, archived_at: null, active_key_count: 1 };
-const archived: Project = { ...project, id: "proj_0b533e99", name: "Legacy", status: "archived", archived_at: 200, active_key_count: 0 };
+const at = (seconds: number) => new Date(seconds * 1000).toISOString();
+const project: AdminProject = { id: "proj_7f3a91c2", name: "Production", created_at: at(100), archived_at: null, active_key_count: 1 };
+const archived: AdminProject = { ...project, id: "proj_0b533e99", name: "Legacy", archived_at: at(200), active_key_count: 0 };
 const secret = "pc_live_" + "x".repeat(40);
-const issued: AdminIssuedKey = { id: "9f0e1d2c-3b4a-4c5d-8e6f-7a8b9c0d1e2f", project_id: "proj_7f3a91c2", name: "bob-laptop", prefix: "pc_live_Zq8", created_at: 300, revoked_at: null, key: secret };
+const issued: AdminIssuedAPIKey = { id: "9f0e1d2c-3b4a-4c5d-8e6f-7a8b9c0d1e2f", project_id: "proj_7f3a91c2", name: "bob-laptop", prefix: "pc_live_Zq8", created_at: at(300), revoked_at: null, key: secret };
 
 const run = (events: KeyFlowEvent[], from: KeyFlow = idleFlow) => events.reduce(keyFlowReducer, from);
 
@@ -47,7 +47,7 @@ describe("project and key names", () => {
     expect(keyNameProblem("tab\there")).toBe("invalid");
     expect(projectNameProblem(" Production", ["Production", "Data team"])).toBe("taken");
     expect(keyNameProblem("alice", activeKeyNames([
-      { id: "a", project_id: "proj_7f3a91c2", name: "alice", prefix: "pc_a", created_at: 1, revoked_at: 2 },
+      { id: "a", project_id: "proj_7f3a91c2", name: "alice", prefix: "pc_a", created_at: at(1), revoked_at: at(2) },
     ]))).toBeNull();
     expect(isUsableName("Production", projectNameProblem("Production", ["Production"]))).toBe(false);
   });
@@ -109,7 +109,7 @@ describe("issuing a key", () => {
 
 describe("helpers", () => {
   it("lists active keys first, newest first", () => {
-    const key = (id: string, created: number, revoked: number | null = null): AdminKey => ({ id, project_id: "proj_7f3a91c2", name: id, prefix: `pc_${id}`, created_at: created, revoked_at: revoked });
+    const key = (id: string, created: number, revoked: number | null = null): AdminAPIKey => ({ id, project_id: "proj_7f3a91c2", name: id, prefix: `pc_${id}`, created_at: at(created), revoked_at: revoked === null ? null : at(revoked) });
     expect(sortKeys([key("old", 1), key("gone", 5, 6), key("new", 3)]).map((entry) => entry.id)).toEqual(["new", "old", "gone"]);
   });
 
@@ -120,10 +120,10 @@ describe("helpers", () => {
   });
 
   it("counts the keys archiving revokes from the project read, or from its key list when that shows more", () => {
-    const key = (id: string, projectId = project.id, revoked: number | null = null): AdminKey => ({ id, project_id: projectId, name: id, prefix: `pc_${id}`, created_at: 1, revoked_at: revoked });
+    const key = (id: string, projectId = project.id, revoked: string | null = null): AdminAPIKey => ({ id, project_id: projectId, name: id, prefix: `pc_${id}`, created_at: at(1), revoked_at: revoked });
     const stale = { ...project, active_key_count: 0 };
     expect(archiveKeyCount(stale, undefined)).toBe(0);
-    expect(archiveKeyCount(stale, [key("new"), key("old", project.id, 5), key("other", "proj_other")])).toBe(1);
+    expect(archiveKeyCount(stale, [key("new"), key("old", project.id, at(5)), key("other", "proj_other")])).toBe(1);
     expect(archiveKeyCount({ ...project, active_key_count: 3 }, [key("new")])).toBe(3);
   });
 
diff --git a/apps/web/src/features/api-keys/key-flows.ts b/apps/web/src/features/api-keys/key-flows.ts
index b960bad53..318d9c605 100644
--- a/apps/web/src/features/api-keys/key-flows.ts
+++ b/apps/web/src/features/api-keys/key-flows.ts
@@ -1,5 +1,4 @@
-import { AgentCoreError } from "@oac/agents-client";
-import { type AdminIssuedKey, type AdminKey, type Project } from "../../lib/admin-view";
+import { type AdminAPIKey, type AdminIssuedAPIKey, type AdminProject, AgentCoreError } from "@oac/agents-client";
 
 /**
  * Pure state for projects and their named API keys. A project owns the assets
@@ -46,7 +45,7 @@ export function isUsableName(value: string, problem: NameProblem | null): boolea
  * project's loaded key list shows more (it may be newer, for example after a
  * key was issued and the project list could not be read again).
  */
-export function archiveKeyCount(project: Pick<Project, "id" | "active_key_count">, keys: readonly AdminKey[] | null | undefined): number {
+export function archiveKeyCount(project: Pick<AdminProject, "id" | "active_key_count">, keys: readonly AdminAPIKey[] | null | undefined): number {
   const listed = keys ? keys.filter((key) => key.project_id === project.id && key.revoked_at === null).length : 0;
   return Math.max(project.active_key_count, listed);
 }
@@ -87,16 +86,16 @@ export function isAbort(error: unknown): boolean {
 export type KeyFlow =
   | { step: "idle" }
   /** Issue a named key for an active project. */
-  | { step: "issue"; project: Project; name: string; busy: boolean; error: FlowError | null }
+  | { step: "issue"; project: AdminProject; name: string; busy: boolean; error: FlowError | null }
   /** The plaintext is on screen until the operator confirms it was saved. */
-  | { step: "issued"; project: Project; issued: AdminIssuedKey; open: boolean };
+  | { step: "issued"; project: AdminProject; issued: AdminIssuedAPIKey; open: boolean };
 
 export type KeyFlowEvent =
-  | { type: "openIssue"; project: Project }
+  | { type: "openIssue"; project: AdminProject }
   | { type: "setName"; name: string }
   | { type: "started" }
   | { type: "failed"; error: FlowError }
-  | { type: "issued"; projectId: string; key: AdminIssuedKey }
+  | { type: "issued"; projectId: string; key: AdminIssuedAPIKey }
   | { type: "hideIssued" }
   | { type: "saved" }
   | { type: "cancel" };
@@ -107,7 +106,7 @@ export function keyFlowReducer(flow: KeyFlow, event: KeyFlowEvent): KeyFlow {
   switch (event.type) {
     case "openIssue":
       // Never start a second issuance while a plaintext key is waiting to be saved.
-      if (flow.step !== "idle" || event.project.status !== "active") return flow;
+      if (flow.step !== "idle" || event.project.archived_at !== null) return flow;
       return { step: "issue", project: event.project, name: "", busy: false, error: null };
     case "setName":
       return flow.step === "issue" && !flow.busy ? { ...flow, name: event.name, error: null } : flow;
@@ -131,16 +130,16 @@ export function keyFlowReducer(flow: KeyFlow, event: KeyFlowEvent): KeyFlow {
 }
 
 /** The plaintext currently held by a flow, if any. */
-export function pendingPlaintext(flow: KeyFlow): AdminIssuedKey | null {
+export function pendingPlaintext(flow: KeyFlow): AdminIssuedAPIKey | null {
   return flow.step === "issued" ? flow.issued : null;
 }
 
 /** Active keys first, then newest first. */
-export function sortKeys(keys: readonly AdminKey[]): AdminKey[] {
-  return [...keys].sort((a, b) => Number(a.revoked_at !== null) - Number(b.revoked_at !== null) || b.created_at - a.created_at || a.id.localeCompare(b.id));
+export function sortKeys(keys: readonly AdminAPIKey[]): AdminAPIKey[] {
+  return [...keys].sort((a, b) => Number(a.revoked_at !== null) - Number(b.revoked_at !== null) || Date.parse(b.created_at) - Date.parse(a.created_at) || a.id.localeCompare(b.id));
 }
 
-export function activeKeyNames(keys: readonly AdminKey[] | null | undefined): string[] {
+export function activeKeyNames(keys: readonly AdminAPIKey[] | null | undefined): string[] {
   return (keys ?? []).filter((key) => key.revoked_at === null).map((key) => key.name);
 }
 
@@ -149,7 +148,7 @@ export function prefixLabel(prefix: string | null | undefined): string {
   return prefix ? `${prefix}…` : "—";
 }
 
-export function matchesProject(project: Project, query: string): boolean {
+export function matchesProject(project: AdminProject, query: string): boolean {
   const needle = query.trim().toLocaleLowerCase();
   if (!needle) return true;
   return [project.name, project.id].some((value) => value.toLocaleLowerCase().includes(needle));
diff --git a/apps/web/src/features/api-keys/project-queries.ts b/apps/web/src/features/api-keys/project-queries.ts
index c74e71c05..a984f73d0 100644
--- a/apps/web/src/features/api-keys/project-queries.ts
+++ b/apps/web/src/features/api-keys/project-queries.ts
@@ -1,6 +1,7 @@
+import type { AdminResourceType } from "@oac/agents-client";
 import { infiniteQueryOptions, queryOptions, type QueryClient } from "@tanstack/react-query";
 
-import { listKeys, listWriteOperations, loadSummary, type OwnerResourceType, type ProjectSummary } from "../../lib/admin-view";
+import { listKeys, listWriteOperations, loadSummary, type ProjectSummary } from "../../lib/admin-view";
 import { projectsQuery } from "../../lib/queries";
 import { sortKeys } from "./key-flows";
 
@@ -26,7 +27,7 @@ export const projectScope = (projectId: string) => ["project", projectId] as con
 /** Last activity per project for the list: the per-project summary rows. */
 export const projectActivityQuery = queryOptions({
   queryKey: ["project-activity"],
-  queryFn: async ({ signal }) => (await loadSummary({ signal })).filter((row) => row.agent_id === null && row.key === null),
+  queryFn: async ({ signal }) => (await loadSummary({ signal })).filter((row) => row.agent_id === null && row.key_id === null),
   select: (rows: ProjectSummary[]): ReadonlyMap<string, ProjectSummary> => new Map(rows.map((row) => [row.project_id, row])),
 });
 
@@ -53,11 +54,11 @@ export function projectSummaryQuery(projectId: string) {
         loadSummary({ project_id: projectId, signal }),
         loadSummary({ project_id: projectId, group_by: "key", signal }).catch(() => null),
       ]);
-      const project = projectRows.find((row) => row.project_id === projectId && row.agent_id === null && row.key === null) ?? null;
+      const project = projectRows.find((row) => row.project_id === projectId && row.agent_id === null && row.key_id === null) ?? null;
       let byKey: ProjectSummaries["byKey"] = null;
       if (keyRows) {
         byKey = new Map();
-        for (const row of keyRows) if (row.project_id === projectId) byKey.set(row.key?.id ?? null, row);
+        for (const row of keyRows) if (row.project_id === projectId) byKey.set(row.key_id, row);
       }
       return { project, byKey };
     },
@@ -68,7 +69,7 @@ export const WRITE_OPERATIONS_PAGE_SIZE = 50;
 
 export interface WriteOperationFilter {
   keyId: string;
-  type: OwnerResourceType | "";
+  type: AdminResourceType | "";
 }
 
 /** One project's write operations for one filter, newest first, paged by `next_cursor`. */
diff --git a/apps/web/src/features/api-keys/use-key-flow.ts b/apps/web/src/features/api-keys/use-key-flow.ts
index 99aae65b2..bcd3712b3 100644
--- a/apps/web/src/features/api-keys/use-key-flow.ts
+++ b/apps/web/src/features/api-keys/use-key-flow.ts
@@ -1,7 +1,8 @@
+import type { AdminProject } from "@oac/agents-client";
 import { useCallback, useEffect, useReducer, useRef } from "react";
 
 import { flowError, idleFlow, isAbort, keyFlowReducer, normalizeName, type KeyFlow, type KeyFlowEvent } from "./key-flows";
-import { issueKey, type Project } from "../../lib/admin-view";
+import { admin } from "../../lib/admin-view";
 
 export interface KeyFlowControls {
   flow: KeyFlow;
@@ -15,7 +16,7 @@ export interface KeyFlowControls {
  * changed a project or its keys. Writes are never retried automatically: an
  * uncertain result is reported for the operator to check.
  */
-export function useKeyFlow(onChanged: (project: Project) => void = () => undefined): KeyFlowControls {
+export function useKeyFlow(onChanged: (project: AdminProject) => void = () => undefined): KeyFlowControls {
   const [flow, dispatch] = useReducer(keyFlowReducer, idleFlow);
   const flowRef = useRef(flow);
   flowRef.current = flow;
@@ -43,7 +44,7 @@ export function useKeyFlow(onChanged: (project: Project) => void = () => undefin
     const project = current.project;
     send({ type: "started" });
     try {
-      const key = await issueKey(project.id, keyName);
+      const key = await admin.issueAPIKey(project.id, { name: keyName });
       send({ type: "issued", projectId: project.id, key });
     } catch (error) {
       if (!isAbort(error)) send({ type: "failed", error: flowError(error) });
diff --git a/apps/web/src/features/metrics/AgentMetricsPage.tsx b/apps/web/src/features/metrics/AgentMetricsPage.tsx
index 833e35435..1bc88bdaa 100644
--- a/apps/web/src/features/metrics/AgentMetricsPage.tsx
+++ b/apps/web/src/features/metrics/AgentMetricsPage.tsx
@@ -1,3 +1,4 @@
+import type { AdminProject } from "@oac/agents-client";
 import { AlertTriangle } from "lucide-react";
 import { keepPreviousData, useQuery } from "@tanstack/react-query";
 import { useCallback, useMemo, useState } from "react";
@@ -39,7 +40,7 @@ import { type ProjectReadFailure } from "./project-sessions";
 import { type KeyUsageRow } from "./key-usage";
 import { useStableColors } from "./use-stable-colors";
 import "./MetricsView.css";
-import { type KeyRef, type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 
 const RANGES: readonly AgentMetricsRange[] = ["1h", "6h", "24h", "7d"];
 
@@ -67,7 +68,7 @@ function bucketLabel(seconds: number, t: TFunction<"metrics">): string {
  * Agent metrics and usage by key through the query cache. A changed project
  * filter or range keeps the last figures on screen until the new ones arrive.
  */
-function useAgentMetricsData(projects: readonly Project[], projectsReady: boolean, filter: ProjectFilterValue, range: AgentMetricsRange) {
+function useAgentMetricsData(projects: readonly AdminProject[], projectsReady: boolean, filter: ProjectFilterValue, range: AgentMetricsRange) {
   const targets = useMemo(() => projects.filter((project) => !filter || project.id === filter), [filter, projects]);
   const metricsQuery = useQuery({ ...agentMetricsQuery(targets, filter, range), enabled: projectsReady, placeholderData: keepPreviousData });
   const keyQuery = useQuery({ ...keyUsageQuery(filter, range), enabled: projectsReady, placeholderData: keepPreviousData });
@@ -172,7 +173,7 @@ function AgentMetricsContent({
   metrics: AgentMetrics;
   listFailures: ProjectReadFailure[];
   showProject: boolean;
-  projectOf: (id: string | null) => Project | undefined;
+  projectOf: (id: string | null) => AdminProject | undefined;
   modelColor: (id: string) => string;
   toolColor: (id: string) => string;
   failure: string | null;
@@ -394,13 +395,8 @@ function AgentMetricsContent({
   );
 }
 
-function keyLabel(key: KeyRef | null, t: TFunction<"metrics">): string {
-  if (!key) return t("keys.unknown");
-  return key.name ?? (key.prefix ? `${key.prefix}…` : t("keys.unknown"));
-}
-
 /** Usage by the API key that created each Session, from Core's summary for the range. */
-function KeyUsageSection({ state, window, showProject, projectOf }: { state: KeyUsageState; window: MetricsWindow; showProject: boolean; projectOf: (id: string) => Project | undefined }) {
+function KeyUsageSection({ state, window, showProject, projectOf }: { state: KeyUsageState; window: MetricsWindow; showProject: boolean; projectOf: (id: string) => AdminProject | undefined }) {
   const { t, i18n } = useTranslation("metrics");
   const { t: tCommon } = useTranslation("common");
   const locale = i18n.resolvedLanguage;
@@ -434,13 +430,13 @@ function KeyUsageSection({ state, window, showProject, projectOf }: { state: Key
   );
 }
 
-function KeyUsageTableRow({ row, showProject, project, now, locale }: { row: ProjectSummary; showProject: boolean; project: Project | undefined; now: number; locale: string | undefined }) {
+function KeyUsageTableRow({ row, showProject, project, now, locale }: { row: ProjectSummary; showProject: boolean; project: AdminProject | undefined; now: number; locale: string | undefined }) {
   const { t } = useTranslation("metrics");
   const key = row.key;
   return (
     <tr>
       <th scope="row">
-        <span className={key ? "table-primary" : "table-primary table-muted"} title={key?.prefix ? `${key.prefix}…` : t("keys.unknownHelp")}>{keyLabel(key, t)}</span>
+        <span className={key ? "table-primary" : "table-primary table-muted"} title={key ? `${key.prefix}…` : t("keys.unknownHelp")}>{key ? key.name : t("keys.unknown")}</span>
         {key?.revoked_at ? <span className="pill">{t("keys.revoked")}</span> : null}
       </th>
       {showProject ? <td><ProjectName project={project} /></td> : null}
@@ -448,8 +444,8 @@ function KeyUsageTableRow({ row, showProject, project, now, locale }: { row: Pro
       <td className="numeric">{formatInteger(row.sessions.in_progress, locale)}</td>
       <td className={row.sessions.failed ? "numeric numeric-danger" : "numeric"}>{formatInteger(row.sessions.failed, locale)}</td>
       <td className="numeric">{row.usage ? formatCompact(row.usage.total_tokens, locale) : MISSING}</td>
-      <td className="numeric" title={row.coverage.sessions ? t("keys.coverageDetail", { reported: row.coverage.reported, total: row.coverage.sessions }) : undefined}>
-        {formatPercent(row.coverage.sessions ? row.coverage.reported / row.coverage.sessions : null, locale)}
+      <td className="numeric" title={row.coverage.total_sessions ? t("keys.coverageDetail", { reported: row.coverage.measured_sessions, total: row.coverage.total_sessions }) : undefined}>
+        {formatPercent(row.coverage.ratio, locale)}
       </td>
       <td className="numeric">{formatRelative(row.last_active_at, now, locale)}</td>
     </tr>
diff --git a/apps/web/src/features/metrics/CoreMetricsPage.tsx b/apps/web/src/features/metrics/CoreMetricsPage.tsx
index 0d7fe6239..887bc7a4e 100644
--- a/apps/web/src/features/metrics/CoreMetricsPage.tsx
+++ b/apps/web/src/features/metrics/CoreMetricsPage.tsx
@@ -9,7 +9,7 @@ import { TimeSeriesChart } from "../../components/charts/TimeSeriesChart";
 import { DashboardSkeleton, TableSkeleton } from "../../components/Skeleton";
 import { useFailureToast } from "../../components/Toast";
 import { EmptyState, Kpi, KpiStrip, PageBody, PageHeader, RefreshButton, Section, SegmentedControl, StatusDot, type Tone } from "../../components/console-ui";
-import { formatBucket, formatBytes, formatClock, formatDuration, formatInteger, formatRelative, MISSING } from "../../lib/format";
+import { epochSeconds, formatBucket, formatBytes, formatClock, formatDuration, formatInteger, formatRelative, MISSING } from "../../lib/format";
 import { FleetReadNotice } from "../fleet/FleetReadNotice";
 import { fleetSnapshot, useSandboxFleet } from "../fleet/use-sandbox-fleet";
 import { coreMetricsQuery } from "./metrics-queries";
@@ -22,12 +22,6 @@ const GIB = 2 ** 30;
 const jobTone: Record<CoreJobStatus, Tone> = { ok: "ok", failing: "danger", stopped: "warning", unknown: "neutral" };
 const statusTone: Record<CoreMetrics["service"]["status"], Tone> = { running: "ok", degraded: "warning", unknown: "neutral" };
 
-function seconds(value: string | null): number | null {
-  if (!value) return null;
-  const parsed = Date.parse(value);
-  return Number.isNaN(parsed) ? null : Math.floor(parsed / 1000);
-}
-
 function milliseconds(value: number | null): string {
   return value === null ? MISSING : formatDuration(value / 1000);
 }
@@ -93,7 +87,7 @@ export function CoreMetricsPage() {
 
 function ServiceMeta({ metrics }: { metrics: CoreMetrics }) {
   const { t } = useTranslation("metrics");
-  const started = seconds(metrics.service.started_at);
+  const started = epochSeconds(metrics.service.started_at);
   const now = Math.floor(Date.now() / 1000);
   const notOwner = metrics.service.execution_owner === false;
   return (
@@ -115,11 +109,11 @@ function CoreMetricsBody({ metrics }: { metrics: CoreMetrics }) {
   const locale = i18n.resolvedLanguage;
   const now = Math.floor(Date.now() / 1000);
   const { execution, database, process } = metrics;
-  const processBuckets = useMemo(() => process.series.map((entry) => seconds(entry.start) ?? 0), [process.series]);
+  const processBuckets = useMemo(() => process.series.map((entry) => epochSeconds(entry.start) ?? 0), [process.series]);
   const bucketSeconds = metrics.range.resolution_seconds;
   const bucket = formatBucket(bucketSeconds, locale);
-  const executionBuckets = useMemo(() => execution.series.map((entry) => seconds(entry.start) ?? 0), [execution.series]);
-  const databaseBuckets = useMemo(() => database.series.map((entry) => seconds(entry.start) ?? 0), [database.series]);
+  const executionBuckets = useMemo(() => execution.series.map((entry) => epochSeconds(entry.start) ?? 0), [execution.series]);
+  const databaseBuckets = useMemo(() => database.series.map((entry) => epochSeconds(entry.start) ?? 0), [database.series]);
   const count = (value: number | null) => (value === null ? MISSING : formatInteger(value, locale));
   const integer = (value: number) => formatInteger(value, locale);
   const slotsFull = execution.slots_in_use >= execution.slots_total;
@@ -313,7 +307,7 @@ function CoreMetricsBody({ metrics }: { metrics: CoreMetrics }) {
                   <tr key={job.id}>
                     <th scope="row"><span className="table-primary">{t(`core.jobs.names.${job.id}`, { defaultValue: job.id })}</span></th>
                     <td><StatusDot tone={jobTone[job.status]} label={t(`core.jobs.health.${job.status}`)} /></td>
-                    <td className="numeric" title={job.last_run_at ?? undefined}>{formatRelative(seconds(job.last_run_at), now, locale)}</td>
+                    <td className="numeric" title={job.last_run_at ?? undefined}>{formatRelative(epochSeconds(job.last_run_at), now, locale)}</td>
                     <td className="numeric">{count(job.processed)}</td>
                     <td className={job.failed ? "numeric numeric-danger" : "numeric"}>{count(job.failed)}</td>
                   </tr>
diff --git a/apps/web/src/features/metrics/agent-metrics-loader.ts b/apps/web/src/features/metrics/agent-metrics-loader.ts
index b7e6ba23a..27cddade7 100644
--- a/apps/web/src/features/metrics/agent-metrics-loader.ts
+++ b/apps/web/src/features/metrics/agent-metrics-loader.ts
@@ -1,9 +1,9 @@
-import type { AgentSession, AgentTurn, ListPage, PageOptions, SessionItem } from "@oac/agents-client";
+import type { AdminProject, AgentSession, AgentTurn, ListPage, PageOptions, SessionItem } from "@oac/agents-client";
 
 import type { ProjectClient } from "../../lib/projects";
 import type { MetricsCoverage, MetricsWindow, SessionActivity } from "./agent-metrics";
 import { readProjectsSessions, type InProject, type ProjectReadFailure, type SessionLister } from "./project-sessions";
-import { type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 
 export interface AgentMetricsSource {
   listTurns(sessionId: string, options?: PageOptions): Promise<ListPage<AgentTurn>>;
@@ -204,7 +204,7 @@ export const PROJECT_SESSION_LIST_CAP = 2_000;
 type ProjectReader = SessionLister & Pick<ProjectClient, "listTurns" | "listItems">;
 
 /** Routes each Session's Turn and Item reads to the admin scope of its project. */
-export function projectMetricsSource(sessions: readonly InProject<AgentSession>[], clientFor: (project: Project) => AgentMetricsSource): AgentMetricsSource {
+export function projectMetricsSource(sessions: readonly InProject<AgentSession>[], clientFor: (project: AdminProject) => AgentMetricsSource): AgentMetricsSource {
   const owners = new Map(sessions.map((entry) => [entry.value.id, entry.project]));
   const client = (sessionId: string) => {
     const project = owners.get(sessionId);
@@ -229,7 +229,7 @@ export function projectMayHaveActivity(row: ProjectSummary | undefined, window:
 
 export interface ProjectAgentMetricsLoad extends AgentMetricsLoad {
   /** Projects whose Session list was longer than the list cap. */
-  truncatedLists: Project[];
+  truncatedLists: AdminProject[];
   listFailures: ProjectReadFailure[];
 }
 
@@ -239,9 +239,9 @@ export interface ProjectAgentMetricsLoad extends AgentMetricsLoad {
  * history of the most recently active ones through each project's scope.
  */
 export async function loadProjectAgentMetrics(
-  projects: readonly Project[],
+  projects: readonly AdminProject[],
   window: MetricsWindow,
-  deps: { clientFor: (project: Project) => ProjectReader; summary: ProjectSummary[] | null },
+  deps: { clientFor: (project: AdminProject) => ProjectReader; summary: ProjectSummary[] | null },
   signal: AbortSignal,
   options: { includeTools: boolean; limits?: AgentMetricsLoadLimits; listCap?: number },
 ): Promise<ProjectAgentMetricsLoad> {
diff --git a/apps/web/src/features/metrics/key-usage.test.ts b/apps/web/src/features/metrics/key-usage.test.ts
index ce8bfb7d7..422bee7ec 100644
--- a/apps/web/src/features/metrics/key-usage.test.ts
+++ b/apps/web/src/features/metrics/key-usage.test.ts
@@ -1,22 +1,19 @@
 import { describe, expect, it } from "vitest";
 
-
 import { summary } from "../overview/test-fixtures";
 import { keyUsageRows } from "./key-usage";
-import { type KeyRef } from "../../lib/admin-view";
 
-const key = (id: string): KeyRef => ({ id, name: id, prefix: `pc_${id}`, revoked_at: null });
 const sessions = (total: number) => ({ total, idle: total, in_progress: 0, requires_action: 0, failed: 0 });
-const usage = (total: number) => ({ input_tokens: total, output_tokens: 0, total_tokens: total, cached_tokens: 0, reasoning_tokens: 0 });
+const usage = (total: number) => ({ input_tokens: total, input_tokens_details: { cached_tokens: 0 }, output_tokens: 0, output_tokens_details: { reasoning_tokens: 0 }, total_tokens: total });
 
 describe("keyUsageRows", () => {
   it("ranks keys by tokens, keeps unreported usage below reported, lists unknown creators last and drops idle keys", () => {
     const rows = keyUsageRows([
-      summary("p1", { key: null, assets: null, sessions: sessions(9), usage: usage(900) }),
-      summary("p1", { key: key("small"), assets: null, sessions: sessions(2), usage: usage(10) }),
-      summary("p2", { key: key("big"), assets: null, sessions: sessions(1), usage: usage(500) }),
-      summary("p2", { key: key("silent"), assets: null, sessions: sessions(4), usage: null }),
-      summary("p2", { key: key("idle"), assets: null, sessions: sessions(0) }),
+      summary("p1", { key_id: null, assets: null, sessions: sessions(9), usage: usage(900) }),
+      summary("p1", { key_id: "small", assets: null, sessions: sessions(2), usage: usage(10) }),
+      summary("p2", { key_id: "big", assets: null, sessions: sessions(1), usage: usage(500) }),
+      summary("p2", { key_id: "silent", assets: null, sessions: sessions(4), usage: null }),
+      summary("p2", { key_id: "idle", assets: null, sessions: sessions(0) }),
     ]);
     expect(rows.map((row) => row.id)).toEqual(["p2:big", "p1:small", "p2:silent", "p1:unknown"]);
   });
diff --git a/apps/web/src/features/metrics/key-usage.ts b/apps/web/src/features/metrics/key-usage.ts
index fa89d686d..593c847d5 100644
--- a/apps/web/src/features/metrics/key-usage.ts
+++ b/apps/web/src/features/metrics/key-usage.ts
@@ -14,9 +14,9 @@ export interface KeyUsageRow {
 export function keyUsageRows(rows: readonly ProjectSummary[]): KeyUsageRow[] {
   return rows
     .filter((row) => row.agent_id === null && row.sessions.total > 0)
-    .map((summary) => ({ id: summary.key ? `${summary.project_id}:${summary.key.id}` : `${summary.project_id}:unknown`, summary }))
+    .map((summary) => ({ id: `${summary.project_id}:${summary.key_id ?? "unknown"}`, summary }))
     .sort((a, b) => (
-      Number(a.summary.key === null) - Number(b.summary.key === null)
+      Number(a.summary.key_id === null) - Number(b.summary.key_id === null)
       || (b.summary.usage?.total_tokens ?? -1) - (a.summary.usage?.total_tokens ?? -1)
       || b.summary.sessions.total - a.summary.sessions.total
       || a.id.localeCompare(b.id)
diff --git a/apps/web/src/features/metrics/metrics-queries.ts b/apps/web/src/features/metrics/metrics-queries.ts
index d76ce332d..f7ac0a983 100644
--- a/apps/web/src/features/metrics/metrics-queries.ts
+++ b/apps/web/src/features/metrics/metrics-queries.ts
@@ -1,7 +1,7 @@
 import { queryOptions } from "@tanstack/react-query";
-import { CoreMetricsClient, type CoreMetricsRange } from "@oac/agents-client";
+import { type AdminProject, CoreMetricsClient, type CoreMetricsRange } from "@oac/agents-client";
 
-import { listRuntimeObservations, loadSummary, type Project } from "../../lib/admin-view";
+import { listRuntimeObservations, loadSummary } from "../../lib/admin-view";
 import { projectClient } from "../../lib/projects";
 import { aggregateAgentMetrics, metricsWindow, type AgentMetrics, type AgentMetricsRange } from "./agent-metrics";
 import { loadProjectAgentMetrics } from "./agent-metrics-loader";
@@ -20,7 +20,7 @@ export const hostedRuntimesQuery = queryOptions({
 
 export interface LoadedAgentMetrics {
   metrics: AgentMetrics;
-  truncatedLists: Project[];
+  truncatedLists: AdminProject[];
   listFailures: ProjectReadFailure[];
   /** Epoch milliseconds. */
   loadedAt: number;
@@ -31,7 +31,7 @@ export interface LoadedAgentMetrics {
  * read time; the key holds every input: the project filter, the range and the
  * projects read.
  */
-export function agentMetricsQuery(targets: readonly Project[], filter: string, range: AgentMetricsRange) {
+export function agentMetricsQuery(targets: readonly AdminProject[], filter: string, range: AgentMetricsRange) {
   return queryOptions({
     queryKey: ["agent-metrics", { project: filter, range }, targets.map((project) => project.id)],
     queryFn: async ({ signal }): Promise<LoadedAgentMetrics> => {
diff --git a/apps/web/src/features/metrics/project-sessions.ts b/apps/web/src/features/metrics/project-sessions.ts
index c5c38fe89..0df779462 100644
--- a/apps/web/src/features/metrics/project-sessions.ts
+++ b/apps/web/src/features/metrics/project-sessions.ts
@@ -1,7 +1,6 @@
-import type { AgentSession } from "@oac/agents-client";
+import type { AdminProject, AgentSession } from "@oac/agents-client";
 
 import type { Owned, ProjectClient } from "../../lib/projects";
-import { type Project } from "../../lib/admin-view";
 
 /**
  * Bounded reads of each project's Session list through its admin scope. The
@@ -45,19 +44,19 @@ export async function readSessions(client: SessionLister, options: SessionReadOp
 }
 
 export interface ProjectSessionRead extends SessionRead {
-  project: Project;
+  project: AdminProject;
 }
 
 export interface ProjectReadFailure {
-  project: Project;
+  project: AdminProject;
   message: string;
 }
 
 /** Reads several projects in parallel; a failing project is reported by name and the others still count. */
 export async function readProjectsSessions(
-  projects: readonly Project[],
-  clientFor: (project: Project) => SessionLister,
-  options: (project: Project) => SessionReadOptions,
+  projects: readonly AdminProject[],
+  clientFor: (project: AdminProject) => SessionLister,
+  options: (project: AdminProject) => SessionReadOptions,
 ): Promise<{ reads: ProjectSessionRead[]; failures: ProjectReadFailure[] }> {
   const results = await Promise.allSettled(projects.map(async (project) => ({ project, ...(await readSessions(clientFor(project), options(project))) })));
   const reads: ProjectSessionRead[] = [];
diff --git a/apps/web/src/features/overview/FleetOverview.tsx b/apps/web/src/features/overview/FleetOverview.tsx
index 238d67d49..310a8a2cc 100644
--- a/apps/web/src/features/overview/FleetOverview.tsx
+++ b/apps/web/src/features/overview/FleetOverview.tsx
@@ -6,13 +6,12 @@ import { useTranslation } from "react-i18next";
 
 import { ConsolePopover } from "../../components/console-popover";
 import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
-import { formatBytes, formatDateTime, formatDuration, formatInteger, formatRelative, MISSING } from "../../lib/format";
+import { epochSeconds, formatBytes, formatDateTime, formatDuration, formatInteger, formatRelative, MISSING } from "../../lib/format";
 import { nodeProviderDiagnostic } from "../../lib/sandbox-diagnostic";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
 import { nodeHealth, suspendedSandboxes, type NodeHealth } from "../fleet/fleet-model";
 import { coreMetricsQuery } from "../metrics/metrics-queries";
 import { NodeRolloutStatus } from "../sandbox/NodeRolloutStatus";
-import { seconds } from "../sandbox/NodeList";
 
 /** Nodes shown in the overview; the rest are counted and listed on the Nodes page. */
 export const FLEET_LIMIT = 4;
@@ -147,7 +146,7 @@ function NodeGlance({ node, health, stale, suspends }: { node: SandboxNode; heal
   const { t, i18n } = useTranslation("overview");
   const locale = i18n.resolvedLanguage;
   const now = Math.floor(Date.now() / 1000);
-  const seen = seconds(node.last_seen_at);
+  const seen = epochSeconds(node.last_seen_at);
   const count = (value: number) => formatInteger(value, locale);
   const diagnostic = health === "degraded" ? nodeProviderDiagnostic(node) : "";
   return (
@@ -180,7 +179,7 @@ function CoreGlance({ label, tone }: { label: string; tone: Tone }) {
   const query = useQuery({ ...coreMetricsQuery("1h"), retry: false });
   const metrics = query.data ?? null;
   const count = (value: number | null) => (value === null ? MISSING : formatInteger(value, locale));
-  const started = seconds(metrics?.service.started_at ?? null);
+  const started = epochSeconds(metrics?.service.started_at ?? null);
   const now = Math.floor(Date.now() / 1000);
   return (
     <Facts>
diff --git a/apps/web/src/features/overview/OverviewPage.tsx b/apps/web/src/features/overview/OverviewPage.tsx
index 0b8975260..0036ee4ef 100644
--- a/apps/web/src/features/overview/OverviewPage.tsx
+++ b/apps/web/src/features/overview/OverviewPage.tsx
@@ -1,4 +1,4 @@
-import type { AgentSession } from "@oac/agents-client";
+import type { AdminProject, AgentSession } from "@oac/agents-client";
 import { useQuery } from "@tanstack/react-query";
 import { useCallback, useMemo, type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
@@ -39,7 +39,6 @@ import { overviewQuery } from "./overview-queries";
 import {
   attentionCount,
   attentionSessions,
-  coverageRatio,
   projectUsageRows,
   recentFailures,
   serviceHealth,
@@ -50,7 +49,7 @@ import {
   type ServiceHealth,
 } from "./overview-model";
 import "./overview.css";
-import { type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 
 export const OVERVIEW_REFRESH_MS = 30_000;
 const ATTENTION_LIMIT = 8;
@@ -72,7 +71,7 @@ function errorText(error: unknown): string {
  * a refresh retains figures within the same project scope, and the
  * page polls while it is visible.
  */
-function useOverviewData(projects: readonly Project[], projectsReady: boolean) {
+function useOverviewData(projects: readonly AdminProject[], projectsReady: boolean) {
   const query = useQuery({
     ...overviewQuery(projects),
     enabled: projectsReady,
@@ -150,10 +149,10 @@ export function OverviewPage() {
 
   const loading = refreshing || projectsState.state.status === "loading" || (fleetState.status === "ready" && fleetState.refreshing);
   const updatedAt = data?.loadedAt ?? fleet?.loadedAt ?? null;
-  const attentionTotal = totals ? attentionCount(totals.sessions) : null;
+  const attentionTotal = totals ? attentionCount(totals) : null;
   const truncated = data?.sessions.truncated ?? [];
   // Whether any Session exists: Core's summary counts them all; without it, any Session read counts.
-  const sessionCount = totals ? totals.sessions.total
+  const sessionCount = totals ? totals.total
     : sessions?.length ? sessions.length
     : summaryError !== null || sessionReadsFailed ? "failed" : null;
 
@@ -190,8 +189,8 @@ export function OverviewPage() {
           <MetricTile
             label={t("kpi.running")}
             help={t("kpi.runningHelp")}
-            value={totals ? <LiveNumber value={totals.sessions.in_progress} /> : MISSING}
-            sub={totals ? t("tiles.sessionSplit", { idle: formatInteger(totals.sessions.idle, locale), total: formatInteger(totals.sessions.total, locale) }) : t("kpi.summaryUnavailable")}
+            value={totals ? <LiveNumber value={totals.in_progress} /> : MISSING}
+            sub={totals ? t("tiles.sessionSplit", { idle: formatInteger(totals.idle, locale), total: formatInteger(totals.total, locale) }) : t("kpi.summaryUnavailable")}
           />
           {cloud ? (
             <MetricTile
@@ -216,7 +215,7 @@ export function OverviewPage() {
             label={t("kpi.attention")}
             help={t("attention.subtitle")}
             value={<LiveNumber value={attentionTotal} />}
-            sub={totals ? t("tiles.attentionSplit", { failed: totals.sessions.failed, waiting: totals.sessions.requires_action }) : t("kpi.summaryUnavailable")}
+            sub={totals ? t("tiles.attentionSplit", { failed: totals.failed, waiting: totals.requires_action }) : t("kpi.summaryUnavailable")}
           />
         </div>
 
@@ -379,12 +378,12 @@ function usageTitle(summary: ProjectSummary, t: TFunction<"overview">, locale: s
   return t("projects.tokenDetail", {
     input: number(summary.usage.input_tokens),
     output: number(summary.usage.output_tokens),
-    cached: number(summary.usage.cached_tokens),
-    reasoning: number(summary.usage.reasoning_tokens),
+    cached: number(summary.usage.input_tokens_details.cached_tokens),
+    reasoning: number(summary.usage.output_tokens_details.reasoning_tokens),
   });
 }
 
-function ProjectUsageTable({ rows, failed, now, onOpen }: { rows: ProjectUsageRow[] | null; failed: boolean; now: number; onOpen: (project: Project) => void }) {
+function ProjectUsageTable({ rows, failed, now, onOpen }: { rows: ProjectUsageRow[] | null; failed: boolean; now: number; onOpen: (project: AdminProject) => void }) {
   const { t, i18n } = useTranslation("overview");
   const { t: tCommon } = useTranslation("common");
   const locale = i18n.resolvedLanguage;
@@ -409,14 +408,13 @@ function ProjectUsageTable({ rows, failed, now, onOpen }: { rows: ProjectUsageRo
         </thead>
         <tbody>
           {rows.map(({ project, summary }) => {
-            const coverage = summary ? coverageRatio(summary.coverage) : null;
             return (
               <tr key={project.id} className="clickable-row" onClick={() => onOpen(project)}>
                 <th scope="row">
                   <button className="table-link" type="button" onClick={(event) => { event.stopPropagation(); onOpen(project); }} aria-label={t("projects.open", { name: project.name })}>
                     <strong><ProjectName project={project} /></strong>
                   </button>
-                  {project.status === "archived" ? <span className="pill">{t("projects.archived")}</span> : null}
+                  {project.archived_at !== null ? <span className="pill">{t("projects.archived")}</span> : null}
                 </th>
                 <td className="numeric">{count(project.active_key_count)}</td>
                 <td className="numeric">{count(summary?.sessions.total)}</td>
@@ -424,8 +422,8 @@ function ProjectUsageTable({ rows, failed, now, onOpen }: { rows: ProjectUsageRo
                 <td className="numeric">{count(summary?.sessions.requires_action)}</td>
                 <td className={summary?.sessions.failed ? "numeric numeric-danger" : "numeric"}>{count(summary?.sessions.failed)}</td>
                 <td className="numeric" title={summary ? usageTitle(summary, t, locale) : undefined}>{summary?.usage ? formatCompact(summary.usage.total_tokens, locale) : MISSING}</td>
-                <td className="numeric" title={summary && summary.coverage.sessions ? t("projects.coverageDetail", { reported: summary.coverage.reported, total: summary.coverage.sessions }) : undefined}>
-                  {formatPercent(coverage, locale)}
+                <td className="numeric" title={summary && summary.coverage.total_sessions ? t("projects.coverageDetail", { reported: summary.coverage.measured_sessions, total: summary.coverage.total_sessions }) : undefined}>
+                  {formatPercent(summary?.coverage.ratio, locale)}
                 </td>
                 <td className="numeric">{formatRelative(summary?.last_active_at ?? null, now, locale)}</td>
               </tr>
diff --git a/apps/web/src/features/overview/getting-started.test.ts b/apps/web/src/features/overview/getting-started.test.ts
index 0194079ae..97249ca59 100644
--- a/apps/web/src/features/overview/getting-started.test.ts
+++ b/apps/web/src/features/overview/getting-started.test.ts
@@ -75,9 +75,9 @@ describe("Getting started steps", () => {
   it("needs an active project with an active key, and any Session", () => {
     const steps = (projects: Parameters<typeof gettingStartedSteps>[0]["projects"], sessions: number | "failed" | null = 0) => gettingStartedSteps({ sandboxReset: false, fleet: { status: "loading" }, projects, sessions, harnesses: undefined });
     expect(steps([]).key).toEqual({ state: "todo", project: null });
-    const older = project("p1", { active_key_count: 0, created_at: 1 });
-    const newer = project("p2", { active_key_count: 0, created_at: 2 });
-    expect(steps([older, newer, project("p3", { status: "archived", active_key_count: 0, created_at: 3 })]).key).toEqual({ state: "todo", project: newer });
+    const older = project("p1", { active_key_count: 0, created_at: "1970-01-01T00:00:01Z" });
+    const newer = project("p2", { active_key_count: 0, created_at: "1970-01-01T00:00:02Z" });
+    expect(steps([older, newer, project("p3", { archived_at: "1970-01-01T00:00:04Z", active_key_count: 0, created_at: "1970-01-01T00:00:03Z" })]).key).toEqual({ state: "todo", project: newer });
     expect(steps([older, project("p4")]).key.state).toBe("done");
     expect(steps(undefined).key.state).toBeNull();
     expect(steps("failed").key.state).toBe("unknown");
@@ -86,9 +86,9 @@ describe("Getting started steps", () => {
 
   it("opens the call samples of the newest active project with a key, else of the newest active project", () => {
     const call = (projects: Parameters<typeof gettingStartedSteps>[0]["projects"]) => gettingStartedSteps({ sandboxReset: false, fleet: { status: "loading" }, projects, sessions: 0, harnesses: undefined }).session.project;
-    const keyed = project("p1", { created_at: 1 });
-    const newer = project("p2", { active_key_count: 0, created_at: 2 });
-    const archived = project("p3", { status: "archived", active_key_count: 0, created_at: 3 });
+    const keyed = project("p1", { created_at: "1970-01-01T00:00:01Z" });
+    const newer = project("p2", { active_key_count: 0, created_at: "1970-01-01T00:00:02Z" });
+    const archived = project("p3", { archived_at: "1970-01-01T00:00:04Z", active_key_count: 0, created_at: "1970-01-01T00:00:03Z" });
     expect(call([keyed, newer, archived])).toBe(keyed);
     expect(call([newer, archived])).toBe(newer);
     expect([call([archived]), call(undefined), call("failed")]).toEqual([null, null, null]);
diff --git a/apps/web/src/features/overview/getting-started.ts b/apps/web/src/features/overview/getting-started.ts
index 915595455..adc43a39c 100644
--- a/apps/web/src/features/overview/getting-started.ts
+++ b/apps/web/src/features/overview/getting-started.ts
@@ -1,6 +1,5 @@
-import type { CoreHarness } from "@oac/agents-client";
+import type { AdminProject, CoreHarness } from "@oac/agents-client";
 
-import { type Project } from "../../lib/admin-view";
 import { nodeServingReady } from "../fleet/fleet-model";
 import { type FleetState } from "../fleet/use-sandbox-fleet";
 import { templateBuildStatus } from "../sandbox/deployment-specification";
@@ -20,9 +19,9 @@ export interface GettingStartedSteps {
   sandboxes: { state: StepState; action: SandboxAction; cloud: boolean };
   model: StepState;
   /** `project` is the active project a key would be issued for; null means create one first. */
-  key: { state: StepState; project: Project | null };
+  key: { state: StepState; project: AdminProject | null };
   /** `project` is the active project whose call samples the step opens; null leads to the project list. */
-  session: { state: StepState; project: Project | null };
+  session: { state: StepState; project: AdminProject | null };
 }
 
 export function gettingStartedSteps(input: {
@@ -32,7 +31,7 @@ export function gettingStartedSteps(input: {
   /** Undefined while reading; a failed installation read cannot confirm readiness. */
   localOnly?: boolean | "failed";
   /** Undefined until the project list is read. */
-  projects: readonly Project[] | "failed" | undefined;
+  projects: readonly AdminProject[] | "failed" | undefined;
   /** Sessions in every project, by Core's summary; null until it is read. */
   sessions: number | "failed" | null;
   /** Core's harnesses; undefined until they are read. */
@@ -87,13 +86,13 @@ export function modelStep(harnesses: readonly CoreHarness[] | "failed" | undefin
 }
 
 /** The newest of the projects, most likely the one just created. */
-function newestOf(projects: readonly Project[]): Project | null {
-  return projects.reduce<Project | null>((best, project) => (!best || project.created_at > best.created_at ? project : best), null);
+function newestOf(projects: readonly AdminProject[]): AdminProject | null {
+  return projects.reduce<AdminProject | null>((best, project) => (!best || Date.parse(project.created_at) > Date.parse(best.created_at) ? project : best), null);
 }
 
-function keyStep(projects: readonly Project[] | "failed" | undefined): GettingStartedSteps["key"] {
+function keyStep(projects: readonly AdminProject[] | "failed" | undefined): GettingStartedSteps["key"] {
   if (!projects || projects === "failed") return { state: projects ? "unknown" : null, project: null };
-  const active = projects.filter((project) => project.status === "active");
+  const active = projects.filter((project) => project.archived_at === null);
   if (active.some((project) => project.active_key_count > 0)) return { state: "done", project: null };
   return { state: "todo", project: newestOf(active) };
 }
@@ -102,9 +101,9 @@ function keyStep(projects: readonly Project[] | "failed" | undefined): GettingSt
  * Where the first Session's call samples are: the newest active project with
  * an active key, else the newest active project (whose page issues one).
  */
-function callProject(projects: readonly Project[] | "failed" | undefined): Project | null {
+function callProject(projects: readonly AdminProject[] | "failed" | undefined): AdminProject | null {
   if (!projects || projects === "failed") return null;
-  const active = projects.filter((project) => project.status === "active");
+  const active = projects.filter((project) => project.archived_at === null);
   return newestOf(active.filter((project) => project.active_key_count > 0)) ?? newestOf(active);
 }
 
diff --git a/apps/web/src/features/overview/overview-loader.ts b/apps/web/src/features/overview/overview-loader.ts
index eba9be5c2..5c3dffaae 100644
--- a/apps/web/src/features/overview/overview-loader.ts
+++ b/apps/web/src/features/overview/overview-loader.ts
@@ -1,8 +1,8 @@
-import type { AgentSession } from "@oac/agents-client";
+import type { AdminProject, AgentSession } from "@oac/agents-client";
 
 import { readProjectsSessions, type InProject, type ProjectReadFailure, type SessionLister } from "../metrics/project-sessions";
 import { activityStart, attentionCount, overviewReadDone, projectRows } from "./overview-model";
-import { type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 
 /** Most Sessions read per project for the 24-hour activity and the attention list. */
 export const OVERVIEW_SESSION_CAP = 1_000;
@@ -10,10 +10,10 @@ export const OVERVIEW_SESSION_CAP = 1_000;
 export interface OverviewSessions {
   sessions: InProject<AgentSession>[];
   /** Projects whose read stopped at the cap before covering the window or every Session needing attention. */
-  truncated: Project[];
+  truncated: AdminProject[];
   failures: ProjectReadFailure[];
   /** Failed projects whose previously read Sessions are retained. */
-  stale: Project[];
+  stale: AdminProject[];
 }
 
 export type OverviewSummary =
@@ -31,7 +31,7 @@ export interface OverviewData {
 
 export interface OverviewSource {
   summary: (signal: AbortSignal) => Promise<ProjectSummary[]>;
-  sessions: (project: Project) => SessionLister;
+  sessions: (project: AdminProject) => SessionLister;
 }
 
 /**
@@ -48,7 +48,7 @@ export function needsSessionRead(row: ProjectSummary | undefined, since: number)
 }
 
 export async function loadOverview(
-  projects: readonly Project[],
+  projects: readonly AdminProject[],
   source: OverviewSource,
   nowSeconds: number,
   signal: AbortSignal,
diff --git a/apps/web/src/features/overview/overview-model.test.ts b/apps/web/src/features/overview/overview-model.test.ts
index d431ef8a3..4834d0bf1 100644
--- a/apps/web/src/features/overview/overview-model.test.ts
+++ b/apps/web/src/features/overview/overview-model.test.ts
@@ -8,7 +8,6 @@ import {
   activityStart,
   attentionCount,
   attentionSessions,
-  coverageRatio,
   isGatewayOrNetworkFailure,
   overviewReadDone,
   projectUsageRows,
@@ -19,12 +18,10 @@ import {
   webApiReachable,
 } from "./overview-model";
 
-const usage = (total: number) => ({ input_tokens: total, output_tokens: 0, total_tokens: total, cached_tokens: 0, reasoning_tokens: 0 });
-
 describe("project usage rows", () => {
   it("joins every project with its summary row, active and recent first, missing rows as null", () => {
     const rows = projectUsageRows(
-      [project("old"), project("archived", { status: "archived" }), project("recent"), project("silent")],
+      [project("old"), project("archived", { archived_at: "1970-01-01T00:00:02Z" }), project("recent"), project("silent")],
       [
         summary("old", { last_active_at: 100 }),
         summary("recent", { last_active_at: 500 }),
@@ -37,22 +34,14 @@ describe("project usage rows", () => {
     expect(rows.find((row) => row.project.id === "silent")?.summary).toBeNull();
   });
 
-  it("adds up Session counts and keeps usage unknown when no project reported any", () => {
-    const withUsage = summaryTotals([
-      summary("a", { sessions: { total: 3, idle: 1, in_progress: 1, requires_action: 0, failed: 1 }, usage: usage(10), coverage: { sessions: 3, reported: 2 } }),
-      summary("b", { sessions: { total: 2, idle: 1, in_progress: 0, requires_action: 1, failed: 0 }, coverage: { sessions: 2, reported: 0 } }),
-      summary("a", { agent_id: "agent_a", sessions: { total: 50, idle: 50, in_progress: 0, requires_action: 0, failed: 0 }, usage: usage(99) }),
+  it("adds up the Session counts of project rows", () => {
+    const totals = summaryTotals([
+      summary("a", { sessions: { total: 3, idle: 1, in_progress: 1, requires_action: 0, failed: 1 } }),
+      summary("b", { sessions: { total: 2, idle: 1, in_progress: 0, requires_action: 1, failed: 0 } }),
+      summary("a", { agent_id: "agent_a", sessions: { total: 50, idle: 50, in_progress: 0, requires_action: 0, failed: 0 } }),
     ]);
-    expect(withUsage.sessions).toEqual({ total: 5, idle: 2, in_progress: 1, requires_action: 1, failed: 1 });
-    expect(withUsage.usage?.total_tokens).toBe(10);
-    expect(withUsage.coverage).toEqual({ sessions: 5, reported: 2 });
-    expect(attentionCount(withUsage.sessions)).toBe(2);
-    expect(summaryTotals([summary("b")]).usage).toBeNull();
-  });
-
-  it("reports coverage only when there are Sessions", () => {
-    expect(coverageRatio({ sessions: 4, reported: 3 })).toBe(0.75);
-    expect(coverageRatio({ sessions: 0, reported: 0 })).toBeNull();
+    expect(totals).toEqual({ total: 5, idle: 2, in_progress: 1, requires_action: 1, failed: 1 });
+    expect(attentionCount(totals)).toBe(2);
   });
 });
 
diff --git a/apps/web/src/features/overview/overview-model.ts b/apps/web/src/features/overview/overview-model.ts
index ef13afa7b..338f58a72 100644
--- a/apps/web/src/features/overview/overview-model.ts
+++ b/apps/web/src/features/overview/overview-model.ts
@@ -1,82 +1,50 @@
-import type { AgentSession } from "@oac/agents-client";
+import type { AdminProject, AgentSession } from "@oac/agents-client";
 
 import type { CapacitySummary } from "../fleet/fleet-model";
 import type { InProject } from "../metrics/project-sessions";
-import { type Project, type ProjectSummary } from "../../lib/admin-view";
+import { type ProjectSummary } from "../../lib/admin-view";
 
 /** Pure projections behind the Overview. Missing inputs stay null, never zero. */
 
-export interface SessionCounts {
-  total: number;
-  idle: number;
-  in_progress: number;
-  requires_action: number;
-  failed: number;
-}
-
-export type SummaryUsage = NonNullable<ProjectSummary["usage"]>;
+export type SessionCounts = ProjectSummary["sessions"];
 
 export interface ProjectUsageRow {
-  project: Project;
+  project: AdminProject;
   /** The project's `/summary` row, or null when Core returned none for it. */
   summary: ProjectSummary | null;
 }
 
 /** Project rows of a `/summary` response (Agent and key rows are skipped). */
 export function projectRows(summary: readonly ProjectSummary[]): ProjectSummary[] {
-  return summary.filter((row) => row.agent_id === null && !row.key);
+  return summary.filter((row) => row.agent_id === null && row.key_id === null);
 }
 
 /**
  * One row per project, joined with its `/summary` row. Active projects come
  * first, then the most recently active.
  */
-export function projectUsageRows(projects: readonly Project[], summary: readonly ProjectSummary[]): ProjectUsageRow[] {
+export function projectUsageRows(projects: readonly AdminProject[], summary: readonly ProjectSummary[]): ProjectUsageRow[] {
   const byProject = new Map(projectRows(summary).map((row) => [row.project_id, row]));
   return projects
     .map((project) => ({ project, summary: byProject.get(project.id) ?? null }))
     .sort((a, b) => (
-      Number(a.project.status === "archived") - Number(b.project.status === "archived")
+      Number(a.project.archived_at !== null) - Number(b.project.archived_at !== null)
       || (b.summary?.last_active_at ?? -1) - (a.summary?.last_active_at ?? -1)
       || a.project.name.localeCompare(b.project.name)
     ));
 }
 
-export interface SummaryTotals {
-  sessions: SessionCounts;
-  /** Sum over projects that reported usage; null when none did. */
-  usage: SummaryUsage | null;
-  coverage: { sessions: number; reported: number };
-}
-
-/** Totals over every project row. */
-export function summaryTotals(summary: readonly ProjectSummary[]): SummaryTotals {
+/** Session counts over every project row. */
+export function summaryTotals(summary: readonly ProjectSummary[]): SessionCounts {
   const sessions: SessionCounts = { total: 0, idle: 0, in_progress: 0, requires_action: 0, failed: 0 };
-  const coverage = { sessions: 0, reported: 0 };
-  let usage: SummaryUsage | null = null;
   for (const row of projectRows(summary)) {
     sessions.total += row.sessions.total;
     sessions.idle += row.sessions.idle;
     sessions.in_progress += row.sessions.in_progress;
     sessions.requires_action += row.sessions.requires_action;
     sessions.failed += row.sessions.failed;
-    coverage.sessions += row.coverage.sessions;
-    coverage.reported += row.coverage.reported;
-    if (row.usage) {
-      usage ??= { input_tokens: 0, output_tokens: 0, total_tokens: 0, cached_tokens: 0, reasoning_tokens: 0 };
-      usage.input_tokens += row.usage.input_tokens;
-      usage.output_tokens += row.usage.output_tokens;
-      usage.total_tokens += row.usage.total_tokens;
-      usage.cached_tokens += row.usage.cached_tokens;
-      usage.reasoning_tokens += row.usage.reasoning_tokens;
-    }
   }
-  return { sessions, usage, coverage };
-}
-
-/** Share of Sessions that reported usage; null when there are none. */
-export function coverageRatio(coverage: { sessions: number; reported: number }): number | null {
-  return coverage.sessions > 0 ? coverage.reported / coverage.sessions : null;
+  return sessions;
 }
 
 export function attentionCount(counts: Pick<SessionCounts, "failed" | "requires_action">): number {
diff --git a/apps/web/src/features/overview/overview-queries.ts b/apps/web/src/features/overview/overview-queries.ts
index 6440af462..5b95711b2 100644
--- a/apps/web/src/features/overview/overview-queries.ts
+++ b/apps/web/src/features/overview/overview-queries.ts
@@ -1,11 +1,12 @@
+import type { AdminProject } from "@oac/agents-client";
 import { queryOptions } from "@tanstack/react-query";
 
-import { loadSummary, type Project } from "../../lib/admin-view";
+import { loadSummary } from "../../lib/admin-view";
 import { projectClient } from "../../lib/projects";
 import { loadOverview, type OverviewData } from "./overview-loader";
 
 /** The Overview's summary and Session reads for the listed projects, keyed by their IDs. */
-export function overviewQuery(projects: readonly Project[]) {
+export function overviewQuery(projects: readonly AdminProject[]) {
   const queryKey = ["overview", projects.map((project) => project.id)];
   return queryOptions({
     queryKey,
diff --git a/apps/web/src/features/overview/test-fixtures.ts b/apps/web/src/features/overview/test-fixtures.ts
index 96ed55aac..e11dfcea3 100644
--- a/apps/web/src/features/overview/test-fixtures.ts
+++ b/apps/web/src/features/overview/test-fixtures.ts
@@ -1,10 +1,10 @@
-import type { AgentSession, SandboxNode } from "@oac/agents-client";
-import { type OwnedRuntimeObservation, type Project, type ProjectSummary } from "../../lib/admin-view";
+import type { AdminProject, AgentSession, SandboxNode } from "@oac/agents-client";
+import { type OwnedRuntimeObservation, type ProjectSummary } from "../../lib/admin-view";
 
 /** Fixtures shared by the Monitor page tests. Not part of the application bundle. */
 
-export function project(id: string, overrides: Partial<Project> = {}): Project {
-  return { id, name: id, status: "active", created_at: 1, archived_at: null, active_key_count: 1, ...overrides };
+export function project(id: string, overrides: Partial<AdminProject> = {}): AdminProject {
+  return { id, name: id, created_at: "1970-01-01T00:00:01Z", archived_at: null, active_key_count: 1, ...overrides };
 }
 
 export function summary(projectId: string, overrides: Partial<ProjectSummary> = {}): ProjectSummary {
@@ -16,7 +16,7 @@ export function summary(projectId: string, overrides: Partial<ProjectSummary> =
     assets: { agents: 1, skills: 0, environment_templates: 0, files: 0, vaults: 0, credentials: 0 },
     sessions: { total: 0, idle: 0, in_progress: 0, requires_action: 0, failed: 0 },
     usage: null,
-    coverage: { sessions: 0, reported: 0 },
+    coverage: { total_sessions: 0, measured_sessions: 0, ratio: null },
     last_active_at: null,
     ...overrides,
   };
diff --git a/apps/web/src/features/sandbox/NodeDetail.tsx b/apps/web/src/features/sandbox/NodeDetail.tsx
index 9483c0879..6425e9766 100644
--- a/apps/web/src/features/sandbox/NodeDetail.tsx
+++ b/apps/web/src/features/sandbox/NodeDetail.tsx
@@ -4,13 +4,13 @@ import { useTranslation } from "react-i18next";
 
 import { EmptyState, HelpTip, Kpi, KpiStrip, Section } from "../../components/console-ui";
 import { CopyableId } from "../../components/list-ui";
-import { formatDateTime, formatInteger, formatRelative, formatSpan, MISSING } from "../../lib/format";
+import { epochSeconds, formatDateTime, formatInteger, formatRelative, formatSpan, MISSING } from "../../lib/format";
 import { nodeProviderDiagnostic, sandboxDiagnosticMessage } from "../../lib/sandbox-diagnostic";
 import { sandboxStateLabel } from "../../lib/sandbox-labels";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
 import { NodeRolloutStatus } from "./NodeRolloutStatus";
 import { phaseTiming } from "./allocation-phase";
-import { nodeState, NodeStatus, OldAddressHint, seconds } from "./NodeList";
+import { nodeState, NodeStatus, OldAddressHint } from "./NodeList";
 
 /** Why a node is not serving: disconnected, or the reason its provider is not ready. */
 function nodeDiagnostic(node: SandboxNode): string {
@@ -73,14 +73,14 @@ export function NodeDetail({ node, allocations, coreUrl, targetGeneration, stale
         </div>
         <div>
           <dt>{t("Last seen")}</dt>
-          <dd title={node.last_seen_at ? formatDateTime(seconds(node.last_seen_at), locale) : undefined}>
-            {node.last_seen_at ? formatRelative(seconds(node.last_seen_at), now, locale) : t("Never")}
+          <dd title={node.last_seen_at ? formatDateTime(epochSeconds(node.last_seen_at), locale) : undefined}>
+            {node.last_seen_at ? formatRelative(epochSeconds(node.last_seen_at), now, locale) : t("Never")}
           </dd>
         </div>
         <div><dt>{t("Target generation")}</dt><dd>{targetGeneration ?? MISSING}</dd></div>
         <div><dt>{t("Target preparation")}</dt><dd><NodeRolloutStatus node={node} stale={stale} /></dd></div>
         <div><dt>{t("Serving generation")}<HelpTip>{t("The saved serving generation is not proof that this node is online, ready or has free capacity.")}</HelpTip></dt><dd>{node.rollout.ready_generation ?? MISSING}</dd></div>
-        <div><dt>{t("Added")}</dt><dd>{formatDateTime(seconds(node.created_at), locale)}</dd></div>
+        <div><dt>{t("Added")}</dt><dd>{formatDateTime(epochSeconds(node.created_at), locale)}</dd></div>
       </dl>
 
       {/* Cleanup and host resources are on Sandbox metrics; the node's limit is here as well, beside Edit node that sets it. */}
@@ -123,7 +123,7 @@ export function NodeDetail({ node, allocations, coreUrl, targetGeneration, stale
                     <td>{allocation.compute_phase ? sandboxStateLabel(allocation.compute_phase, shortLocale) : MISSING}</td>
                     {suspension ? <PhaseTime allocation={allocation} retentionSeconds={suspension.retention_seconds} now={now} /> : null}
                     <td>{allocation.diagnostic ? <Diagnostic value={allocation.diagnostic} /> : MISSING}</td>
-                    <td className="nodes-nowrap">{formatDateTime(seconds(allocation.created_at), locale)}</td>
+                    <td className="nodes-nowrap">{formatDateTime(epochSeconds(allocation.created_at), locale)}</td>
                   </tr>
                 ))}
               </tbody>
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index 9a1ef808a..8247faea1 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -96,7 +96,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   const backend = sandboxProviderLabel(deployment.provider, locale);
   // Nodes and their sandboxes reach Core at its public URL, so a loopback one serves no other machine;
   // and without the provider's node files the installer would fail on the host. Either way no command
-  // is issued, nor before the installation is read: a failed read (an older Core, say) proves nothing.
+  // is issued, nor before the installation is read: a failed read proves nothing about the address.
   const blocker: { text: string; failed?: boolean } | null = deployment.reset
     ? { text: t("Node enrollment is paused while reset is in progress.") }
     : !fresh
diff --git a/apps/web/src/features/sandbox/NodeList.tsx b/apps/web/src/features/sandbox/NodeList.tsx
index b5c4fd979..055c9b700 100644
--- a/apps/web/src/features/sandbox/NodeList.tsx
+++ b/apps/web/src/features/sandbox/NodeList.tsx
@@ -3,7 +3,7 @@ import { useTranslation } from "react-i18next";
 
 import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
 import { NameCell, RowActions } from "../../components/list-ui";
-import { formatDateTime, formatRelative } from "../../lib/format";
+import { epochSeconds, formatDateTime, formatRelative } from "../../lib/format";
 import type { MessageKey } from "../../lib/locale-strings";
 import { nodeProviderDiagnostic } from "../../lib/sandbox-diagnostic";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
@@ -56,12 +56,6 @@ export function OldAddressHint() {
   return <span className="node-status-hint">{t("Remove and add again")}</span>;
 }
 
-export function seconds(value: string | null): number | null {
-  if (!value) return null;
-  const parsed = Date.parse(value);
-  return Number.isNaN(parsed) ? null : Math.floor(parsed / 1000);
-}
-
 export function NodeList({ nodes, allocations, coreUrl, stale, disabled, suspends = false, onOpen, onRemove }: {
   nodes: readonly SandboxNode[];
   /** The deployment's address; a node enrolled with another one is on an old address. */
@@ -111,10 +105,10 @@ export function NodeList({ nodes, allocations, coreUrl, stale, disabled, suspend
                 </td>
                 <td className="numeric">{node.active} / {node.max_active}</td>
                 {suspends ? <td className="numeric">{suspendedSandboxes(node)}</td> : null}
-                <td className="numeric" title={node.last_seen_at ? formatDateTime(seconds(node.last_seen_at), locale) : undefined}>
-                  {node.last_seen_at ? formatRelative(seconds(node.last_seen_at), now, locale) : t("Never")}
+                <td className="numeric" title={node.last_seen_at ? formatDateTime(epochSeconds(node.last_seen_at), locale) : undefined}>
+                  {node.last_seen_at ? formatRelative(epochSeconds(node.last_seen_at), now, locale) : t("Never")}
                 </td>
-                <td className="nodes-nowrap">{formatDateTime(seconds(node.created_at), locale)}</td>
+                <td className="nodes-nowrap">{formatDateTime(epochSeconds(node.created_at), locale)}</td>
                 <td className="actions-cell">
                   <RowActions>
                     <button className="text-action danger" type="button" disabled={disabled} aria-label={t("Remove {{name}}", { name })} onClick={() => onRemove(node)}>
diff --git a/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx b/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
index b764877a8..6ce5664a3 100644
--- a/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
+++ b/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
@@ -12,7 +12,7 @@ import { Modal } from "../../components/Modal";
 import { TableSkeleton } from "../../components/Skeleton";
 import { failedLast, useFailureToast, useToast } from "../../components/Toast";
 import { useDeleteFlow } from "../../lib/delete-flow";
-import { formatDateTime, shortId } from "../../lib/format";
+import { epochSeconds, formatDateTime, shortId } from "../../lib/format";
 import { admin, useProjects } from "../../lib/projects";
 import { ExecutorInstallPanel, useExecutorInstall } from "./ExecutorInstallPanel";
 import { CredentialFile } from "./executor-credential-file";
@@ -54,10 +54,6 @@ function sameKey(a: string, b: string): boolean {
   return a.toLowerCase() === b.toLowerCase();
 }
 
-function seconds(value: string | null): number | null {
-  return value === null ? null : Math.floor(Date.parse(value) / 1000);
-}
-
 /**
  * Executor credentials of a self-hosted Session's environment: Core issues,
  * rotates and revokes them with the deployment's Core key. An issued
@@ -78,7 +74,7 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
   const locale = i18n.resolvedLanguage;
   const toast = useToast();
   const { byId, refresh: refreshProjects } = useProjects();
-  const archived = byId.get(projectId)?.status === "archived";
+  const archived = Boolean(byId.get(projectId)?.archived_at);
   const install = useExecutorInstall(projectId, environmentId, archived);
   const query = useQuery(executorConnectionQuery(projectId, sessionId, environmentId));
   const credentials = query.data?.data ?? null;
@@ -253,11 +249,11 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
                       <HelpTip>{t(revoked ? "executor.connection.restore" : "executor.connection.bound", { id })}</HelpTip>
                     </span> : null}
                   </span></th>
-                  <td className="session-nowrap">{formatDateTime(seconds(credential.created_at), locale)}</td>
+                  <td className="session-nowrap">{formatDateTime(epochSeconds(credential.created_at), locale)}</td>
                   <td>
                     <span className="executor-credential-status">
                       <StatusDot tone={revoked ? "neutral" : "ok"} label={revoked ? t("executor.status.revoked") : t("executor.status.active")} />
-                      {revoked ? <span className="executor-credential-date">{formatDateTime(seconds(credential.revoked_at), locale)}</span> : null}
+                      {revoked ? <span className="executor-credential-date">{formatDateTime(epochSeconds(credential.revoked_at), locale)}</span> : null}
                     </span>
                   </td>
                   <td className="actions-cell">
diff --git a/apps/web/src/features/sessions/SessionDeleteDialog.tsx b/apps/web/src/features/sessions/SessionDeleteDialog.tsx
index 388af654b..52a6ce180 100644
--- a/apps/web/src/features/sessions/SessionDeleteDialog.tsx
+++ b/apps/web/src/features/sessions/SessionDeleteDialog.tsx
@@ -1,4 +1,4 @@
-import { AgentCoreError, isSessionDeletionConflict } from "@oac/agents-client";
+import { type AdminProject, AgentCoreError, isSessionDeletionConflict } from "@oac/agents-client";
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 
@@ -6,10 +6,9 @@ import { ConfirmDialog } from "../../components/ConfirmDialog";
 import { useToast } from "../../components/Toast";
 import { projectClient } from "../../lib/projects";
 import { shortId } from "../../lib/format";
-import { type Project } from "../../lib/admin-view";
 
 export interface SessionDeleteTarget {
-  project: Project;
+  project: AdminProject;
   sessionId: string;
 }
 
diff --git a/apps/web/src/features/sessions/SessionLogPage.tsx b/apps/web/src/features/sessions/SessionLogPage.tsx
index 53cf494e0..f4ecc097e 100644
--- a/apps/web/src/features/sessions/SessionLogPage.tsx
+++ b/apps/web/src/features/sessions/SessionLogPage.tsx
@@ -1,4 +1,4 @@
-import type { AgentSession } from "@oac/agents-client";
+import type { AdminProject, AgentSession } from "@oac/agents-client";
 import { MessageSquareText } from "lucide-react";
 import { useEffect, useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
@@ -25,7 +25,6 @@ import {
   type SessionLogFilters,
 } from "./session-log";
 import "./sessions.css";
-import { type Project } from "../../lib/admin-view";
 import { collections, queryClient } from "../../lib/queries";
 import { forgetDeleted } from "../resources/detail-queries";
 import { sessionKey } from "./session-queries";
@@ -238,7 +237,7 @@ function SessionLogRow({
   now: number;
   locale: string | undefined;
   onOpen: (projectId: string, sessionId: string) => void;
-  onDelete: (target: { project: Project; sessionId: string }) => void;
+  onDelete: (target: { project: AdminProject; sessionId: string }) => void;
 }) {
   const { t } = useTranslation("sessions");
   const projectCell = allProjects ? <td><ProjectName project={row.project} /></td> : null;
diff --git a/apps/web/src/features/sessions/executor-credential-ownership.test.tsx b/apps/web/src/features/sessions/executor-credential-ownership.test.tsx
index e10fa04cc..4295269c9 100644
--- a/apps/web/src/features/sessions/executor-credential-ownership.test.tsx
+++ b/apps/web/src/features/sessions/executor-credential-ownership.test.tsx
@@ -9,7 +9,7 @@ import { executorConnectionQuery } from "./executor-connection-query";
 const project = vi.hoisted(() => ({ archived: false }));
 vi.mock("../../lib/projects", async (original) => ({
   ...await original<typeof import("../../lib/projects")>(),
-  useProjects: () => ({ byId: new Map([["project", { status: project.archived ? "archived" : "active" }]]), refresh: () => undefined }),
+  useProjects: () => ({ byId: new Map([["project", { archived_at: project.archived ? "2026-09-28T04:00:00Z" : null }]]), refresh: () => undefined }),
 }));
 vi.mock("./ExecutorInstallPanel", () => ({
   useExecutorInstall: () => ({ kind: "unavailable" }),
diff --git a/apps/web/src/features/sessions/session-log.test.ts b/apps/web/src/features/sessions/session-log.test.ts
index 8f12ae19e..419469c31 100644
--- a/apps/web/src/features/sessions/session-log.test.ts
+++ b/apps/web/src/features/sessions/session-log.test.ts
@@ -1,9 +1,8 @@
 import { describe, expect, it } from "vitest";
 
-import type { AgentSession, ListPage } from "@oac/agents-client";
+import type { AdminProject, AgentSession, ListPage } from "@oac/agents-client";
 
 import type { Owned } from "../../lib/projects";
-import { type Project } from "../../lib/admin-view";
 import {
   agentOptions,
   environmentKind,
@@ -16,8 +15,8 @@ import {
   type SessionLogFilters,
 } from "./session-log";
 
-function project(id: string, name: string): Project {
-  return { id, name, status: "active", created_at: 1, archived_at: null, active_key_count: 1 };
+function project(id: string, name: string): AdminProject {
+  return { id, name, created_at: "1970-01-01T00:00:01Z", archived_at: null, active_key_count: 1 };
 }
 
 const production = project("proj_prod", "Production");
@@ -52,7 +51,7 @@ function session(id: string, overrides: Partial<AgentSession> & { agentId?: stri
   };
 }
 
-function row(owner: Project, value: AgentSession): Owned<AgentSession> {
+function row(owner: AdminProject, value: AgentSession): Owned<AgentSession> {
   return { project: owner, value };
 }
 
diff --git a/apps/web/src/i18n/locales/en/keys.ts b/apps/web/src/i18n/locales/en/keys.ts
index 5f15a8187..d7d438205 100644
--- a/apps/web/src/i18n/locales/en/keys.ts
+++ b/apps/web/src/i18n/locales/en/keys.ts
@@ -172,12 +172,11 @@ export const keys = {
   },
   operations: {
     title: "Write operations",
-    help: "Every successful write in this project, with the key that made it, recorded by Core, newest first. Reads are not recorded; request bodies and secrets are never stored. Unknown: no recorded key.",
+    help: "Every successful write in this project, with the key that made it, recorded by Core, newest first. Reads are not recorded; request bodies and secrets are never stored.",
     filterLabel: "Filter write operations",
     allTypes: "All resources",
     allKeys: "All keys",
     revokedKeyOption: "{{name}} · revoked",
-    unknownKey: "Unknown",
     columns: {
       time: "Time",
       action: "Action",
diff --git a/apps/web/src/i18n/locales/zh-CN/keys.ts b/apps/web/src/i18n/locales/zh-CN/keys.ts
index b5340bd6a..6879216fb 100644
--- a/apps/web/src/i18n/locales/zh-CN/keys.ts
+++ b/apps/web/src/i18n/locales/zh-CN/keys.ts
@@ -174,12 +174,11 @@ export const keys: TranslationShape<typeof english> = {
   },
   operations: {
     title: "写操作记录",
-    help: "这个项目里每一次成功的写操作，以及发起它的 key，由 Core 记录，按时间倒序。读操作不记录，也不保存请求内容和密钥。“未知”表示没有记录 key。",
+    help: "这个项目里每一次成功的写操作，以及发起它的 key，由 Core 记录，按时间倒序。读操作不记录，也不保存请求内容和密钥。",
     filterLabel: "筛选写操作记录",
     allTypes: "全部资源",
     allKeys: "全部 key",
     revokedKeyOption: "{{name}} · 已撤销",
-    unknownKey: "未知",
     columns: {
       time: "时间",
       action: "操作",
diff --git a/apps/web/src/lib/admin-view.ts b/apps/web/src/lib/admin-view.ts
index 86c5a3154..258dae7be 100644
--- a/apps/web/src/lib/admin-view.ts
+++ b/apps/web/src/lib/admin-view.ts
@@ -6,135 +6,37 @@ import {
   type AdminResourceType,
   type AdminRuntimeObservation,
   type AdminSummaryEntry,
-  type AdminWriteOperation,
-  type RuntimeObservation,
+  type AdminWriteOperationOptions,
+  type AdminWriteOperationPage,
 } from "@oac/agents-client";
 
 /**
- * View models over the typed management client (`AdminClient`, `/core/v1`).
- * Pages format Unix seconds and never treat missing data as zero, so this
- * layer converts RFC 3339 timestamps, resolves creating keys by name, walks
- * cursor pages and turns an unmeasured usage sum into `null`.
+ * Reads over the typed management client (`AdminClient`, `/core/v1`): they
+ * walk cursor pages, resolve the creating key of summary key rows and turn an
+ * unmeasured usage sum into `null`, so pages never treat missing data as zero.
  */
 export const admin = new AdminClient();
 
-export type ProjectStatus = "active" | "archived";
-
-export interface Project {
-  id: string;
-  name: string;
-  status: ProjectStatus;
-  /** Unix seconds. */
-  created_at: number;
-  archived_at: number | null;
-  active_key_count: number;
-}
-
-export interface AdminKey {
-  id: string;
-  project_id: string;
-  name: string;
-  prefix: string;
-  created_at: number;
-  revoked_at: number | null;
-}
-
-export interface AdminIssuedKey extends AdminKey {
-  /** Plaintext returned once by issuance; never stored. */
-  key: string;
-}
-
-/** The key recorded for a write or a resource's creation. */
-export interface KeyRef {
-  id: string;
-  name: string | null;
-  prefix: string | null;
-  revoked_at: number | null;
-}
-
-/** Who created a resource: a key, or null when Core has no creation record. */
-export interface Creator {
-  key: KeyRef | null;
-}
-
-export interface SpaceUsage {
-  input_tokens: number;
-  output_tokens: number;
-  total_tokens: number;
-  cached_tokens: number;
-  reasoning_tokens: number;
-}
-
-export interface ProjectSummary {
-  project_id: string;
-  agent_id: string | null;
-  /** Key rows: the creating key's ID; null groups Sessions with unknown provenance. */
-  key_id: string | null;
-  /** Key rows: the creating key resolved by name, or null when unknown. */
-  key: KeyRef | null;
-  assets: { agents: number; skills: number; environment_templates: number; files: number; vaults: number; credentials: number } | null;
-  sessions: { total: number; idle: number; in_progress: number; requires_action: number; failed: number };
+/** A summary row; a key row carries its key when the project's key list holds it. */
+export type ProjectSummary = Omit<AdminSummaryEntry, "usage"> & {
+  key: AdminAPIKey | null;
   /** null when no Session in the group reported usage. */
-  usage: SpaceUsage | null;
-  /** Sessions in range (denominator) and those that reported usage. */
-  coverage: { sessions: number; reported: number };
-  last_active_at: number | null;
-}
+  usage: AdminSummaryEntry["usage"] | null;
+};
 
-export interface WriteOperation {
-  id: string;
-  created_at: number;
-  api_key: KeyRef | null;
-  action: string;
-  resource_type: string;
-  resource_id: string;
-  parent_id: string;
-  request_id: string;
-  trace_id: string;
-}
-
-/** A Runtime observation with its project; the administrator list adds disk (E2B only, null elsewhere). */
-export type OwnedRuntimeObservation = RuntimeObservation & { project_id: string; disk?: AdminRuntimeObservation["observation"]["disk"] };
-export const ownerResourceTypes = ["agent", "session", "environment", "environment_template", "skill", "skill_version", "file", "vault", "credential", "artifact"] as const satisfies readonly AdminResourceType[];
-export type OwnerResourceType = AdminResourceType;
+/** A Runtime observation with its project; disk is E2B-only and null elsewhere. */
+export type OwnedRuntimeObservation = AdminRuntimeObservation["observation"] & { project_id: string };
 
 const PAGE = 100;
 /** Bounded walks: a deployment has a handful of projects and keys. */
 const MAX_PAGES = 100;
 
-function seconds(value: string): number {
-  return Math.floor(Date.parse(value) / 1000);
-}
-function maybeSeconds(value: string | null): number | null {
-  return value === null ? null : seconds(value);
-}
-
-export function projectView(project: AdminProject): Project {
-  return {
-    id: project.id,
-    name: project.name,
-    status: project.archived_at === null ? "active" : "archived",
-    created_at: seconds(project.created_at),
-    archived_at: maybeSeconds(project.archived_at),
-    active_key_count: project.active_key_count,
-  };
-}
-
-function keyView(key: AdminAPIKey): AdminKey {
-  return { ...key, created_at: seconds(key.created_at), revoked_at: maybeSeconds(key.revoked_at) };
-}
-
-function keyRef(key: AdminKeyProvenance | null): KeyRef | null {
-  if (!key) return null;
-  return { id: key.id, name: key.name || null, prefix: key.prefix || null, revoked_at: maybeSeconds(key.revoked_at) };
-}
-
-export async function listAllProjects(signal?: AbortSignal): Promise<Project[]> {
-  const projects: Project[] = [];
+export async function listAllProjects(signal?: AbortSignal): Promise<AdminProject[]> {
+  const projects: AdminProject[] = [];
   let after: string | undefined;
   for (let page = 0; page < MAX_PAGES; page += 1) {
     const result = await admin.listProjects({ after, limit: PAGE, order: "asc", signal });
-    projects.push(...result.data.map(projectView));
+    projects.push(...result.data);
     const last = result.data.at(-1)?.id;
     if (!result.has_more || !last) break;
     after = last;
@@ -142,23 +44,12 @@ export async function listAllProjects(signal?: AbortSignal): Promise<Project[]>
   return projects;
 }
 
-export async function createProject(name: string, signal?: AbortSignal): Promise<Project> {
-  return projectView(await admin.createProject({ name }, { signal }));
-}
-export async function renameProject(projectId: string, name: string, signal?: AbortSignal): Promise<Project> {
-  return projectView(await admin.renameProject(projectId, { name }, { signal }));
-}
-/** Revokes every key of the project; its assets stay viewable. */
-export async function archiveProject(projectId: string, signal?: AbortSignal): Promise<Project> {
-  return projectView(await admin.archiveProject(projectId, { signal }));
-}
-
-export async function listKeys(projectId: string, signal?: AbortSignal): Promise<AdminKey[]> {
-  const keys: AdminKey[] = [];
+export async function listKeys(projectId: string, signal?: AbortSignal): Promise<AdminAPIKey[]> {
+  const keys: AdminAPIKey[] = [];
   let after: string | undefined;
   for (let page = 0; page < MAX_PAGES; page += 1) {
     const result = await admin.listAPIKeys(projectId, { after, limit: PAGE, signal });
-    keys.push(...result.data.map(keyView));
+    keys.push(...result.data);
     const last = result.data.at(-1)?.id;
     if (!result.has_more || !last) break;
     after = last;
@@ -166,40 +57,6 @@ export async function listKeys(projectId: string, signal?: AbortSignal): Promise
   return keys;
 }
 
-/** Issues a named key; the plaintext exists only in this result. */
-export async function issueKey(projectId: string, name: string, signal?: AbortSignal): Promise<AdminIssuedKey> {
-  const issued = await admin.issueAPIKey(projectId, { name }, { signal });
-  return { ...keyView(issued), key: issued.key };
-}
-export async function revokeKey(projectId: string, keyId: string, signal?: AbortSignal): Promise<void> {
-  await admin.revokeAPIKey(projectId, keyId, { signal });
-}
-
-function summaryView(entry: AdminSummaryEntry, keys: ReadonlyMap<string, AdminKey>): ProjectSummary {
-  const measured = entry.coverage.measured_sessions;
-  const key = entry.key_id ? keys.get(entry.key_id) : undefined;
-  return {
-    project_id: entry.project_id,
-    agent_id: entry.agent_id,
-    key_id: entry.key_id,
-    key: entry.key_id
-      ? { id: entry.key_id, name: key?.name ?? null, prefix: key?.prefix ?? null, revoked_at: key?.revoked_at ?? null }
-      : null,
-    assets: entry.assets,
-    sessions: entry.sessions,
-    // Unmeasured Sessions add no tokens; an all-unmeasured group has no usage, not zero.
-    usage: measured === 0 ? null : {
-      input_tokens: entry.usage.input_tokens,
-      output_tokens: entry.usage.output_tokens,
-      total_tokens: entry.usage.total_tokens,
-      cached_tokens: entry.usage.input_tokens_details.cached_tokens,
-      reasoning_tokens: entry.usage.output_tokens_details.reasoning_tokens,
-    },
-    coverage: { sessions: entry.coverage.total_sessions, reported: measured },
-    last_active_at: entry.last_active_at,
-  };
-}
-
 export interface SummaryQuery {
   group_by?: "project" | "agent" | "key";
   project_id?: string;
@@ -210,7 +67,7 @@ export interface SummaryQuery {
   signal?: AbortSignal;
 }
 
-/** Every summary row for the query; key rows carry the creating key's name. */
+/** Every summary row for the query; key rows carry the creating key. */
 export async function loadSummary(query: SummaryQuery = {}): Promise<ProjectSummary[]> {
   const entries: AdminSummaryEntry[] = [];
   let after: string | undefined;
@@ -228,48 +85,35 @@ export async function loadSummary(query: SummaryQuery = {}): Promise<ProjectSumm
     if (!result.has_more || !result.next_cursor) break;
     after = result.next_cursor;
   }
-  const keys = new Map<string, AdminKey>();
+  const keys = new Map<string, AdminAPIKey>();
   if (query.group_by === "key") {
     const projectIds = [...new Set(entries.filter((entry) => entry.key_id).map((entry) => entry.project_id))];
     const lists = await Promise.allSettled(projectIds.map((projectId) => listKeys(projectId, query.signal)));
     for (const list of lists) if (list.status === "fulfilled") for (const key of list.value) keys.set(key.id, key);
   }
-  return entries.map((entry) => summaryView(entry, keys));
+  return entries.map((entry) => ({
+    ...entry,
+    key: entry.key_id === null ? null : keys.get(entry.key_id) ?? null,
+    // Unmeasured Sessions add no tokens; an all-unmeasured group has no usage, not zero.
+    usage: entry.coverage.measured_sessions === 0 ? null : entry.usage,
+  }));
 }
 
-export interface WriteOperationQuery {
-  key_id?: string;
-  resource_type?: AdminResourceType;
-  resource_id?: string;
-  after?: string;
-  limit?: number;
-  signal?: AbortSignal;
-}
+export type WriteOperationQuery = Pick<AdminWriteOperationOptions, "key_id" | "resource_type" | "resource_id" | "after" | "limit" | "signal">;
 
-function operationView(operation: AdminWriteOperation): WriteOperation {
-  return { ...operation, created_at: seconds(operation.created_at), api_key: keyRef(operation.api_key) };
+export async function listWriteOperations(projectId: string, query: WriteOperationQuery = {}): Promise<AdminWriteOperationPage> {
+  const page = await admin.listWriteOperations(projectId, { ...query, limit: query.limit ?? 50 });
+  return { ...page, has_more: page.has_more && page.next_cursor !== "" };
 }
 
-export async function listWriteOperations(projectId: string, query: WriteOperationQuery = {}): Promise<{ data: WriteOperation[]; has_more: boolean; next_cursor: string }> {
-  const page = await admin.listWriteOperations(projectId, {
-    key_id: query.key_id,
-    resource_type: query.resource_type,
-    resource_id: query.resource_id,
-    after: query.after,
-    limit: query.limit ?? 50,
-    signal: query.signal,
-  });
-  return { data: page.data.map(operationView), has_more: page.has_more && page.next_cursor !== "", next_cursor: page.next_cursor };
-}
-
-/** Creators of up to any number of resources of one project, in batches of 100. */
-export async function listCreators(projectId: string, type: OwnerResourceType, ids: readonly string[], signal?: AbortSignal): Promise<Map<string, Creator>> {
+/** Creators of any number of resources of one project, in batches of 100; null when Core has no creation record. */
+export async function listCreators(projectId: string, type: AdminResourceType, ids: readonly string[], signal?: AbortSignal): Promise<Map<string, AdminKeyProvenance | null>> {
   const unique = [...new Set(ids)];
-  const creators = new Map<string, Creator>();
+  const creators = new Map<string, AdminKeyProvenance | null>();
   for (let start = 0; start < unique.length; start += PAGE) {
     const batch = unique.slice(start, start + PAGE);
     const result = await admin.retrieveResourceOwners(projectId, type, batch, { signal });
-    for (const owner of result.data) creators.set(owner.resource_id, { key: keyRef(owner.api_key) });
+    for (const owner of result.data) creators.set(owner.resource_id, owner.api_key);
   }
   return creators;
 }
@@ -286,11 +130,3 @@ export async function listRuntimeObservations(signal?: AbortSignal): Promise<Own
   }
   return observations;
 }
-
-export function isProjectName(value: string): boolean {
-  return value.trim() === value && [...value].length >= 1 && [...value].length <= 128 && !/[\u0000-\u001f\u007f]/.test(value);
-}
-
-export function isKeyName(value: string): boolean {
-  return value.trim() === value && [...value].length >= 1 && [...value].length <= 80 && !/[\u0000-\u001f\u007f]/.test(value);
-}
diff --git a/apps/web/src/lib/format.ts b/apps/web/src/lib/format.ts
index c2b1fb7f2..b9e28984f 100644
--- a/apps/web/src/lib/format.ts
+++ b/apps/web/src/lib/format.ts
@@ -56,6 +56,13 @@ export function formatCores(value: number | null | undefined, locale?: string):
   return value.toLocaleString(locale, { maximumFractionDigits: value < 10 ? 2 : 1 });
 }
 
+/** Unix seconds of an RFC 3339 timestamp, for the formatters below; null when absent or unparseable. */
+export function epochSeconds(value: string | null | undefined): number | null {
+  if (!value) return null;
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? null : Math.floor(parsed / 1000);
+}
+
 /** Date and time; the year is left out for dates in the current year. */
 export function formatDateTime(epochSeconds: number | null | undefined, locale?: string, now: Date = new Date()): string {
   if (epochSeconds === null || epochSeconds === undefined || !Number.isFinite(epochSeconds)) return MISSING;
diff --git a/apps/web/src/lib/projects.tsx b/apps/web/src/lib/projects.tsx
index b8ac7df0d..c5dc0e10f 100644
--- a/apps/web/src/lib/projects.tsx
+++ b/apps/web/src/lib/projects.tsx
@@ -1,8 +1,8 @@
 import type {
-  AgentDeleted, AgentSession, AgentTurn, EnvironmentTemplateDeleted, EnvironmentTemplateList, EnvironmentTemplateResource, ListPage, PageOptions, ReadOptions,
-  RuntimeHistory, RuntimeHistoryQuery, RuntimeObservation, SavedAgent, SessionDeleted, SessionItem, SessionListOptions, Skill, SkillContent, SkillDeleted, SkillList,
-  SkillListOptions, SkillVersionDeleted, SkillVersionList, SourceFileDeleted, SourceFileList, SourceFileListOptions, Vault, VaultCredentialDeleted,
-  VaultCredentialList, VaultDeleted, VaultList, VaultListOptions,
+  AdminKeyProvenance, AdminProject, AdminResourceType, AgentDeleted, AgentSession, AgentTurn, EnvironmentTemplateDeleted, EnvironmentTemplateList,
+  EnvironmentTemplateResource, ListPage, PageOptions, ReadOptions, RuntimeHistory, RuntimeHistoryQuery, RuntimeObservation, SavedAgent, SessionDeleted,
+  SessionItem, SessionListOptions, Skill, SkillContent, SkillDeleted, SkillList, SkillListOptions, SkillVersionDeleted, SkillVersionList, SourceFileDeleted,
+  SourceFileList, SourceFileListOptions, Vault, VaultCredentialDeleted, VaultCredentialList, VaultDeleted, VaultList, VaultListOptions,
 } from "@oac/agents-client";
 import { QueryClientProvider, useQueries, useQuery, useQueryClient } from "@tanstack/react-query";
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
@@ -11,11 +11,10 @@ import { useTranslation } from "react-i18next";
 import { readError } from "./read-error";
 import { ConsoleSelect } from "../components/console-select";
 import { HelpTip } from "../components/console-ui";
-import { admin, listCreators, type Creator, type OwnerResourceType, type Project } from "./admin-view";
+import { admin, listCreators } from "./admin-view";
 import { collectionQuery, projectsQuery, queryClient, type CollectionSpec } from "./queries";
 
 export { admin };
-export type { Project };
 
 /**
  * The console reaches Core only through the Web API (`/core/v1`). A
@@ -24,14 +23,14 @@ export type { Project };
  */
 
 export type ProjectsState =
-  | { status: "loading"; projects: Project[]; error: null }
-  | { status: "ready"; projects: Project[]; error: null }
-  | { status: "failed"; projects: Project[]; error: string };
+  | { status: "loading"; projects: AdminProject[]; error: null }
+  | { status: "ready"; projects: AdminProject[]; error: null }
+  | { status: "failed"; projects: AdminProject[]; error: string };
 
 interface ProjectsContextValue {
   state: ProjectsState;
   refresh: () => void;
-  byId: ReadonlyMap<string, Project>;
+  byId: ReadonlyMap<string, AdminProject>;
   /** Why the last refresh failed while earlier projects stay on screen. */
   refreshError: string | null;
   /** Original query failure for classification; translated display text is never evidence. */
@@ -84,30 +83,30 @@ export function ProjectFilter({ value, onChange, includeAll = true }: { value: P
     ...(includeAll ? [{ value: "", label: t("project.all") }] : []),
     ...state.projects.map((project) => ({
       value: project.id,
-      label: project.status === "archived" ? t("project.archivedOption", { name: project.name }) : project.name,
+      label: project.archived_at !== null ? t("project.archivedOption", { name: project.name }) : project.name,
     })),
   ], [includeAll, state.projects, t]);
   return <ConsoleSelect value={value} onChange={onChange} options={options} label={t("project.filter")} />;
 }
 
 /** The project a row belongs to when a table shows every project. */
-export function ProjectName({ project }: { project: Project | undefined }) {
+export function ProjectName({ project }: { project: AdminProject | undefined }) {
   const { t } = useTranslation("common");
   if (!project) return <span className="table-muted">—</span>;
   return (
-    <span className={project.status === "archived" ? "space-name space-disabled" : "space-name"} title={project.status === "archived" ? t("project.archived") : undefined}>
+    <span className={project.archived_at !== null ? "space-name space-disabled" : "space-name"} title={project.archived_at !== null ? t("project.archived") : undefined}>
       {project.name}
     </span>
   );
 }
 
 export interface Owned<T> {
-  project: Project;
+  project: AdminProject;
   value: T;
 }
 
 export interface ProjectFailure {
-  project: Project;
+  project: AdminProject;
   message: string;
 }
 
@@ -221,7 +220,7 @@ export function useProjectCollection<T>(spec: CollectionSpec<T>, filter: Project
   });
   // `items` keeps its identity until a project's cached data changes, so pages
   // may depend on it in effects and memos without re-running on every render.
-  const cache = useRef<{ targets: readonly Project[]; sources: readonly (T[] | undefined)[]; items: Owned<T>[] } | null>(null);
+  const cache = useRef<{ targets: readonly AdminProject[]; sources: readonly (T[] | undefined)[]; items: Owned<T>[] } | null>(null);
   const sources = results.map((result) => result.data);
   const previous = cache.current;
   let items: Owned<T>[];
@@ -262,9 +261,9 @@ export async function readAllPages<T extends { id: string }>(
   return values;
 }
 
-/** Creator lookups are cached per project and resource; a refresh forgets them. */
-const creatorCache = new Map<string, Creator>();
-const creatorKey = (type: OwnerResourceType, projectId: string, id: string) => `${type}:${projectId}:${id}`;
+/** Creator lookups are cached per project and resource (null when Core has no creation record); a refresh forgets them. */
+const creatorCache = new Map<string, AdminKeyProvenance | null>();
+const creatorKey = (type: AdminResourceType, projectId: string, id: string) => `${type}:${projectId}:${id}`;
 let creatorGeneration = 0;
 const creatorListeners = new Set<(generation: number) => void>();
 
@@ -277,11 +276,11 @@ export function forgetCreators() {
 
 export interface Creators {
   /** undefined: not loaded yet or the lookup failed. */
-  creatorOf: (projectId: string, id: string) => Creator | undefined;
+  creatorOf: (projectId: string, id: string) => AdminKeyProvenance | null | undefined;
 }
 
 /** The key that created each row (#87 ownership), batched per project. */
-export function useCreators(type: OwnerResourceType, rows: ReadonlyArray<{ projectId: string; id: string }>): Creators {
+export function useCreators(type: AdminResourceType, rows: ReadonlyArray<{ projectId: string; id: string }>): Creators {
   const [, setVersion] = useState(0);
   const [generation, setGeneration] = useState(creatorGeneration);
   useEffect(() => {
@@ -299,7 +298,7 @@ export function useCreators(type: OwnerResourceType, rows: ReadonlyArray<{ proje
     const controller = new AbortController();
     void Promise.allSettled([...byProject].map(async ([projectId, ids]) => {
       const creators = await listCreators(projectId, type, ids, controller.signal);
-      for (const id of ids) creatorCache.set(creatorKey(type, projectId, id), creators.get(id) ?? { key: null });
+      for (const id of ids) creatorCache.set(creatorKey(type, projectId, id), creators.get(id) ?? null);
     })).then(() => { if (!controller.signal.aborted) setVersion((value) => value + 1); });
     return () => controller.abort();
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -316,16 +315,14 @@ export function CreatorHeading() {
 }
 
 /** The creating key's name, or "Unknown" when Core has no record. */
-export function CreatorCell({ creator }: { creator: Creator | undefined }) {
+export function CreatorCell({ creator }: { creator: AdminKeyProvenance | null | undefined }) {
   const { t } = useTranslation("common");
   if (creator === undefined) return <span className="owner-missing">—</span>;
-  const key = creator.key;
-  if (!key) return <span className="owner-missing" title={t("creator.unknownHelp")}>{t("creator.unknown")}</span>;
-  const label = key.name ?? (key.prefix ? `${key.prefix}…` : t("creator.unknown"));
+  if (!creator) return <span className="owner-missing" title={t("creator.unknownHelp")}>{t("creator.unknown")}</span>;
   return (
-    <span className={key.revoked_at ? "owner-name owner-revoked" : "owner-name"} title={key.prefix ? `${key.prefix}…` : undefined}>
-      {label}
-      {key.revoked_at ? <span className="pill">{t("creator.revoked")}</span> : null}
+    <span className={creator.revoked_at ? "owner-name owner-revoked" : "owner-name"} title={`${creator.prefix}…`}>
+      {creator.name}
+      {creator.revoked_at ? <span className="pill">{t("creator.revoked")}</span> : null}
     </span>
   );
 }
diff --git a/apps/web/src/lib/sandbox-diagnostic.test.ts b/apps/web/src/lib/sandbox-diagnostic.test.ts
index 4ead7d8fb..5c6c5a0c6 100644
--- a/apps/web/src/lib/sandbox-diagnostic.test.ts
+++ b/apps/web/src/lib/sandbox-diagnostic.test.ts
@@ -19,7 +19,7 @@ describe("sandbox diagnostics", () => {
   it("names why a node's provider is not ready, reading an unknown code as provider_unavailable", () => {
     expect(sandboxDiagnosticMessage(nodeProviderDiagnostic({ online: true, provider_ready: false, diagnostic: "host_unsupported" }))?.label).toBe("Host unsupported");
     expect(nodeProviderDiagnostic({ online: true, provider_ready: false, diagnostic: "future_code" as SandboxNodeDiagnostic })).toBe("provider_unavailable");
-    expect(nodeProviderDiagnostic({ online: true, provider_ready: true, diagnostic: "" })).toBe("");
+    expect(nodeProviderDiagnostic({ online: true, provider_ready: true })).toBe("");
     // An offline node's last code may no longer apply.
     expect(nodeProviderDiagnostic({ online: false, provider_ready: false, diagnostic: "host_unsupported" })).toBe("");
   });
diff --git a/contracts/agents-api/core.openapi.yaml b/contracts/agents-api/core.openapi.yaml
index af9ea99b5..941308164 100644
--- a/contracts/agents-api/core.openapi.yaml
+++ b/contracts/agents-api/core.openapi.yaml
@@ -23,6 +23,17 @@ definitions:
         type: string
       trace_id:
         type: string
+    required:
+      - action
+      - actor_label
+      - admin_credential_id
+      - created_at
+      - id
+      - project_id
+      - request_id
+      - resource_id
+      - resource_type
+      - trace_id
     type: object
   adminaudit.Page:
     properties:
@@ -34,6 +45,10 @@ definitions:
         type: boolean
       next_cursor:
         type: string
+    required:
+      - data
+      - has_more
+      - next_cursor
     type: object
   api.AdminRuntimeObservation:
     properties:
@@ -41,6 +56,9 @@ definitions:
         $ref: '#/definitions/api.AdminRuntimeObservationDetail'
       project_id:
         type: string
+    required:
+      - observation
+      - project_id
     type: object
   api.AdminRuntimeObservationDetail:
     properties:
@@ -150,17 +168,29 @@ definitions:
         type: array
       first_id:
         type: string
+        x-nullable: true
       has_more:
         type: boolean
       last_id:
         type: string
+        x-nullable: true
       object:
+        enum:
+          - list
         type: string
+    required:
+      - data
+      - first_id
+      - has_more
+      - last_id
+      - object
     type: object
   api.AdminSessionArchiveRequest:
     properties:
       expected_generation:
         type: integer
+    required:
+      - expected_generation
     type: object
   api.AdminSessionCounts:
     properties:
@@ -174,6 +204,12 @@ definitions:
         type: integer
       total:
         type: integer
+    required:
+      - failed
+      - idle
+      - in_progress
+      - requires_action
+      - total
     type: object
   api.AdminSummaryResponse:
     properties:
@@ -185,25 +221,43 @@ definitions:
         type: boolean
       next_cursor:
         type: string
+    required:
+      - data
+      - has_more
+      - next_cursor
     type: object
   api.AdminSummaryRow:
     properties:
       agent_id:
         type: string
+        x-nullable: true
       assets:
-        $ref: '#/definitions/sessions.AdminAssetCounts'
+        allOf:
+          - $ref: '#/definitions/sessions.AdminAssetCounts'
+        x-nullable: true
       coverage:
         $ref: '#/definitions/api.AdminUsageCoverage'
       key_id:
         type: string
+        x-nullable: true
       last_active_at:
         type: integer
+        x-nullable: true
       project_id:
         type: string
       sessions:
         $ref: '#/definitions/api.AdminSessionCounts'
       usage:
         $ref: '#/definitions/v1.TokenUsage'
+    required:
+      - agent_id
+      - assets
+      - coverage
+      - key_id
+      - last_active_at
+      - project_id
+      - sessions
+      - usage
     type: object
   api.AdminUsageCoverage:
     properties:
@@ -211,8 +265,13 @@ definitions:
         type: integer
       ratio:
         type: number
+        x-nullable: true
       total_sessions:
         type: integer
+    required:
+      - measured_sessions
+      - ratio
+      - total_sessions
     type: object
   api.CoreAPIError:
     properties:
@@ -322,6 +381,10 @@ definitions:
         x-nullable: true
       params:
         type: object
+    required:
+      - code
+      - failed_at
+      - params
     type: object
   api.EnvironmentExecutorCredentialRequest:
     properties:
@@ -330,6 +393,8 @@ definitions:
         type: string
       rotate:
         type: boolean
+    required:
+      - key_id
     type: object
   api.ExecutorConnection:
     properties:
@@ -449,6 +514,15 @@ definitions:
         description: Full source commit Core was built from; null for development builds.
         type: string
         x-nullable: true
+    required:
+      - address_bindings
+      - api_base_url
+      - configuration
+      - installation_id
+      - local_only
+      - object
+      - public_url
+      - source_commit
     type: object
   api.InstallationConfiguration:
     properties:
@@ -456,6 +530,8 @@ definitions:
         items:
           $ref: '#/definitions/api.InstallationSetting'
         type: array
+    required:
+      - settings
     type: object
   api.InstallationSetting:
     properties:
@@ -473,6 +549,9 @@ definitions:
       restarts:
         description: Services that restart when the setting changes.
         items:
+          enum:
+            - core
+            - web
           type: string
         type: array
       sensitive:
@@ -480,6 +559,13 @@ definitions:
       value:
         description: Applied value; always null for a sensitive setting.
         x-nullable: true
+    required:
+      - changeable
+      - default
+      - key
+      - restarts
+      - sensitive
+      - value
     type: object
   api.ItemDiagnosticTiming:
     properties:
@@ -493,16 +579,25 @@ definitions:
         x-nullable: true
       started_at:
         type: string
+    required:
+      - completed_at
+      - item_id
+      - observed_duration_ms
+      - started_at
     type: object
   api.ProjectAPIKeyRequest:
     properties:
       name:
         type: string
+    required:
+      - name
     type: object
   api.ProjectRequest:
     properties:
       name:
         type: string
+    required:
+      - name
     type: object
   api.ResourceOwnerList:
     properties:
@@ -510,6 +605,8 @@ definitions:
         items:
           $ref: '#/definitions/writeaudit.ResourceOwner'
         type: array
+    required:
+      - data
     type: object
   api.RuntimeDiskObservation:
     properties:
@@ -531,6 +628,8 @@ definitions:
         items:
           $ref: '#/definitions/deployment.NodeAllocation'
         type: array
+    required:
+      - data
     type: object
   api.SandboxDeploymentChangeInput:
     properties:
@@ -583,6 +682,10 @@ definitions:
         type: string
       token:
         type: string
+    required:
+      - enrollment_id
+      - expires_at
+      - token
     type: object
   api.SandboxEnrollmentTokenRequest:
     properties:
@@ -600,6 +703,8 @@ definitions:
         type: string
       updated:
         type: boolean
+    required:
+      - id
     type: object
   api.SandboxNodeList:
     properties:
@@ -607,6 +712,8 @@ definitions:
         items:
           $ref: '#/definitions/deployment.Node'
         type: array
+    required:
+      - data
     type: object
   api.SessionDiagnosticFailure:
     properties:
@@ -651,6 +758,11 @@ definitions:
         type: string
       turn_id:
         type: string
+    required:
+      - code
+      - failed_at
+      - params
+      - source
     type: object
   api.SessionDiagnostics:
     properties:
@@ -671,6 +783,11 @@ definitions:
           - requires_action
           - failed
         type: string
+    required:
+      - failure
+      - object
+      - session_id
+      - status
     type: object
   api.TurnDiagnostics:
     properties:
@@ -694,6 +811,14 @@ definitions:
         type: string
       turn_id:
         type: string
+    required:
+      - failure
+      - items
+      - items_truncated
+      - object
+      - session_id
+      - status
+      - turn_id
     type: object
   coremetrics.Database:
     properties:
@@ -708,6 +833,11 @@ definitions:
       size_bytes:
         type: integer
         x-nullable: true
+    required:
+      - ping_ms
+      - pool
+      - series
+      - size_bytes
     type: object
   coremetrics.DatabaseBucket:
     properties:
@@ -719,6 +849,10 @@ definitions:
         x-nullable: true
       start:
         type: string
+    required:
+      - ping_p95_ms
+      - pool_in_use
+      - start
     type: object
   coremetrics.Execution:
     properties:
@@ -752,6 +886,18 @@ definitions:
       waiting_for_daemon:
         type: integer
         x-nullable: true
+    required:
+      - connected_daemons
+      - in_progress_turns
+      - interrupted
+      - oldest_queued_seconds
+      - queue_wait_ms
+      - queued_turns
+      - series
+      - slots_in_use
+      - slots_total
+      - unavailable
+      - waiting_for_daemon
     type: object
   coremetrics.ExecutionBucket:
     properties:
@@ -766,6 +912,11 @@ definitions:
         x-nullable: true
       start:
         type: string
+    required:
+      - in_progress
+      - queue_wait_p95_ms
+      - queued
+      - start
     type: object
   coremetrics.Job:
     properties:
@@ -781,7 +932,18 @@ definitions:
         type: integer
         x-nullable: true
       status:
+        enum:
+          - ok
+          - failing
+          - stopped
+          - unknown
         type: string
+    required:
+      - failed
+      - id
+      - last_run_at
+      - processed
+      - status
     type: object
   coremetrics.Latency:
     properties:
@@ -791,6 +953,9 @@ definitions:
       p95:
         type: number
         x-nullable: true
+    required:
+      - p50
+      - p95
     type: object
   coremetrics.Pool:
     properties:
@@ -803,6 +968,10 @@ definitions:
       max:
         type: integer
         x-nullable: true
+    required:
+      - idle
+      - in_use
+      - max
     type: object
   coremetrics.Process:
     properties:
@@ -828,6 +997,14 @@ definitions:
         items:
           $ref: '#/definitions/coremetrics.ProcessBucket'
         type: array
+    required:
+      - cpu_cores
+      - cpu_limit_cores
+      - goroutines
+      - memory_bytes
+      - memory_limit_bytes
+      - rss_bytes
+      - series
     type: object
   coremetrics.ProcessBucket:
     properties:
@@ -839,6 +1016,10 @@ definitions:
         x-nullable: true
       start:
         type: string
+    required:
+      - cpu_cores
+      - rss_bytes
+      - start
     type: object
   coremetrics.Range:
     properties:
@@ -848,6 +1029,10 @@ definitions:
         type: integer
       start:
         type: string
+    required:
+      - end
+      - resolution_seconds
+      - start
     type: object
   coremetrics.ServiceState:
     properties:
@@ -861,7 +1046,15 @@ definitions:
         type: string
         x-nullable: true
       status:
+        enum:
+          - running
+          - degraded
         type: string
+    required:
+      - execution_owner
+      - revision
+      - started_at
+      - status
     type: object
   coremetrics.View:
     properties:
@@ -874,6 +1067,8 @@ definitions:
           $ref: '#/definitions/coremetrics.Job'
         type: array
       object:
+        enum:
+          - core.metrics
         type: string
       process:
         $ref: '#/definitions/coremetrics.Process'
@@ -881,6 +1076,14 @@ definitions:
         $ref: '#/definitions/coremetrics.Range'
       service:
         $ref: '#/definitions/coremetrics.ServiceState'
+    required:
+      - database
+      - execution
+      - jobs
+      - object
+      - process
+      - range
+      - service
     type: object
   deployment.AddressBindings:
     properties:
@@ -892,6 +1095,11 @@ definitions:
         type: integer
       self_hosted_executors:
         type: integer
+    required:
+      - hosted_sandboxes
+      - nodes
+      - nodes_on_other_address
+      - self_hosted_executors
     type: object
   deployment.HostHistory:
     properties:
@@ -901,6 +1109,9 @@ definitions:
         type: array
       resolution_seconds:
         type: integer
+    required:
+      - points
+      - resolution_seconds
     type: object
   deployment.HostHistoryPoint:
     properties:
@@ -915,6 +1126,11 @@ definitions:
         x-nullable: true
       start:
         type: string
+    required:
+      - available_disk_bytes_min
+      - cpu_utilization_max
+      - memory_used_bytes_max
+      - start
     type: object
   deployment.Node:
     properties:
@@ -922,8 +1138,10 @@ definitions:
         type: integer
       available_disk_bytes:
         type: integer
+        x-nullable: true
       available_memory_bytes:
         type: integer
+        x-nullable: true
       cleanup_pending:
         type: integer
       core_url:
@@ -933,6 +1151,7 @@ definitions:
         type: string
       cpu_count:
         type: integer
+        x-nullable: true
       created_at:
         type: string
       diagnostic:
@@ -953,6 +1172,7 @@ definitions:
         type: string
       last_seen_at:
         type: string
+        x-nullable: true
       max_active:
         type: integer
       max_retained:
@@ -975,6 +1195,28 @@ definitions:
         type: integer
       snapshots:
         type: integer
+    required:
+      - active
+      - available_disk_bytes
+      - available_memory_bytes
+      - cleanup_pending
+      - core_url
+      - cpu_count
+      - created_at
+      - enrollment_id
+      - id
+      - last_seen_at
+      - max_active
+      - max_retained
+      - name
+      - online
+      - provider
+      - provider_ready
+      - reserved
+      - retained
+      - rollout
+      - running
+      - snapshots
     type: object
   deployment.NodeAllocation:
     properties:
@@ -989,6 +1231,13 @@ definitions:
       deployment_generation:
         type: integer
       diagnostic:
+        enum:
+          - ""
+          - node_unavailable
+          - resource_missing
+          - compute_unconfirmed
+          - ownership_mismatch
+          - provider_unavailable
         type: string
       environment_id:
         type: string
@@ -1004,6 +1253,19 @@ definitions:
         type: string
       tenant_id:
         type: string
+    required:
+      - compute_phase
+      - compute_phase_changed_at
+      - created_at
+      - deployment_generation
+      - diagnostic
+      - environment_id
+      - id
+      - initialization
+      - node_id
+      - session_id
+      - state
+      - tenant_id
     type: object
   deployment.NodeDetail:
     properties:
@@ -1011,8 +1273,10 @@ definitions:
         type: integer
       available_disk_bytes:
         type: integer
+        x-nullable: true
       available_memory_bytes:
         type: integer
+        x-nullable: true
       cleanup_pending:
         type: integer
       core_url:
@@ -1022,6 +1286,7 @@ definitions:
         type: string
       cpu_count:
         type: integer
+        x-nullable: true
       created_at:
         type: string
       diagnostic:
@@ -1046,6 +1311,7 @@ definitions:
         type: string
       last_seen_at:
         type: string
+        x-nullable: true
       max_active:
         type: integer
       max_retained:
@@ -1068,6 +1334,30 @@ definitions:
         type: integer
       snapshots:
         type: integer
+    required:
+      - active
+      - available_disk_bytes
+      - available_memory_bytes
+      - cleanup_pending
+      - core_url
+      - cpu_count
+      - created_at
+      - enrollment_id
+      - history
+      - host
+      - id
+      - last_seen_at
+      - max_active
+      - max_retained
+      - name
+      - online
+      - provider
+      - provider_ready
+      - reserved
+      - retained
+      - rollout
+      - running
+      - snapshots
     type: object
   deployment.NodeHost:
     properties:
@@ -1089,6 +1379,13 @@ definitions:
       total_memory_bytes:
         type: integer
         x-nullable: true
+    required:
+      - available_disk_bytes
+      - available_memory_bytes
+      - cpu_utilization
+      - effective_cpu_cores
+      - observed_at
+      - total_memory_bytes
     type: object
   deployment.NodeRollout:
     properties:
@@ -1114,6 +1411,9 @@ definitions:
           - update_required
           - unknown
         type: string
+    required:
+      - ready_generation
+      - state
     type: object
   deployment.NodeUpdate:
     properties:
@@ -1124,10 +1424,16 @@ definitions:
         type: integer
       name:
         type: string
+    required:
+      - max_active
+      - name
     type: object
   deployment.Reset:
     properties:
       clear:
+        enum:
+          - auto
+          - force
         type: string
       deadline_at:
         type: string
@@ -1139,6 +1445,12 @@ definitions:
         $ref: '#/definitions/deployment.ResetRemaining'
       requested_at:
         type: string
+    required:
+      - clear
+      - deadline_at
+      - forced_at
+      - remaining
+      - requested_at
     type: object
   deployment.ResetOfflineNode:
     properties:
@@ -1148,6 +1460,10 @@ definitions:
         type: string
       resources:
         type: integer
+    required:
+      - name
+      - node_id
+      - resources
     type: object
   deployment.ResetRemaining:
     properties:
@@ -1163,6 +1479,12 @@ definitions:
         type: array
       on_offline_nodes:
         type: integer
+    required:
+      - busy
+      - cleanup
+      - idle
+      - offline_nodes
+      - on_offline_nodes
     type: object
   deployment.ResetRequest:
     properties:
@@ -1188,6 +1510,9 @@ definitions:
         type: integer
       pending:
         type: integer
+    required:
+      - allocations
+      - pending
     type: object
   deployment.Rollout:
     properties:
@@ -1202,6 +1527,10 @@ definitions:
           - settled
           - preparing
         type: string
+    required:
+      - nodes
+      - previous_generation_sandboxes
+      - state
     type: object
   deployment.RolloutNodes:
     properties:
@@ -1215,6 +1544,12 @@ definitions:
         type: integer
       update_required:
         type: integer
+    required:
+      - failed
+      - preparing
+      - ready
+      - unknown
+      - update_required
     type: object
   deployment.Suspension:
     properties:
@@ -1222,6 +1557,9 @@ definitions:
         type: integer
       retention_seconds:
         type: integer
+    required:
+      - idle_seconds
+      - retention_seconds
     type: object
   deployment.View:
     properties:
@@ -1239,6 +1577,10 @@ definitions:
       metadata:
         type: object
       mode:
+        enum:
+          - ""
+          - nodes
+          - direct
         type: string
       owner_epoch:
         type: integer
@@ -1261,6 +1603,18 @@ definitions:
           - $ref: '#/definitions/deployment.Suspension'
         description: Idle suspension policy; null unless the selected Provider declares checkpoint support.
         x-nullable: true
+    required:
+      - core_url
+      - credential_configured
+      - generation
+      - installation_id
+      - mode
+      - owner_epoch
+      - provider
+      - reset
+      - resources
+      - rollout
+      - suspension
     type: object
   projects.APIKey:
     properties:
@@ -1276,6 +1630,14 @@ definitions:
         type: string
       revoked_at:
         type: string
+        x-nullable: true
+    required:
+      - created_at
+      - id
+      - name
+      - prefix
+      - project_id
+      - revoked_at
     type: object
   projects.IssuedAPIKey:
     properties:
@@ -1293,6 +1655,15 @@ definitions:
         type: string
       revoked_at:
         type: string
+        x-nullable: true
+    required:
+      - created_at
+      - id
+      - key
+      - name
+      - prefix
+      - project_id
+      - revoked_at
     type: object
   projects.KeyPage:
     properties:
@@ -1302,6 +1673,9 @@ definitions:
         type: array
       has_more:
         type: boolean
+    required:
+      - data
+      - has_more
     type: object
   projects.Page:
     properties:
@@ -1311,6 +1685,9 @@ definitions:
         type: array
       has_more:
         type: boolean
+    required:
+      - data
+      - has_more
     type: object
   projects.Project:
     properties:
@@ -1318,12 +1695,19 @@ definitions:
         type: integer
       archived_at:
         type: string
+        x-nullable: true
       created_at:
         type: string
       id:
         type: string
       name:
         type: string
+    required:
+      - active_key_count
+      - archived_at
+      - created_at
+      - id
+      - name
     type: object
   sandbox.ConfigurationDiscoveryInput:
     properties:
@@ -1340,6 +1724,8 @@ definitions:
         $ref: '#/definitions/sandbox.Resources'
       runtime:
         $ref: '#/definitions/sandbox.RuntimeRelease'
+    required:
+      - resources
     type: object
   sandbox.Resources:
     properties:
@@ -1351,6 +1737,9 @@ definitions:
         type: integer
       root_disk_mib:
         type: integer
+    required:
+      - cpus
+      - memory_mib
     type: object
   sandbox.RuntimeRelease:
     properties:
@@ -1366,6 +1755,13 @@ definitions:
         type: string
       source_commit:
         type: string
+    required:
+      - firmware_sha256
+      - image_id
+      - image_manifest_digest
+      - microsandbox_ref
+      - runtime_sha256
+      - source_commit
     type: object
   sessions.AdminAssetCounts:
     properties:
@@ -1381,6 +1777,13 @@ definitions:
         type: integer
       vaults:
         type: integer
+    required:
+      - agents
+      - credentials
+      - environment_templates
+      - files
+      - skills
+      - vaults
     type: object
   sessions.ExecutorCredential:
     properties:
@@ -1392,6 +1795,10 @@ definitions:
       revoked_at:
         type: string
         x-nullable: true
+    required:
+      - created_at
+      - key_id
+      - revoked_at
     type: object
   sessions.IssuedExecutorCredential:
     properties:
@@ -1401,6 +1808,9 @@ definitions:
         type: string
       key_id:
         type: string
+    required:
+      - executor_token
+      - key_id
     type: object
   sessions.ManagedArchive:
     properties:
@@ -1409,7 +1819,15 @@ definitions:
       session_id:
         type: string
       state:
+        enum:
+          - active
+          - cleanup_pending
+          - released
         type: string
+    required:
+      - environment_id
+      - session_id
+      - state
     type: object
   v1.Agent:
     properties:
@@ -3333,6 +3751,8 @@ definitions:
       id:
         type: string
       kind:
+        enum:
+          - issued
         type: string
       name:
         type: string
@@ -3340,10 +3760,25 @@ definitions:
         type: string
       revoked_at:
         type: string
+        x-nullable: true
+    required:
+      - id
+      - kind
+      - name
+      - prefix
+      - revoked_at
     type: object
   writeaudit.Operation:
     properties:
       action:
+        enum:
+          - create
+          - update
+          - delete
+          - send_events
+          - upload_file
+          - upload_version
+          - update_default_version
         type: string
       api_key:
         $ref: '#/definitions/writeaudit.APIKey'
@@ -3358,9 +3793,30 @@ definitions:
       resource_id:
         type: string
       resource_type:
+        enum:
+          - agent
+          - session
+          - environment
+          - environment_template
+          - skill
+          - skill_version
+          - file
+          - vault
+          - credential
+          - artifact
         type: string
       trace_id:
         type: string
+    required:
+      - action
+      - api_key
+      - created_at
+      - id
+      - parent_id
+      - request_id
+      - resource_id
+      - resource_type
+      - trace_id
     type: object
   writeaudit.Page:
     properties:
@@ -3372,13 +3828,22 @@ definitions:
         type: boolean
       next_cursor:
         type: string
+    required:
+      - data
+      - has_more
+      - next_cursor
     type: object
   writeaudit.ResourceOwner:
     properties:
       api_key:
-        $ref: '#/definitions/writeaudit.APIKey'
+        allOf:
+          - $ref: '#/definitions/writeaudit.APIKey'
+        x-nullable: true
       resource_id:
         type: string
+    required:
+      - api_key
+      - resource_id
     type: object
 info:
   contact: {}
diff --git a/contracts/agents-api/index.md b/contracts/agents-api/index.md
index 286d27a27..f9ffb2cf9 100644
--- a/contracts/agents-api/index.md
+++ b/contracts/agents-api/index.md
@@ -14,7 +14,7 @@ Core targets the complete OpenAI Agents API as pinned below ([public API rule](h
 | [openapi.yaml](./openapi.yaml) | The official public contract with Core's `x_agents_core` extension on Agent and Session request/response objects |
 | [go-bindings.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/go-bindings.json) | Go names, field representations, encoding order and stored projections; it does not define official field membership, enums or constraints |
 
-Run `make openapi` to regenerate the public Go types, the Agent request shapes, the route inventory and all three OpenAPI documents. `scripts/generate-public-api.py` reads the checked-in, checksum-verified official source without network access. It selects Agents, Vaults, Files and Skills and follows their schema references, preserving union types, nullability, required fields and constraints. The request shapes in `services/core/internal/api/official_shapes.gen.go` project `CreateAgentParams`, `UpdateAgentParams` and `SessionAgentConfigParam`; Core checks request bodies against them before it reads an Agent configuration. Core's extension types in `v1/` remain authored in Go and are added to the public schema during generation. The TypeScript client's types, enum values and field names in `packages/agents-client/src/generated/public-api.ts` are generated from the resulting public schema. The internal `/core/v1` and `/api/v1` documents come from handler annotations. `make check-openapi` checks freshness and the generator; it also runs through `make check-go`.
+Run `make openapi` to regenerate the public Go types, the Agent request shapes, the route inventory and all three OpenAPI documents. `scripts/generate-public-api.py` reads the checked-in, checksum-verified official source without network access. It selects Agents, Vaults, Files and Skills and follows their schema references, preserving union types, nullability, required fields and constraints. The request shapes in `services/core/internal/api/official_shapes.gen.go` project `CreateAgentParams`, `UpdateAgentParams` and `SessionAgentConfigParam`; Core checks request bodies against them before it reads an Agent configuration. Core's extension types in `v1/` remain authored in Go and are added to the public schema during generation. The TypeScript client's types, enum values and field names in `packages/agents-client/src/generated/public-api.ts` are generated from the resulting public schema. The internal `/core/v1` and `/api/v1` documents come from handler annotations; the same generator projects the `/core/v1` document into `packages/agents-client/src/generated/core-api.ts`, which imports the public types it references from `public-api.ts`. `make check-openapi` checks freshness and the generator; it also runs through `make check-go`.
 
 The public contract is the official API plus Core extensions. Standard fields are generated into `v1/official.gen.go`; `go-bindings.json` lists types consumed by Core and overrides only the Go representation or field order that existing storage or custom JSON encoding requires. Unspecified fields follow the official schema; shared shapes use one Go type. Selected discriminated unions also generate JSON serializers to retain required nullable fields for each variant. Other union serializers, Core's local limits, execution admission and state transitions remain implementation code. Contract tests verify that the public schema preserves the official definitions, extensions remain in `x_agents_core`, and all documents match registered routes. Official-client and raw HTTP tests verify behavior. Schema generation does not qualify an unimplemented feature; the gaps below still apply. Upstream upgrades update the OpenAPI and SDK pins together after comparison and compatibility tests.
 
diff --git a/contracts/agents-api/runtime.openapi.yaml b/contracts/agents-api/runtime.openapi.yaml
index 8e1ac37a7..fb434cab2 100644
--- a/contracts/agents-api/runtime.openapi.yaml
+++ b/contracts/agents-api/runtime.openapi.yaml
@@ -117,6 +117,8 @@ definitions:
         $ref: '#/definitions/sandbox.Resources'
       runtime:
         $ref: '#/definitions/sandbox.RuntimeRelease'
+    required:
+      - resources
     type: object
   sandbox.Resources:
     properties:
@@ -128,6 +130,9 @@ definitions:
         type: integer
       root_disk_mib:
         type: integer
+    required:
+      - cpus
+      - memory_mib
     type: object
   sandbox.RuntimeRelease:
     properties:
@@ -143,6 +148,13 @@ definitions:
         type: string
       source_commit:
         type: string
+    required:
+      - firmware_sha256
+      - image_id
+      - image_manifest_digest
+      - microsandbox_ref
+      - runtime_sha256
+      - source_commit
     type: object
   v1.APIError:
     properties:
diff --git a/contracts/agents-api/zh/index.md b/contracts/agents-api/zh/index.md
index 3897fefdc..04c831d54 100644
--- a/contracts/agents-api/zh/index.md
+++ b/contracts/agents-api/zh/index.md
@@ -1,7 +1,7 @@
 ---
 title: "Agents API 覆盖台账"
 source: contracts/agents-api/index.md
-source_hash: c3180e51ce893b3752370abbdf3a58255ebe11fdfd7ec1e1620ad85f7ce1b30d
+source_hash: b2281fe0f7ab7c4f810b029aca847a11a3a292d367dcacd1ac3f716f511e2814
 ---
 
 Core 旨在以下方固定版本为准支持完整的 OpenAI Agents API（[public API rule](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#public-api)）。本台账记录 Core 对各项资源实现了哪些内容、哪些契约保存其详细信息，并列出相对于 OpenAI 服务的所有已知差异和所有未解决缺口。[API namespaces and credentials](../../../docs/zh/api/index.md) 说明谁调用哪些 API；[Agents API guide](../../../docs/zh/api/public-agent-api.md) 介绍使用方法。
@@ -16,7 +16,7 @@ Core 旨在以下方固定版本为准支持完整的 OpenAI Agents API（[publi
 | [openapi.yaml](../openapi.yaml) | 官方公共契约，并在 Agent 和 Session 请求及响应对象上加入 Core 的 `x_agents_core` 扩展 |
 | [go-bindings.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/go-bindings.json) | Go 名称、字段表示、编码顺序和存储投影；不定义官方字段集合、枚举或约束 |
 
-运行 `make openapi` 重新生成公共 Go 类型、Agent 请求结构、路由清单和三个 OpenAPI 文档。`scripts/generate-public-api.py` 读取仓库内经过校验和验证的官方源文件，无需网络。它选择 Agents、Vaults、Files 和 Skills，并跟随 schema 引用，保留联合类型、可空性、必填字段和约束。`services/core/internal/api/official_shapes.gen.go` 中的请求结构投影 `CreateAgentParams`、`UpdateAgentParams` 和 `SessionAgentConfigParam`；Core 在读取 Agent 配置前先按它们检查请求体。Core 在 `v1/` 中的扩展类型继续由 Go 定义，在生成时加入公共 schema。TypeScript 客户端在 `packages/agents-client/src/generated/public-api.ts` 中的类型、枚举值和字段名由生成后的公共 schema 生成。内部 `/core/v1` 和 `/api/v1` 文档由处理函数注解生成。`make check-openapi` 检查生成结果是否最新并测试生成器；`make check-go` 也会运行此检查。
+运行 `make openapi` 重新生成公共 Go 类型、Agent 请求结构、路由清单和三个 OpenAPI 文档。`scripts/generate-public-api.py` 读取仓库内经过校验和验证的官方源文件，无需网络。它选择 Agents、Vaults、Files 和 Skills，并跟随 schema 引用，保留联合类型、可空性、必填字段和约束。`services/core/internal/api/official_shapes.gen.go` 中的请求结构投影 `CreateAgentParams`、`UpdateAgentParams` 和 `SessionAgentConfigParam`；Core 在读取 Agent 配置前先按它们检查请求体。Core 在 `v1/` 中的扩展类型继续由 Go 定义，在生成时加入公共 schema。TypeScript 客户端在 `packages/agents-client/src/generated/public-api.ts` 中的类型、枚举值和字段名由生成后的公共 schema 生成。内部 `/core/v1` 和 `/api/v1` 文档由处理函数注解生成；同一生成器把 `/core/v1` 文档投影为 `packages/agents-client/src/generated/core-api.ts`，其中引用的公共类型从 `public-api.ts` 导入。`make check-openapi` 检查生成结果是否最新并测试生成器；`make check-go` 也会运行此检查。
 
 公共契约是官方 API 加上 Core 扩展。标准字段生成到 `v1/official.gen.go`；`go-bindings.json` 只列出 Core 使用的类型，仅在已有存储或自定义 JSON 编码需要时覆盖 Go 表示或字段顺序。未覆盖的字段遵循官方 schema，相同结构复用同一个 Go 类型。部分带判别字段的联合类型也从 schema 生成 JSON 序列化代码，保留每个分支必需的可空字段。其他联合类型序列化、Core 的本地限制、执行准入和状态转换仍由实现代码负责。契约测试验证公共 schema 保留官方定义、扩展位于 `x_agents_core` 中，且所有文档与注册路由一致。官方客户端和原始 HTTP 测试验证行为。生成 schema 不代表某个尚未实现的功能已经得到验证；下方缺口仍然适用。升级上游时，在比对和兼容性测试后一起更新 OpenAPI 和 SDK 固定版本。
 
diff --git a/packages/agents-client/README.md b/packages/agents-client/README.md
index c93f98670..0e471313f 100644
--- a/packages/agents-client/README.md
+++ b/packages/agents-client/README.md
@@ -20,7 +20,7 @@ Every constructor also takes `baseUrl` and `fetch`. A token may be a string or a
 
 Behavior shared by the clients:
 
-- **Generated types.** `make openapi` generates `src/generated/public-api.ts` from the [public schema](../../contracts/agents-api/openapi.yaml): each schema's type, each enum's values and each object's field names. `types.ts` builds on the types and the validators read the value and field lists; `make check-openapi` rejects a stale copy, so change the schema and regenerate instead of editing the file.
+- **Generated types.** `make openapi` generates `src/generated/public-api.ts` from the [public schema](../../contracts/agents-api/openapi.yaml) and `src/generated/core-api.ts` from the [Core API schema](../../contracts/agents-api/core.openapi.yaml): each schema's type, each enum's values and each object's field names. `types.ts`, `admin-types.ts`, `sandbox-client.ts` and `core-metrics.ts` name and compose the types, and the validators read the value and field lists; `make check-openapi` rejects a stale copy, so change the schema or the Go annotations and regenerate instead of editing the files.
 - **Strict responses.** Session, history, event, Environment and Core API responses are checked against their pinned shapes before they are returned. A malformed one throws `AgentCoreError` with status 502 and a code such as `invalid_session_resource` or `invalid_admin_response` (`CoreMetricsClient`: status 0, `invalid_response`) instead of passing on a guessed value. Agent responses are typed but not checked at run time.
 - **Errors.** A non-2xx response throws `AgentCoreError` with `status`, `code`, `param`, `errorType` and, from the Core API, the optional `details` of the [Core error envelope](../../contracts/agents-api/core-errors.md). Input the client cannot send, such as a malformed resource ID, throws `TypeError` before any request; Core enforces size, count and range limits.
 - **No retries or timeouts.** No client retries a request. Pass `signal` to cancel one.
diff --git a/packages/agents-client/src/admin-client.test.ts b/packages/agents-client/src/admin-client.test.ts
index 94613c92e..a19504b87 100644
--- a/packages/agents-client/src/admin-client.test.ts
+++ b/packages/agents-client/src/admin-client.test.ts
@@ -236,10 +236,10 @@ describe("AdminClient response contracts", () => {
     }
   });
 
-  it("reads any provider base URL an earlier Core stored but still rejects unsafe ones", async () => {
+  it("reads any provider base URL Core's write rule allows but still rejects unsafe ones", async () => {
     const saved = { id: resourceId, object: "agent", model: "model", name: null, instructions: null, metadata: {}, multi_agent: { enabled: false, max_concurrent_subagents: null }, reasoning: { effort: null, summary: null }, service_tier: "auto", text: { format: { type: "text" }, verbosity: "medium" }, tools: [], created_at: 1, updated_at: 1 };
     const withURL = (base_url: string, id = resourceId) => ({ ...saved, id, x_agents_core: { model_provider: { protocol: "responses", base_url, api_key_configured: true } } });
-    // Core once accepted hosts and ports that URL parsing rejects; one must not fail the list.
+    // The client is never stricter than Core's write rule: a host or port that URL parsing rejects must not fail the list.
     const stored = ["https://p.test:99999/v1", "https://xn--.test", "https://[::1]:8443/v1", "HTTPS://p.test/v1?"].map((url, index) => withURL(url, `agent-${index}`));
     expect((await clientWith(page(stored)).client.listAgents(projectId)).data).toEqual(stored);
     for (const url of ["http://p.test", "https://user:pw@p.test", "https://p.test/?key=secret", "https://p.test/#secret", "https://:443/v1"]) {
@@ -248,10 +248,12 @@ describe("AdminClient response contracts", () => {
   });
 
   it("binds Skills, versions and Artifacts to requested resources", async () => {
-    const skill = { id: "skill", object: "skill", created_at: 1, name: "helper", description: "help", default_version: "1", latest_version: "2" };
-    expect(await clientWith(skill).client.retrieveSkill(projectId, "skill")).toEqual(skill);
-    const version = { id: "version", object: "skill.version", created_at: 1, skill_id: "skill", version: "2", name: "helper", description: "help" };
-    await expect(clientWith(version).client.retrieveSkillVersion(projectId, "other", "2")).rejects.toBeInstanceOf(AgentCoreError);
+    const skill = { id: "skill_helper", object: "skill", created_at: 1, name: "helper", description: "help", default_version: "1", latest_version: "2" };
+    expect(await clientWith(skill).client.retrieveSkill(projectId, "skill_helper")).toEqual(skill);
+    await expect(clientWith(skill).client.retrieveSkill(projectId, "skill_other")).rejects.toBeInstanceOf(AgentCoreError);
+    const version = { id: "skillver_helper2", object: "skill.version", created_at: 1, skill_id: "skill_helper", version: "2", name: "helper", description: "help" };
+    expect(await clientWith(version).client.retrieveSkillVersion(projectId, "skill_helper", "2")).toEqual(version);
+    await expect(clientWith(version).client.retrieveSkillVersion(projectId, "skill_other", "2")).rejects.toBeInstanceOf(AgentCoreError);
     const artifact = { id: "artifact", object: "agent.session.artifact", created_at: 1, session_id: sessionId, environment_id: resourceId, path: "/result.txt", size_bytes: 2, turn_id: "turn" };
     expect((await clientWith(page([artifact])).client.listArtifacts(projectId, sessionId)).data).toEqual([artifact]);
     await expect(clientWith(artifact).client.retrieveArtifact(projectId, resourceId, "artifact")).rejects.toBeInstanceOf(AgentCoreError);
@@ -302,6 +304,15 @@ describe("AdminClient deployment read models", () => {
     await expect(clientWith({ ...audit, data: [{ ...audit.data[0], request_body: { token: "leak" } }] }).client.listAuditLog()).rejects.toBeInstanceOf(AgentCoreError);
   });
 
+  it("requires each write operation's key and a recorded action and resource type", async () => {
+    const operation = { id: "op", created_at: "2026-09-24T00:00:00Z", api_key: { id: keyId, name: "SDK", prefix: "p", kind: "issued", revoked_at: null }, action: "create", resource_type: "agent", resource_id: "a", parent_id: "", request_id: "request", trace_id: "trace" };
+    const operations = { data: [operation], has_more: false, next_cursor: "" };
+    expect(await clientWith(operations).client.listWriteOperations(projectId)).toEqual(operations);
+    for (const invalid of [{ ...operation, api_key: null }, { ...operation, action: "archive" }, { ...operation, resource_type: "deployment" }]) {
+      await expect(clientWith({ ...operations, data: [invalid] }).client.listWriteOperations(projectId)).rejects.toBeInstanceOf(AgentCoreError);
+    }
+  });
+
   it("passes provenance filters without a binding digest and preserves Vault status arrays", async () => {
     const operations = { data: [], has_more: false, next_cursor: "" };
     const { client, fetch } = clientWith(operations);
@@ -456,8 +467,8 @@ describe("AdminClient project monitoring", () => {
     };
     const value = { object: "list", data: [{ project_id: projectId, observation }], has_more: false, first_id: sessionId, last_id: sessionId };
     expect(await clientWith(value).client.listRuntimeObservations()).toEqual(value);
-    const { disk: _, ...older } = observation;
-    expect((await clientWith({ ...value, data: [{ project_id: projectId, observation: older }] }).client.listRuntimeObservations()).data[0]!.observation.disk).toBeNull();
+    const { disk: _, ...withoutDisk } = observation;
+    await expect(clientWith({ ...value, data: [{ project_id: projectId, observation: withoutDisk }] }).client.listRuntimeObservations()).rejects.toMatchObject({ code: "invalid_admin_response" });
     const invalid = { ...observation, disk: { usage_bytes: 1, limit_bytes: 0 } };
     await expect(clientWith({ ...value, data: [{ project_id: projectId, observation: invalid }] }).client.listRuntimeObservations()).rejects.toMatchObject({ code: "invalid_admin_response" });
   });
diff --git a/packages/agents-client/src/admin-client.ts b/packages/agents-client/src/admin-client.ts
index 7d208fc0c..16e5ae20c 100644
--- a/packages/agents-client/src/admin-client.ts
+++ b/packages/agents-client/src/admin-client.ts
@@ -11,9 +11,11 @@ import { projectAgentTurn, projectSessionItem, projectHistoryPage } from "./hist
 import { projectRuntimeHistory } from "./runtime-history-projection";
 import { canonicalUuid, isNonnegativeInteger, isRecord } from "./response-projection";
 import { CoreRequester } from "./core-request";
+import { projectSkill, projectSkillDeleted, projectSkillVersion, projectSkillVersionDeleted } from "./skill-projection";
+import { keyPageFields, projectsPageFields } from "./generated/core-api";
 import {
   invalidAdminResponse, projectAdminProject, projectAdminKey, projectIssuedAdminKey, projectAdminPage, projectAdminDeleted, projectAdminSessionArchive,
-  projectResourcePage, projectSavedAgent, projectSkill, projectSkillVersion, projectArtifact, projectSummary, projectAdminRuntimePage, projectResourceOwners, projectWriteOperations, projectAdminAudit,
+  projectResourcePage, projectSavedAgent, projectArtifact, projectSummary, projectAdminRuntimePage, projectResourceOwners, projectWriteOperations, projectAdminAudit,
   projectExecutorCredentials, projectIssuedExecutorCredential, projectCoreHarnessList, projectHarnessModelConfiguration, projectInstallation,
 } from "./admin-projection";
 import type {
@@ -78,7 +80,7 @@ export class AdminClient {
     return projectInstallation(await this.#json("/installation", options));
   }
   async listProjects(options?: PageOptions) {
-    return projectAdminPage(await this.#json(pageQuery("/projects", options), options), (value) => projectAdminProject(value));
+    return projectAdminPage(await this.#json(pageQuery("/projects", options), options), projectsPageFields, (value) => projectAdminProject(value));
   }
   async createProject(input: CreateAdminProjectInput, options?: ReadOptions) {
     return projectAdminProject(await this.#json("/projects", options, "POST", { name: input.name }));
@@ -90,7 +92,7 @@ export class AdminClient {
     return projectAdminProject(await this.#json(`${scope(projectId)}/archive`, options, "POST"), projectId);
   }
   async listAPIKeys(projectId: string, options?: PageOptions) {
-    return projectAdminPage(await this.#json(pageQuery(`${scope(projectId)}/keys`, options), options), (value) => projectAdminKey(value, projectId));
+    return projectAdminPage(await this.#json(pageQuery(`${scope(projectId)}/keys`, options), options), keyPageFields, (value) => projectAdminKey(value, projectId));
   }
   async issueAPIKey(projectId: string, input: IssueAdminAPIKeyInput, options?: ReadOptions) {
     return projectIssuedAdminKey(await this.#json(`${scope(projectId)}/keys`, options, "POST", { name: input.name }), projectId);
@@ -121,25 +123,22 @@ export class AdminClient {
     return this.#delete(`${scope(projectId)}/agents/${segment(agentId)}`, agentId, "agent.deleted", options);
   }
   async listSkills(projectId: string, options?: PageOptions): Promise<SkillList> {
-    return projectResourcePage(await this.#json(pageQuery(`${scope(projectId)}/skills`, options), options), (value) => projectSkill(value));
+    return projectResourcePage(await this.#json(pageQuery(`${scope(projectId)}/skills`, options), options), (value) => projectSkill(value, invalidAdminResponse));
   }
   async retrieveSkill(projectId: string, skillId: string, options?: ReadOptions) {
-    return projectSkill(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}`, options), skillId);
+    return projectSkill(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}`, options), invalidAdminResponse, skillId);
   }
-  deleteSkill(projectId: string, skillId: string, options?: ReadOptions) {
-    return this.#delete(`${scope(projectId)}/skills/${segment(skillId)}`, skillId, "skill.deleted", options);
+  async deleteSkill(projectId: string, skillId: string, options?: ReadOptions) {
+    return projectSkillDeleted(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}`, options, "DELETE"), invalidAdminResponse, skillId);
   }
   async listSkillVersions(projectId: string, skillId: string, options?: PageOptions): Promise<SkillVersionList> {
-    return projectResourcePage(await this.#json(pageQuery(`${scope(projectId)}/skills/${segment(skillId)}/versions`, options), options), (value) => projectSkillVersion(value, skillId));
+    return projectResourcePage(await this.#json(pageQuery(`${scope(projectId)}/skills/${segment(skillId)}/versions`, options), options), (value) => projectSkillVersion(value, invalidAdminResponse, skillId));
   }
   async retrieveSkillVersion(projectId: string, skillId: string, version: string, options?: ReadOptions) {
-    return projectSkillVersion(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}/versions/${segment(version)}`, options), skillId, version);
+    return projectSkillVersion(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}/versions/${segment(version)}`, options), invalidAdminResponse, skillId, version);
   }
   async deleteSkillVersion(projectId: string, skillId: string, version: string, options?: ReadOptions): Promise<SkillVersionDeleted> {
-    const value = await this.#json(`${scope(projectId)}/skills/${segment(skillId)}/versions/${segment(version)}`, options, "DELETE");
-    if (!isRecord(value) || value.version !== version || typeof value.id !== "string") return invalidAdminResponse();
-    const { version: _, ...receipt } = value;
-    return { ...projectAdminDeleted(receipt, value.id, "skill.version.deleted"), version };
+    return projectSkillVersionDeleted(await this.#json(`${scope(projectId)}/skills/${segment(skillId)}/versions/${segment(version)}`, options, "DELETE"), invalidAdminResponse, version);
   }
   downloadSkill(projectId: string, skillId: string, options?: ReadOptions) {
     return this.#content(`${scope(projectId)}/skills/${segment(skillId)}/content`, options);
diff --git a/packages/agents-client/src/admin-projection.ts b/packages/agents-client/src/admin-projection.ts
index 28051cae1..de765a7df 100644
--- a/packages/agents-client/src/admin-projection.ts
+++ b/packages/agents-client/src/admin-projection.ts
@@ -2,15 +2,30 @@ import { coreHarnessKinds, modelProviderProtocols } from "./harness-catalog";
 import { AgentCoreError, projectRuntimeObservation, projectSavedAgentConfiguration } from "./client";
 import { projectTokenUsage } from "./usage-projection";
 import { safeProvider } from "./execution-configuration-projection";
-import { canonicalUuid, exactFields, isNonnegativeInteger, isRecord, onlyFields, sameResourceId } from "./response-projection";
-import type { CoreHarness, CoreHarnessKind, HarnessModelConfiguration, ProviderObservationErrorCode, ListPage, SavedAgent } from "./types";
-import type { AdminAPIKey, AdminProject, AdminAuditPage, AdminSummary, AdminRuntimeObservation, RuntimeDiskObservation, AdminKeyProvenance, AdminResourceOwner, AdminWriteOperationPage, AdminDeleted, AdminIssuedAPIKey, AdminPage, AdminSessionArchive, SessionArtifact, Skill, SkillVersion, ExecutorCredentialList, ExecutorConnection, IssuedExecutorCredential, CoreInstallation, CoreInstallationSetting } from "./admin-types";
+import { canonicalUuid, exactFields, type FieldNames, hasOwn, isNonnegativeInteger, isOneOf, isRecord, onlyFields, sameResourceId } from "./response-projection";
+import { sessionArtifactResourceFields } from "./generated/public-api";
+import {
+  addressBindingsFields, adminAssetCountsFields, adminauditOperationFields, adminauditPageFields, adminRuntimeObservationFields,
+  adminRuntimeObservationListFields, adminSessionCountsFields, adminSummaryResponseFields, adminSummaryRowFields, adminUsageCoverageFields,
+  coreHarnessFields, coreHarnessListFields, executorConnectionFields, executorConnectionStatusValues, executorCredentialFields,
+  executorCredentialListFields, harnessModelConfigurationFields, harnessModelConfigurationLastErrorCodeValues, installationConfigurationFields,
+  installationFields, installationSettingFields, installationSettingRequired, installationSettingRestartsValues, issuedExecutorCredentialFields,
+  managedArchiveFields, managedArchiveStateValues, modelConfigurationSupportFields, projectFields, projectsAPIKeyFields, resourceOwnerFields,
+  resourceOwnerListFields, runtimeDiskObservationFields, writeauditAPIKeyFields, writeauditOperationActionValues, writeauditOperationFields,
+  writeauditOperationResourceTypeValues, writeauditPageFields,
+} from "./generated/core-api";
+import type { CoreHarness, CoreHarnessKind, HarnessModelConfiguration, ListPage, SavedAgent, SessionArtifact } from "./types";
+import type {
+  AdminAPIKey, AdminAuditPage, AdminDeleted, AdminIssuedAPIKey, AdminKeyProvenance, AdminPage, AdminProject, AdminResourceOwner,
+  AdminRuntimeObservation, AdminSessionArchive, AdminSummary, AdminWriteOperationPage, CoreInstallation, CoreInstallationSetting,
+  ExecutorConnection, ExecutorCredentialList, IssuedExecutorCredential, RuntimeDiskObservation,
+} from "./admin-types";
 
 export function invalidAdminResponse(): never {
   throw new AgentCoreError("Core returned an invalid administration response.", 502, "invalid_admin_response");
 }
-function record(value: unknown, fields: string[]): Record<string, unknown> {
-  if (!isRecord(value) || !exactFields(value, new Set(fields))) return invalidAdminResponse();
+function record(value: unknown, fields: FieldNames): Record<string, unknown> {
+  if (!isRecord(value) || !exactFields(value, fields)) return invalidAdminResponse();
   return value;
 }
 function strings(value: Record<string, unknown>, fields: string[]): void {
@@ -20,7 +35,7 @@ function date(value: unknown): boolean {
   return value === null || (typeof value === "string" && Number.isFinite(Date.parse(value)));
 }
 export function projectAdminProject(value: unknown, expectedId?: string): AdminProject {
-  const project = record(value, ["id", "name", "created_at", "archived_at", "active_key_count"]);
+  const project = record(value, projectFields);
   strings(project, ["id", "name", "created_at"]);
   if (!date(project.created_at) ||
     !date(project.archived_at) || !isNonnegativeInteger(project.active_key_count) ||
@@ -28,7 +43,7 @@ export function projectAdminProject(value: unknown, expectedId?: string): AdminP
   return { ...project } as unknown as AdminProject;
 }
 export function projectAdminKey(value: unknown, projectId: string): AdminAPIKey {
-  const key = record(value, ["id", "project_id", "name", "prefix", "created_at", "revoked_at"]);
+  const key = record(value, projectsAPIKeyFields);
   strings(key, ["id", "project_id", "name", "prefix", "created_at"]);
   if (!date(key.created_at) || !date(key.revoked_at) ||
     !sameResourceId(key.project_id as string, projectId)) return invalidAdminResponse();
@@ -41,8 +56,8 @@ export function projectIssuedAdminKey(value: unknown, projectId: string): AdminI
   if (projected.revoked_at !== null) return invalidAdminResponse();
   return { ...projected, key };
 }
-export function projectAdminPage<T>(value: unknown, project: (entry: unknown) => T): AdminPage<T> {
-  const page = record(value, ["data", "has_more"]);
+export function projectAdminPage<T>(value: unknown, fields: FieldNames, project: (entry: unknown) => T): AdminPage<T> {
+  const page = record(value, fields);
   if (!Array.isArray(page.data) || typeof page.has_more !== "boolean" || (page.has_more && page.data.length === 0)) return invalidAdminResponse();
   return { data: page.data.map(project), has_more: page.has_more };
 }
@@ -62,10 +77,9 @@ export function projectAdminDeleted<O extends string>(value: unknown, expectedId
   return { id: deleted.id, object, deleted: true };
 }
 export function projectAdminSessionArchive(value: unknown, sessionId: string): AdminSessionArchive {
-  const archive = record(value, ["session_id", "environment_id", "state"]);
+  const archive = record(value, managedArchiveFields);
   if (typeof archive.session_id !== "string" || !sameResourceId(archive.session_id, sessionId) ||
-    canonicalUuid(archive.environment_id) === null ||
-    (archive.state !== "active" && archive.state !== "cleanup_pending" && archive.state !== "released")) return invalidAdminResponse();
+    canonicalUuid(archive.environment_id) === null || !isOneOf(managedArchiveStateValues, archive.state)) return invalidAdminResponse();
   return { session_id: archive.session_id, environment_id: archive.environment_id as string, state: archive.state };
 }
 export function projectSavedAgent(value: unknown, expectedId?: string): SavedAgent {
@@ -77,66 +91,51 @@ export function projectSavedAgent(value: unknown, expectedId?: string): SavedAge
     (expectedId !== undefined && !sameResourceId(agent.id, expectedId))) return invalidAdminResponse();
   return { ...agent, object, metadata: { ...metadata } as Record<string, string>, created_at, updated_at };
 }
-export function projectSkill(value: unknown, expectedId?: string): Skill {
-  const skill = record(value, ["id", "object", "created_at", "name", "description", "default_version", "latest_version"]);
-  strings(skill, ["id", "name", "description", "default_version", "latest_version"]);
-  if (skill.object !== "skill" || !isNonnegativeInteger(skill.created_at) ||
-    (expectedId !== undefined && !sameResourceId(skill.id as string, expectedId))) return invalidAdminResponse();
-  return { ...skill } as unknown as Skill;
-}
-export function projectSkillVersion(value: unknown, skillId: string, version?: string): SkillVersion {
-  const skill = record(value, ["id", "object", "created_at", "skill_id", "version", "name", "description"]);
-  strings(skill, ["id", "skill_id", "version", "name", "description"]);
-  if (skill.object !== "skill.version" || !isNonnegativeInteger(skill.created_at) || !sameResourceId(skill.skill_id as string, skillId) ||
-    (version !== undefined && skill.version !== version)) return invalidAdminResponse();
-  return { ...skill } as unknown as SkillVersion;
-}
 export function projectArtifact(value: unknown, sessionId: string, expectedId?: string): SessionArtifact {
-  const artifact = record(value, ["id", "object", "created_at", "environment_id", "path", "session_id", "size_bytes", "turn_id"]);
+  const artifact = record(value, sessionArtifactResourceFields);
   strings(artifact, ["id", "environment_id", "path", "session_id", "turn_id"]);
   if (artifact.object !== "agent.session.artifact" || !isNonnegativeInteger(artifact.created_at) || !isNonnegativeInteger(artifact.size_bytes) ||
     !sameResourceId(artifact.session_id as string, sessionId) || (expectedId !== undefined && !sameResourceId(artifact.id as string, expectedId))) return invalidAdminResponse();
   return { ...artifact } as unknown as SessionArtifact;
 }
-function projectProvenance(value: unknown): AdminKeyProvenance | null {
-  if (value === null) return null;
-  const key = record(value, ["id", "name", "prefix", "kind", "revoked_at"]);
+function projectProvenance(value: unknown): AdminKeyProvenance {
+  const key = record(value, writeauditAPIKeyFields);
   strings(key, ["id", "name", "prefix"]);
   if (key.kind !== "issued" || !date(key.revoked_at)) return invalidAdminResponse();
   return { ...key } as unknown as AdminKeyProvenance;
 }
 export function projectResourceOwners(value: unknown, ids: string[]): { data: AdminResourceOwner[] } {
-  const page = record(value, ["data"]);
+  const page = record(value, resourceOwnerListFields);
   if (!Array.isArray(page.data) || page.data.length !== ids.length) return invalidAdminResponse();
   return { data: page.data.map((entry, index) => {
-    const owner = record(entry, ["resource_id", "api_key"]);
+    const owner = record(entry, resourceOwnerFields);
     if (owner.resource_id !== ids[index]) return invalidAdminResponse();
-    return { resource_id: owner.resource_id as string, api_key: projectProvenance(owner.api_key) };
+    return { resource_id: owner.resource_id as string, api_key: owner.api_key === null ? null : projectProvenance(owner.api_key) };
   }) };
 }
 export function projectWriteOperations(value: unknown): AdminWriteOperationPage {
-  const page = record(value, ["data", "has_more", "next_cursor"]);
+  const page = record(value, writeauditPageFields);
   if (!Array.isArray(page.data) || typeof page.has_more !== "boolean" || typeof page.next_cursor !== "string") return invalidAdminResponse();
   const data = page.data.map((entry) => {
-    const operation = record(entry, ["id", "created_at", "api_key", "action", "resource_type", "resource_id", "parent_id", "request_id", "trace_id"]);
-    strings(operation, ["id", "created_at", "action", "resource_type", "resource_id", "parent_id", "request_id", "trace_id"]);
-    if (!date(operation.created_at)) return invalidAdminResponse();
+    const operation = record(entry, writeauditOperationFields);
+    strings(operation, ["id", "created_at", "action", "resource_id", "parent_id", "request_id", "trace_id"]);
+    if (!date(operation.created_at) || !isOneOf(writeauditOperationActionValues, operation.action) || !isOneOf(writeauditOperationResourceTypeValues, operation.resource_type)) return invalidAdminResponse();
     return { ...operation, api_key: projectProvenance(operation.api_key) };
   });
   return { data, has_more: page.has_more, next_cursor: page.next_cursor } as AdminWriteOperationPage;
 }
 export function projectSummary(value: unknown): AdminSummary {
-  const page = record(value, ["data", "has_more", "next_cursor"]);
+  const page = record(value, adminSummaryResponseFields);
   if (!Array.isArray(page.data) || typeof page.has_more !== "boolean" || typeof page.next_cursor !== "string") return invalidAdminResponse();
   const data = page.data.map((entry) => {
-    const summary = record(entry, ["project_id", "key_id", "agent_id", "assets", "sessions", "usage", "coverage", "last_active_at"]);
+    const summary = record(entry, adminSummaryRowFields);
     strings(summary, ["project_id"]);
     if (!(summary.key_id === null || typeof summary.key_id === "string") ||
       !(summary.agent_id === null || typeof summary.agent_id === "string") ||
       !(summary.last_active_at === null || isNonnegativeInteger(summary.last_active_at))) return invalidAdminResponse();
-    const assets = summary.assets === null ? null : record(summary.assets, ["agents", "skills", "environment_templates", "files", "vaults", "credentials"]);
-    const sessions = record(summary.sessions, ["total", "idle", "in_progress", "requires_action", "failed"]);
-    const coverage = record(summary.coverage, ["measured_sessions", "total_sessions", "ratio"]);
+    const assets = summary.assets === null ? null : record(summary.assets, adminAssetCountsFields);
+    const sessions = record(summary.sessions, adminSessionCountsFields);
+    const coverage = record(summary.coverage, adminUsageCoverageFields);
     const usage = projectTokenUsage(summary.usage, invalidAdminResponse);
     if (usage === null || (assets !== null && Object.values(assets).some((count) => !isNonnegativeInteger(count))) ||
       Object.values(sessions).some((count) => !isNonnegativeInteger(count)) || !isNonnegativeInteger(coverage.measured_sessions) ||
@@ -144,17 +143,16 @@ export function projectSummary(value: unknown): AdminSummary {
       !(coverage.ratio === null || (typeof coverage.ratio === "number" && Number.isFinite(coverage.ratio) && coverage.ratio >= 0 && coverage.ratio <= 1))) return invalidAdminResponse();
     return { ...summary, assets, sessions, coverage, usage };
   });
-  return { data, has_more: page.has_more, next_cursor: page.next_cursor } as AdminSummary;
+  return { data, has_more: page.has_more, next_cursor: page.next_cursor } as unknown as AdminSummary;
 }
 export function projectAdminRuntimePage(value: unknown): ListPage<AdminRuntimeObservation> {
-  const page = record(value, ["object", "data", "has_more", "first_id", "last_id"]);
+  const page = record(value, adminRuntimeObservationListFields);
   if (page.object !== "list" || !Array.isArray(page.data) || typeof page.has_more !== "boolean") return invalidAdminResponse();
   const data = page.data.map((entry) => {
-    const item = record(entry, ["project_id", "observation"]);
+    const item = record(entry, adminRuntimeObservationFields);
     strings(item, ["project_id"]);
-    if (!isRecord(item.observation)) return invalidAdminResponse();
-    // A Core without disk observations omits the field; disk is then unknown.
-    const { disk = null, ...rest } = item.observation;
+    if (!isRecord(item.observation) || !hasOwn(item.observation, "disk")) return invalidAdminResponse();
+    const { disk, ...rest } = item.observation;
     const observation = projectRuntimeObservation(rest);
     return { project_id: item.project_id as string, observation: { ...observation, disk: projectRuntimeDisk(disk, observation.status === "observed") } };
   });
@@ -165,7 +163,7 @@ export function projectAdminRuntimePage(value: unknown): ListPage<AdminRuntimeOb
 
 function projectRuntimeDisk(value: unknown, observed: boolean): RuntimeDiskObservation | null {
   if (value === null) return null;
-  const disk = record(value, ["usage_bytes", "limit_bytes"]);
+  const disk = record(value, runtimeDiskObservationFields);
   const known = (field: unknown) => field === null || isNonnegativeInteger(field);
   if (!observed || !known(disk.usage_bytes) || !known(disk.limit_bytes) || disk.limit_bytes === 0 ||
     (disk.usage_bytes === null && disk.limit_bytes === null)) return invalidAdminResponse();
@@ -173,10 +171,10 @@ function projectRuntimeDisk(value: unknown, observed: boolean): RuntimeDiskObser
 }
 
 export function projectAdminAudit(value: unknown): AdminAuditPage {
-  const page = record(value, ["data", "has_more", "next_cursor"]);
+  const page = record(value, adminauditPageFields);
   if (!Array.isArray(page.data) || typeof page.has_more !== "boolean" || typeof page.next_cursor !== "string") return invalidAdminResponse();
   const data = page.data.map((entry) => {
-    const audit = record(entry, ["id", "created_at", "admin_credential_id", "actor_label", "action", "project_id", "resource_type", "resource_id", "request_id", "trace_id"]);
+    const audit = record(entry, adminauditOperationFields);
     strings(audit, ["id", "created_at", "admin_credential_id", "actor_label", "action", "resource_type", "resource_id", "request_id", "trace_id"]);
     if (!date(audit.created_at) || !(audit.project_id === null || typeof audit.project_id === "string")) return invalidAdminResponse();
     return audit;
@@ -184,52 +182,49 @@ export function projectAdminAudit(value: unknown): AdminAuditPage {
   return { data, has_more: page.has_more, next_cursor: page.next_cursor } as unknown as AdminAuditPage;
 }
 export function projectExecutorCredentials(value: unknown): ExecutorCredentialList {
-  const page = record(value, ["data", "connection"]);
+  const page = record(value, executorCredentialListFields);
   if (!Array.isArray(page.data)) return invalidAdminResponse();
-  const connection = record(page.connection, ["status", "bound_key_id", "enrolled_at", "last_seen_at"]);
-  if (!["never_enrolled", "connected", "disconnected"].includes(connection.status as string) ||
+  const connection = record(page.connection, executorConnectionFields);
+  if (!isOneOf(executorConnectionStatusValues, connection.status) ||
       !(connection.bound_key_id === null || (typeof connection.bound_key_id === "string" && connection.bound_key_id.length > 0)) ||
       !date(connection.enrolled_at) || !date(connection.last_seen_at)) return invalidAdminResponse();
   if (connection.status === "never_enrolled" && [connection.bound_key_id, connection.enrolled_at, connection.last_seen_at].some(value => value !== null)) return invalidAdminResponse();
   if (connection.status !== "never_enrolled" && connection.enrolled_at === null) return invalidAdminResponse();
   if (connection.status === "connected" && connection.bound_key_id === null) return invalidAdminResponse();
   return { connection: { ...connection } as unknown as ExecutorConnection, data: page.data.map((entry) => {
-    const credential = record(entry, ["key_id", "created_at", "revoked_at"]);
+    const credential = record(entry, executorCredentialFields);
     if (typeof credential.key_id !== "string" || typeof credential.created_at !== "string" || !date(credential.created_at) || !date(credential.revoked_at)) return invalidAdminResponse();
     return { key_id: credential.key_id, created_at: credential.created_at, revoked_at: credential.revoked_at as string | null };
   }) };
 }
 /** The one-time credential must belong to the requested key ID and Environment. */
 export function projectIssuedExecutorCredential(value: unknown, keyId: string, environmentId: string): IssuedExecutorCredential {
-  const issued = record(value, ["key_id", "environment_id", "executor_token"]);
+  const issued = record(value, issuedExecutorCredentialFields);
   if (typeof issued.key_id !== "string" || !sameResourceId(issued.key_id, keyId) ||
     typeof issued.environment_id !== "string" || !sameResourceId(issued.environment_id, environmentId) ||
     typeof issued.executor_token !== "string" || !issued.executor_token) return invalidAdminResponse();
   return { key_id: issued.key_id, environment_id: issued.environment_id, executor_token: issued.executor_token };
 }
 
-const providerObservationErrors = new Set<string>(["authentication_error", "connection_failed", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "resource_not_found", "request_timeout", "invalid_request"]);
-const harnessKinds = new Set<string>(coreHarnessKinds);
 /** A deployment default model provider: exactly the safe view, never `api_key`. */
 export function projectHarnessModelConfiguration(value: unknown, harness?: CoreHarnessKind): HarnessModelConfiguration {
-  if (!isRecord(value) || !onlyFields(value, new Set(["object", "harness", "updated_at", "last_used_at", "last_error_code", "last_error_at", "model_provider", "model", "harness_config"]))) return invalidAdminResponse();
+  if (!isRecord(value) || !onlyFields(value, harnessModelConfigurationFields)) return invalidAdminResponse();
   const { object, harness: kind, updated_at, last_used_at, last_error_code, last_error_at, model_provider, model, harness_config } = value;
   if ((last_used_at !== null && (typeof last_used_at !== "string" || !date(last_used_at))) ||
     (last_error_at !== null && (typeof last_error_at !== "string" || !date(last_error_at))) ||
-    (last_error_code !== null && (typeof last_error_code !== "string" || !providerObservationErrors.has(last_error_code))) ||
+    (last_error_code !== null && !isOneOf(harnessModelConfigurationLastErrorCodeValues, last_error_code)) ||
     ((last_error_code === null) !== (last_error_at === null))) return invalidAdminResponse();
-  if (object !== "core.model_configuration" || typeof kind !== "string" || !harnessKinds.has(kind) || (harness !== undefined && kind !== harness) ||
+  if (object !== "core.model_configuration" || !isOneOf(coreHarnessKinds, kind) || (harness !== undefined && kind !== harness) ||
     typeof updated_at !== "string" || !date(updated_at)) return invalidAdminResponse();
   if (typeof model !== "string" || !model.trim() || !isRecord(harness_config)) return invalidAdminResponse();
   const provider = safeProvider(model_provider, invalidAdminResponse);
   if (!provider.api_key_configured) return invalidAdminResponse();
-  return { object, harness: kind as CoreHarnessKind, model_provider: provider, model, harness_config: { ...harness_config }, updated_at, last_used_at, last_error_at, last_error_code: last_error_code as ProviderObservationErrorCode | null };
+  return { object, harness: kind, model_provider: provider, model, harness_config: { ...harness_config }, updated_at, last_used_at, last_error_at, last_error_code };
 }
 function projectModelConfigurationSupport(value: unknown): CoreHarness["model_configuration_support"] {
-  const support = record(value, ["protocols", "accepts_harness_config", "token_limits_required"]);
-  const known: ReadonlySet<unknown> = new Set(modelProviderProtocols);
+  const support = record(value, modelConfigurationSupportFields);
   const protocols = support.protocols;
-  if (!Array.isArray(protocols) || protocols.length === 0 || protocols.some((protocol) => !known.has(protocol)) ||
+  if (!Array.isArray(protocols) || protocols.length === 0 || !protocols.every((protocol) => isOneOf(modelProviderProtocols, protocol)) ||
     new Set(protocols).size !== protocols.length ||
     typeof support.accepts_harness_config !== "boolean" || typeof support.token_limits_required !== "boolean") return invalidAdminResponse();
   return {
@@ -238,13 +233,13 @@ function projectModelConfigurationSupport(value: unknown): CoreHarness["model_co
   };
 }
 export function projectCoreHarnessList(value: unknown): { object: "list"; data: CoreHarness[] } {
-  const page = record(value, ["object", "data"]);
+  const page = record(value, coreHarnessListFields);
   if (page.object !== "list" || !Array.isArray(page.data)) return invalidAdminResponse();
   const data = page.data.map((entry): CoreHarness => {
-    const harness = record(entry, ["object", "id", "enabled", "default", "model_configuration", "model_configuration_support"]);
-    if (harness.object !== "core.harness" || typeof harness.id !== "string" || !harnessKinds.has(harness.id) ||
+    const harness = record(entry, coreHarnessFields);
+    if (harness.object !== "core.harness" || !isOneOf(coreHarnessKinds, harness.id) ||
       typeof harness.enabled !== "boolean" || typeof harness.default !== "boolean" || (harness.default && !harness.enabled)) return invalidAdminResponse();
-    const id = harness.id as CoreHarnessKind;
+    const id = harness.id;
     return {
       object: "core.harness", id, enabled: harness.enabled, default: harness.default,
       model_configuration_support: projectModelConfigurationSupport(harness.model_configuration_support),
@@ -255,28 +250,27 @@ export function projectCoreHarnessList(value: unknown): { object: "list"; data:
   return { object: "list", data };
 }
 const settingKey = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$/;
-const settingServices = new Set(["core", "web", "database"]);
 function projectInstallationSetting(value: unknown): CoreInstallationSetting {
-  const base = ["key", "value", "default", "changeable", "sensitive", "restarts"];
   if (!isRecord(value) || typeof value.sensitive !== "boolean") return invalidAdminResponse();
-  const setting = record(value, value.sensitive ? [...base, "configured"] : base);
+  // `configured` is present exactly for a sensitive setting.
+  const setting = record(value, value.sensitive ? installationSettingFields : installationSettingRequired);
   if (typeof setting.key !== "string" || !settingKey.test(setting.key) || typeof setting.changeable !== "boolean" ||
-    !Array.isArray(setting.restarts) || !setting.restarts.every((service) => typeof service === "string" && settingServices.has(service)) ||
+    !Array.isArray(setting.restarts) || !setting.restarts.every((service) => isOneOf(installationSettingRestartsValues, service)) ||
     (setting.sensitive && (setting.value !== null || setting.default !== null || typeof setting.configured !== "boolean"))) return invalidAdminResponse();
   return { ...setting } as unknown as CoreInstallationSetting;
 }
 /** Sensitive settings carry no value, keys are unique and binding counts are consistent. */
 export function projectInstallation(value: unknown): CoreInstallation {
-  const installation = record(value, ["object", "installation_id", "public_url", "api_base_url", "local_only", "source_commit", "configuration", "address_bindings"]);
+  const installation = record(value, installationFields);
   const origin = installation.public_url;
   if (installation.object !== "core.installation" || canonicalUuid(installation.installation_id) === null ||
     typeof origin !== "string" || installation.api_base_url !== `${origin}/v1` ||
     typeof installation.local_only !== "boolean" ||
     (installation.source_commit !== null && (typeof installation.source_commit !== "string" || !/^[0-9a-f]{40}$/.test(installation.source_commit)))) return invalidAdminResponse();
-  const bindings = record(installation.address_bindings, ["nodes", "nodes_on_other_address", "hosted_sandboxes", "self_hosted_executors"]);
+  const bindings = record(installation.address_bindings, addressBindingsFields);
   if (![bindings.nodes, bindings.nodes_on_other_address, bindings.hosted_sandboxes, bindings.self_hosted_executors].every(isNonnegativeInteger) ||
     (bindings.nodes_on_other_address as number) > (bindings.nodes as number)) return invalidAdminResponse();
-  const configuration = record(installation.configuration, ["settings"]);
+  const configuration = record(installation.configuration, installationConfigurationFields);
   if (!Array.isArray(configuration.settings)) return invalidAdminResponse();
   const settings = configuration.settings.map(projectInstallationSetting);
   if (new Set(settings.map((setting) => setting.key)).size !== settings.length) return invalidAdminResponse();
diff --git a/packages/agents-client/src/admin-types.ts b/packages/agents-client/src/admin-types.ts
index 815592d83..266296360 100644
--- a/packages/agents-client/src/admin-types.ts
+++ b/packages/agents-client/src/admin-types.ts
@@ -1,5 +1,50 @@
-import type { PageOptions } from "./types";
+import type {
+  AddressBindings, AdminauditOperation, AdminauditPage, AdminRuntimeObservationDetail, AdminSessionArchiveRequest, AdminSummaryResponse,
+  AdminSummaryRow, EnvironmentExecutorCredentialRequest, Installation, InstallationConfiguration, InstallationSetting, IssuedAPIKey,
+  IssuedExecutorCredential as IssuedExecutorCredentialResource, ManagedArchive, Project, ProjectAPIKeyRequest, ProjectRequest, ProjectsAPIKey,
+  ResourceOwner, WriteauditAPIKey, WriteauditOperation, WriteauditOperationResourceType, WriteauditPage,
+} from "./generated/core-api";
+import type { PageOptions, RuntimeObservation } from "./types";
 
+export type { ExecutorConnection, ExecutorCredential, ExecutorCredentialList, RuntimeDiskObservation } from "./generated/core-api";
+export { writeauditOperationResourceTypeValues as adminResourceTypes } from "./generated/core-api";
+
+// Generated types keep their schema names in ./generated/core-api; these are the client's names for them.
+export type AdminProject = Project;
+export type CreateAdminProjectInput = ProjectRequest;
+export type RenameAdminProjectInput = ProjectRequest;
+export type AdminAPIKey = ProjectsAPIKey;
+export type AdminIssuedAPIKey = IssuedAPIKey;
+export type IssueAdminAPIKeyInput = ProjectAPIKeyRequest;
+export type ArchiveAdminSessionInput = AdminSessionArchiveRequest;
+/** Current resource disposition; released does not imply that the active Turn has finalized. */
+export type AdminSessionArchive = ManagedArchive;
+export type AdminResourceType = WriteauditOperationResourceType;
+export type AdminKeyProvenance = WriteauditAPIKey;
+/** `api_key` is null when Core has no creation record. */
+export type AdminResourceOwner = ResourceOwner;
+export type AdminWriteOperation = WriteauditOperation;
+export type AdminWriteOperationPage = WriteauditPage;
+export type AdminSummaryEntry = AdminSummaryRow;
+export type AdminSummary = AdminSummaryResponse;
+export type AdminAuditEntry = AdminauditOperation;
+export type AdminAuditPage = AdminauditPage;
+/** `key_id` is chosen by the caller, so an uncertain issuance can be reissued with the same ID and `rotate: true`. */
+export type IssueExecutorCredentialInput = EnvironmentExecutorCredentialRequest;
+// This route always restricts the credential to its Environment, so environment_id is always present.
+export type IssuedExecutorCredential = Required<IssuedExecutorCredentialResource>;
+export type CoreAddressBindings = AddressBindings;
+export type CoreInstallationSetting = InstallationSetting;
+export type CoreInstallationConfiguration = InstallationConfiguration;
+export type CoreInstallation = Installation;
+
+// The schema's flat observation cannot state each mode's null rules; the client's RuntimeObservation union does.
+export interface AdminRuntimeObservation {
+  project_id: string;
+  observation: RuntimeObservation & Pick<AdminRuntimeObservationDetail, "disk">;
+}
+
+// Call options and receipts the client composes; they are not schema definitions.
 export interface AdminClientOptions {
   /** Prefix that request paths are appended to; defaults to `/core/v1`. */
   baseUrl?: string;
@@ -8,88 +53,12 @@ export interface AdminClientOptions {
   /** Fetch implementation; defaults to the global fetch. */
   fetch?: typeof fetch;
 }
-
-export interface AdminProject {
-  id: string;
-  name: string;
-  created_at: string;
-  archived_at: string | null;
-  active_key_count: number;
-}
-export interface CreateAdminProjectInput { name: string }
-export interface RenameAdminProjectInput { name: string }
-export interface AdminAPIKey {
-  id: string;
-  project_id: string;
-  name: string;
-  prefix: string;
-  created_at: string;
-  revoked_at: string | null;
-}
-export interface AdminIssuedAPIKey extends AdminAPIKey { key: string }
-export interface IssueAdminAPIKeyInput { name: string }
+/** The project and key pages; the schema repeats this envelope for each. */
 export interface AdminPage<T> { data: T[]; has_more: boolean }
+/** Deletion receipts of the `/v1` objects administrators delete; `deleted` is always true. */
 export interface AdminDeleted<O extends string = string> { id: string; object: O; deleted: true }
-export interface ArchiveAdminSessionInput { expected_generation: number }
-/** Current resource disposition; released does not imply that the active Turn has finalized. */
-export interface AdminSessionArchive {
-  session_id: string;
-  environment_id: string;
-  state: "active" | "cleanup_pending" | "released";
-}
-export interface Skill {
-  id: string;
-  object: "skill";
-  created_at: number;
-  name: string;
-  description: string;
-  default_version: string;
-  latest_version: string;
-}
-export interface SkillVersion {
-  id: string;
-  object: "skill.version";
-  created_at: number;
-  skill_id: string;
-  version: string;
-  name: string;
-  description: string;
-}
-export interface SessionArtifact {
-  id: string;
-  object: "agent.session.artifact";
-  created_at: number;
-  environment_id: string;
-  path: string;
-  session_id: string;
-  size_bytes: number;
-  turn_id: string;
-}
+/** A downloaded body; it is not JSON. */
 export interface AdminContent { blob: Blob; contentType: string | null; contentDisposition: string | null }
-export type AdminResourceType = "agent" | "skill" | "environment_template" | "file" | "vault" | "credential" | "session" | "environment" | "skill_version" | "artifact";
-export interface AdminKeyProvenance {
-  id: string;
-  name: string;
-  prefix: string;
-  kind: "issued";
-  revoked_at: string | null;
-}
-/** `api_key` is null when Core has no creation record. */
-export interface AdminResourceOwner {
-  resource_id: string;
-  api_key: AdminKeyProvenance | null;
-}
-export interface AdminWriteOperation {
-  id: string;
-  created_at: string;
-  api_key: AdminKeyProvenance | null;
-  action: string;
-  resource_type: AdminResourceType;
-  resource_id: string;
-  parent_id: string;
-  request_id: string;
-  trace_id: string;
-}
 export interface AdminWriteOperationOptions extends Omit<PageOptions, "order"> {
   key_id?: string;
   resource_type?: AdminResourceType;
@@ -97,113 +66,14 @@ export interface AdminWriteOperationOptions extends Omit<PageOptions, "order"> {
   created_after?: string;
   created_before?: string;
 }
-export interface AdminWriteOperationPage extends AdminPage<AdminWriteOperation> { next_cursor: string }
-
 export interface AdminSummaryOptions extends PageOptions {
   project_id?: string;
   group_by?: "project" | "agent" | "key";
   created_after?: string;
   created_before?: string;
 }
-export interface AdminSummaryEntry {
-  project_id: string;
-  /** Session creation provenance for key grouping; null includes unknown creators. */
-  key_id: string | null;
-  agent_id: string | null;
-  assets: { agents: number; skills: number; environment_templates: number; files: number; vaults: number; credentials: number } | null;
-  sessions: { total: number; idle: number; in_progress: number; requires_action: number; failed: number };
-  usage: import("./types").TokenUsage;
-  coverage: { measured_sessions: number; total_sessions: number; ratio: number | null };
-  last_active_at: number | null;
-}
-export interface AdminSummary extends AdminPage<AdminSummaryEntry> { next_cursor: string }
-/** Current disk usage and capacity; E2B reports them, Docker and microsandbox return null. */
-export interface RuntimeDiskObservation { usage_bytes: number | null; limit_bytes: number | null }
-/** The administrator list adds disk to the project observation shape. */
-export interface AdminRuntimeObservation {
-  project_id: string;
-  observation: import("./types").RuntimeObservation & { disk: RuntimeDiskObservation | null };
-}
-
 export interface AdminAuditOptions extends Omit<AdminWriteOperationOptions, "resource_type" | "key_id"> {
   project_id?: string;
   action?: string;
   resource_type?: string;
 }
-export interface AdminAuditEntry {
-  id: string;
-  created_at: string;
-  admin_credential_id: string;
-  actor_label: string;
-  action: string;
-  /** Null for deployment-wide writes, such as deployment default model providers. */
-  project_id: string | null;
-  resource_type: string;
-  resource_id: string;
-  request_id: string;
-  trace_id: string;
-}
-export interface AdminAuditPage extends AdminPage<AdminAuditEntry> { next_cursor: string }
-
-/** Executor credential metadata for one self_hosted environment; the credential itself is never listed. */
-export interface ExecutorCredential { key_id: string; created_at: string; revoked_at: string | null }
-/** Core authority plus a matching live gateway peer; timestamps alone are not readiness. */
-export interface ExecutorConnection {
-  status: "never_enrolled" | "connected" | "disconnected";
-  bound_key_id: string | null;
-  enrolled_at: string | null;
-  last_seen_at: string | null;
-}
-export interface ExecutorCredentialList { data: ExecutorCredential[]; connection: ExecutorConnection }
-
-/** `key_id` is chosen by the caller, so an uncertain issuance can be reissued with the same ID and `rotate: true`. */
-export interface IssueExecutorCredentialInput { key_id: string; rotate?: boolean }
-/** Returned once, on issuance or rotation. */
-export interface IssuedExecutorCredential { key_id: string; environment_id: string; executor_token: string }
-
-/** What is bound to the installation public URL; a change of that URL affects all of it. */
-export interface CoreAddressBindings {
-  /** Enrolled nodes that are not removed. */
-  nodes: number;
-  /** Nodes enrolled with another address; they receive no new sandboxes until re-added. At most `nodes`. */
-  nodes_on_other_address: number;
-  /** Retained and pending hosted sandboxes, which were started with the address current at the time. */
-  hosted_sandboxes: number;
-  /** Unrevoked self-hosted executor credentials, whose executors were installed with an advertised remote_url. */
-  self_hosted_executors: number;
-}
-/** One process setting from the installation's config.json, as last applied. */
-export interface CoreInstallationSetting {
-  /** Dotted config.json key, such as `ports.core`. Unique within the snapshot. */
-  key: string;
-  /** Applied JSON value; always null for a sensitive setting. */
-  value: unknown;
-  default: unknown;
-  /** Present exactly for a sensitive setting: whether it has a value. */
-  configured?: boolean;
-  /** False for settings fixed at installation. */
-  changeable: boolean;
-  sensitive: boolean;
-  /** Services that restart when the setting changes. */
-  restarts: ("core" | "web" | "database")[];
-}
-/** The process settings Core loaded. */
-export interface CoreInstallationConfiguration {
-  settings: CoreInstallationSetting[];
-}
-/** `GET /core/v1/installation`: available before any sandbox deployment exists. */
-export interface CoreInstallation {
-  object: "core.installation";
-  installation_id: string;
-  /** The origin applications, nodes, sandboxes and self-hosted executors use. */
-  public_url: string;
-  /** `public_url` followed by `/v1`; the base URL for application API keys. */
-  api_base_url: string;
-  /** True when `public_url` is a loopback origin that only the Core host reaches. */
-  local_only: boolean;
-  /** Full source commit Core was built from; null for development builds. */
-  source_commit: string | null;
-  /** The process settings Core loaded. */
-  configuration: CoreInstallationConfiguration;
-  address_bindings: CoreAddressBindings;
-}
diff --git a/packages/agents-client/src/client.ts b/packages/agents-client/src/client.ts
index aac1fd365..5beb09c3a 100644
--- a/packages/agents-client/src/client.ts
+++ b/packages/agents-client/src/client.ts
@@ -23,6 +23,10 @@ import {
   textFormatResourceFields, textResourceFields, vaultCredentialResourceFields, vaultListResourceFields, vaultResourceFields,
   verbosityResourceValues,
 } from "./generated/public-api";
+import {
+  runtimeCPUObservationFields, runtimeInstanceFields, runtimeMemoryObservationFields, runtimeObservationFields,
+  runtimeObservationLifecycleStateValues, runtimeObservationModeValues, runtimeObservationReasonValues, runtimeObservationStatusValues,
+} from "./generated/core-api";
 import { projectTokenUsage } from "./usage-projection";
 import { projectAgentTurn, projectSessionItem, projectItemContent, projectHistoryPage } from "./history-projection";
 import { projectOpenAIHostedSessionEnvironment } from "./session-environment-projection";
@@ -240,19 +244,7 @@ const maxSourceFileListLimit = 10000;
 const unsafeUnknownEventFields = new Set([
   "session", "turn", "turn_id", "item", "item_id", "output_index", "content_index", "part", "delta", "text", "error", "environment",
 ]);
-const runtimeObservationFields = new Set([
-  "id", "object", "session_id", "environment_id", "mode", "provider_type", "instance", "status", "reason",
-  "lifecycle_state", "allocation_created_at", "resolved_at", "observed_at", "started_at", "cpu", "memory",
-]);
-const runtimeInstanceFields = new Set(["kind", "allocation_id", "device_id", "connection_generation"]);
-const runtimeCPUFields = new Set(["usage_seconds_total", "capacity_cores", "usage_cores", "utilization_ratio"]);
-const runtimeMemoryFields = new Set(["usage_bytes", "limit_bytes"]);
-const runtimeObservationReasons = new Set([
-  "runtime_mode_not_observable", "allocation_pending", "runtime_not_running",
-  "sample_timeout", "sample_unavailable",
-]);
 const runtimeProviderTypePattern = /^[a-z][a-z0-9_]{0,31}$/;
-const runtimeLifecycleStates = new Set(["active", "sleeping", "transitioning", "pending", "stopped"]);
 function invalidSessionInputBatch(): never {
   throw new TypeError("Invalid Session input event batch.");
 }
@@ -886,15 +878,13 @@ export function projectRuntimeObservation(value: unknown, expectedSessionId?: st
     id === null || sessionId === null || id !== sessionId ||
     (expectedSessionId !== undefined && !sameUuid(sessionId, expectedSessionId)) ||
     value.object !== "agent.runtime_observation" ||
-    (value.mode !== "none" && value.mode !== "self_hosted" && value.mode !== "openai_hosted") ||
+    !isOneOf(runtimeObservationModeValues, value.mode) ||
     !(value.provider_type === null || (
       typeof value.provider_type === "string" && runtimeProviderTypePattern.test(value.provider_type)
     )) ||
     !isRecord(value.instance) || !exactFields(value.instance, runtimeInstanceFields) ||
-    (value.status !== "observed" && value.status !== "unsupported" && value.status !== "unavailable") ||
-    !(value.reason === null || (
-      typeof value.reason === "string" && runtimeObservationReasons.has(value.reason)
-    )) ||
+    !isOneOf(runtimeObservationStatusValues, value.status) ||
+    !(value.reason === null || isOneOf(runtimeObservationReasonValues, value.reason)) ||
     !isNonnegativeInteger(value.resolved_at)
   ) return invalidRuntimeObservation();
 
@@ -927,7 +917,7 @@ export function projectRuntimeObservation(value: unknown, expectedSessionId?: st
     )) ||
     (isManaged && (
       value.instance.kind !== "managed_allocation" || environmentId === null || connectionGeneration !== null ||
-      !runtimeLifecycleStates.has(String(value.lifecycle_state)) ||
+      !isOneOf(runtimeObservationLifecycleStateValues, value.lifecycle_state) ||
       (allocationId === null && (deviceId !== null || allocationCreatedAt !== null))
     ))
   ) return invalidRuntimeObservation();
@@ -953,7 +943,7 @@ export function projectRuntimeObservation(value: unknown, expectedSessionId?: st
 
   let cpu: RuntimeObservation["cpu"] = null;
   if (value.cpu !== null) {
-    if (!observed || !isRecord(value.cpu) || !exactFields(value.cpu, runtimeCPUFields)) {
+    if (!observed || !isRecord(value.cpu) || !exactFields(value.cpu, runtimeCPUObservationFields)) {
       return invalidRuntimeObservation();
     }
     cpu = {
@@ -970,7 +960,7 @@ export function projectRuntimeObservation(value: unknown, expectedSessionId?: st
 
   let memory: RuntimeObservation["memory"] = null;
   if (value.memory !== null) {
-    if (!observed || !isRecord(value.memory) || !exactFields(value.memory, runtimeMemoryFields)) {
+    if (!observed || !isRecord(value.memory) || !exactFields(value.memory, runtimeMemoryObservationFields)) {
       return invalidRuntimeObservation();
     }
     memory = {
diff --git a/packages/agents-client/src/core-metrics.ts b/packages/agents-client/src/core-metrics.ts
index d1b14ceeb..43cd21e9e 100644
--- a/packages/agents-client/src/core-metrics.ts
+++ b/packages/agents-client/src/core-metrics.ts
@@ -1,111 +1,25 @@
 import { AgentCoreError } from "./client";
 import { CoreRequester, type CoreClientOptions } from "./core-request";
+import { isOneOf } from "./response-projection";
 import type { ReadOptions } from "./types";
+import { jobStatusValues, serviceStateStatusValues, type CoremetricsView, type JobStatus, type Latency, type ServiceState, type ServiceStateStatus } from "./generated/core-api";
 
 function invalidCoreMetrics(): never {
   throw new AgentCoreError("Core metrics: the response is not JSON.", 0, "invalid_response");
 }
 
+export type CoreMetricsRange = "1h" | "6h" | "24h" | "7d";
+export type CoreJobStatus = JobStatus;
 /**
  * Core's own health as the one `oac-core` process sees it: execution slots
  * and the Turn queue (a Postgres table polled by the worker), connected
  * daemons, the PostgreSQL database, background jobs and the process itself.
  * `GET /core/v1/metrics`, defined in
  * contracts/agents-api/core-metrics.md; every figure Core cannot measure is
- * null, never zero.
+ * null, never zero. The client reads a service status it does not recognise
+ * as `unknown`, which is never shown as running.
  */
-export type CoreMetricsRange = "1h" | "6h" | "24h" | "7d";
-export type CoreJobStatus = "ok" | "failing" | "stopped" | "unknown";
-
-export interface CoreLatency {
-  p50: number | null;
-  p95: number | null;
-}
-
-export interface CoreExecutionBucket {
-  start: string;
-  /** Highest queued Turn count seen in the bucket. */
-  queued: number | null;
-  /** Highest in-progress Turn count seen in the bucket. */
-  in_progress: number | null;
-  queue_wait_p95_ms: number | null;
-}
-
-export interface CoreDatabaseBucket {
-  start: string;
-  ping_p95_ms: number | null;
-  pool_in_use: number | null;
-}
-
-export interface CoreProcessBucket {
-  start: string;
-  /** Highest CPU use observed in the bucket, in cores. */
-  cpu_cores: number | null;
-  /** Highest resident memory observed in the bucket. */
-  rss_bytes: number | null;
-}
-
-export interface CoreJob {
-  /** `scheduler`, `runtime_sampler`, `history_cleanup`, `audit_cleanup`, or another bounded name. */
-  id: string;
-  status: CoreJobStatus;
-  last_run_at: string | null;
-  /** Items the last run handled (Turns dispatched, Runtimes sampled, rows removed). */
-  processed: number | null;
-  failed: number | null;
-}
-
-export interface CoreMetrics {
-  object: "core.metrics";
-  range: { start: string; end: string; resolution_seconds: number };
-  service: {
-    /** `unknown` stands for a status this client does not recognise; it is never shown as running. */
-    status: "running" | "degraded" | "unknown";
-    /** Build revision (source commit) of the running Core. */
-    revision: string | null;
-    started_at: string | null;
-    /** Whether this process holds the database's execution lease. */
-    execution_owner: boolean | null;
-  };
-  execution: {
-    slots_in_use: number;
-    slots_total: number;
-    queued_turns: number | null;
-    /** Queued Turns whose Session has no connected daemon (part of queued_turns). */
-    waiting_for_daemon: number | null;
-    in_progress_turns: number | null;
-    oldest_queued_seconds: number | null;
-    connected_daemons: number;
-    /** Turns failed with execution_interrupted in the range. */
-    interrupted: number | null;
-    /** Requests refused with execution_unavailable in the range. */
-    unavailable: number | null;
-    queue_wait_ms: CoreLatency;
-    series: CoreExecutionBucket[];
-  };
-  database: {
-    ping_ms: CoreLatency;
-    pool: { in_use: number | null; idle: number | null; max: number | null };
-    size_bytes: number | null;
-    series: CoreDatabaseBucket[];
-  };
-  jobs: CoreJob[];
-  process: {
-    /** Go heap in use (runtime.MemStats.Alloc), not resident memory. */
-    memory_bytes: number | null;
-    goroutines: number | null;
-    /**
-     * CPU used over the last sample interval, in cores; the CPU available to
-     * the process; resident memory; its memory limit; and a series
-     * (contracts/agents-api/core-metrics.md). Null when Core cannot measure them.
-     */
-    cpu_cores: number | null;
-    cpu_limit_cores: number | null;
-    rss_bytes: number | null;
-    memory_limit_bytes: number | null;
-    series: CoreProcessBucket[];
-  };
-}
+export type CoreMetrics = Omit<CoremetricsView, "service"> & { service: Omit<ServiceState, "status"> & { status: ServiceStateStatus | "unknown" } };
 
 type Json = Record<string, unknown>;
 
@@ -138,13 +52,11 @@ function list<T>(value: unknown, item: (entry: Json, index: number) => T, path:
   return value.map((entry, index) => item(record(entry, `${path}[${index}]`), index));
 }
 
-function latency(value: unknown): CoreLatency {
+function latency(value: unknown): Latency {
   const entry = optional(value);
   return { p50: number(entry.p50), p95: number(entry.p95) };
 }
 
-const jobStatuses = new Set<CoreJobStatus>(["ok", "failing", "stopped", "unknown"]);
-
 /** Validates the envelope and normalises every missing figure to null. */
 export function projectCoreMetrics(value: unknown): CoreMetrics {
   const body = record(value, "response");
@@ -155,7 +67,7 @@ export function projectCoreMetrics(value: unknown): CoreMetrics {
   const database = optional(body.database);
   const pool = optional(database.pool);
   const process = optional(body.process);
-  const status = service.status === "running" || service.status === "degraded" ? service.status : "unknown";
+  const status = isOneOf(serviceStateStatusValues, service.status) ? service.status : "unknown";
   const resolution = number(range.resolution_seconds);
   if (resolution === null || resolution <= 0) throw new AgentCoreError("Core metrics: range.resolution_seconds is missing.", 0, "invalid_response");
   return {
@@ -197,7 +109,7 @@ export function projectCoreMetrics(value: unknown): CoreMetrics {
     },
     jobs: list(body.jobs, (entry, index) => ({
       id: String(entry.id ?? index),
-      status: jobStatuses.has(entry.status as CoreJobStatus) ? entry.status as CoreJobStatus : "unknown",
+      status: isOneOf(jobStatusValues, entry.status) ? entry.status : "unknown",
       last_run_at: text(entry.last_run_at),
       processed: number(entry.processed),
       failed: number(entry.failed),
diff --git a/packages/agents-client/src/execution-configuration-projection.ts b/packages/agents-client/src/execution-configuration-projection.ts
index 577a2fd36..efaca3016 100644
--- a/packages/agents-client/src/execution-configuration-projection.ts
+++ b/packages/agents-client/src/execution-configuration-projection.ts
@@ -1,27 +1,29 @@
 import { modelProviderProtocols } from "./harness-catalog";
-import { canonicalUuid, exactFields, isNonnegativeInteger, isRecord, onlyFields, sameResourceId } from "./response-projection";
 import { modelProviderViewFields } from "./generated/public-api";
-import type { ExecutionConfigurationSource, ModelProviderView, SessionExecutionConfiguration } from "./types";
+import {
+  executionHarnessConfigSelectionFields, executionProviderSelectionFields, executionSelectionFields, executionSelectionSourceValues,
+  sessionExecutionConfigurationFields, type ExecutionSelectionSource,
+} from "./generated/core-api";
+import { canonicalUuid, exactFields, isNonnegativeInteger, isOneOf, isRecord, onlyFields, sameResourceId } from "./response-projection";
+import type { ModelProviderView, SessionExecutionConfiguration } from "./types";
 
 type Invalid = () => never;
-const sources = new Set(["session", "agent", "deployment", "unknown"]);
-const selectionFields = new Set(["value", "source"]);
 const protocols: ReadonlySet<unknown> = new Set(modelProviderProtocols);
 
 function selection(value: unknown, invalid: Invalid): SessionExecutionConfiguration["model"] {
-  if (!isRecord(value) || !exactFields(value, selectionFields) || !sources.has(String(value.source)) ||
+  if (!isRecord(value) || !exactFields(value, executionSelectionFields) || !isOneOf(executionSelectionSourceValues, value.source) ||
     (value.value !== null && (typeof value.value !== "string" || value.value.length === 0)) ||
     (value.value === null && value.source !== "unknown")) return invalid();
-  return { value: value.value as string | null, source: value.source as ExecutionConfigurationSource };
+  return { value: value.value as string | null, source: value.source as ExecutionSelectionSource };
 }
 
 // Splits an absolute URL as RFC 3986 appendix B does, without parsing its host.
 const baseURLPattern = /^https:\/\/([^/?#]*)[^?#]*(?:\?([^#]*))?(?:#([\s\S]*))?$/iu;
 
 /**
- * Checks a stored base URL no more strictly than Core's write rule: HTTPS with a
- * host and no credentials, query or fragment. Host syntax is Core's to enforce;
- * a value an earlier Core accepted must not fail a whole list.
+ * Checks a stored base URL as Core's write rule does, never more strictly:
+ * HTTPS with a host and no credentials, query or fragment. Host syntax is
+ * Core's to enforce, so one stored value never fails a whole list.
  */
 function safeBaseURL(value: string): boolean {
   const match = baseURLPattern.exec(value);
@@ -48,13 +50,13 @@ export function safeProvider(value: unknown, invalid: Invalid): ModelProviderVie
 }
 
 export function projectExecutionConfiguration(value: unknown, sessionId: string, invalid: Invalid): SessionExecutionConfiguration {
-  if (!isRecord(value) || !exactFields(value, new Set(["object", "schema_version", "session_id", "model", "harness", "model_provider", "harness_config"])) ||
+  if (!isRecord(value) || !exactFields(value, sessionExecutionConfigurationFields) ||
     value.object !== "agent.session.execution_configuration" || value.schema_version !== 1 ||
     typeof value.session_id !== "string" || !canonicalUuid(value.session_id) || !sameResourceId(value.session_id, sessionId) ||
-    !isRecord(value.model_provider) || !exactFields(value.model_provider, new Set(["source", "status", "configuration"]))) return invalid();
+    !isRecord(value.model_provider) || !exactFields(value.model_provider, executionProviderSelectionFields)) return invalid();
   const native = value.harness_config;
-  if (!isRecord(native) || !exactFields(native, selectionFields) || !isRecord(native.value) ||
-    !sources.has(String(native.source)) || (native.source === "unknown" && Object.keys(native.value).length !== 0)) return invalid();
+  if (!isRecord(native) || !exactFields(native, executionHarnessConfigSelectionFields) || !isRecord(native.value) ||
+    !isOneOf(executionSelectionSourceValues, native.source) || (native.source === "unknown" && Object.keys(native.value).length !== 0)) return invalid();
   const provider = value.model_provider;
   let configuration: ModelProviderView | null = null;
   if (provider.status === "available" && (provider.source === "session" || provider.source === "agent" || provider.source === "deployment")) {
@@ -64,7 +66,7 @@ export function projectExecutionConfiguration(value: unknown, sessionId: string,
   return {
     object: "agent.session.execution_configuration", schema_version: 1, session_id: value.session_id,
     model: selection(value.model, invalid), harness: selection(value.harness, invalid),
-    harness_config: { value: { ...native.value }, source: native.source as ExecutionConfigurationSource },
-    model_provider: { source: provider.source as ExecutionConfigurationSource, status: provider.status as SessionExecutionConfiguration["model_provider"]["status"], configuration },
+    harness_config: { value: { ...native.value }, source: native.source as ExecutionSelectionSource },
+    model_provider: { source: provider.source as ExecutionSelectionSource, status: provider.status as SessionExecutionConfiguration["model_provider"]["status"], configuration },
   };
 }
diff --git a/packages/agents-client/src/generated/core-api.ts b/packages/agents-client/src/generated/core-api.ts
new file mode 100644
index 000000000..b930cfad5
--- /dev/null
+++ b/packages/agents-client/src/generated/core-api.ts
@@ -0,0 +1,907 @@
+// Code generated by scripts/generate-public-api.py from contracts/agents-api/core.openapi.yaml; DO NOT EDIT.
+import type { ModelProviderInput, ModelProviderView, TokenUsageResource } from "./public-api";
+
+export interface AddressBindings {
+  hosted_sandboxes: number;
+  nodes: number;
+  nodes_on_other_address: number;
+  self_hosted_executors: number;
+}
+export const addressBindingsFields = ["hosted_sandboxes", "nodes", "nodes_on_other_address", "self_hosted_executors"] as const;
+export interface AdminAssetCounts {
+  agents: number;
+  credentials: number;
+  environment_templates: number;
+  files: number;
+  skills: number;
+  vaults: number;
+}
+export const adminAssetCountsFields = ["agents", "credentials", "environment_templates", "files", "skills", "vaults"] as const;
+export interface AdminRuntimeObservation {
+  observation: AdminRuntimeObservationDetail;
+  project_id: string;
+}
+export const adminRuntimeObservationFields = ["observation", "project_id"] as const;
+export interface AdminRuntimeObservationDetail {
+  allocation_created_at: number | null;
+  cpu: RuntimeCPUObservation | null;
+  disk: RuntimeDiskObservation | null;
+  environment_id: string | null;
+  id: string;
+  instance: RuntimeInstance;
+  lifecycle_state: AdminRuntimeObservationDetailLifecycleState | null;
+  memory: RuntimeMemoryObservation | null;
+  mode: AdminRuntimeObservationDetailMode;
+  object: "agent.runtime_observation";
+  observed_at: number | null;
+  provider_type: string | null;
+  reason: AdminRuntimeObservationDetailReason | null;
+  resolved_at: number;
+  session_id: string;
+  started_at: number | null;
+  status: AdminRuntimeObservationDetailStatus;
+}
+export const adminRuntimeObservationDetailFields = ["allocation_created_at", "cpu", "disk", "environment_id", "id", "instance", "lifecycle_state", "memory", "mode", "object", "observed_at", "provider_type", "reason", "resolved_at", "session_id", "started_at", "status"] as const;
+export const adminRuntimeObservationDetailLifecycleStateValues = ["active", "sleeping", "transitioning", "pending", "stopped"] as const;
+export type AdminRuntimeObservationDetailLifecycleState = (typeof adminRuntimeObservationDetailLifecycleStateValues)[number];
+export const adminRuntimeObservationDetailModeValues = ["none", "self_hosted", "openai_hosted"] as const;
+export type AdminRuntimeObservationDetailMode = (typeof adminRuntimeObservationDetailModeValues)[number];
+export const adminRuntimeObservationDetailReasonValues = ["runtime_mode_not_observable", "allocation_pending", "runtime_not_running", "sample_timeout", "sample_unavailable"] as const;
+export type AdminRuntimeObservationDetailReason = (typeof adminRuntimeObservationDetailReasonValues)[number];
+export const adminRuntimeObservationDetailStatusValues = ["observed", "unsupported", "unavailable"] as const;
+export type AdminRuntimeObservationDetailStatus = (typeof adminRuntimeObservationDetailStatusValues)[number];
+export interface AdminRuntimeObservationList {
+  data: AdminRuntimeObservation[];
+  first_id: string | null;
+  has_more: boolean;
+  last_id: string | null;
+  object: "list";
+}
+export const adminRuntimeObservationListFields = ["data", "first_id", "has_more", "last_id", "object"] as const;
+export interface AdminSessionArchiveRequest {
+  expected_generation: number;
+}
+export const adminSessionArchiveRequestFields = ["expected_generation"] as const;
+export interface AdminSessionCounts {
+  failed: number;
+  idle: number;
+  in_progress: number;
+  requires_action: number;
+  total: number;
+}
+export const adminSessionCountsFields = ["failed", "idle", "in_progress", "requires_action", "total"] as const;
+export interface AdminSummaryResponse {
+  data: AdminSummaryRow[];
+  has_more: boolean;
+  next_cursor: string;
+}
+export const adminSummaryResponseFields = ["data", "has_more", "next_cursor"] as const;
+export interface AdminSummaryRow {
+  agent_id: string | null;
+  assets: AdminAssetCounts | null;
+  coverage: AdminUsageCoverage;
+  key_id: string | null;
+  last_active_at: number | null;
+  project_id: string;
+  sessions: AdminSessionCounts;
+  usage: TokenUsageResource;
+}
+export const adminSummaryRowFields = ["agent_id", "assets", "coverage", "key_id", "last_active_at", "project_id", "sessions", "usage"] as const;
+export interface AdminUsageCoverage {
+  measured_sessions: number;
+  ratio: number | null;
+  total_sessions: number;
+}
+export const adminUsageCoverageFields = ["measured_sessions", "ratio", "total_sessions"] as const;
+export interface AdminauditOperation {
+  action: string;
+  actor_label: string;
+  admin_credential_id: string;
+  created_at: string;
+  id: string;
+  project_id: string | null;
+  request_id: string;
+  resource_id: string;
+  resource_type: string;
+  trace_id: string;
+}
+export const adminauditOperationFields = ["action", "actor_label", "admin_credential_id", "created_at", "id", "project_id", "request_id", "resource_id", "resource_type", "trace_id"] as const;
+export interface AdminauditPage {
+  data: AdminauditOperation[];
+  has_more: boolean;
+  next_cursor: string;
+}
+export const adminauditPageFields = ["data", "has_more", "next_cursor"] as const;
+export interface ConfigurationDiscoveryInput {
+  configuration?: Record<string, unknown>;
+  credential?: Record<string, unknown>;
+  query?: Record<string, unknown>;
+}
+export const configurationDiscoveryInputFields = ["configuration", "credential", "query"] as const;
+export const configurationDiscoveryInputRequired = [] as const;
+export interface CoreAPIError {
+  code?: string | null;
+  details?: Record<string, unknown>;
+  message: string;
+  param?: string | null;
+  type: string;
+}
+export const coreAPIErrorFields = ["code", "details", "message", "param", "type"] as const;
+export const coreAPIErrorRequired = ["message", "type"] as const;
+export interface CoreErrorResponse {
+  error: CoreAPIError;
+}
+export const coreErrorResponseFields = ["error"] as const;
+export interface CoreHarness {
+  default: boolean;
+  enabled: boolean;
+  id: CoreHarnessId;
+  model_configuration: HarnessModelConfiguration | null;
+  model_configuration_support: ModelConfigurationSupport;
+  object: "core.harness";
+}
+export const coreHarnessFields = ["default", "enabled", "id", "model_configuration", "model_configuration_support", "object"] as const;
+export const coreHarnessIdValues = ["claude_sdk", "codex", "mcode"] as const;
+export type CoreHarnessId = (typeof coreHarnessIdValues)[number];
+export interface CoreHarnessList {
+  data: CoreHarness[];
+  object: "list";
+}
+export const coreHarnessListFields = ["data", "object"] as const;
+export interface CoremetricsView {
+  database: Database;
+  execution: Execution;
+  jobs: Job[];
+  object: "core.metrics";
+  process: Process;
+  range: Range;
+  service: ServiceState;
+}
+export const coremetricsViewFields = ["database", "execution", "jobs", "object", "process", "range", "service"] as const;
+export interface Database {
+  ping_ms: Latency;
+  pool: Pool;
+  series: DatabaseBucket[];
+  size_bytes: number | null;
+}
+export const databaseFields = ["ping_ms", "pool", "series", "size_bytes"] as const;
+export interface DatabaseBucket {
+  ping_p95_ms: number | null;
+  pool_in_use: number | null;
+  start: string;
+}
+export const databaseBucketFields = ["ping_p95_ms", "pool_in_use", "start"] as const;
+export interface DeploymentResources {
+  allocations: number;
+  pending: number;
+}
+export const deploymentResourcesFields = ["allocations", "pending"] as const;
+export interface DeploymentSpec {
+  resources: SandboxResources;
+  runtime?: RuntimeRelease;
+}
+export const deploymentSpecFields = ["resources", "runtime"] as const;
+export const deploymentSpecRequired = ["resources"] as const;
+export interface DeploymentView {
+  configuration?: Record<string, unknown>;
+  core_url: string;
+  credential_configured: boolean;
+  generation: number;
+  installation_id: string;
+  metadata?: Record<string, unknown>;
+  mode: DeploymentViewMode;
+  owner_epoch: number;
+  provider: string;
+  reset: Reset | null;
+  resources: DeploymentResources;
+  rollout: Rollout;
+  specification?: DeploymentSpec;
+  specification_digest?: string;
+  suspension: Suspension | null;
+}
+export const deploymentViewFields = ["configuration", "core_url", "credential_configured", "generation", "installation_id", "metadata", "mode", "owner_epoch", "provider", "reset", "resources", "rollout", "specification", "specification_digest", "suspension"] as const;
+export const deploymentViewRequired = ["core_url", "credential_configured", "generation", "installation_id", "mode", "owner_epoch", "provider", "reset", "resources", "rollout", "suspension"] as const;
+export const deploymentViewModeValues = ["", "nodes", "direct"] as const;
+export type DeploymentViewMode = (typeof deploymentViewModeValues)[number];
+export interface DiagnosticFailure {
+  code: DiagnosticFailureCode;
+  failed_at: string | null;
+  params: Record<string, unknown>;
+}
+export const diagnosticFailureFields = ["code", "failed_at", "params"] as const;
+export const diagnosticFailureCodeValues = ["harness_error", "model_provider_required", "runtime_unavailable", "runtime_disconnected", "runtime_preparation_failed", "execution_interrupted", "delivery_unconfirmed", "input_rejected", "executor_protocol_error", "core_storage_failed", "internal_error", "environment_connection_timeout", "environment_unavailable", "environment_provisioning_failed", "authentication_error", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "invalid_request", "resource_not_found", "request_timeout", "context_length_exceeded", "cyber_policy", "connection_failed"] as const;
+export type DiagnosticFailureCode = (typeof diagnosticFailureCodeValues)[number];
+export interface EnvironmentExecutorCredentialRequest {
+  key_id: string;
+  rotate?: boolean;
+}
+export const environmentExecutorCredentialRequestFields = ["key_id", "rotate"] as const;
+export const environmentExecutorCredentialRequestRequired = ["key_id"] as const;
+export interface Execution {
+  connected_daemons: number;
+  in_progress_turns: number | null;
+  interrupted: number | null;
+  oldest_queued_seconds: number | null;
+  queue_wait_ms: Latency;
+  queued_turns: number | null;
+  series: ExecutionBucket[];
+  slots_in_use: number;
+  slots_total: number;
+  unavailable: number | null;
+  waiting_for_daemon: number | null;
+}
+export const executionFields = ["connected_daemons", "in_progress_turns", "interrupted", "oldest_queued_seconds", "queue_wait_ms", "queued_turns", "series", "slots_in_use", "slots_total", "unavailable", "waiting_for_daemon"] as const;
+export interface ExecutionBucket {
+  in_progress: number | null;
+  queue_wait_p95_ms: number | null;
+  queued: number | null;
+  start: string;
+}
+export const executionBucketFields = ["in_progress", "queue_wait_p95_ms", "queued", "start"] as const;
+export interface ExecutionHarnessConfigSelection {
+  source: ExecutionHarnessConfigSelectionSource;
+  value: Record<string, unknown>;
+}
+export const executionHarnessConfigSelectionFields = ["source", "value"] as const;
+export const executionHarnessConfigSelectionSourceValues = ["session", "agent", "deployment", "unknown"] as const;
+export type ExecutionHarnessConfigSelectionSource = (typeof executionHarnessConfigSelectionSourceValues)[number];
+export interface ExecutionProviderSelection {
+  configuration: ModelProviderView | null;
+  source: ExecutionProviderSelectionSource;
+  status: ExecutionProviderSelectionStatus;
+}
+export const executionProviderSelectionFields = ["configuration", "source", "status"] as const;
+export const executionProviderSelectionSourceValues = ["session", "agent", "deployment", "unknown"] as const;
+export type ExecutionProviderSelectionSource = (typeof executionProviderSelectionSourceValues)[number];
+export const executionProviderSelectionStatusValues = ["available", "redacted", "unavailable"] as const;
+export type ExecutionProviderSelectionStatus = (typeof executionProviderSelectionStatusValues)[number];
+export interface ExecutionSelection {
+  source: ExecutionSelectionSource;
+  value: string | null;
+}
+export const executionSelectionFields = ["source", "value"] as const;
+export const executionSelectionSourceValues = ["session", "agent", "deployment", "unknown"] as const;
+export type ExecutionSelectionSource = (typeof executionSelectionSourceValues)[number];
+export interface ExecutorConnection {
+  bound_key_id: string | null;
+  enrolled_at: string | null;
+  last_seen_at: string | null;
+  status: ExecutorConnectionStatus;
+}
+export const executorConnectionFields = ["bound_key_id", "enrolled_at", "last_seen_at", "status"] as const;
+export const executorConnectionStatusValues = ["never_enrolled", "connected", "disconnected"] as const;
+export type ExecutorConnectionStatus = (typeof executorConnectionStatusValues)[number];
+export interface ExecutorCredential {
+  created_at: string;
+  key_id: string;
+  revoked_at: string | null;
+}
+export const executorCredentialFields = ["created_at", "key_id", "revoked_at"] as const;
+export interface ExecutorCredentialList {
+  connection: ExecutorConnection;
+  data: ExecutorCredential[];
+}
+export const executorCredentialListFields = ["connection", "data"] as const;
+export interface HarnessModelConfiguration {
+  harness: HarnessModelConfigurationHarness;
+  harness_config: Record<string, unknown>;
+  last_error_at: string | null;
+  last_error_code: HarnessModelConfigurationLastErrorCode | null;
+  last_used_at: string | null;
+  model: string;
+  model_provider: ModelProviderView;
+  object: "core.model_configuration";
+  updated_at: string;
+}
+export const harnessModelConfigurationFields = ["harness", "harness_config", "last_error_at", "last_error_code", "last_used_at", "model", "model_provider", "object", "updated_at"] as const;
+export const harnessModelConfigurationHarnessValues = ["claude_sdk", "codex", "mcode"] as const;
+export type HarnessModelConfigurationHarness = (typeof harnessModelConfigurationHarnessValues)[number];
+export const harnessModelConfigurationLastErrorCodeValues = ["authentication_error", "connection_failed", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "resource_not_found", "request_timeout", "invalid_request"] as const;
+export type HarnessModelConfigurationLastErrorCode = (typeof harnessModelConfigurationLastErrorCodeValues)[number];
+export interface HostHistory {
+  points: HostHistoryPoint[];
+  resolution_seconds: number;
+}
+export const hostHistoryFields = ["points", "resolution_seconds"] as const;
+export interface HostHistoryPoint {
+  available_disk_bytes_min: number | null;
+  cpu_utilization_max: number | null;
+  memory_used_bytes_max: number | null;
+  start: string;
+}
+export const hostHistoryPointFields = ["available_disk_bytes_min", "cpu_utilization_max", "memory_used_bytes_max", "start"] as const;
+export interface Installation {
+  address_bindings: AddressBindings;
+  api_base_url: string;
+  configuration: InstallationConfiguration;
+  installation_id: string;
+  local_only: boolean;
+  object: "core.installation";
+  public_url: string;
+  source_commit: string | null;
+}
+export const installationFields = ["address_bindings", "api_base_url", "configuration", "installation_id", "local_only", "object", "public_url", "source_commit"] as const;
+export interface InstallationConfiguration {
+  settings: InstallationSetting[];
+}
+export const installationConfigurationFields = ["settings"] as const;
+export interface InstallationSetting {
+  changeable: boolean;
+  configured?: boolean;
+  default: unknown | null;
+  key: string;
+  restarts: InstallationSettingRestarts[];
+  sensitive: boolean;
+  value: unknown | null;
+}
+export const installationSettingFields = ["changeable", "configured", "default", "key", "restarts", "sensitive", "value"] as const;
+export const installationSettingRequired = ["changeable", "default", "key", "restarts", "sensitive", "value"] as const;
+export const installationSettingRestartsValues = ["core", "web"] as const;
+export type InstallationSettingRestarts = (typeof installationSettingRestartsValues)[number];
+export interface IssuedAPIKey {
+  created_at: string;
+  id: string;
+  key: string;
+  name: string;
+  prefix: string;
+  project_id: string;
+  revoked_at: string | null;
+}
+export const issuedAPIKeyFields = ["created_at", "id", "key", "name", "prefix", "project_id", "revoked_at"] as const;
+export interface IssuedExecutorCredential {
+  environment_id?: string;
+  executor_token: string;
+  key_id: string;
+}
+export const issuedExecutorCredentialFields = ["environment_id", "executor_token", "key_id"] as const;
+export const issuedExecutorCredentialRequired = ["executor_token", "key_id"] as const;
+export interface ItemDiagnosticTiming {
+  completed_at: string | null;
+  item_id: string;
+  observed_duration_ms: number | null;
+  started_at: string;
+}
+export const itemDiagnosticTimingFields = ["completed_at", "item_id", "observed_duration_ms", "started_at"] as const;
+export interface Job {
+  failed: number | null;
+  id: string;
+  last_run_at: string | null;
+  processed: number | null;
+  status: JobStatus;
+}
+export const jobFields = ["failed", "id", "last_run_at", "processed", "status"] as const;
+export const jobStatusValues = ["ok", "failing", "stopped", "unknown"] as const;
+export type JobStatus = (typeof jobStatusValues)[number];
+export interface KeyPage {
+  data: ProjectsAPIKey[];
+  has_more: boolean;
+}
+export const keyPageFields = ["data", "has_more"] as const;
+export interface Latency {
+  p50: number | null;
+  p95: number | null;
+}
+export const latencyFields = ["p50", "p95"] as const;
+export interface ManagedArchive {
+  environment_id: string;
+  session_id: string;
+  state: ManagedArchiveState;
+}
+export const managedArchiveFields = ["environment_id", "session_id", "state"] as const;
+export const managedArchiveStateValues = ["active", "cleanup_pending", "released"] as const;
+export type ManagedArchiveState = (typeof managedArchiveStateValues)[number];
+export interface ModelConfigurationInput {
+  harness_config?: Record<string, unknown>;
+  model: string;
+  model_provider: ModelProviderInput;
+}
+export const modelConfigurationInputFields = ["harness_config", "model", "model_provider"] as const;
+export const modelConfigurationInputRequired = ["model", "model_provider"] as const;
+export interface ModelConfigurationSupport {
+  accepts_harness_config: boolean;
+  protocols: string[];
+  token_limits_required: boolean;
+}
+export const modelConfigurationSupportFields = ["accepts_harness_config", "protocols", "token_limits_required"] as const;
+export interface Node {
+  active: number;
+  available_disk_bytes: number | null;
+  available_memory_bytes: number | null;
+  cleanup_pending: number;
+  core_url: string;
+  cpu_count: number | null;
+  created_at: string;
+  diagnostic?: NodeDiagnostic;
+  enrollment_id: string | null;
+  id: string;
+  last_seen_at: string | null;
+  max_active: number;
+  max_retained: number;
+  name: string;
+  online: boolean;
+  provider: string;
+  provider_ready: boolean;
+  reserved: number;
+  retained: number;
+  rollout: NodeRollout;
+  running: number;
+  snapshots: number;
+}
+export const nodeFields = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "diagnostic", "enrollment_id", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
+export const nodeRequired = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "enrollment_id", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
+export interface NodeAllocation {
+  compute_phase: string;
+  compute_phase_changed_at: string | null;
+  created_at: string;
+  deployment_generation: number;
+  diagnostic: NodeAllocationDiagnostic;
+  environment_id: string;
+  id: string;
+  initialization: string;
+  node_id: string;
+  session_id: string;
+  state: string;
+  tenant_id: string;
+}
+export const nodeAllocationFields = ["compute_phase", "compute_phase_changed_at", "created_at", "deployment_generation", "diagnostic", "environment_id", "id", "initialization", "node_id", "session_id", "state", "tenant_id"] as const;
+export const nodeAllocationDiagnosticValues = ["", "node_unavailable", "resource_missing", "compute_unconfirmed", "ownership_mismatch", "provider_unavailable"] as const;
+export type NodeAllocationDiagnostic = (typeof nodeAllocationDiagnosticValues)[number];
+export interface NodeDetail {
+  active: number;
+  available_disk_bytes: number | null;
+  available_memory_bytes: number | null;
+  cleanup_pending: number;
+  core_url: string;
+  cpu_count: number | null;
+  created_at: string;
+  diagnostic?: NodeDetailDiagnostic;
+  enrollment_id: string | null;
+  history: HostHistory;
+  host: NodeHost;
+  id: string;
+  last_seen_at: string | null;
+  max_active: number;
+  max_retained: number;
+  name: string;
+  online: boolean;
+  provider: string;
+  provider_ready: boolean;
+  reserved: number;
+  retained: number;
+  rollout: NodeRollout;
+  running: number;
+  snapshots: number;
+}
+export const nodeDetailFields = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "diagnostic", "enrollment_id", "history", "host", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
+export const nodeDetailRequired = ["active", "available_disk_bytes", "available_memory_bytes", "cleanup_pending", "core_url", "cpu_count", "created_at", "enrollment_id", "history", "host", "id", "last_seen_at", "max_active", "max_retained", "name", "online", "provider", "provider_ready", "reserved", "retained", "rollout", "running", "snapshots"] as const;
+export const nodeDetailDiagnosticValues = ["provider_unavailable", "host_unsupported", "artifacts_unavailable", "runtime_download_failed", "runtime_image_unavailable", "capacity_insufficient"] as const;
+export type NodeDetailDiagnostic = (typeof nodeDetailDiagnosticValues)[number];
+export const nodeDiagnosticValues = ["provider_unavailable", "host_unsupported", "artifacts_unavailable", "runtime_download_failed", "runtime_image_unavailable", "capacity_insufficient"] as const;
+export type NodeDiagnostic = (typeof nodeDiagnosticValues)[number];
+export interface NodeHost {
+  available_disk_bytes: number | null;
+  available_memory_bytes: number | null;
+  cpu_utilization: number | null;
+  effective_cpu_cores: number | null;
+  observed_at: string | null;
+  total_memory_bytes: number | null;
+}
+export const nodeHostFields = ["available_disk_bytes", "available_memory_bytes", "cpu_utilization", "effective_cpu_cores", "observed_at", "total_memory_bytes"] as const;
+export interface NodeRollout {
+  diagnostic?: NodeRolloutDiagnostic;
+  ready_generation: number | null;
+  state: NodeRolloutState;
+}
+export const nodeRolloutFields = ["diagnostic", "ready_generation", "state"] as const;
+export const nodeRolloutRequired = ["ready_generation", "state"] as const;
+export const nodeRolloutDiagnosticValues = ["provider_unavailable", "host_unsupported", "artifacts_unavailable", "runtime_download_failed", "runtime_image_unavailable", "capacity_insufficient"] as const;
+export type NodeRolloutDiagnostic = (typeof nodeRolloutDiagnosticValues)[number];
+export const nodeRolloutStateValues = ["ready", "preparing", "failed", "update_required", "unknown"] as const;
+export type NodeRolloutState = (typeof nodeRolloutStateValues)[number];
+export interface NodeUpdate {
+  max_active: number;
+  max_retained?: number;
+  name: string;
+}
+export const nodeUpdateFields = ["max_active", "max_retained", "name"] as const;
+export const nodeUpdateRequired = ["max_active", "name"] as const;
+export interface Pool {
+  idle: number | null;
+  in_use: number | null;
+  max: number | null;
+}
+export const poolFields = ["idle", "in_use", "max"] as const;
+export interface Process {
+  cpu_cores: number | null;
+  cpu_limit_cores: number | null;
+  goroutines: number | null;
+  memory_bytes: number | null;
+  memory_limit_bytes: number | null;
+  rss_bytes: number | null;
+  series: ProcessBucket[];
+}
+export const processFields = ["cpu_cores", "cpu_limit_cores", "goroutines", "memory_bytes", "memory_limit_bytes", "rss_bytes", "series"] as const;
+export interface ProcessBucket {
+  cpu_cores: number | null;
+  rss_bytes: number | null;
+  start: string;
+}
+export const processBucketFields = ["cpu_cores", "rss_bytes", "start"] as const;
+export interface Project {
+  active_key_count: number;
+  archived_at: string | null;
+  created_at: string;
+  id: string;
+  name: string;
+}
+export const projectFields = ["active_key_count", "archived_at", "created_at", "id", "name"] as const;
+export interface ProjectAPIKeyRequest {
+  name: string;
+}
+export const projectAPIKeyRequestFields = ["name"] as const;
+export interface ProjectRequest {
+  name: string;
+}
+export const projectRequestFields = ["name"] as const;
+export interface ProjectsAPIKey {
+  created_at: string;
+  id: string;
+  name: string;
+  prefix: string;
+  project_id: string;
+  revoked_at: string | null;
+}
+export const projectsAPIKeyFields = ["created_at", "id", "name", "prefix", "project_id", "revoked_at"] as const;
+export interface ProjectsPage {
+  data: Project[];
+  has_more: boolean;
+}
+export const projectsPageFields = ["data", "has_more"] as const;
+export interface Range {
+  end: string;
+  resolution_seconds: number;
+  start: string;
+}
+export const rangeFields = ["end", "resolution_seconds", "start"] as const;
+export interface Reset {
+  clear: ResetClear;
+  deadline_at: string | null;
+  forced_at: string | null;
+  remaining: ResetRemaining;
+  requested_at: string;
+}
+export const resetFields = ["clear", "deadline_at", "forced_at", "remaining", "requested_at"] as const;
+export const resetClearValues = ["auto", "force"] as const;
+export type ResetClear = (typeof resetClearValues)[number];
+export interface ResetOfflineNode {
+  name: string;
+  node_id: string;
+  resources: number;
+}
+export const resetOfflineNodeFields = ["name", "node_id", "resources"] as const;
+export interface ResetRemaining {
+  busy: number;
+  cleanup: number;
+  idle: number;
+  offline_nodes: ResetOfflineNode[];
+  on_offline_nodes: number;
+}
+export const resetRemainingFields = ["busy", "cleanup", "idle", "offline_nodes", "on_offline_nodes"] as const;
+export interface ResetRequest {
+  clear: ResetRequestClear;
+  deadline_seconds?: number;
+  expected_generation: number;
+}
+export const resetRequestFields = ["clear", "deadline_seconds", "expected_generation"] as const;
+export const resetRequestRequired = ["clear", "expected_generation"] as const;
+export const resetRequestClearValues = ["auto", "force"] as const;
+export type ResetRequestClear = (typeof resetRequestClearValues)[number];
+export interface ResourceOwner {
+  api_key: WriteauditAPIKey | null;
+  resource_id: string;
+}
+export const resourceOwnerFields = ["api_key", "resource_id"] as const;
+export interface ResourceOwnerList {
+  data: ResourceOwner[];
+}
+export const resourceOwnerListFields = ["data"] as const;
+export interface Rollout {
+  nodes: RolloutNodes | null;
+  previous_generation_sandboxes: number;
+  state: RolloutState;
+}
+export const rolloutFields = ["nodes", "previous_generation_sandboxes", "state"] as const;
+export interface RolloutNodes {
+  failed: number;
+  preparing: number;
+  ready: number;
+  unknown: number;
+  update_required: number;
+}
+export const rolloutNodesFields = ["failed", "preparing", "ready", "unknown", "update_required"] as const;
+export const rolloutStateValues = ["settled", "preparing"] as const;
+export type RolloutState = (typeof rolloutStateValues)[number];
+export interface RuntimeCPUObservation {
+  capacity_cores: number | null;
+  usage_cores: number | null;
+  usage_seconds_total: number | null;
+  utilization_ratio: number | null;
+}
+export const runtimeCPUObservationFields = ["capacity_cores", "usage_cores", "usage_seconds_total", "utilization_ratio"] as const;
+export interface RuntimeDiskObservation {
+  limit_bytes: number | null;
+  usage_bytes: number | null;
+}
+export const runtimeDiskObservationFields = ["limit_bytes", "usage_bytes"] as const;
+export interface RuntimeHistory {
+  coverage: RuntimeHistoryCoverage;
+  generated_at: number;
+  object: "agent.runtime_history";
+  requested_range: RuntimeHistoryRange;
+  resolution_seconds: number;
+  series: RuntimeHistorySeries[];
+  session_id: string;
+  source: "durable";
+  token_usage: RuntimeHistoryTokenUsagePoint[];
+}
+export const runtimeHistoryFields = ["coverage", "generated_at", "object", "requested_range", "resolution_seconds", "series", "session_id", "source", "token_usage"] as const;
+export interface RuntimeHistoryCPU {
+  capacity_cores: number | null;
+  contributor_count: number;
+  utilization_ratio: number | null;
+}
+export const runtimeHistoryCPUFields = ["capacity_cores", "contributor_count", "utilization_ratio"] as const;
+export interface RuntimeHistoryCoverage {
+  buckets: RuntimeHistoryCoveragePoint[];
+  expected_sample_count: number;
+  first_sample_at: number | null;
+  last_sample_at: number | null;
+  retained_start: number;
+  sample_count: number;
+}
+export const runtimeHistoryCoverageFields = ["buckets", "expected_sample_count", "first_sample_at", "last_sample_at", "retained_start", "sample_count"] as const;
+export interface RuntimeHistoryCoveragePoint {
+  end: number;
+  first_observed_at: number | null;
+  last_observed_at: number | null;
+  observation_count: number;
+  observed_count: number;
+  start: number;
+  unavailable_count: number;
+}
+export const runtimeHistoryCoveragePointFields = ["end", "first_observed_at", "last_observed_at", "observation_count", "observed_count", "start", "unavailable_count"] as const;
+export interface RuntimeHistoryMemory {
+  contributor_count: number;
+  limit_bytes: number | null;
+  usage_bytes: number | null;
+}
+export const runtimeHistoryMemoryFields = ["contributor_count", "limit_bytes", "usage_bytes"] as const;
+export interface RuntimeHistoryPoint {
+  cpu: RuntimeHistoryCPU | null;
+  end: number;
+  first_observed_at: number | null;
+  last_observed_at: number | null;
+  memory: RuntimeHistoryMemory | null;
+  observation_count: number;
+  observed_count: number;
+  start: number;
+  unavailable_count: number;
+}
+export const runtimeHistoryPointFields = ["cpu", "end", "first_observed_at", "last_observed_at", "memory", "observation_count", "observed_count", "start", "unavailable_count"] as const;
+export interface RuntimeHistoryRange {
+  end: number;
+  start: number;
+}
+export const runtimeHistoryRangeFields = ["end", "start"] as const;
+export interface RuntimeHistorySeries {
+  allocation_id: string;
+  environment_id: string;
+  points: RuntimeHistoryPoint[];
+  provider_type: string;
+  started_at: RuntimeHistoryTime;
+}
+export const runtimeHistorySeriesFields = ["allocation_id", "environment_id", "points", "provider_type", "started_at"] as const;
+export interface RuntimeHistoryTime {
+  nanoseconds: number;
+  seconds: number;
+}
+export const runtimeHistoryTimeFields = ["nanoseconds", "seconds"] as const;
+export interface RuntimeHistoryTokenUsagePoint {
+  end: number;
+  input_tokens: number;
+  output_tokens: number;
+  sampled_at: number;
+  start: number;
+}
+export const runtimeHistoryTokenUsagePointFields = ["end", "input_tokens", "output_tokens", "sampled_at", "start"] as const;
+export interface RuntimeInstance {
+  allocation_id: string | null;
+  connection_generation: string | null;
+  device_id: string | null;
+  kind: RuntimeInstanceKind;
+}
+export const runtimeInstanceFields = ["allocation_id", "connection_generation", "device_id", "kind"] as const;
+export const runtimeInstanceKindValues = ["managed_allocation", "self_hosted_connection", "none"] as const;
+export type RuntimeInstanceKind = (typeof runtimeInstanceKindValues)[number];
+export interface RuntimeMemoryObservation {
+  limit_bytes: number | null;
+  usage_bytes: number | null;
+}
+export const runtimeMemoryObservationFields = ["limit_bytes", "usage_bytes"] as const;
+export interface RuntimeObservation {
+  allocation_created_at: number | null;
+  cpu: RuntimeCPUObservation | null;
+  environment_id: string | null;
+  id: string;
+  instance: RuntimeInstance;
+  lifecycle_state: RuntimeObservationLifecycleState | null;
+  memory: RuntimeMemoryObservation | null;
+  mode: RuntimeObservationMode;
+  object: "agent.runtime_observation";
+  observed_at: number | null;
+  provider_type: string | null;
+  reason: RuntimeObservationReason | null;
+  resolved_at: number;
+  session_id: string;
+  started_at: number | null;
+  status: RuntimeObservationStatus;
+}
+export const runtimeObservationFields = ["allocation_created_at", "cpu", "environment_id", "id", "instance", "lifecycle_state", "memory", "mode", "object", "observed_at", "provider_type", "reason", "resolved_at", "session_id", "started_at", "status"] as const;
+export const runtimeObservationLifecycleStateValues = ["active", "sleeping", "transitioning", "pending", "stopped"] as const;
+export type RuntimeObservationLifecycleState = (typeof runtimeObservationLifecycleStateValues)[number];
+export const runtimeObservationModeValues = ["none", "self_hosted", "openai_hosted"] as const;
+export type RuntimeObservationMode = (typeof runtimeObservationModeValues)[number];
+export const runtimeObservationReasonValues = ["runtime_mode_not_observable", "allocation_pending", "runtime_not_running", "sample_timeout", "sample_unavailable"] as const;
+export type RuntimeObservationReason = (typeof runtimeObservationReasonValues)[number];
+export const runtimeObservationStatusValues = ["observed", "unsupported", "unavailable"] as const;
+export type RuntimeObservationStatus = (typeof runtimeObservationStatusValues)[number];
+export interface RuntimeRelease {
+  firmware_sha256: string;
+  image_id: string;
+  image_manifest_digest: string;
+  microsandbox_ref: string;
+  runtime_sha256: string;
+  source_commit: string;
+}
+export const runtimeReleaseFields = ["firmware_sha256", "image_id", "image_manifest_digest", "microsandbox_ref", "runtime_sha256", "source_commit"] as const;
+export interface SandboxAllocationList {
+  data: NodeAllocation[];
+}
+export const sandboxAllocationListFields = ["data"] as const;
+export interface SandboxDeploymentChangeInput {
+  configuration?: Record<string, unknown>;
+  credential?: Record<string, unknown>;
+  expected_generation: number;
+  provider?: string;
+  resources?: SandboxResources;
+  runtime?: RuntimeRelease;
+}
+export const sandboxDeploymentChangeInputFields = ["configuration", "credential", "expected_generation", "provider", "resources", "runtime"] as const;
+export const sandboxDeploymentChangeInputRequired = ["expected_generation"] as const;
+export interface SandboxDeploymentInput {
+  configuration?: Record<string, unknown>;
+  credential?: Record<string, unknown>;
+  expected_generation: number;
+  provider?: string;
+  resources?: SandboxResources;
+  runtime?: RuntimeRelease;
+}
+export const sandboxDeploymentInputFields = ["configuration", "credential", "expected_generation", "provider", "resources", "runtime"] as const;
+export const sandboxDeploymentInputRequired = ["expected_generation"] as const;
+export interface SandboxEnrollmentToken {
+  enrollment_id: string;
+  expires_at: string;
+  token: string;
+}
+export const sandboxEnrollmentTokenFields = ["enrollment_id", "expires_at", "token"] as const;
+export interface SandboxEnrollmentTokenRequest {
+  max_active?: number;
+  max_retained?: number;
+}
+export const sandboxEnrollmentTokenRequestFields = ["max_active", "max_retained"] as const;
+export const sandboxEnrollmentTokenRequestRequired = [] as const;
+export interface SandboxMutationResponse {
+  deleted?: boolean;
+  id: string;
+  updated?: boolean;
+}
+export const sandboxMutationResponseFields = ["deleted", "id", "updated"] as const;
+export const sandboxMutationResponseRequired = ["id"] as const;
+export interface SandboxNodeList {
+  data: Node[];
+}
+export const sandboxNodeListFields = ["data"] as const;
+export interface SandboxResources {
+  cpus: number;
+  environment_disk_mib?: number;
+  memory_mib: number;
+  root_disk_mib?: number;
+}
+export const sandboxResourcesFields = ["cpus", "environment_disk_mib", "memory_mib", "root_disk_mib"] as const;
+export const sandboxResourcesRequired = ["cpus", "memory_mib"] as const;
+export interface ServiceState {
+  execution_owner: boolean | null;
+  revision: string | null;
+  started_at: string | null;
+  status: ServiceStateStatus;
+}
+export const serviceStateFields = ["execution_owner", "revision", "started_at", "status"] as const;
+export const serviceStateStatusValues = ["running", "degraded"] as const;
+export type ServiceStateStatus = (typeof serviceStateStatusValues)[number];
+export interface SessionDiagnosticFailure {
+  code: SessionDiagnosticFailureCode;
+  failed_at: string | null;
+  params: Record<string, unknown>;
+  source: SessionDiagnosticFailureSource;
+  turn_id?: string;
+}
+export const sessionDiagnosticFailureFields = ["code", "failed_at", "params", "source", "turn_id"] as const;
+export const sessionDiagnosticFailureRequired = ["code", "failed_at", "params", "source"] as const;
+export const sessionDiagnosticFailureCodeValues = ["harness_error", "model_provider_required", "runtime_unavailable", "runtime_disconnected", "runtime_preparation_failed", "execution_interrupted", "delivery_unconfirmed", "input_rejected", "executor_protocol_error", "core_storage_failed", "internal_error", "environment_connection_timeout", "environment_unavailable", "environment_provisioning_failed", "authentication_error", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "invalid_request", "resource_not_found", "request_timeout", "context_length_exceeded", "cyber_policy", "connection_failed"] as const;
+export type SessionDiagnosticFailureCode = (typeof sessionDiagnosticFailureCodeValues)[number];
+export const sessionDiagnosticFailureSourceValues = ["turn", "environment", "environment_input"] as const;
+export type SessionDiagnosticFailureSource = (typeof sessionDiagnosticFailureSourceValues)[number];
+export interface SessionDiagnostics {
+  failure: SessionDiagnosticFailure | null;
+  object: "core.session_diagnostics";
+  session_id: string;
+  status: SessionDiagnosticsStatus;
+}
+export const sessionDiagnosticsFields = ["failure", "object", "session_id", "status"] as const;
+export const sessionDiagnosticsStatusValues = ["idle", "in_progress", "requires_action", "failed"] as const;
+export type SessionDiagnosticsStatus = (typeof sessionDiagnosticsStatusValues)[number];
+export interface SessionExecutionConfiguration {
+  harness: ExecutionSelection;
+  harness_config: ExecutionHarnessConfigSelection;
+  model: ExecutionSelection;
+  model_provider: ExecutionProviderSelection;
+  object: "agent.session.execution_configuration";
+  schema_version: 1;
+  session_id: string;
+}
+export const sessionExecutionConfigurationFields = ["harness", "harness_config", "model", "model_provider", "object", "schema_version", "session_id"] as const;
+export interface Suspension {
+  idle_seconds: number;
+  retention_seconds: number;
+}
+export const suspensionFields = ["idle_seconds", "retention_seconds"] as const;
+export interface TurnDiagnostics {
+  failure: DiagnosticFailure | null;
+  items: ItemDiagnosticTiming[];
+  items_truncated: boolean;
+  object: "core.turn_diagnostics";
+  session_id: string;
+  status: string;
+  turn_id: string;
+}
+export const turnDiagnosticsFields = ["failure", "items", "items_truncated", "object", "session_id", "status", "turn_id"] as const;
+export interface WriteauditAPIKey {
+  id: string;
+  kind: "issued";
+  name: string;
+  prefix: string;
+  revoked_at: string | null;
+}
+export const writeauditAPIKeyFields = ["id", "kind", "name", "prefix", "revoked_at"] as const;
+export interface WriteauditOperation {
+  action: WriteauditOperationAction;
+  api_key: WriteauditAPIKey;
+  created_at: string;
+  id: string;
+  parent_id: string;
+  request_id: string;
+  resource_id: string;
+  resource_type: WriteauditOperationResourceType;
+  trace_id: string;
+}
+export const writeauditOperationFields = ["action", "api_key", "created_at", "id", "parent_id", "request_id", "resource_id", "resource_type", "trace_id"] as const;
+export const writeauditOperationActionValues = ["create", "update", "delete", "send_events", "upload_file", "upload_version", "update_default_version"] as const;
+export type WriteauditOperationAction = (typeof writeauditOperationActionValues)[number];
+export const writeauditOperationResourceTypeValues = ["agent", "session", "environment", "environment_template", "skill", "skill_version", "file", "vault", "credential", "artifact"] as const;
+export type WriteauditOperationResourceType = (typeof writeauditOperationResourceTypeValues)[number];
+export interface WriteauditPage {
+  data: WriteauditOperation[];
+  has_more: boolean;
+  next_cursor: string;
+}
+export const writeauditPageFields = ["data", "has_more", "next_cursor"] as const;
diff --git a/packages/agents-client/src/index.ts b/packages/agents-client/src/index.ts
index 18711e960..c902b2b43 100644
--- a/packages/agents-client/src/index.ts
+++ b/packages/agents-client/src/index.ts
@@ -12,7 +12,8 @@ export { isEnvironmentTemplateName, isRecognizedEnvironmentTemplate } from "./en
 export { isOpenAIHostedSessionEnvironment } from "./session-environment-projection";
 export { compareSkillVersionNumbers, isSkillId, isSkillUploadPath, isSkillVersionId, isSkillVersionNumber } from "./skill-projection";
 export { AdminClient } from "./admin-client";
-// Skill and SkillVersion come from ./types; the admin projections use the same shapes.
-export type { AdminClientOptions, AdminProject, CreateAdminProjectInput, RenameAdminProjectInput, AdminAPIKey, AdminIssuedAPIKey, IssueAdminAPIKeyInput, AdminPage, AdminDeleted, SessionArtifact, AdminContent, AdminResourceType, AdminKeyProvenance, AdminResourceOwner, AdminWriteOperation, AdminWriteOperationOptions, AdminWriteOperationPage, AdminSummaryOptions, AdminSummaryEntry, AdminSummary, AdminRuntimeObservation, AdminAuditOptions, AdminAuditEntry, AdminAuditPage, ExecutorCredential, ExecutorConnection, ExecutorCredentialList, IssueExecutorCredentialInput, IssuedExecutorCredential, CoreInstallation, CoreInstallationConfiguration, CoreInstallationSetting, CoreAddressBindings } from "./admin-types";
+// Skill, SkillVersion and SessionArtifact come from ./types; the admin projections use the same shapes.
+export { adminResourceTypes } from "./admin-types";
+export type { AdminClientOptions, AdminProject, CreateAdminProjectInput, RenameAdminProjectInput, AdminAPIKey, AdminIssuedAPIKey, IssueAdminAPIKeyInput, AdminPage, AdminDeleted, AdminContent, AdminResourceType, AdminKeyProvenance, AdminResourceOwner, AdminWriteOperation, AdminWriteOperationOptions, AdminWriteOperationPage, AdminSummaryOptions, AdminSummaryEntry, AdminSummary, AdminRuntimeObservation, AdminAuditOptions, AdminAuditEntry, AdminAuditPage, ExecutorCredential, ExecutorConnection, ExecutorCredentialList, IssueExecutorCredentialInput, IssuedExecutorCredential, CoreInstallation, CoreInstallationConfiguration, CoreInstallationSetting, CoreAddressBindings } from "./admin-types";
 
-export type { DiagnosticFailureCode, NativeFailureCode, ConnectionFailureParams, ProvisioningFailureParams, DiagnosticFailure, SessionDiagnosticFailure, SessionDiagnostics, ItemDiagnosticTiming, TurnDiagnostics } from "./session-diagnostics";
+export type { DiagnosticFailureCode, ConnectionFailureParams, ProvisioningFailureParams, DiagnosticFailure, SessionDiagnosticFailure, SessionDiagnostics, ItemDiagnosticTiming, TurnDiagnostics } from "./session-diagnostics";
diff --git a/packages/agents-client/src/runtime-history-projection.ts b/packages/agents-client/src/runtime-history-projection.ts
index 82dfea325..6cc2040ec 100644
--- a/packages/agents-client/src/runtime-history-projection.ts
+++ b/packages/agents-client/src/runtime-history-projection.ts
@@ -1,33 +1,14 @@
-import { canonicalUuid, exactFields, isNonnegativeInteger, isRecord, sameResourceId } from "./response-projection";
-import type {
-  RuntimeHistory,
-  RuntimeHistoryCPU,
-  RuntimeHistoryCoveragePoint,
-  RuntimeHistoryMemory,
-  RuntimeHistoryPoint,
-  RuntimeHistoryQuery,
-  RuntimeHistorySeries,
-  RuntimeHistoryTokenUsagePoint,
-} from "./types";
+import {
+  runtimeHistoryCPUFields, runtimeHistoryCoverageFields, runtimeHistoryCoveragePointFields, runtimeHistoryFields, runtimeHistoryMemoryFields,
+  runtimeHistoryPointFields, runtimeHistoryRangeFields, runtimeHistorySeriesFields, runtimeHistoryTimeFields, runtimeHistoryTokenUsagePointFields,
+  type RuntimeHistoryCPU, type RuntimeHistoryCoveragePoint, type RuntimeHistoryMemory, type RuntimeHistoryPoint, type RuntimeHistorySeries,
+  type RuntimeHistoryTokenUsagePoint,
+} from "./generated/core-api";
+import { canonicalUuid, exactFields, isNonnegativeInteger, isRecord, sameResourceId, type FieldNames } from "./response-projection";
+import type { RuntimeHistory, RuntimeHistoryQuery } from "./types";
 
 type InvalidRuntimeHistory = (message?: string) => never;
 
-const historyFields = new Set([
-  "object", "source", "session_id", "requested_range", "resolution_seconds", "generated_at", "coverage", "series", "token_usage",
-]);
-const rangeFields = new Set(["start", "end"]);
-const coverageFields = new Set([
-  "retained_start", "first_sample_at", "last_sample_at", "sample_count", "expected_sample_count", "buckets",
-]);
-const coveragePointFields = new Set([
-  "start", "end", "first_observed_at", "last_observed_at", "observation_count", "observed_count", "unavailable_count",
-]);
-const seriesFields = new Set(["environment_id", "allocation_id", "started_at", "provider_type", "points"]);
-const timeFields = new Set(["seconds", "nanoseconds"]);
-const pointFields = new Set([...coveragePointFields, "cpu", "memory"]);
-const cpuFields = new Set(["contributor_count", "utilization_ratio", "capacity_cores"]);
-const memoryFields = new Set(["contributor_count", "usage_bytes", "limit_bytes"]);
-const tokenUsageFields = new Set(["start", "end", "sampled_at", "input_tokens", "output_tokens"]);
 const providerTypePattern = /^[a-z][a-z0-9_]{0,31}$/;
 const maximumSeries = 1_000;
 const maximumTotalPoints = 100_000;
@@ -62,7 +43,7 @@ function nullablePositiveNumber(value: unknown, invalid: InvalidRuntimeHistory):
 
 function projectCoveragePoint(
   value: unknown,
-  fields: Set<string>,
+  fields: FieldNames,
   requestedStart: number,
   requestedEnd: number,
   resolution: number,
@@ -96,7 +77,7 @@ function projectCoveragePoint(
 
 function projectCPU(value: unknown, observedCount: number, invalid: InvalidRuntimeHistory): RuntimeHistoryCPU | null {
   if (value === null) return null;
-  if (!isRecord(value) || !exactFields(value, cpuFields) || !positiveInteger(value.contributor_count) || value.contributor_count > observedCount) return invalid();
+  if (!isRecord(value) || !exactFields(value, runtimeHistoryCPUFields) || !positiveInteger(value.contributor_count) || value.contributor_count > observedCount) return invalid();
   const utilization = nullableNonnegativeNumber(value.utilization_ratio, invalid);
   const capacity = nullablePositiveNumber(value.capacity_cores, invalid);
   if (utilization === null && capacity === null) return invalid();
@@ -105,7 +86,7 @@ function projectCPU(value: unknown, observedCount: number, invalid: InvalidRunti
 
 function projectMemory(value: unknown, observedCount: number, invalid: InvalidRuntimeHistory): RuntimeHistoryMemory | null {
   if (value === null) return null;
-  if (!isRecord(value) || !exactFields(value, memoryFields) || !positiveInteger(value.contributor_count) || value.contributor_count > observedCount) return invalid();
+  if (!isRecord(value) || !exactFields(value, runtimeHistoryMemoryFields) || !positiveInteger(value.contributor_count) || value.contributor_count > observedCount) return invalid();
   const usage = nullableNonnegativeInteger(value.usage_bytes, invalid);
   const limit = nullablePositiveInteger(value.limit_bytes, invalid);
   if (usage === null && limit === null) return invalid();
@@ -120,7 +101,7 @@ function projectPoint(
   startedAt: number,
   invalid: InvalidRuntimeHistory,
 ): RuntimeHistoryPoint {
-  const coverage = projectCoveragePoint(value, pointFields, requestedStart, requestedEnd, resolution, invalid);
+  const coverage = projectCoveragePoint(value, runtimeHistoryPointFields, requestedStart, requestedEnd, resolution, invalid);
   if (!isRecord(value) || coverage.end <= startedAt || (coverage.first_observed_at !== null && coverage.first_observed_at < startedAt)) return invalid();
   const cpu = projectCPU(value.cpu, coverage.observed_count, invalid);
   const memory = projectMemory(value.memory, coverage.observed_count, invalid);
@@ -141,7 +122,7 @@ function projectTokenUsagePoint(
   invalid: InvalidRuntimeHistory,
 ): RuntimeHistoryTokenUsagePoint {
   if (
-    !isRecord(value) || !exactFields(value, tokenUsageFields) ||
+    !isRecord(value) || !exactFields(value, runtimeHistoryTokenUsagePointFields) ||
     !isNonnegativeInteger(value.start) || !positiveInteger(value.end) ||
     value.start < requestedStart || value.end <= value.start || value.end > requestedEnd || value.end - value.start > resolution ||
     !isNonnegativeInteger(value.sampled_at) || value.sampled_at < value.start || value.sampled_at >= value.end || value.sampled_at > generatedAt ||
@@ -165,10 +146,10 @@ function projectSeries(
   maximumPoints: number,
   invalid: InvalidRuntimeHistory,
 ): RuntimeHistorySeries {
-  if (!isRecord(value) || !exactFields(value, seriesFields) || !Array.isArray(value.points)) return invalid();
+  if (!isRecord(value) || !exactFields(value, runtimeHistorySeriesFields) || !Array.isArray(value.points)) return invalid();
   const environmentId = canonicalUuid(value.environment_id);
   const allocationId = canonicalUuid(value.allocation_id);
-  if (!isRecord(value.started_at) || !exactFields(value.started_at, timeFields)) return invalid();
+  if (!isRecord(value.started_at) || !exactFields(value.started_at, runtimeHistoryTimeFields)) return invalid();
   const startedAtSeconds = value.started_at.seconds;
   const startedAtNanoseconds = value.started_at.nanoseconds;
   if (
@@ -197,12 +178,12 @@ export function projectRuntimeHistory(
   invalid: InvalidRuntimeHistory,
 ): RuntimeHistory {
   if (
-    !isRecord(value) || !exactFields(value, historyFields) || value.object !== "agent.runtime_history" || value.source !== "durable" ||
+    !isRecord(value) || !exactFields(value, runtimeHistoryFields) || value.object !== "agent.runtime_history" || value.source !== "durable" ||
     typeof value.session_id !== "string" || !sameResourceId(value.session_id, expectedSessionId) ||
-    !isRecord(value.requested_range) || !exactFields(value.requested_range, rangeFields) ||
+    !isRecord(value.requested_range) || !exactFields(value.requested_range, runtimeHistoryRangeFields) ||
     value.requested_range.start !== requested.start || value.requested_range.end !== requested.end ||
     !positiveInteger(value.resolution_seconds) || !isNonnegativeInteger(value.generated_at) ||
-    !isRecord(value.coverage) || !exactFields(value.coverage, coverageFields) || !Array.isArray(value.coverage.buckets) ||
+    !isRecord(value.coverage) || !exactFields(value.coverage, runtimeHistoryCoverageFields) || !Array.isArray(value.coverage.buckets) ||
     !Array.isArray(value.series) || !Array.isArray(value.token_usage)
   ) return invalid();
   const sessionId = canonicalUuid(value.session_id);
@@ -221,7 +202,7 @@ export function projectRuntimeHistory(
     (firstSample !== null && (firstSample < retainedStart || lastSample! < firstSample || lastSample! >= requested.end || lastSample! > generatedAt))
   ) return invalid();
   const buckets = value.coverage.buckets.map((point) => projectCoveragePoint(
-    point, coveragePointFields, requested.start, requested.end, value.resolution_seconds as number, invalid,
+    point, runtimeHistoryCoveragePointFields, requested.start, requested.end, value.resolution_seconds as number, invalid,
   ));
   if (!ordered(buckets)) return invalid();
   const sampleCount = buckets.reduce((sum, point) => sum + point.observation_count, 0);
diff --git a/packages/agents-client/src/sandbox-client.test.ts b/packages/agents-client/src/sandbox-client.test.ts
index 9bea39776..1f32f2173 100644
--- a/packages/agents-client/src/sandbox-client.test.ts
+++ b/packages/agents-client/src/sandbox-client.test.ts
@@ -157,7 +157,7 @@ describe("Core sandbox credential boundaries", () => {
     const fetch = vi.fn<typeof globalThis.fetch>().mockResolvedValue(response({ data: [unready, { ...unready, diagnostic: "future_code" }, node] }));
     const { data } = await new SandboxAdminClient({ baseUrl: "/core/v1/sandbox", fetch }).listNodes();
     expect(data.map((entry) => entry.diagnostic)).toEqual(["host_unsupported", "provider_unavailable", undefined]);
-    expectTypeOf<SandboxNode["diagnostic"]>().toEqualTypeOf<undefined | "" | "provider_unavailable" | "host_unsupported" | "artifacts_unavailable" | "runtime_download_failed" | "runtime_image_unavailable" | "capacity_insufficient">();
+    expectTypeOf<SandboxNode["diagnostic"]>().toEqualTypeOf<undefined | "provider_unavailable" | "host_unsupported" | "artifacts_unavailable" | "runtime_download_failed" | "runtime_image_unavailable" | "capacity_insufficient">();
   });
   it("requires each node's enrollment ID: a string, or null for nodes enrolled before Core recorded it", async () => {
     const fetch = vi.fn<typeof globalThis.fetch>().mockResolvedValue(response({ data: [node, unready] }));
diff --git a/packages/agents-client/src/sandbox-client.ts b/packages/agents-client/src/sandbox-client.ts
index ef1cafcb8..1cdc84d2d 100644
--- a/packages/agents-client/src/sandbox-client.ts
+++ b/packages/agents-client/src/sandbox-client.ts
@@ -1,26 +1,27 @@
 import { AgentCoreError } from "./client";
 import { CoreRequester, type CoreClientOptions } from "./core-request";
 import { deploymentContract } from "./deployment-contract";
-import { hasOwn, isNonnegativeInteger, isRecord, onlyFields, sameResourceId } from "./response-projection";
+import { hasOwn, isNonnegativeInteger, isOneOf, isRecord, onlyFields, sameResourceId, schemaFields } from "./response-projection";
+import {
+  deploymentResourcesFields, deploymentSpecFields, deploymentSpecRequired, deploymentViewFields, deploymentViewModeValues, deploymentViewRequired,
+  hostHistoryFields, hostHistoryPointFields, nodeAllocationDiagnosticValues, nodeAllocationFields, nodeDetailFields, nodeDetailRequired,
+  nodeDiagnosticValues, nodeFields, nodeHostFields, nodeRequired, nodeRolloutFields, nodeRolloutRequired, nodeRolloutStateValues, resetClearValues,
+  resetFields, resetOfflineNodeFields, resetRemainingFields, rolloutFields, rolloutNodesFields, rolloutStateValues, runtimeReleaseFields,
+  sandboxAllocationListFields, sandboxNodeListFields, sandboxResourcesFields, sandboxResourcesRequired, suspensionFields,
+  type DeploymentSpec, type DeploymentView, type HostHistoryPoint, type Node, type NodeAllocation, type NodeDetail, type NodeDiagnostic,
+  type NodeHost, type NodeRollout, type NodeUpdate, type Reset, type ResetOfflineNode, type ResetRequest, type Rollout, type RuntimeRelease,
+  type SandboxDeploymentInput, type SandboxEnrollmentToken, type SandboxResources as SandboxResourcesResource,
+} from "./generated/core-api";
 import type { ReadOptions } from "./types";
 
-export type SandboxDiagnostic = "" | "node_unavailable" | "resource_missing" | "compute_unconfirmed" | "ownership_mismatch" | "provider_unavailable";
 /** Checked against Core's shared node-diagnostics.json fixture. */
-export const sandboxNodeDiagnostics = [
-  "provider_unavailable",
-  "host_unsupported",
-  "artifacts_unavailable",
-  "runtime_download_failed",
-  "runtime_image_unavailable",
-  "capacity_insufficient",
-] as const;
+export const sandboxNodeDiagnostics = nodeDiagnosticValues;
 /** Fixed reason a node's provider is not ready. Core omits the field while the provider is ready, so read it as falsy (undefined) then. The client reads an unknown future value as provider_unavailable. */
-export type SandboxNodeDiagnostic = "" | typeof sandboxNodeDiagnostics[number];
-const nodeDiagnostics: ReadonlySet<string> = new Set(sandboxNodeDiagnostics);
+export type SandboxNodeDiagnostic = NodeDiagnostic;
 
 /** Keep a known readiness cause; never expose unclassified node-supplied text. */
-export function normalizeSandboxNodeDiagnostic(value: string): Exclude<SandboxNodeDiagnostic, ""> {
-  return nodeDiagnostics.has(value) ? value as Exclude<SandboxNodeDiagnostic, ""> : "provider_unavailable";
+export function normalizeSandboxNodeDiagnostic(value: string): SandboxNodeDiagnostic {
+  return isOneOf(nodeDiagnosticValues, value) ? value : "provider_unavailable";
 }
 
 /** A registered Provider kind; deploymentContract.providers holds each one's declaration. */
@@ -28,68 +29,46 @@ export type SandboxProvider = keyof typeof deploymentContract.providers;
 /** Client-generated, never a Core code: a deployment write whose rejection could echo the key and is withheld. */
 export const sandboxConfigurationUnconfirmed = "sandbox_configuration_unconfirmed";
 const sandboxConfigurationParams = new Set<unknown>(["runtime", ...deploymentContract.resources.map(({ name }) => `resources.${name}`)]);
+
+// Generated types keep their schema names in ./generated/core-api; these are the client's names for them.
 /** CPU and MiB limits for each sandbox, not node concurrency. */
-export interface SandboxResources { cpus: number; memory_mib: number; root_disk_mib?: number; environment_disk_mib?: number }
-export interface SandboxRuntimeRelease { source_commit: string; image_id: string; image_manifest_digest: string; microsandbox_ref: string; runtime_sha256: string; firmware_sha256: string }
-export interface SandboxSpecification { resources: SandboxResources; runtime?: SandboxRuntimeRelease }
-/** Core derives the deployment's address from the installation public URL; a `core_url` member is rejected. */
-export interface InitializeSandboxDeployment {
+export type SandboxResources = SandboxResourcesResource;
+export type SandboxRuntimeRelease = RuntimeRelease;
+export type SandboxSpecification = DeploymentSpec;
+export type SandboxRollout = Rollout;
+/** `state` is target preparation, which never invalidates a qualified older serving pin; `ready_generation` is that durable pin and alone does not imply connection readiness. */
+export type SandboxNodeRollout = NodeRollout;
+export type StartSandboxReset = ResetRequest;
+export type SandboxReset = Reset;
+/** `provider_ready` is the last provider report, so combine it with `online`; `diagnostic` is absent while the provider is ready. A `core_url` other than the installation public URL means the node receives no new sandboxes and must be re-added. */
+export type SandboxNode = Node;
+/** A one-time node enrollment command; `enrollment_id` is its public handle, never a credential. */
+export type SandboxEnrollment = SandboxEnrollmentToken;
+/** One node with its host observation and complete UTC buckets of host history. */
+export type SandboxNodeDetail = NodeDetail;
+/** A node's name and sandbox limits, with a retained limit of at least the active one. Under Docker, Core sets the retained limit to the active one. */
+export type SandboxNodeUpdate = NodeUpdate;
+export type SandboxAllocation = NodeAllocation;
+
+// The schema types each Provider's configuration, credential and metadata as free-form objects; the client names E2B's.
+/**
+ * Core derives the deployment's address from the installation public URL; a `core_url` member is rejected.
+ * `expected_generation` is required, zero for first setup. Docker and microsandbox require `resources` and `runtime`;
+ * E2B may omit `resources` to adopt its template build's CPU and memory, and always runs that build.
+ */
+export type InitializeSandboxDeployment = Omit<SandboxDeploymentInput, "provider" | "configuration" | "credential"> & {
   provider: SandboxProvider;
-  /** Required, including zero for first setup; read it from GET before submitting once. */
-  expected_generation: number;
-  /** Required for Docker/microsandbox. E2B may omit it to adopt its validated template build's CPU and memory. */
-  resources?: SandboxResources;
-  /** Required for Docker/microsandbox; E2B uses its fixed template build. */
-  runtime?: SandboxRuntimeRelease;
-  configuration?: { template?: string; api_url?: string; domain?: string };
+  configuration?: SandboxE2BConfiguration;
   /** Write-only. Omission on update preserves the current credential. */
   credential?: { api_key: string };
-}
-export interface UpdateSandboxDeployment extends InitializeSandboxDeployment {}
-export interface SandboxRollout {
-  /** Poll at high frequency only while preparing, independently of old Session retention. */
-  state: "settled" | "preparing";
-  previous_generation_sandboxes: number;
-  nodes: { ready: number; preparing: number; failed: number; update_required: number; unknown: number } | null;
-}
-export interface SandboxNodeRollout {
-  /** Target preparation; unknown/failed/preparing does not invalidate a qualified old serving pin. */
-  state: "ready" | "preparing" | "failed" | "update_required" | "unknown";
-  /** Durable serving pin; this alone does not imply current connection readiness. */
-  ready_generation: number | null;
-  diagnostic?: SandboxNodeDiagnostic;
-}
-export interface StartSandboxReset { expected_generation: number; clear: "auto" | "force"; deadline_seconds?: number }
-export interface SandboxReset {
-  clear: "auto" | "force";
-  requested_at: string;
-  deadline_at: string | null;
-  forced_at: string | null;
-  remaining: {
-    busy: number; idle: number; cleanup: number; on_offline_nodes: number;
-    offline_nodes: Array<{ node_id: string; name: string; resources: number }>;
-  };
-}
-
-export interface SandboxDeployment {
-  rollout: SandboxRollout;
-  specification?: SandboxSpecification;
-  specification_digest?: string;
-  installation_id: string;
+};
+export type UpdateSandboxDeployment = InitializeSandboxDeployment;
+export type SandboxDeployment = Omit<DeploymentView, "provider" | "configuration" | "metadata"> & {
   provider: SandboxProvider | "";
-  /** Read-only: the installation public URL, which nodes and sandboxes use to reach Core. Present before configuration. */
-  readonly core_url: string;
-  reset: SandboxReset | null;
-  owner_epoch: number;
-  generation: number;
-  mode: "nodes" | "direct" | "";
-  resources: { allocations: number; pending: number };
-  configuration?: { template?: string; api_url?: string; domain?: string };
+  configuration?: SandboxE2BConfiguration;
   metadata?: { template_build?: SandboxE2BTemplateBuild };
-  credential_configured: boolean;
-  /** Idle suspension policy; null unless the Provider declares checkpoint support. */
-  suspension: { idle_seconds: number; retention_seconds: number } | null;
-}
+};
+export interface SandboxE2BConfiguration { template?: string; api_url?: string; domain?: string }
 /** The fixed E2B build as Core read it when the selection was saved; unknown values are null. */
 export interface SandboxE2BTemplateBuild {
   status: string | null;
@@ -98,95 +77,15 @@ export interface SandboxE2BTemplateBuild {
 export interface SandboxE2BDiscoveryInput { api_key: string; api_url?: string; domain?: string }
 export interface SandboxE2BTemplate { id: string; names: string[] }
 export interface SandboxE2BReadyBuild { id: string; cpus: number; memory_mib: number }
-export interface SandboxNode {
-  rollout: SandboxNodeRollout;
-  id: string;
-  name: string;
-  provider: string;
-  online: boolean;
-  /** Last provider report; combine with online. Target rollout state is independent of serving readiness. */
-  provider_ready: boolean;
-  /** Absent while the provider is ready. */
-  diagnostic?: SandboxNodeDiagnostic;
-  cpu_count: number | null;
-  available_memory_bytes: number | null;
-  available_disk_bytes: number | null;
-  running: number;
-  snapshots: number;
-  last_seen_at: string | null;
-  max_active: number;
-  max_retained: number;
-  active: number;
-  reserved: number;
-  retained: number;
-  cleanup_pending: number;
-  created_at: string;
-  /** Read-only: the Core address this node enrolled with. When it differs from the installation public URL, the node receives no new sandboxes and must be re-added. */
-  readonly core_url: string;
-  /** Read-only: the `enrollment_id` of the command that registered this node; null for nodes enrolled before Core recorded it. Core always sends the member. */
-  readonly enrollment_id: string | null;
-}
-/** A one-time node enrollment command issued by Core. */
-export interface SandboxEnrollment {
-  /** The one-use secret the node registers with. */
-  token: string;
-  expires_at: string;
-  /** Public, non-secret handle of this command; never a credential. The node it registers reports the same `enrollment_id`. */
-  enrollment_id: string;
-}
-/** The node machine's last heartbeat observation; unavailable measurements are null. */
-export interface SandboxNodeHost {
-  effective_cpu_cores: number | null;
-  /** Busy share of the whole host's CPU between heartbeats, 0–1. */
-  cpu_utilization: number | null;
-  total_memory_bytes: number | null;
-  available_memory_bytes: number | null;
-  available_disk_bytes: number | null;
-  observed_at: string | null;
-}
-export interface SandboxNodeHostPoint {
-  start: string;
-  cpu_utilization_max: number | null;
-  memory_used_bytes_max: number | null;
-  available_disk_bytes_min: number | null;
-}
 export type SandboxNodeHistoryRange = "1h" | "6h" | "24h";
-/** One node with its host observation and complete UTC buckets of host history. */
-export interface SandboxNodeDetail extends SandboxNode {
-  host: SandboxNodeHost;
-  history: { resolution_seconds: number; points: SandboxNodeHostPoint[] };
-}
-/** A node's name and sandbox limits; Core takes all three, with a retained limit of at least the active one. Under Docker, Core sets the retained limit to the active one. */
-export interface SandboxNodeUpdate {
-  name: string;
-  max_active: number;
-  max_retained: number;
-}
-export interface SandboxAllocation {
-  deployment_generation: number;
-  id: string;
-  node_id: string;
-  tenant_id: string;
-  session_id: string;
-  environment_id: string;
-  state: string;
-  compute_phase: string;
-  /** When the allocation entered its current compute_phase, or null when unknown; an allocation that existed before Core recorded it reports null until its next phase change. */
-  compute_phase_changed_at: string | null;
-  diagnostic: SandboxDiagnostic;
-  initialization: string;
-  created_at: string;
-}
+
 function invalidSandboxResponse(): never {
   throw new AgentCoreError("Core returned an invalid sandbox administration response.", 502, "invalid_admin_response");
 }
 
-/**
- * The object has every required member, optional ones only where listed, and nothing else. The projections below
- * follow Core's deployment.View, deployment.Node, deployment.NodeDetail and deployment.NodeAllocation serialization.
- */
-function members(value: unknown, required: readonly string[], optional: readonly string[] = []): Record<string, unknown> {
-  if (!isRecord(value) || !required.every((field) => hasOwn(value, field)) || !onlyFields(value, new Set([...required, ...optional]))) return invalidSandboxResponse();
+/** The object has every required field, optional ones only where the schema lists them, and nothing else. */
+function members(value: unknown, fields: readonly string[], required: readonly string[] = fields): Record<string, unknown> {
+  if (!isRecord(value) || !schemaFields(value, fields, required)) return invalidSandboxResponse();
   return value;
 }
 function valid(condition: boolean): void {
@@ -197,22 +96,20 @@ const measure = (value: unknown) => typeof value === "number" && Number.isFinite
 const nullable = (test: (value: unknown) => boolean) => (value: unknown) => value === null || test(value);
 const strings = (value: Record<string, unknown>, fields: readonly string[]) => fields.every((field) => typeof value[field] === "string");
 
-const modes = new Set(["", "nodes", "direct"]);
-const releaseFields = ["source_commit", "image_id", "image_manifest_digest", "microsandbox_ref", "runtime_sha256", "firmware_sha256"];
 function projectSpecification(value: unknown): SandboxSpecification {
-  const specification = members(value, ["resources"], ["runtime"]);
-  const resources = members(specification.resources, ["cpus", "memory_mib"], ["root_disk_mib", "environment_disk_mib"]);
+  const specification = members(value, deploymentSpecFields, deploymentSpecRequired);
+  const resources = members(specification.resources, sandboxResourcesFields, sandboxResourcesRequired);
   valid(Object.values(resources).every(isNonnegativeInteger));
   if (!hasOwn(specification, "runtime")) return { resources: { ...resources } as unknown as SandboxResources };
-  const runtime = members(specification.runtime, releaseFields);
-  valid(strings(runtime, releaseFields));
+  const runtime = members(specification.runtime, runtimeReleaseFields);
+  valid(strings(runtime, runtimeReleaseFields));
   return { resources: { ...resources } as unknown as SandboxResources, runtime: { ...runtime } as unknown as SandboxRuntimeRelease };
 }
 /** The adapter's public projection has no credential member. */
 function projectE2B(configuration: unknown, metadata: unknown): Pick<SandboxDeployment, "configuration" | "metadata"> {
   const config = members(configuration, ["template", "api_url", "domain"]);
   valid(strings(config, ["template", "api_url", "domain"]));
-  const facts = members(metadata, [], ["template_build"]);
+  const facts = members(metadata, ["template_build"], []);
   if (!hasOwn(facts, "template_build")) return { configuration: { ...config }, metadata: {} };
   const build = members(facts.template_build, ["status", "resources"]);
   const resources = members(build.resources, ["cpus", "memory_mib", "root_disk_mib"]);
@@ -222,16 +119,16 @@ function projectE2B(configuration: unknown, metadata: unknown): Pick<SandboxDepl
 /** Counts and blocker identities are one Core snapshot, never reconstructed from node lists. */
 function projectReset(value: unknown, held: number): SandboxReset | null {
   if (value === null) return null;
-  const reset = members(value, ["clear", "requested_at", "deadline_at", "forced_at", "remaining"]);
-  const remaining = members(reset.remaining, ["busy", "idle", "cleanup", "on_offline_nodes", "offline_nodes"]);
-  valid((reset.clear === "auto" || reset.clear === "force") && timestamp(reset.requested_at) &&
+  const reset = members(value, resetFields);
+  const remaining = members(reset.remaining, resetRemainingFields);
+  valid(isOneOf(resetClearValues, reset.clear) && timestamp(reset.requested_at) &&
     nullable(timestamp)(reset.deadline_at) && nullable(timestamp)(reset.forced_at) &&
     (reset.clear === "auto" ? reset.deadline_at !== null && reset.forced_at === null : reset.forced_at !== null) &&
     [remaining.busy, remaining.idle, remaining.cleanup, remaining.on_offline_nodes].every(isNonnegativeInteger) && Array.isArray(remaining.offline_nodes));
   const nodes = (remaining.offline_nodes as unknown[]).map(value => {
-    const node = members(value, ["node_id", "name", "resources"]);
+    const node = members(value, resetOfflineNodeFields);
     valid(strings(node, ["node_id", "name"]) && node.node_id !== "" && isNonnegativeInteger(node.resources) && Number(node.resources) > 0);
-    return { ...node } as SandboxReset["remaining"]["offline_nodes"][number];
+    return { ...node } as unknown as ResetOfflineNode;
   });
   valid(Number(remaining.busy) + Number(remaining.idle) + Number(remaining.cleanup) === held &&
     Number(remaining.on_offline_nodes) <= held && nodes.reduce((sum, node) => sum + node.resources, 0) === remaining.on_offline_nodes &&
@@ -239,15 +136,15 @@ function projectReset(value: unknown, held: number): SandboxReset | null {
   return { ...reset, remaining: { ...remaining, offline_nodes: nodes } } as unknown as SandboxReset;
 }
 function projectRollout(value: unknown, mode: unknown, held: number): SandboxRollout {
-  const rollout = members(value, ["state", "previous_generation_sandboxes", "nodes"]);
-  valid((rollout.state === "settled" || rollout.state === "preparing") && isNonnegativeInteger(rollout.previous_generation_sandboxes) && Number(rollout.previous_generation_sandboxes) <= held);
-  const nodes = rollout.nodes === null ? null : members(rollout.nodes, ["ready", "preparing", "failed", "update_required", "unknown"]);
+  const rollout = members(value, rolloutFields);
+  valid(isOneOf(rolloutStateValues, rollout.state) && isNonnegativeInteger(rollout.previous_generation_sandboxes) && Number(rollout.previous_generation_sandboxes) <= held);
+  const nodes = rollout.nodes === null ? null : members(rollout.nodes, rolloutNodesFields);
   valid((nodes !== null) === (mode === "nodes") && (nodes === null || Object.values(nodes).every(isNonnegativeInteger)) && (rollout.state === "preparing") === (nodes !== null && Number(nodes.preparing) > 0));
   return { ...rollout, nodes: nodes && { ...nodes } } as unknown as SandboxRollout;
 }
 function projectNodeRollout(value: unknown, online: unknown): SandboxNodeRollout {
-  const rollout = members(value, ["state", "ready_generation"], ["diagnostic"]);
-  valid(["ready", "preparing", "failed", "update_required", "unknown"].includes(rollout.state as string) && nullable(isNonnegativeInteger)(rollout.ready_generation) &&
+  const rollout = members(value, nodeRolloutFields, nodeRolloutRequired);
+  valid(isOneOf(nodeRolloutStateValues, rollout.state) && nullable(isNonnegativeInteger)(rollout.ready_generation) &&
     (online !== false || rollout.state === "unknown") && (rollout.state !== "ready" || rollout.ready_generation !== null) &&
     (rollout.diagnostic === undefined || (typeof rollout.diagnostic === "string" && rollout.diagnostic !== "" && rollout.state === "failed")));
   return { ...rollout, ...(rollout.diagnostic !== undefined ? { diagnostic: normalizeSandboxNodeDiagnostic(rollout.diagnostic as string) } : {}) } as unknown as SandboxNodeRollout;
@@ -255,26 +152,26 @@ function projectNodeRollout(value: unknown, online: unknown): SandboxNodeRollout
 /** Configured deployments carry a validated public configuration and observation object. */
 function projectDeployment(value: unknown): SandboxDeployment {
   const e2b = isRecord(value) && value.provider === "e2b";
-  const fields = ["installation_id", "provider", "core_url", "reset", "rollout", "owner_epoch", "generation", "mode", "resources", "suspension", "credential_configured"];
-  const deployment = members(value, isRecord(value) && value.provider !== "" ? [...fields, "configuration", "metadata"] : fields, ["specification", "specification_digest"]);
+  // A selected Provider always has its configuration and metadata; no Provider has neither.
+  const selected = isRecord(value) && value.provider !== "";
+  const deployment = members(value, deploymentViewFields, selected ? [...deploymentViewRequired, "configuration", "metadata"] : deploymentViewRequired);
+  valid(selected || (!hasOwn(deployment, "configuration") && !hasOwn(deployment, "metadata")));
   valid(typeof deployment.credential_configured === "boolean");
   if (!e2b && deployment.provider !== "") { members(deployment.configuration, []); members(deployment.metadata, []); valid(deployment.credential_configured === false); }
-  const resources = members(deployment.resources, ["allocations", "pending"]);
-  const suspension = deployment.suspension === null ? null : members(deployment.suspension, ["idle_seconds", "retention_seconds"]);
+  const resources = members(deployment.resources, deploymentResourcesFields);
+  const suspension = deployment.suspension === null ? null : members(deployment.suspension, suspensionFields);
   const configured = hasOwn(deployment, "specification");
-  valid(strings(deployment, ["installation_id", "core_url"]) && (deployment.provider === "" || (typeof deployment.provider === "string" && hasOwn(deploymentContract.providers, deployment.provider))) && modes.has(deployment.mode as string) &&
+  valid(strings(deployment, ["installation_id", "core_url"]) && (deployment.provider === "" || (typeof deployment.provider === "string" && hasOwn(deploymentContract.providers, deployment.provider))) && isOneOf(deploymentViewModeValues, deployment.mode) &&
     [deployment.owner_epoch, deployment.generation, resources.allocations, resources.pending].every(isNonnegativeInteger) &&
     (suspension === null || [suspension.idle_seconds, suspension.retention_seconds].every(isNonnegativeInteger)) &&
     configured === hasOwn(deployment, "specification_digest") && (!configured || (typeof deployment.specification_digest === "string" && deployment.specification_digest !== "")));
   return {
-    ...deployment, rollout: projectRollout(deployment.rollout, deployment.mode, Number(resources.allocations) + Number(resources.pending)), reset: projectReset(deployment.reset, Number(resources.allocations) + Number(resources.pending)), resources: { ...resources } as SandboxDeployment["resources"], suspension: suspension && { ...suspension } as SandboxDeployment["suspension"],
+    ...deployment, rollout: projectRollout(deployment.rollout, deployment.mode, Number(resources.allocations) + Number(resources.pending)), reset: projectReset(deployment.reset, Number(resources.allocations) + Number(resources.pending)), resources: { ...resources } as unknown as SandboxDeployment["resources"], suspension: suspension && { ...suspension } as unknown as SandboxDeployment["suspension"],
     ...(configured ? { specification: projectSpecification(deployment.specification) } : {}),
     ...(e2b ? projectE2B(deployment.configuration, deployment.metadata) : {}),
   } as unknown as SandboxDeployment;
 }
 
-const nodeFields = ["rollout", "id", "name", "provider", "online", "provider_ready", "cpu_count", "available_memory_bytes", "available_disk_bytes", "running", "snapshots",
-  "last_seen_at", "max_active", "max_retained", "active", "reserved", "retained", "cleanup_pending", "created_at", "core_url", "enrollment_id"];
 /** Core omits an empty `diagnostic`, so a present one is a code; an unknown code reads as provider_unavailable. */
 function projectNode(node: Record<string, unknown>): SandboxNode {
   const { diagnostic, rollout, ...rest } = node;
@@ -288,35 +185,34 @@ function projectNode(node: Record<string, unknown>): SandboxNode {
   return { ...fields, diagnostic: normalizeSandboxNodeDiagnostic(diagnostic as string) } as unknown as SandboxNode;
 }
 function projectNodeList(value: unknown): { data: SandboxNode[] } {
-  const list = members(value, ["data"]);
+  const list = members(value, sandboxNodeListFields);
   valid(Array.isArray(list.data));
-  return { data: (list.data as unknown[]).map((entry) => projectNode(members(entry, nodeFields, ["diagnostic"]))) };
+  return { data: (list.data as unknown[]).map((entry) => projectNode(members(entry, nodeFields, nodeRequired))) };
 }
 /** A never-observed host is all null; the history lists every bucket of the range. */
 function projectNodeDetail(value: unknown, nodeId: string): SandboxNodeDetail {
-  const { host, history, ...fields } = members(value, [...nodeFields, "host", "history"], ["diagnostic"]);
+  const { host, history, ...fields } = members(value, nodeDetailFields, nodeDetailRequired);
   const node = projectNode(fields);
-  const observed = members(host, ["effective_cpu_cores", "cpu_utilization", "total_memory_bytes", "available_memory_bytes", "available_disk_bytes", "observed_at"]);
-  const buckets = members(history, ["resolution_seconds", "points"]);
+  const observed = members(host, nodeHostFields);
+  const buckets = members(history, hostHistoryFields);
   valid(sameResourceId(node.id, nodeId) && [observed.effective_cpu_cores, observed.cpu_utilization].every(nullable(measure)) &&
     [observed.total_memory_bytes, observed.available_memory_bytes, observed.available_disk_bytes].every(nullable(isNonnegativeInteger)) &&
     nullable(timestamp)(observed.observed_at) && isNonnegativeInteger(buckets.resolution_seconds) && buckets.resolution_seconds > 0 && Array.isArray(buckets.points));
   const points = (buckets.points as unknown[]).map((entry) => {
-    const point = members(entry, ["start", "cpu_utilization_max", "memory_used_bytes_max", "available_disk_bytes_min"]);
+    const point = members(entry, hostHistoryPointFields);
     valid(timestamp(point.start) && nullable(measure)(point.cpu_utilization_max) && [point.memory_used_bytes_max, point.available_disk_bytes_min].every(nullable(isNonnegativeInteger)));
-    return { ...point } as unknown as SandboxNodeHostPoint;
+    return { ...point } as unknown as HostHistoryPoint;
   });
-  return { ...node, host: { ...observed } as unknown as SandboxNodeHost, history: { resolution_seconds: buckets.resolution_seconds as number, points } };
+  return { ...node, host: { ...observed } as unknown as NodeHost, history: { resolution_seconds: buckets.resolution_seconds as number, points } };
 }
 
-const allocationFields = ["id", "node_id", "tenant_id", "session_id", "environment_id", "state", "compute_phase", "initialization", "diagnostic"];
-const allocationDiagnostics = new Set(["", "node_unavailable", "resource_missing", "compute_unconfirmed", "ownership_mismatch", "provider_unavailable"]);
+const allocationStrings = ["id", "node_id", "tenant_id", "session_id", "environment_id", "state", "compute_phase", "initialization", "diagnostic"];
 function projectAllocations(value: unknown, nodeId: string): { data: SandboxAllocation[] } {
-  const list = members(value, ["data"]);
+  const list = members(value, sandboxAllocationListFields);
   valid(Array.isArray(list.data));
   return { data: (list.data as unknown[]).map((entry) => {
-    const allocation = members(entry, [...allocationFields, "deployment_generation", "compute_phase_changed_at", "created_at"]);
-    valid(isNonnegativeInteger(allocation.deployment_generation) && strings(allocation, allocationFields) && sameResourceId(allocation.node_id as string, nodeId) && allocationDiagnostics.has(allocation.diagnostic as string) &&
+    const allocation = members(entry, nodeAllocationFields);
+    valid(isNonnegativeInteger(allocation.deployment_generation) && strings(allocation, allocationStrings) && sameResourceId(allocation.node_id as string, nodeId) && isOneOf(nodeAllocationDiagnosticValues, allocation.diagnostic) &&
       nullable(timestamp)(allocation.compute_phase_changed_at) && timestamp(allocation.created_at));
     return { ...allocation } as unknown as SandboxAllocation;
   }) };
diff --git a/packages/agents-client/src/session-diagnostics.ts b/packages/agents-client/src/session-diagnostics.ts
index c8af4468e..f2793ca82 100644
--- a/packages/agents-client/src/session-diagnostics.ts
+++ b/packages/agents-client/src/session-diagnostics.ts
@@ -1,27 +1,35 @@
-import { canonicalUuid, exactFields, isRecord, sameResourceId } from "./response-projection";
+import { canonicalUuid, exactFields, isOneOf, isRecord, sameResourceId } from "./response-projection";
 import { invalidAdminResponse } from "./admin-projection";
+import { turnStatusResourceValues } from "./generated/public-api";
+import {
+  diagnosticFailureFields, itemDiagnosticTimingFields, sessionDiagnosticFailureFields, sessionDiagnosticFailureRequired,
+  sessionDiagnosticFailureSourceValues, sessionDiagnosticsFields, sessionDiagnosticsStatusValues, turnDiagnosticsFields,
+  type DiagnosticFailure as DiagnosticFailureResource, type DiagnosticFailureCode, type ItemDiagnosticTiming,
+  type SessionDiagnosticFailure as SessionDiagnosticFailureResource, type SessionDiagnostics as SessionDiagnosticsResource,
+  type TurnDiagnostics as TurnDiagnosticsResource,
+} from "./generated/core-api";
 
-export type NativeFailureCode = "authentication_error" | "rate_limit_exceeded" | "usage_limit_exceeded" | "server_overloaded" | "server_error" | "invalid_request" | "resource_not_found" | "request_timeout" | "context_length_exceeded" | "cyber_policy" | "connection_failed";
-export type DiagnosticFailureCode = NativeFailureCode | "harness_error" | "model_provider_required" | "runtime_unavailable" | "runtime_disconnected" | "runtime_preparation_failed" | "execution_interrupted" | "delivery_unconfirmed" | "input_rejected" | "executor_protocol_error" | "core_storage_failed" | "internal_error" | "environment_connection_timeout" | "environment_unavailable" | "environment_provisioning_failed";
+// ItemDiagnosticTiming holds Core receipt intervals, distinct from the public tool-reported duration_ms.
+export type { DiagnosticFailureCode, ItemDiagnosticTiming };
+// The schema types params as a free-form object; each code that carries params has one of these shapes.
 export type ProvisioningFailureParams = { step: "setup" | "python" | "npm" | "system" | "file" | "skill" | null; index: number | null; exit_code: number | null };
 export type ConnectionFailureParams = { http_status: number | null };
-export type DiagnosticFailure = { code: DiagnosticFailureCode; params: Record<string, never> | ProvisioningFailureParams | ConnectionFailureParams; failed_at: string | null };
-export type SessionDiagnosticFailure = DiagnosticFailure & { source: "turn" | "environment" | "environment_input"; turn_id?: string };
-export type SessionDiagnostics = { object: "core.session_diagnostics"; session_id: string; status: "idle" | "in_progress" | "requires_action" | "failed"; failure: SessionDiagnosticFailure | null };
-/** Core receipt intervals, distinct from the public tool-reported duration_ms. */
-export type ItemDiagnosticTiming = { item_id: string; started_at: string; completed_at: string | null; observed_duration_ms: number | null };
-export type TurnDiagnostics = { object: "core.turn_diagnostics"; session_id: string; turn_id: string; status: string; failure: DiagnosticFailure | null; items: ItemDiagnosticTiming[]; items_truncated: boolean };
+export type DiagnosticFailure = Omit<DiagnosticFailureResource, "params"> & { params: Record<string, never> | ProvisioningFailureParams | ConnectionFailureParams };
+export type SessionDiagnosticFailure = DiagnosticFailure & Pick<SessionDiagnosticFailureResource, "source" | "turn_id">;
+export type SessionDiagnostics = Omit<SessionDiagnosticsResource, "failure"> & { failure: SessionDiagnosticFailure | null };
+export type TurnDiagnostics = Omit<TurnDiagnosticsResource, "failure"> & { failure: DiagnosticFailure | null };
 
-const turnCodes = new Set(["authentication_error", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "invalid_request", "resource_not_found", "request_timeout", "context_length_exceeded", "cyber_policy", "connection_failed", "harness_error", "model_provider_required", "runtime_unavailable", "runtime_disconnected", "runtime_preparation_failed", "execution_interrupted", "delivery_unconfirmed", "input_rejected", "executor_protocol_error", "core_storage_failed", "internal_error"]);
-const inputCodes = new Set(["environment_connection_timeout", "environment_unavailable", "model_provider_required", "internal_error"]);
-const turnStatuses = new Set(["queued", "in_progress", "waiting", "completed", "failed", "cancelled"]);
+// The schema's one code enum covers every failure source; each source produces only its subset.
+const turnCodes: readonly DiagnosticFailureCode[] = ["authentication_error", "rate_limit_exceeded", "usage_limit_exceeded", "server_overloaded", "server_error", "invalid_request", "resource_not_found", "request_timeout", "context_length_exceeded", "cyber_policy", "connection_failed", "harness_error", "model_provider_required", "runtime_unavailable", "runtime_disconnected", "runtime_preparation_failed", "execution_interrupted", "delivery_unconfirmed", "input_rejected", "executor_protocol_error", "core_storage_failed", "internal_error"];
+const inputCodes: readonly DiagnosticFailureCode[] = ["environment_connection_timeout", "environment_unavailable", "model_provider_required", "internal_error"];
+const environmentCodes: readonly DiagnosticFailureCode[] = ["environment_provisioning_failed"];
 const fields = (...values: string[]) => new Set(values);
 function timestamp(value: unknown): value is string {
   return typeof value === "string" && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/u.test(value) && Number.isFinite(Date.parse(value));
 }
-function failure(value: unknown, codes: Set<string>, session = false): DiagnosticFailure {
-  if (!isRecord(value) || !exactFields(value, fields("code", "params", "failed_at", ...(session ? ["source", ...(value.source === "turn" ? ["turn_id"] : [])] : []))) ||
-      typeof value.code !== "string" || !codes.has(value.code) || !isRecord(value.params) || (value.failed_at !== null && !timestamp(value.failed_at))) return invalidAdminResponse();
+function failure(value: unknown, codes: readonly DiagnosticFailureCode[], session = false): DiagnosticFailure {
+  if (!isRecord(value) || !exactFields(value, !session ? diagnosticFailureFields : value.source === "turn" ? sessionDiagnosticFailureFields : sessionDiagnosticFailureRequired) ||
+      !isOneOf(codes, value.code) || !isRecord(value.params) || (value.failed_at !== null && !timestamp(value.failed_at))) return invalidAdminResponse();
   let params: DiagnosticFailure["params"] = {};
   if (value.code === "environment_provisioning_failed") {
     const p = value.params;
@@ -34,40 +42,40 @@ function failure(value: unknown, codes: Set<string>, session = false): Diagnosti
     if (!exactFields(p, fields("http_status")) || (p.http_status !== null && (!Number.isSafeInteger(p.http_status) || (p.http_status as number) < 100 || (p.http_status as number) > 599))) return invalidAdminResponse();
     params = { http_status: p.http_status as number | null };
   } else if (Object.keys(value.params).length !== 0) return invalidAdminResponse();
-  return { code: value.code as DiagnosticFailureCode, params, failed_at: value.failed_at as string | null };
+  return { code: value.code, params, failed_at: value.failed_at as string | null };
 }
 
 export function projectSessionDiagnostics(value: unknown, sessionId: string): SessionDiagnostics {
-  if (!isRecord(value) || !exactFields(value, fields("object", "session_id", "status", "failure")) || value.object !== "core.session_diagnostics" ||
-      canonicalUuid(value.session_id) === null || !sameResourceId(value.session_id as string, sessionId) || typeof value.status !== "string" || !["idle", "in_progress", "requires_action", "failed"].includes(value.status)) return invalidAdminResponse();
+  if (!isRecord(value) || !exactFields(value, sessionDiagnosticsFields) || value.object !== "core.session_diagnostics" ||
+      canonicalUuid(value.session_id) === null || !sameResourceId(value.session_id as string, sessionId) || !isOneOf(sessionDiagnosticsStatusValues, value.status)) return invalidAdminResponse();
   let projected: SessionDiagnosticFailure | null = null;
   if (value.status === "failed") {
-    if (!isRecord(value.failure) || typeof value.failure.source !== "string" || !["turn", "environment", "environment_input"].includes(value.failure.source)) return invalidAdminResponse();
+    if (!isRecord(value.failure) || !isOneOf(sessionDiagnosticFailureSourceValues, value.failure.source)) return invalidAdminResponse();
     const f = value.failure;
-    const source = f.source as SessionDiagnosticFailure["source"];
-    projected = { ...failure(f, source === "turn" ? turnCodes : source === "environment_input" ? inputCodes : new Set(["environment_provisioning_failed"]), true), source };
+    const source = value.failure.source;
+    projected = { ...failure(f, source === "turn" ? turnCodes : source === "environment_input" ? inputCodes : environmentCodes, true), source };
     if (source === "turn") {
       if (canonicalUuid(f.turn_id) === null) return invalidAdminResponse();
       projected.turn_id = f.turn_id as string;
     }
   } else if (value.failure !== null) return invalidAdminResponse();
-  return { object: "core.session_diagnostics", session_id: value.session_id as string, status: value.status as SessionDiagnostics["status"], failure: projected };
+  return { object: "core.session_diagnostics", session_id: value.session_id as string, status: value.status, failure: projected };
 }
 
 export function projectTurnDiagnostics(value: unknown, sessionId: string, turnId: string): TurnDiagnostics {
-  if (!isRecord(value) || !exactFields(value, fields("object", "session_id", "turn_id", "status", "failure", "items", "items_truncated")) || value.object !== "core.turn_diagnostics" ||
+  if (!isRecord(value) || !exactFields(value, turnDiagnosticsFields) || value.object !== "core.turn_diagnostics" ||
       canonicalUuid(value.session_id) === null || !sameResourceId(value.session_id as string, sessionId) || canonicalUuid(value.turn_id) === null || !sameResourceId(value.turn_id as string, turnId) ||
-      typeof value.status !== "string" || !turnStatuses.has(value.status) || !Array.isArray(value.items) || value.items.length > 1000 || typeof value.items_truncated !== "boolean" || (value.items_truncated && value.items.length !== 1000)) return invalidAdminResponse();
+      !isOneOf(turnStatusResourceValues, value.status) || !Array.isArray(value.items) || value.items.length > 1000 || typeof value.items_truncated !== "boolean" || (value.items_truncated && value.items.length !== 1000)) return invalidAdminResponse();
   const projected = value.status === "failed" ? failure(value.failure, turnCodes) : null;
   if (value.status !== "failed" && value.failure !== null) return invalidAdminResponse();
   const seen = new Set<string>();
   const items: ItemDiagnosticTiming[] = value.items.map((item: unknown) => {
-    if (!isRecord(item) || !exactFields(item, fields("item_id", "started_at", "completed_at", "observed_duration_ms")) || canonicalUuid(item.item_id) === null || !timestamp(item.started_at) ||
+    if (!isRecord(item) || !exactFields(item, itemDiagnosticTimingFields) || canonicalUuid(item.item_id) === null || !timestamp(item.started_at) ||
         (item.completed_at !== null && !timestamp(item.completed_at)) || (item.completed_at === null ? item.observed_duration_ms !== null : !Number.isSafeInteger(item.observed_duration_ms))) return invalidAdminResponse();
     const id = canonicalUuid(item.item_id)!;
     if (seen.has(id)) return invalidAdminResponse();
     seen.add(id);
     return { item_id: item.item_id as string, started_at: item.started_at, completed_at: item.completed_at as string | null, observed_duration_ms: item.observed_duration_ms as number | null };
   });
-  return { object: "core.turn_diagnostics", session_id: value.session_id as string, turn_id: value.turn_id as string, status: value.status as string, failure: projected, items, items_truncated: value.items_truncated };
+  return { object: "core.turn_diagnostics", session_id: value.session_id as string, turn_id: value.turn_id as string, status: value.status, failure: projected, items, items_truncated: value.items_truncated };
 }
diff --git a/packages/agents-client/src/types.ts b/packages/agents-client/src/types.ts
index 56a9b0f89..c9e056007 100644
--- a/packages/agents-client/src/types.ts
+++ b/packages/agents-client/src/types.ts
@@ -11,7 +11,7 @@ import type {
   PersistedAgentToolConfigParamToolSearch, PersistedAgentToolConfigParamWebSearch, ReasoningEffortResource,
   ReasoningParam, ReasoningResource, ReasoningSummaryResource, RotateVaultCredentialAuthParamStaticBearer,
   RotateVaultCredentialParams, ServiceTierResource, SessionEnvironmentStateResource, SessionEnvironmentStatusResource,
-  SessionErrorResource, SessionInputParam, SessionInputParamAgentSessionInputCancel,
+  SessionArtifactResource, SessionErrorResource, SessionInputParam, SessionInputParamAgentSessionInputCancel,
   SessionInputParamAgentSessionInputMessage, SessionInputParamAgentSessionInputToolResult,
   SessionRequiredActionResource, SessionRequiredActionResourceEnvironmentConnection,
   SessionRequiredActionResourceFunctionCall, SessionStatusResource, SkillResource, SkillVersionResource,
@@ -19,6 +19,10 @@ import type {
   VaultCredentialAuthResourceMcpOauth, VaultCredentialAuthResourceStaticBearer, VaultCredentialResource,
   VaultResource, VaultStatusParam, WebSearchLocationParam,
 } from "./generated/public-api";
+import type {
+  CoreHarness as CoreHarnessResource, ModelConfigurationSupport as ModelConfigurationSupportResource, RuntimeCPUObservation,
+  RuntimeMemoryObservation, RuntimeObservationLifecycleState, RuntimeObservationReason,
+} from "./generated/core-api";
 
 // Generated types keep their schema names in ./generated/public-api; these are the client's names for them.
 export type PageOrder = ListOrderParam;
@@ -468,6 +472,8 @@ export type SkillDeleted = DeletedSkillResource;
 /** Deleting the only remaining version also deletes its Skill. */
 export type SkillVersionDeleted = DeletedSkillVersionResource;
 
+export type SessionArtifact = SessionArtifactResource;
+
 /** Skill lists accept 0 through 100 entries; `after` is a Skill ID, or a version resource ID for version lists. */
 export type SkillListOptions = PageOptions;
 
@@ -776,29 +782,14 @@ export interface CreateSessionStreamOptions extends StreamOptions {
   onSession: (session: AgentSession) => void;
 }
 
-export type RuntimeObservationStatus = "observed" | "unsupported" | "unavailable";
-export type RuntimeLifecycleState = "active" | "sleeping" | "transitioning" | "pending" | "stopped";
-export type RuntimeObservationReason =
-  | "runtime_mode_not_observable"
-  | "allocation_pending"
-  | "runtime_not_running"
-  | "sample_timeout"
-  | "sample_unavailable";
+// Generated /core/v1 types keep their schema names in ./generated/core-api.
+export type {
+  HarnessModelConfiguration, RuntimeCPUObservation, RuntimeHistory, RuntimeMemoryObservation, RuntimeObservationReason, SessionExecutionConfiguration,
+} from "./generated/core-api";
 
 export type RuntimeUnavailableReason = Exclude<RuntimeObservationReason, "runtime_mode_not_observable">;
 
-export interface RuntimeCPUObservation {
-  usage_seconds_total: number | null;
-  capacity_cores: number | null;
-  usage_cores: number | null;
-  utilization_ratio: number | null;
-}
-
-export interface RuntimeMemoryObservation {
-  usage_bytes: number | null;
-  limit_bytes: number | null;
-}
-
+// The schema's flat observation cannot state each mode's null rules; this union does, and the client validates them.
 interface RuntimeObservationBase {
   id: string;
   object: "agent.runtime_observation";
@@ -816,7 +807,7 @@ export interface RuntimeObservedObservation extends RuntimeObservationBase {
     device_id: string | null;
     connection_generation: null;
   };
-  lifecycle_state: RuntimeLifecycleState;
+  lifecycle_state: RuntimeObservationLifecycleState;
   status: "observed";
   reason: null;
   allocation_created_at: number | null;
@@ -836,7 +827,7 @@ export interface RuntimeUnavailableObservation extends RuntimeObservationBase {
     device_id: string | null;
     connection_generation: null;
   };
-  lifecycle_state: RuntimeLifecycleState;
+  lifecycle_state: RuntimeObservationLifecycleState;
   status: "unavailable";
   reason: RuntimeUnavailableReason;
   allocation_created_at: number | null;
@@ -896,83 +887,9 @@ export interface RuntimeHistoryQuery extends ReadOptions {
   maxPoints?: number;
 }
 
-export interface RuntimeHistoryRange {
-  start: number;
-  end: number;
-}
-
-export interface RuntimeHistoryCoveragePoint {
-  start: number;
-  end: number;
-  first_observed_at: number | null;
-  last_observed_at: number | null;
-  observation_count: number;
-  observed_count: number;
-  unavailable_count: number;
-}
-
-export interface RuntimeHistoryCPU {
-  contributor_count: number;
-  utilization_ratio: number | null;
-  capacity_cores: number | null;
-}
-
-export interface RuntimeHistoryMemory {
-  contributor_count: number;
-  usage_bytes: number | null;
-  limit_bytes: number | null;
-}
-
-export interface RuntimeHistoryPoint extends RuntimeHistoryCoveragePoint {
-  cpu: RuntimeHistoryCPU | null;
-  memory: RuntimeHistoryMemory | null;
-}
-
-export interface RuntimeHistorySeries {
-  environment_id: string;
-  allocation_id: string;
-  /** Earliest retained provider start estimate for compatible uptime display. */
-  started_at: RuntimeHistoryTime;
-  provider_type: string;
-  points: RuntimeHistoryPoint[];
-}
-
-export interface RuntimeHistoryTime {
-  seconds: number;
-  nanoseconds: number;
-}
-
-export interface RuntimeHistoryCoverage {
-  retained_start: number;
-  first_sample_at: number | null;
-  last_sample_at: number | null;
-  sample_count: number;
-  expected_sample_count: number;
-  buckets: RuntimeHistoryCoveragePoint[];
-}
-
-export interface RuntimeHistoryTokenUsagePoint {
-  start: number;
-  end: number;
-  sampled_at: number;
-  input_tokens: number;
-  output_tokens: number;
-}
-
-export interface RuntimeHistory {
-  object: "agent.runtime_history";
-  source: "durable";
-  session_id: string;
-  requested_range: RuntimeHistoryRange;
-  resolution_seconds: number;
-  generated_at: number;
-  coverage: RuntimeHistoryCoverage;
-  series: RuntimeHistorySeries[];
-  token_usage: RuntimeHistoryTokenUsagePoint[];
-}
-
 export type { CoreHarnessKind, ModelProviderProtocol } from "./harness-catalog";
 
+// The model provider shapes keep `never` guards so an input and a view can never be mistaken for each other.
 /** A complete replacement bundle. API keys are write-only. */
 export interface ModelProviderInput {
   protocol: ModelProviderProtocol;
@@ -992,9 +909,6 @@ export interface ModelProviderView {
   api_key?: never;
 }
 
-/** A harness's deployment default model provider in Core. The key is never returned. */
-export type ProviderObservationErrorCode = "authentication_error" | "connection_failed" | "rate_limit_exceeded" | "usage_limit_exceeded" | "server_overloaded" | "server_error" | "resource_not_found" | "request_timeout" | "invalid_request";
-
 /** Native model parameters validated by the selected harness. An empty object clears them. */
 export type HarnessConfig = Record<string, unknown>;
 
@@ -1010,35 +924,15 @@ export interface ModelConfigurationView {
   harness_config: HarnessConfig;
 }
 
-export interface HarnessModelConfiguration extends ModelConfigurationView {
-  last_used_at: string | null;
-  last_error_code: ProviderObservationErrorCode | null;
-  last_error_at: string | null;
-  object: "core.model_configuration";
-  harness: CoreHarnessKind;
-  updated_at: string;
-}
-
-/** Adapter build support, independent of runtime readiness or model availability. */
-export interface ModelConfigurationSupport {
-  /** Ordered supported native protocols; the first is the default. */
-  protocols: ModelProviderInput["protocol"][];
-  accepts_harness_config: boolean;
-  token_limits_required: boolean;
-}
+// The schema declares protocols as plain strings; the harness catalog names them.
+/** Adapter build support, independent of runtime readiness or model availability. Ordered protocols; the first is the default. */
+export type ModelConfigurationSupport = Omit<ModelConfigurationSupportResource, "protocols"> & { protocols: ModelProviderProtocol[] };
 
 /**
  * A harness this Core build supports. `enabled` and `default` are read-only views of
  * the process configuration; `model_configuration` is the deployment default, or null.
  */
-export interface CoreHarness {
-  object: "core.harness";
-  id: CoreHarnessKind;
-  enabled: boolean;
-  default: boolean;
-  model_configuration: HarnessModelConfiguration | null;
-  model_configuration_support: ModelConfigurationSupport;
-}
+export type CoreHarness = Omit<CoreHarnessResource, "model_configuration_support"> & { model_configuration_support: ModelConfigurationSupport };
 
 /** Native parameter inheritance follows the extension contract; null provider clears it. */
 export interface SavedAgentCoreInput {
@@ -1055,23 +949,6 @@ export interface SavedAgentCore {
 
 export type AgentsCoreSelection = AgentsCore;
 
-export type ExecutionConfigurationSource = "session" | "agent" | "deployment" | "unknown";
-
-/** Immutable committed selections, not live execution health. */
-export interface SessionExecutionConfiguration {
-  object: "agent.session.execution_configuration";
-  schema_version: 1;
-  session_id: string;
-  model: { value: string | null; source: ExecutionConfigurationSource };
-  harness: { value: string | null; source: ExecutionConfigurationSource };
-  harness_config: { value: HarnessConfig; source: ExecutionConfigurationSource };
-  model_provider: {
-    source: ExecutionConfigurationSource;
-    status: "available" | "redacted" | "unavailable";
-    configuration: ModelProviderView | null;
-  };
-}
-
 export interface AgentCore {
   listAgents(options?: PageOptions): Promise<ListPage<SavedAgent>>;
   createAgent(input: CreateAgentInput): Promise<SavedAgent>;
diff --git a/scripts/generate-public-api.py b/scripts/generate-public-api.py
index f6b778cab..8b92496ff 100644
--- a/scripts/generate-public-api.py
+++ b/scripts/generate-public-api.py
@@ -12,6 +12,7 @@
 CONTRACT = ROOT / 'contracts/agents-api'
 SHAPES = ROOT / 'services/core/internal/api/official_shapes.gen.go'
 CLIENT_TYPES = ROOT / 'packages/agents-client/src/generated/public-api.ts'
+CORE_CLIENT_TYPES = ROOT / 'packages/agents-client/src/generated/core-api.ts'
 # Agent configuration request bodies checked by Core's shape walker.
 REQUEST_SHAPES = ('CreateAgentParams', 'UpdateAgentParams', 'SessionAgentConfigParam')
 HTTP_METHODS = {'get', 'post', 'put', 'patch', 'delete', 'head', 'options'}
@@ -350,16 +351,16 @@ def ts_type(schema):
     return {'string': 'string', 'integer': 'number', 'number': 'number', 'boolean': 'boolean', 'null': 'null'}.get(kind, 'unknown')
 
 
-def ts_module(schemas, source):
+def ts_module(schemas, source, header=()):
     """Project parsed schemas (OpenAPI components.schemas or Swagger definitions) onto TypeScript.
 
     Each enum X gets xValues; each object X gets xFields, plus xRequired when some
     fields are optional; each discriminated union X maps its tags to the variants'
-    field names in xFields.
+    field names in xFields. Header lines follow the generated-file notice.
     """
     if len({ts_name(name) for name in schemas}) != len(schemas):
         raise ValueError('TypeScript names collide')
-    lines = [f'// Code generated by scripts/generate-public-api.py from {source}; DO NOT EDIT.', '']
+    lines = [f'// Code generated by scripts/generate-public-api.py from {source}; DO NOT EDIT.', *header, '']
     unions = []
     for name, schema in sorted(schemas.items(), key=lambda item: ts_name(item[0])):
         typ = ts_name(name)
@@ -381,6 +382,44 @@ def ts_module(schemas, source):
     return ('\n'.join(lines + unions) + '\n').encode()
 
 
+def core_module(document, public, bindings):
+    """Project the Swagger definitions the Core document's paths reach onto TypeScript beside the public types.
+
+    The v1 types the public schema owns are imported under their public names. A
+    name that collides once ts_name strips the Go package keeps the package as a
+    prefix, and each inline enum becomes a definition named after its owner and
+    field, so that it gets its values.
+    """
+    definitions, names, refs = document['definitions'], {}, re.compile(r'"#/definitions/([^"]+)"')
+    for name in definitions:
+        sources = bindings.get(name.removeprefix('v1.'), {}).get('sources', [])
+        if name in public:
+            names[name] = ts_name(name)
+        elif name.startswith('v1.') and len(sources) == 1 and sources[0].split('/')[-1] in public:
+            names[name] = ts_name(sources[0])
+    imported, local, pending = set(names.values()), [], [document['paths']]
+    while pending:
+        for ref in refs.findall(json.dumps(pending.pop())):
+            if ref not in names and ref not in local:
+                local.append(ref)
+                pending.append(definitions[ref])
+    taken = [ts_name(name) for name in local] + list(imported)
+    for name in local:
+        names[name] = ts_name(name) if taken.count(ts_name(name)) == 1 else name.split('.')[0].capitalize() + ts_name(name)
+    schemas = {}
+    for name in local:
+        schema = schemas[names[name]] = json.loads(refs.sub(lambda ref: f'"#/definitions/{names[ref[1]]}"', json.dumps(definitions[name])))
+        for field, member in schema.get('properties', {}).items():
+            target = member.get('items', member)
+            if len(target.get('enum', [])) > 1:
+                enum = names[name] + ''.join(part.capitalize() for part in field.split('_'))
+                schemas[enum] = {'type': target.pop('type'), 'enum': target.pop('enum')}
+                target['$ref'] = '#/definitions/' + enum
+    used = sorted(imported.intersection(refs.findall(json.dumps(schemas))))
+    header = ['import type { ' + ', '.join(used) + ' } from "./public-api";'] if used else []
+    return ts_module(schemas, 'contracts/agents-api/core.openapi.yaml', header)
+
+
 def write(path, data, check):
     if check:
         if not path.exists() or path.read_bytes() != data:
@@ -395,7 +434,10 @@ def main():
     stage = parser.add_mutually_exclusive_group(required=True)
     stage.add_argument('--swag-roots', type=Path, help='Temporary entry points for Go-owned extension types')
     stage.add_argument('--extensions', type=Path, help='JSON definitions projected from Core extension types')
+    parser.add_argument('--core', type=Path, help='The /core/v1 document as JSON, required with --extensions')
     args = parser.parse_args()
+    if args.extensions and not args.core:
+        parser.error('--extensions requires --core')
     source, pin = read_source()
     bindings = json.loads((CONTRACT / 'go-bindings.json').read_text())
     owners = extension_owners(bindings)
@@ -409,6 +451,7 @@ def main():
         # JSON is a YAML subset and keeps generation independent of PyYAML.
         write(CONTRACT / 'openapi.yaml', (json.dumps(doc, indent=2, ensure_ascii=False) + '\n').encode(), args.check)
         write(CLIENT_TYPES, ts_module(doc['components']['schemas'], 'contracts/agents-api/openapi.yaml'), args.check)
+        write(CORE_CLIENT_TYPES, core_module(json.loads(args.core.read_text()), doc['components']['schemas'], bindings), args.check)
         routes = sorted(method.upper() + ' ' + re.sub(r'\{[^}]*\}', '{}', path) for path, item in doc['paths'].items() for method in item if method in HTTP_METHODS)
         write(CONTRACT / 'upstream-routes.json', (json.dumps({'openapi_commit': pin['openapi']['commit'], 'generator': 'scripts/generate-public-api.py', 'routes': routes}, indent=2) + '\n').encode(), args.check)
 
diff --git a/scripts/generate-public-api.test.py b/scripts/generate-public-api.test.py
index 83d346df1..ca05c253b 100644
--- a/scripts/generate-public-api.test.py
+++ b/scripts/generate-public-api.test.py
@@ -112,6 +112,28 @@ def test_client_types_project_values_fields_and_unions(self):
         ):
             self.assertIn(line, generated)
 
+    def test_core_types_import_public_names_and_hoist_inline_enums(self):
+        ref = '#/definitions/'
+        document = {'paths': {'/things': {'get': {'responses': {'200': {'schema': {'$ref': ref + 'api.Thing'}}}}}}, 'definitions': {
+            'api.Thing': {'type': 'object', 'required': ['color'], 'properties': {
+                'color': {'type': 'string', 'enum': ['red', 'blue']}, 'tags': {'type': 'array', 'items': {'type': 'string', 'enum': ['a', 'b']}},
+                'shared': {'$ref': ref + 'v1.Shared'}, 'first': {'$ref': ref + 'one.Page'}, 'second': {'$ref': ref + 'two.Page'},
+            }},
+            'one.Page': {'type': 'object', 'properties': {'id': {'type': 'string'}}},
+            'two.Page': {'type': 'object', 'properties': {'id': {'type': 'string'}}},
+            'v1.Shared': {'type': 'object'},
+            'api.Unused': {'type': 'object'},
+        }}
+        bindings = {'Shared': {'sources': ['#/components/schemas/SharedResource']}}
+        generated = generator.core_module(document, {'SharedResource': {}}, bindings).decode()
+        for line in (
+            'import type { SharedResource } from "./public-api";', '  color: ThingColor;', '  tags?: ThingTags[];',
+            'export const thingColorValues = ["red", "blue"] as const;', '  shared?: SharedResource;',
+            '  first?: OnePage;', '  second?: TwoPage;',
+        ):
+            self.assertIn(line, generated)
+        self.assertNotIn('Unused', generated)
+
     def test_every_public_reference_resolves_and_no_other_apis_leak(self):
         self.assertEqual({p.split('/')[1] for p in self.public['paths']}, {'agents', 'vaults', 'files', 'skills'})
         generator.prune_components(copy.deepcopy(self.public))
diff --git a/scripts/openapi-split/main.go b/scripts/openapi-split/main.go
index 66d4f7438..64cf47796 100644
--- a/scripts/openapi-split/main.go
+++ b/scripts/openapi-split/main.go
@@ -1,5 +1,5 @@
 // Command openapi-split emits internal contracts and exports Go definitions
-// for the public contract extension overlay.
+// for the public contract extension overlay and the Core client types.
 package main
 
 import (
@@ -22,19 +22,20 @@ const (
 func main() {
 	check := flag.Bool("check", false, "check generated internal contracts without changing them")
 	flag.Parse()
-	if flag.NArg() != 4 {
-		fmt.Fprintln(os.Stderr, "usage: openapi-split [--check] INPUT EXTENSIONS_OUTPUT CORE_OUTPUT RUNTIME_OUTPUT")
+	if flag.NArg() != 5 {
+		fmt.Fprintln(os.Stderr, "usage: openapi-split [--check] INPUT EXTENSIONS_OUTPUT CORE_JSON_OUTPUT CORE_OUTPUT RUNTIME_OUTPUT")
 		os.Exit(1)
 	}
-	if err := run(flag.Arg(0), flag.Arg(1), flag.Arg(2), flag.Arg(3), *check); err != nil {
+	if err := run(flag.Arg(0), flag.Arg(1), flag.Arg(2), flag.Arg(3), flag.Arg(4), *check); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 }
 
-// run exports Go-owned definitions for the public extension overlay and emits
-// the two internal contracts. Public operations come only from official OpenAPI.
-func run(input, extensionOutput, coreOutput, runtimeOutput string, check bool) error {
+// run exports Go-owned definitions for the public extension overlay and the
+// Core client types, and emits the two internal contracts. Public operations
+// come only from official OpenAPI.
+func run(input, extensionOutput, coreJSONOutput, coreOutput, runtimeOutput string, check bool) error {
 	raw, err := os.ReadFile(input)
 	if err != nil {
 		return err
@@ -43,23 +44,17 @@ func run(input, extensionOutput, coreOutput, runtimeOutput string, check bool) e
 	if err := yaml.Unmarshal(raw, &source); err != nil {
 		return err
 	}
-	var definitions map[string]any
-	if err := field(source.Content[0], "definitions").Decode(&definitions); err != nil {
-		return err
-	}
-	extensionJSON, err := json.Marshal(definitions)
-	if err != nil {
-		return err
-	}
-	if err := os.WriteFile(extensionOutput, extensionJSON, 0644); err != nil {
+	if err := writeJSON(field(source.Content[0], "definitions"), extensionOutput); err != nil {
 		return err
 	}
 	for _, output := range []struct {
 		path, title, description string
 		surface                  int
+		// jsonOutput, when set, receives the document as JSON.
+		jsonOutput string
 	}{
-		{coreOutput, "OpenAgentCore Core API", "Deployment and operations routes under /core/v1 for Core Web's server and operator scripts. Every operation requires the Core key; Project API keys and machine credentials are not accepted.", coreSurface},
-		{runtimeOutput, "OpenAgentCore Machine Connections", "Machine connection routes under /api/v1. Sandbox nodes authenticate with a one-use enrollment token or their node credential; Project API keys and the Core key are not accepted. See each operation's security requirements.", runtimeSurface},
+		{coreOutput, "OpenAgentCore Core API", "Deployment and operations routes under /core/v1 for Core Web's server and operator scripts. Every operation requires the Core key; Project API keys and machine credentials are not accepted.", coreSurface, coreJSONOutput},
+		{runtimeOutput, "OpenAgentCore Machine Connections", "Machine connection routes under /api/v1. Sandbox nodes authenticate with a one-use enrollment token or their node credential; Project API keys and the Core key are not accepted. See each operation's security requirements.", runtimeSurface, ""},
 	} {
 		var doc yaml.Node
 		if err := yaml.Unmarshal(raw, &doc); err != nil {
@@ -84,9 +79,28 @@ func run(input, extensionOutput, coreOutput, runtimeOutput string, check bool) e
 		if err := writeGenerated(output.path, buf.Bytes(), check); err != nil {
 			return err
 		}
+		if output.jsonOutput != "" {
+			if err := writeJSON(root, output.jsonOutput); err != nil {
+				return err
+			}
+		}
 	}
 	return nil
 }
+
+// writeJSON writes a YAML node as JSON, which scripts/generate-public-api.py
+// reads without a YAML parser.
+func writeJSON(node *yaml.Node, path string) error {
+	var value map[string]any
+	if err := node.Decode(&value); err != nil {
+		return err
+	}
+	raw, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(path, raw, 0644)
+}
 func field(n *yaml.Node, key string) *yaml.Node {
 	if n != nil {
 		for i := 0; i+1 < len(n.Content); i += 2 {
diff --git a/scripts/openapi-split/main_test.go b/scripts/openapi-split/main_test.go
index fa8b65ea7..542d47ca5 100644
--- a/scripts/openapi-split/main_test.go
+++ b/scripts/openapi-split/main_test.go
@@ -14,6 +14,7 @@ func TestInternalContractsAndExtensionDefinitions(t *testing.T) {
 	d := t.TempDir()
 	input := filepath.Join(d, "combined.yaml")
 	project := filepath.Join(d, "extensions.json")
+	coreJSON := filepath.Join(d, "core.json")
 	core := filepath.Join(d, "core.yaml")
 	machine := filepath.Join(d, "runtime.yaml")
 	raw := `swagger: "2.0"
@@ -72,7 +73,7 @@ securityDefinitions:
 	if err := os.WriteFile(input, []byte(raw), 0600); err != nil {
 		t.Fatal(err)
 	}
-	if err := run(input, project, core, machine, false); err != nil {
+	if err := run(input, project, coreJSON, core, machine, false); err != nil {
 		t.Fatal(err)
 	}
 	for _, check := range []struct{ path, base, own, other, definition, absent string }{
@@ -98,16 +99,20 @@ securityDefinitions:
 			t.Fatal("reference closure was not preserved")
 		}
 	}
-	rawDefinitions, err := os.ReadFile(project)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var definitions map[string]any
-	if err := json.Unmarshal(rawDefinitions, &definitions); err != nil {
-		t.Fatal(err)
+	// Extensions keep every definition; the Core document as JSON only its own.
+	var extensions map[string]any
+	var coreDocument struct{ Definitions map[string]any }
+	for path, value := range map[string]any{project: &extensions, coreJSON: &coreDocument} {
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := json.Unmarshal(raw, value); err != nil {
+			t.Fatal(err)
+		}
 	}
-	if len(definitions) != 4 {
-		t.Fatalf("missing extension dependencies: %v", definitions)
+	if len(extensions) != 4 || len(coreDocument.Definitions) != 2 || coreDocument.Definitions["Node"] == nil {
+		t.Fatalf("definitions: extensions %v, core %v", extensions, coreDocument.Definitions)
 	}
 	// Every internal document keeps only the schemes its operations use.
 	for path, want := range map[string]string{core: "DeploymentAdminAuth", machine: "NodeAuth"} {
diff --git a/services/core/internal/adminaudit/reader.go b/services/core/internal/adminaudit/reader.go
index 81265e682..921e68e57 100644
--- a/services/core/internal/adminaudit/reader.go
+++ b/services/core/internal/adminaudit/reader.go
@@ -29,22 +29,22 @@ type Filter struct {
 // Operation is one administrator write. ProjectID is null for
 // deployment-wide writes, such as deployment default model providers.
 type Operation struct {
-	ID                string    `json:"id"`
-	CreatedAt         time.Time `json:"created_at"`
-	AdminCredentialID string    `json:"admin_credential_id"`
-	ActorLabel        string    `json:"actor_label"`
-	Action            string    `json:"action"`
-	ProjectID         *string   `json:"project_id" extensions:"x-nullable"`
-	ResourceType      string    `json:"resource_type"`
-	ResourceID        string    `json:"resource_id"`
-	RequestID         string    `json:"request_id"`
-	TraceID           string    `json:"trace_id"`
+	ID                string    `json:"id" binding:"required"`
+	CreatedAt         time.Time `json:"created_at" binding:"required"`
+	AdminCredentialID string    `json:"admin_credential_id" binding:"required"`
+	ActorLabel        string    `json:"actor_label" binding:"required"`
+	Action            string    `json:"action" binding:"required"`
+	ProjectID         *string   `json:"project_id" extensions:"x-nullable" binding:"required"`
+	ResourceType      string    `json:"resource_type" binding:"required"`
+	ResourceID        string    `json:"resource_id" binding:"required"`
+	RequestID         string    `json:"request_id" binding:"required"`
+	TraceID           string    `json:"trace_id" binding:"required"`
 }
 
 type Page struct {
-	Data       []Operation `json:"data"`
-	HasMore    bool        `json:"has_more"`
-	NextCursor string      `json:"next_cursor"`
+	Data       []Operation `json:"data" binding:"required"`
+	HasMore    bool        `json:"has_more" binding:"required"`
+	NextCursor string      `json:"next_cursor" binding:"required"`
 }
 
 // Validate checks f and returns it with the default page size applied. The
diff --git a/services/core/internal/api/admin_runtime.go b/services/core/internal/api/admin_runtime.go
index c11dae6aa..77f96d043 100644
--- a/services/core/internal/api/admin_runtime.go
+++ b/services/core/internal/api/admin_runtime.go
@@ -10,8 +10,8 @@ import (
 )
 
 type AdminRuntimeObservation struct {
-	ProjectID   string                        `json:"project_id"`
-	Observation AdminRuntimeObservationDetail `json:"observation"`
+	ProjectID   string                        `json:"project_id" binding:"required"`
+	Observation AdminRuntimeObservationDetail `json:"observation" binding:"required"`
 }
 
 // AdminRuntimeObservationDetail adds administrator-only measurements to the
@@ -29,11 +29,11 @@ type RuntimeDiskObservation struct {
 	LimitBytes *uint64 `json:"limit_bytes" extensions:"x-nullable" binding:"required" minimum:"1"`
 }
 type AdminRuntimeObservationList struct {
-	Object  string                    `json:"object"`
-	Data    []AdminRuntimeObservation `json:"data"`
-	HasMore bool                      `json:"has_more"`
-	FirstID *string                   `json:"first_id"`
-	LastID  *string                   `json:"last_id"`
+	Object  string                    `json:"object" enums:"list" binding:"required"`
+	Data    []AdminRuntimeObservation `json:"data" binding:"required"`
+	HasMore bool                      `json:"has_more" binding:"required"`
+	FirstID *string                   `json:"first_id" extensions:"x-nullable" binding:"required"`
+	LastID  *string                   `json:"last_id" extensions:"x-nullable" binding:"required"`
 }
 
 // @Summary List Runtime observations across managed Projects
diff --git a/services/core/internal/api/admin_session_archive.go b/services/core/internal/api/admin_session_archive.go
index 2a7b0e46e..e5354358a 100644
--- a/services/core/internal/api/admin_session_archive.go
+++ b/services/core/internal/api/admin_session_archive.go
@@ -15,7 +15,7 @@ type SessionArchive interface {
 }
 
 type AdminSessionArchiveRequest struct {
-	ExpectedGeneration uint64 `json:"expected_generation"`
+	ExpectedGeneration uint64 `json:"expected_generation" binding:"required"`
 }
 
 // @Summary Release a managed Session's execution resources while retaining history
diff --git a/services/core/internal/api/admin_summary.go b/services/core/internal/api/admin_summary.go
index 83c1a8188..2b2b835da 100644
--- a/services/core/internal/api/admin_summary.go
+++ b/services/core/internal/api/admin_summary.go
@@ -12,31 +12,31 @@ import (
 )
 
 type AdminSessionCounts struct {
-	Total          int64 `json:"total"`
-	Idle           int64 `json:"idle"`
-	InProgress     int64 `json:"in_progress"`
-	RequiresAction int64 `json:"requires_action"`
-	Failed         int64 `json:"failed"`
+	Total          int64 `json:"total" binding:"required"`
+	Idle           int64 `json:"idle" binding:"required"`
+	InProgress     int64 `json:"in_progress" binding:"required"`
+	RequiresAction int64 `json:"requires_action" binding:"required"`
+	Failed         int64 `json:"failed" binding:"required"`
 }
 type AdminUsageCoverage struct {
-	MeasuredSessions int64    `json:"measured_sessions"`
-	TotalSessions    int64    `json:"total_sessions"`
-	Ratio            *float64 `json:"ratio"`
+	MeasuredSessions int64    `json:"measured_sessions" binding:"required"`
+	TotalSessions    int64    `json:"total_sessions" binding:"required"`
+	Ratio            *float64 `json:"ratio" extensions:"x-nullable" binding:"required"`
 }
 type AdminSummaryRow struct {
-	ProjectID    string                     `json:"project_id"`
-	KeyID        *string                    `json:"key_id"`
-	AgentID      *string                    `json:"agent_id"`
-	Assets       *sessions.AdminAssetCounts `json:"assets"`
-	Sessions     AdminSessionCounts         `json:"sessions"`
-	Usage        v1.TokenUsage              `json:"usage"`
-	Coverage     AdminUsageCoverage         `json:"coverage"`
-	LastActiveAt *int64                     `json:"last_active_at"`
+	ProjectID    string                     `json:"project_id" binding:"required"`
+	KeyID        *string                    `json:"key_id" extensions:"x-nullable" binding:"required"`
+	AgentID      *string                    `json:"agent_id" extensions:"x-nullable" binding:"required"`
+	Assets       *sessions.AdminAssetCounts `json:"assets" extensions:"x-nullable" binding:"required"`
+	Sessions     AdminSessionCounts         `json:"sessions" binding:"required"`
+	Usage        v1.TokenUsage              `json:"usage" binding:"required"`
+	Coverage     AdminUsageCoverage         `json:"coverage" binding:"required"`
+	LastActiveAt *int64                     `json:"last_active_at" extensions:"x-nullable" binding:"required"`
 }
 type AdminSummaryResponse struct {
-	Data       []AdminSummaryRow `json:"data"`
-	HasMore    bool              `json:"has_more"`
-	NextCursor string            `json:"next_cursor"`
+	Data       []AdminSummaryRow `json:"data" binding:"required"`
+	HasMore    bool              `json:"has_more" binding:"required"`
+	NextCursor string            `json:"next_cursor" binding:"required"`
 }
 
 func adminSummaryTime(r *http.Request, name string) (*time.Time, error) {
diff --git a/services/core/internal/api/environment_executor_management.go b/services/core/internal/api/environment_executor_management.go
index 5bbb1ee57..8e20745e8 100644
--- a/services/core/internal/api/environment_executor_management.go
+++ b/services/core/internal/api/environment_executor_management.go
@@ -22,7 +22,7 @@ type ExecutorConnections interface {
 }
 
 type EnvironmentExecutorCredentialRequest struct {
-	KeyID  string `json:"key_id" format:"uuid"`
+	KeyID  string `json:"key_id" format:"uuid" binding:"required"`
 	Rotate bool   `json:"rotate,omitempty"`
 }
 
diff --git a/services/core/internal/api/installation.go b/services/core/internal/api/installation.go
index 8d18088ac..e99e574ed 100644
--- a/services/core/internal/api/installation.go
+++ b/services/core/internal/api/installation.go
@@ -10,40 +10,40 @@ import (
 // Installation reports Core's installation facts. Core reads them from its
 // environment and build; configuration is the process settings it loaded.
 type Installation struct {
-	Object string `json:"object" enums:"core.installation"`
+	Object string `json:"object" enums:"core.installation" binding:"required"`
 	// The ID in OAC_INSTALLATION_ID_FILE.
-	InstallationID string `json:"installation_id"`
+	InstallationID string `json:"installation_id" binding:"required"`
 	// OAC_PUBLIC_URL: the origin applications, nodes, sandboxes and self-hosted executors use.
-	PublicURL string `json:"public_url"`
+	PublicURL string `json:"public_url" binding:"required"`
 	// public_url followed by /v1.
-	APIBaseURL string `json:"api_base_url"`
+	APIBaseURL string `json:"api_base_url" binding:"required"`
 	// True when public_url names a loopback host, reachable only from the Core host.
-	LocalOnly bool `json:"local_only"`
+	LocalOnly bool `json:"local_only" binding:"required"`
 	// Full source commit Core was built from; null for development builds.
-	SourceCommit *string `json:"source_commit" extensions:"x-nullable"`
+	SourceCommit *string `json:"source_commit" extensions:"x-nullable" binding:"required"`
 	// The process settings Core loaded.
-	Configuration   InstallationConfiguration  `json:"configuration"`
-	AddressBindings deployment.AddressBindings `json:"address_bindings"`
+	Configuration   InstallationConfiguration  `json:"configuration" binding:"required"`
+	AddressBindings deployment.AddressBindings `json:"address_bindings" binding:"required"`
 }
 
 // InstallationConfiguration is the process settings Core loaded.
 type InstallationConfiguration struct {
-	Settings []InstallationSetting `json:"settings"`
+	Settings []InstallationSetting `json:"settings" binding:"required"`
 }
 
 type InstallationSetting struct {
 	// Dotted config.json key, such as ports.core.
-	Key string `json:"key"`
+	Key string `json:"key" binding:"required"`
 	// Applied value; always null for a sensitive setting.
-	Value   any `json:"value" extensions:"x-nullable"`
-	Default any `json:"default" extensions:"x-nullable"`
+	Value   any `json:"value" extensions:"x-nullable" binding:"required"`
+	Default any `json:"default" extensions:"x-nullable" binding:"required"`
 	// Present only for a sensitive setting: whether it has a value.
 	Configured *bool `json:"configured,omitempty"`
 	// False for settings fixed at installation.
-	Changeable bool `json:"changeable"`
-	Sensitive  bool `json:"sensitive"`
+	Changeable bool `json:"changeable" binding:"required"`
+	Sensitive  bool `json:"sensitive" binding:"required"`
 	// Services that restart when the setting changes.
-	Restarts []string `json:"restarts"`
+	Restarts []string `json:"restarts" enums:"core,web" binding:"required"`
 }
 
 // InstallationBindings counts what is bound to the current public URL.
diff --git a/services/core/internal/api/project_api_keys.go b/services/core/internal/api/project_api_keys.go
index bf36c6b4e..bb37ff844 100644
--- a/services/core/internal/api/project_api_keys.go
+++ b/services/core/internal/api/project_api_keys.go
@@ -32,10 +32,10 @@ type ProjectsReader interface {
 	ResolveAPIKey(context.Context, [sha256.Size]byte) (projects.KeyBinding, error)
 }
 type ProjectRequest struct {
-	Name string `json:"name"`
+	Name string `json:"name" binding:"required"`
 }
 type ProjectAPIKeyRequest struct {
-	Name string `json:"name"`
+	Name string `json:"name" binding:"required"`
 }
 
 func (h *Handler) registerProjectAPIKeyRoutes(r chi.Router) {
diff --git a/services/core/internal/api/sandbox_manager.go b/services/core/internal/api/sandbox_manager.go
index aa1143b3c..57713a257 100644
--- a/services/core/internal/api/sandbox_manager.go
+++ b/services/core/internal/api/sandbox_manager.go
@@ -12,19 +12,19 @@ import (
 )
 
 type SandboxNodeList struct {
-	Data []deployment.Node `json:"data"`
+	Data []deployment.Node `json:"data" binding:"required"`
 }
 type SandboxAllocationList struct {
-	Data []deployment.NodeAllocation `json:"data"`
+	Data []deployment.NodeAllocation `json:"data" binding:"required"`
 }
 type SandboxEnrollmentToken struct {
-	Token     string    `json:"token"`
-	ExpiresAt time.Time `json:"expires_at"`
+	Token     string    `json:"token" binding:"required"`
+	ExpiresAt time.Time `json:"expires_at" binding:"required"`
 	// Public, non-secret handle of this command; never a credential. The node it registers reports the same value as enrollment_id.
-	EnrollmentID string `json:"enrollment_id"`
+	EnrollmentID string `json:"enrollment_id" binding:"required"`
 }
 type SandboxMutationResponse struct {
-	ID      string `json:"id"`
+	ID      string `json:"id" binding:"required"`
 	Deleted bool   `json:"deleted,omitempty"`
 	Updated bool   `json:"updated,omitempty"`
 }
diff --git a/services/core/internal/api/session_diagnostics.go b/services/core/internal/api/session_diagnostics.go
index 9e14f19b5..759e6aab4 100644
--- a/services/core/internal/api/session_diagnostics.go
+++ b/services/core/internal/api/session_diagnostics.go
@@ -11,39 +11,39 @@ import (
 )
 
 type DiagnosticFailure struct {
-	Code     string           `json:"code" enums:"harness_error,model_provider_required,runtime_unavailable,runtime_disconnected,runtime_preparation_failed,execution_interrupted,delivery_unconfirmed,input_rejected,executor_protocol_error,core_storage_failed,internal_error,environment_connection_timeout,environment_unavailable,environment_provisioning_failed,authentication_error,rate_limit_exceeded,usage_limit_exceeded,server_overloaded,server_error,invalid_request,resource_not_found,request_timeout,context_length_exceeded,cyber_policy,connection_failed"`
-	Params   CoreErrorDetails `json:"params" swaggertype:"object"`
-	FailedAt *time.Time       `json:"failed_at" extensions:"x-nullable"`
+	Code     string           `json:"code" binding:"required" enums:"harness_error,model_provider_required,runtime_unavailable,runtime_disconnected,runtime_preparation_failed,execution_interrupted,delivery_unconfirmed,input_rejected,executor_protocol_error,core_storage_failed,internal_error,environment_connection_timeout,environment_unavailable,environment_provisioning_failed,authentication_error,rate_limit_exceeded,usage_limit_exceeded,server_overloaded,server_error,invalid_request,resource_not_found,request_timeout,context_length_exceeded,cyber_policy,connection_failed"`
+	Params   CoreErrorDetails `json:"params" swaggertype:"object" binding:"required"`
+	FailedAt *time.Time       `json:"failed_at" extensions:"x-nullable" binding:"required"`
 }
 
 type SessionDiagnosticFailure struct {
 	DiagnosticFailure
-	Source string `json:"source" enums:"turn,environment,environment_input"`
+	Source string `json:"source" binding:"required" enums:"turn,environment,environment_input"`
 	TurnID string `json:"turn_id,omitempty"`
 }
 
 type SessionDiagnostics struct {
-	Object    string                    `json:"object" enums:"core.session_diagnostics"`
-	SessionID string                    `json:"session_id"`
-	Status    string                    `json:"status" enums:"idle,in_progress,requires_action,failed"`
-	Failure   *SessionDiagnosticFailure `json:"failure" extensions:"x-nullable"`
+	Object    string                    `json:"object" enums:"core.session_diagnostics" binding:"required"`
+	SessionID string                    `json:"session_id" binding:"required"`
+	Status    string                    `json:"status" enums:"idle,in_progress,requires_action,failed" binding:"required"`
+	Failure   *SessionDiagnosticFailure `json:"failure" extensions:"x-nullable" binding:"required"`
 }
 
 type ItemDiagnosticTiming struct {
-	ItemID             string     `json:"item_id"`
-	StartedAt          time.Time  `json:"started_at"`
-	CompletedAt        *time.Time `json:"completed_at" extensions:"x-nullable"`
-	ObservedDurationMS *int64     `json:"observed_duration_ms" extensions:"x-nullable"`
+	ItemID             string     `json:"item_id" binding:"required"`
+	StartedAt          time.Time  `json:"started_at" binding:"required"`
+	CompletedAt        *time.Time `json:"completed_at" extensions:"x-nullable" binding:"required"`
+	ObservedDurationMS *int64     `json:"observed_duration_ms" extensions:"x-nullable" binding:"required"`
 }
 
 type TurnDiagnostics struct {
-	Object         string                 `json:"object" enums:"core.turn_diagnostics"`
-	SessionID      string                 `json:"session_id"`
-	TurnID         string                 `json:"turn_id"`
-	Status         string                 `json:"status"`
-	Failure        *DiagnosticFailure     `json:"failure" extensions:"x-nullable"`
-	Items          []ItemDiagnosticTiming `json:"items"`
-	ItemsTruncated bool                   `json:"items_truncated"`
+	Object         string                 `json:"object" enums:"core.turn_diagnostics" binding:"required"`
+	SessionID      string                 `json:"session_id" binding:"required"`
+	TurnID         string                 `json:"turn_id" binding:"required"`
+	Status         string                 `json:"status" binding:"required"`
+	Failure        *DiagnosticFailure     `json:"failure" extensions:"x-nullable" binding:"required"`
+	Items          []ItemDiagnosticTiming `json:"items" binding:"required"`
+	ItemsTruncated bool                   `json:"items_truncated" binding:"required"`
 }
 
 // SessionAdmin serves the administrator's per-Session reads: Turn diagnostics
diff --git a/services/core/internal/api/write_audit.go b/services/core/internal/api/write_audit.go
index 8f4b8e258..fd1ca82de 100644
--- a/services/core/internal/api/write_audit.go
+++ b/services/core/internal/api/write_audit.go
@@ -20,7 +20,7 @@ type WriteAudit interface {
 }
 
 type ResourceOwnerList struct {
-	Data []writeaudit.ResourceOwner `json:"data"`
+	Data []writeaudit.ResourceOwner `json:"data" binding:"required"`
 }
 
 func (h *Handler) writeAuditScope(w http.ResponseWriter, r *http.Request, allowed ...string) (url.Values, string, bool) {
diff --git a/services/core/internal/coremetrics/types.go b/services/core/internal/coremetrics/types.go
index 9aafca860..611efe657 100644
--- a/services/core/internal/coremetrics/types.go
+++ b/services/core/internal/coremetrics/types.go
@@ -13,84 +13,84 @@ import (
 var ErrInvalidRange = errors.New("invalid Core metrics range")
 
 type Latency struct {
-	P50 *float64 `json:"p50" extensions:"x-nullable"`
-	P95 *float64 `json:"p95" extensions:"x-nullable"`
+	P50 *float64 `json:"p50" extensions:"x-nullable" binding:"required"`
+	P95 *float64 `json:"p95" extensions:"x-nullable" binding:"required"`
 }
 type Range struct {
-	Start             time.Time `json:"start"`
-	End               time.Time `json:"end"`
-	ResolutionSeconds int64     `json:"resolution_seconds"`
+	Start             time.Time `json:"start" binding:"required"`
+	End               time.Time `json:"end" binding:"required"`
+	ResolutionSeconds int64     `json:"resolution_seconds" binding:"required"`
 }
 type ServiceState struct {
-	Status         string     `json:"status"`
-	Revision       *string    `json:"revision" extensions:"x-nullable"`
-	StartedAt      *time.Time `json:"started_at" extensions:"x-nullable"`
-	ExecutionOwner *bool      `json:"execution_owner" extensions:"x-nullable"`
+	Status         string     `json:"status" enums:"running,degraded" binding:"required"`
+	Revision       *string    `json:"revision" extensions:"x-nullable" binding:"required"`
+	StartedAt      *time.Time `json:"started_at" extensions:"x-nullable" binding:"required"`
+	ExecutionOwner *bool      `json:"execution_owner" extensions:"x-nullable" binding:"required"`
 }
 type ExecutionBucket struct {
-	Start          time.Time `json:"start"`
-	Queued         *int64    `json:"queued" extensions:"x-nullable"`
-	InProgress     *int64    `json:"in_progress" extensions:"x-nullable"`
-	QueueWaitP95MS *float64  `json:"queue_wait_p95_ms" extensions:"x-nullable"`
+	Start          time.Time `json:"start" binding:"required"`
+	Queued         *int64    `json:"queued" extensions:"x-nullable" binding:"required"`
+	InProgress     *int64    `json:"in_progress" extensions:"x-nullable" binding:"required"`
+	QueueWaitP95MS *float64  `json:"queue_wait_p95_ms" extensions:"x-nullable" binding:"required"`
 }
 type DatabaseBucket struct {
-	Start     time.Time `json:"start"`
-	PingP95MS *float64  `json:"ping_p95_ms" extensions:"x-nullable"`
-	PoolInUse *int64    `json:"pool_in_use" extensions:"x-nullable"`
+	Start     time.Time `json:"start" binding:"required"`
+	PingP95MS *float64  `json:"ping_p95_ms" extensions:"x-nullable" binding:"required"`
+	PoolInUse *int64    `json:"pool_in_use" extensions:"x-nullable" binding:"required"`
 }
 type Pool struct {
-	InUse *int64 `json:"in_use" extensions:"x-nullable"`
-	Idle  *int64 `json:"idle" extensions:"x-nullable"`
-	Max   *int64 `json:"max" extensions:"x-nullable"`
+	InUse *int64 `json:"in_use" extensions:"x-nullable" binding:"required"`
+	Idle  *int64 `json:"idle" extensions:"x-nullable" binding:"required"`
+	Max   *int64 `json:"max" extensions:"x-nullable" binding:"required"`
 }
 type Execution struct {
-	SlotsInUse          int64             `json:"slots_in_use"`
-	SlotsTotal          int64             `json:"slots_total"`
-	QueuedTurns         *int64            `json:"queued_turns" extensions:"x-nullable"`
-	WaitingForDaemon    *int64            `json:"waiting_for_daemon" extensions:"x-nullable"`
-	InProgressTurns     *int64            `json:"in_progress_turns" extensions:"x-nullable"`
-	OldestQueuedSeconds *float64          `json:"oldest_queued_seconds" extensions:"x-nullable"`
-	ConnectedDaemons    int64             `json:"connected_daemons"`
-	Interrupted         *int64            `json:"interrupted" extensions:"x-nullable"`
-	Unavailable         *int64            `json:"unavailable" extensions:"x-nullable"`
-	QueueWaitMS         Latency           `json:"queue_wait_ms"`
-	Series              []ExecutionBucket `json:"series"`
+	SlotsInUse          int64             `json:"slots_in_use" binding:"required"`
+	SlotsTotal          int64             `json:"slots_total" binding:"required"`
+	QueuedTurns         *int64            `json:"queued_turns" extensions:"x-nullable" binding:"required"`
+	WaitingForDaemon    *int64            `json:"waiting_for_daemon" extensions:"x-nullable" binding:"required"`
+	InProgressTurns     *int64            `json:"in_progress_turns" extensions:"x-nullable" binding:"required"`
+	OldestQueuedSeconds *float64          `json:"oldest_queued_seconds" extensions:"x-nullable" binding:"required"`
+	ConnectedDaemons    int64             `json:"connected_daemons" binding:"required"`
+	Interrupted         *int64            `json:"interrupted" extensions:"x-nullable" binding:"required"`
+	Unavailable         *int64            `json:"unavailable" extensions:"x-nullable" binding:"required"`
+	QueueWaitMS         Latency           `json:"queue_wait_ms" binding:"required"`
+	Series              []ExecutionBucket `json:"series" binding:"required"`
 }
 type Database struct {
-	PingMS    Latency          `json:"ping_ms"`
-	Pool      Pool             `json:"pool"`
-	SizeBytes *int64           `json:"size_bytes" extensions:"x-nullable"`
-	Series    []DatabaseBucket `json:"series"`
+	PingMS    Latency          `json:"ping_ms" binding:"required"`
+	Pool      Pool             `json:"pool" binding:"required"`
+	SizeBytes *int64           `json:"size_bytes" extensions:"x-nullable" binding:"required"`
+	Series    []DatabaseBucket `json:"series" binding:"required"`
 }
 type Job struct {
-	ID        string     `json:"id"`
-	Status    string     `json:"status"`
-	LastRunAt *time.Time `json:"last_run_at" extensions:"x-nullable"`
-	Processed *int64     `json:"processed" extensions:"x-nullable"`
-	Failed    *int64     `json:"failed" extensions:"x-nullable"`
+	ID        string     `json:"id" binding:"required"`
+	Status    string     `json:"status" enums:"ok,failing,stopped,unknown" binding:"required"`
+	LastRunAt *time.Time `json:"last_run_at" extensions:"x-nullable" binding:"required"`
+	Processed *int64     `json:"processed" extensions:"x-nullable" binding:"required"`
+	Failed    *int64     `json:"failed" extensions:"x-nullable" binding:"required"`
 }
 type Process struct {
-	MemoryBytes      *uint64         `json:"memory_bytes" extensions:"x-nullable"`
-	Goroutines       *int64          `json:"goroutines" extensions:"x-nullable"`
-	CPUCores         *float64        `json:"cpu_cores" extensions:"x-nullable"`
-	CPULimitCores    *float64        `json:"cpu_limit_cores" extensions:"x-nullable"`
-	RSSBytes         *uint64         `json:"rss_bytes" extensions:"x-nullable"`
-	MemoryLimitBytes *uint64         `json:"memory_limit_bytes" extensions:"x-nullable"`
-	Series           []ProcessBucket `json:"series"`
+	MemoryBytes      *uint64         `json:"memory_bytes" extensions:"x-nullable" binding:"required"`
+	Goroutines       *int64          `json:"goroutines" extensions:"x-nullable" binding:"required"`
+	CPUCores         *float64        `json:"cpu_cores" extensions:"x-nullable" binding:"required"`
+	CPULimitCores    *float64        `json:"cpu_limit_cores" extensions:"x-nullable" binding:"required"`
+	RSSBytes         *uint64         `json:"rss_bytes" extensions:"x-nullable" binding:"required"`
+	MemoryLimitBytes *uint64         `json:"memory_limit_bytes" extensions:"x-nullable" binding:"required"`
+	Series           []ProcessBucket `json:"series" binding:"required"`
 }
 type ProcessBucket struct {
-	Start    time.Time `json:"start"`
-	CPUCores *float64  `json:"cpu_cores" extensions:"x-nullable"`
-	RSSBytes *uint64   `json:"rss_bytes" extensions:"x-nullable"`
+	Start    time.Time `json:"start" binding:"required"`
+	CPUCores *float64  `json:"cpu_cores" extensions:"x-nullable" binding:"required"`
+	RSSBytes *uint64   `json:"rss_bytes" extensions:"x-nullable" binding:"required"`
 }
 type View struct {
-	Object    string       `json:"object"`
-	Range     Range        `json:"range"`
-	Service   ServiceState `json:"service"`
-	Execution Execution    `json:"execution"`
-	Database  Database     `json:"database"`
-	Jobs      []Job        `json:"jobs"`
-	Process   Process      `json:"process"`
+	Object    string       `json:"object" enums:"core.metrics" binding:"required"`
+	Range     Range        `json:"range" binding:"required"`
+	Service   ServiceState `json:"service" binding:"required"`
+	Execution Execution    `json:"execution" binding:"required"`
+	Database  Database     `json:"database" binding:"required"`
+	Jobs      []Job        `json:"jobs" binding:"required"`
+	Process   Process      `json:"process" binding:"required"`
 }
 
 // Sample contains only measurements, never resource identities or error text.
diff --git a/services/core/internal/deployment/allocation.go b/services/core/internal/deployment/allocation.go
index 02324ff49..c51f2527b 100644
--- a/services/core/internal/deployment/allocation.go
+++ b/services/core/internal/deployment/allocation.go
@@ -127,19 +127,19 @@ type LifecyclePlacement struct {
 
 // NodeAllocation is an unreleased allocation a node serves.
 type NodeAllocation struct {
-	DeploymentGeneration uint64 `json:"deployment_generation"`
-	Diagnostic           string `json:"diagnostic"`
-	ID                   string `json:"id"`
-	NodeID               string `json:"node_id"`
-	TenantID             string `json:"tenant_id"`
-	SessionID            string `json:"session_id"`
-	EnvironmentID        string `json:"environment_id"`
-	State                string `json:"state"`
-	ComputePhase         string `json:"compute_phase"`
+	DeploymentGeneration uint64 `json:"deployment_generation" binding:"required"`
+	Diagnostic           string `json:"diagnostic" enums:",node_unavailable,resource_missing,compute_unconfirmed,ownership_mismatch,provider_unavailable" binding:"required"`
+	ID                   string `json:"id" binding:"required"`
+	NodeID               string `json:"node_id" binding:"required"`
+	TenantID             string `json:"tenant_id" binding:"required"`
+	SessionID            string `json:"session_id" binding:"required"`
+	EnvironmentID        string `json:"environment_id" binding:"required"`
+	State                string `json:"state" binding:"required"`
+	ComputePhase         string `json:"compute_phase" binding:"required"`
 	// The time the allocation entered its current compute_phase, or null when unknown; an allocation that existed before Core recorded it reports null until its next phase change. For a suspended microsandbox allocation, this time plus the deployment's snapshot retention tells roughly when Core reclaims it.
-	ComputePhaseChangedAt *time.Time `json:"compute_phase_changed_at" extensions:"x-nullable"`
-	Initialization        string     `json:"initialization"`
-	CreatedAt             time.Time  `json:"created_at"`
+	ComputePhaseChangedAt *time.Time `json:"compute_phase_changed_at" extensions:"x-nullable" binding:"required"`
+	Initialization        string     `json:"initialization" binding:"required"`
+	CreatedAt             time.Time  `json:"created_at" binding:"required"`
 }
 
 // observationDiagnostics are the diagnostics an observation records; empty
diff --git a/services/core/internal/deployment/node.go b/services/core/internal/deployment/node.go
index 485d464e8..164d54234 100644
--- a/services/core/internal/deployment/node.go
+++ b/services/core/internal/deployment/node.go
@@ -47,39 +47,39 @@ type NodeHealth struct {
 	Host *NodeHost `json:"-"`
 	// Fixed reason for the last reported unreadiness; absent while the provider is ready. Clients treat an unknown value as provider_unavailable.
 	Diagnostic           string `json:"diagnostic,omitempty" enums:"provider_unavailable,host_unsupported,artifacts_unavailable,runtime_download_failed,runtime_image_unavailable,capacity_insufficient"`
-	ProviderReady        bool   `json:"provider_ready"`
-	CPUCount             *int64 `json:"cpu_count"`
-	AvailableMemoryBytes *int64 `json:"available_memory_bytes"`
-	AvailableDiskBytes   *int64 `json:"available_disk_bytes"`
+	ProviderReady        bool   `json:"provider_ready" binding:"required"`
+	CPUCount             *int64 `json:"cpu_count" extensions:"x-nullable" binding:"required"`
+	AvailableMemoryBytes *int64 `json:"available_memory_bytes" extensions:"x-nullable" binding:"required"`
+	AvailableDiskBytes   *int64 `json:"available_disk_bytes" extensions:"x-nullable" binding:"required"`
 }
 
 type Node struct {
-	Rollout NodeRollout `json:"rollout"`
+	Rollout NodeRollout `json:"rollout" binding:"required"`
 	NodeHealth
-	Running        int64      `json:"running"`
-	Snapshots      int64      `json:"snapshots"`
-	ID             string     `json:"id"`
-	Name           string     `json:"name"`
-	Provider       string     `json:"provider"`
-	Online         bool       `json:"online"`
-	LastSeenAt     *time.Time `json:"last_seen_at"`
-	MaxActive      int        `json:"max_active"`
-	MaxRetained    int        `json:"max_retained"`
-	Active         int64      `json:"active"`
-	Reserved       int64      `json:"reserved"`
-	Retained       int64      `json:"retained"`
-	CleanupPending int64      `json:"cleanup_pending"`
-	CreatedAt      time.Time  `json:"created_at"`
+	Running        int64      `json:"running" binding:"required"`
+	Snapshots      int64      `json:"snapshots" binding:"required"`
+	ID             string     `json:"id" binding:"required"`
+	Name           string     `json:"name" binding:"required"`
+	Provider       string     `json:"provider" binding:"required"`
+	Online         bool       `json:"online" binding:"required"`
+	LastSeenAt     *time.Time `json:"last_seen_at" extensions:"x-nullable" binding:"required"`
+	MaxActive      int        `json:"max_active" binding:"required"`
+	MaxRetained    int        `json:"max_retained" binding:"required"`
+	Active         int64      `json:"active" binding:"required"`
+	Reserved       int64      `json:"reserved" binding:"required"`
+	Retained       int64      `json:"retained" binding:"required"`
+	CleanupPending int64      `json:"cleanup_pending" binding:"required"`
+	CreatedAt      time.Time  `json:"created_at" binding:"required"`
 	// The Core address this node enrolled with. A node whose address differs
 	// from the installation public URL receives no new sandboxes; re-add it.
-	CoreURL string `json:"core_url"`
+	CoreURL string `json:"core_url" binding:"required"`
 	// The enrollment_id of the command that registered this node (POST /core/v1/sandbox/enrollment-tokens); null for nodes enrolled before Core recorded it.
-	EnrollmentID *string `json:"enrollment_id" extensions:"x-nullable"`
+	EnrollmentID *string `json:"enrollment_id" extensions:"x-nullable" binding:"required"`
 }
 
 type NodeUpdate struct {
-	Name      string `json:"name"`
-	MaxActive int    `json:"max_active"`
+	Name      string `json:"name" binding:"required"`
+	MaxActive int    `json:"max_active" binding:"required"`
 	// Docker never suspends, so Core replaces this with max_active; microsandbox uses both limits.
 	MaxRetained int `json:"max_retained"`
 }
@@ -104,28 +104,28 @@ type NodeConfiguration struct {
 
 // NodeHost is deployment telemetry, not sandbox capacity authority.
 type NodeHost struct {
-	EffectiveCPUCores    *float64   `json:"effective_cpu_cores" extensions:"x-nullable"`
-	CPUUtilization       *float64   `json:"cpu_utilization" extensions:"x-nullable"`
-	TotalMemoryBytes     *int64     `json:"total_memory_bytes" extensions:"x-nullable"`
-	AvailableMemoryBytes *int64     `json:"available_memory_bytes" extensions:"x-nullable"`
-	AvailableDiskBytes   *int64     `json:"available_disk_bytes" extensions:"x-nullable"`
-	ObservedAt           *time.Time `json:"observed_at" extensions:"x-nullable"`
+	EffectiveCPUCores    *float64   `json:"effective_cpu_cores" extensions:"x-nullable" binding:"required"`
+	CPUUtilization       *float64   `json:"cpu_utilization" extensions:"x-nullable" binding:"required"`
+	TotalMemoryBytes     *int64     `json:"total_memory_bytes" extensions:"x-nullable" binding:"required"`
+	AvailableMemoryBytes *int64     `json:"available_memory_bytes" extensions:"x-nullable" binding:"required"`
+	AvailableDiskBytes   *int64     `json:"available_disk_bytes" extensions:"x-nullable" binding:"required"`
+	ObservedAt           *time.Time `json:"observed_at" extensions:"x-nullable" binding:"required"`
 }
 
 type HostHistoryPoint struct {
-	Start                 time.Time `json:"start"`
-	CPUUtilizationMax     *float64  `json:"cpu_utilization_max" extensions:"x-nullable"`
-	MemoryUsedBytesMax    *int64    `json:"memory_used_bytes_max" extensions:"x-nullable"`
-	AvailableDiskBytesMin *int64    `json:"available_disk_bytes_min" extensions:"x-nullable"`
+	Start                 time.Time `json:"start" binding:"required"`
+	CPUUtilizationMax     *float64  `json:"cpu_utilization_max" extensions:"x-nullable" binding:"required"`
+	MemoryUsedBytesMax    *int64    `json:"memory_used_bytes_max" extensions:"x-nullable" binding:"required"`
+	AvailableDiskBytesMin *int64    `json:"available_disk_bytes_min" extensions:"x-nullable" binding:"required"`
 }
 
 type HostHistory struct {
-	ResolutionSeconds int64              `json:"resolution_seconds"`
-	Points            []HostHistoryPoint `json:"points"`
+	ResolutionSeconds int64              `json:"resolution_seconds" binding:"required"`
+	Points            []HostHistoryPoint `json:"points" binding:"required"`
 }
 
 type NodeDetail struct {
 	Node
-	Host    NodeHost    `json:"host"`
-	History HostHistory `json:"history"`
+	Host    NodeHost    `json:"host" binding:"required"`
+	History HostHistory `json:"history" binding:"required"`
 }
diff --git a/services/core/internal/deployment/public_url.go b/services/core/internal/deployment/public_url.go
index 1bf556928..e6d947160 100644
--- a/services/core/internal/deployment/public_url.go
+++ b/services/core/internal/deployment/public_url.go
@@ -73,10 +73,10 @@ func (o PublicOrigin) InstallerBase() string { return o.origin + "/api/v1/agent-
 // the address current at the time, and self-hosted executors were installed
 // with an advertised remote_url.
 type AddressBindings struct {
-	Nodes               int64 `json:"nodes"`
-	NodesOnOtherAddress int64 `json:"nodes_on_other_address"`
-	HostedSandboxes     int64 `json:"hosted_sandboxes"`
-	SelfHostedExecutors int64 `json:"self_hosted_executors"`
+	Nodes               int64 `json:"nodes" binding:"required"`
+	NodesOnOtherAddress int64 `json:"nodes_on_other_address" binding:"required"`
+	HostedSandboxes     int64 `json:"hosted_sandboxes" binding:"required"`
+	SelfHostedExecutors int64 `json:"self_hosted_executors" binding:"required"`
 }
 
 // AddressBindings counts what is bound to the installation public URL.
diff --git a/services/core/internal/deployment/view.go b/services/core/internal/deployment/view.go
index 4c6beb6bc..f45b90afe 100644
--- a/services/core/internal/deployment/view.go
+++ b/services/core/internal/deployment/view.go
@@ -9,79 +9,79 @@ import (
 
 // View is the sandbox deployment as administrators read it.
 type View struct {
-	Rollout              Rollout                 `json:"rollout"`
+	Rollout              Rollout                 `json:"rollout" binding:"required"`
 	Specification        *sandbox.DeploymentSpec `json:"specification,omitempty"`
 	SpecificationDigest  string                  `json:"specification_digest,omitempty"`
-	Generation           uint64                  `json:"generation"`
-	Mode                 string                  `json:"mode"`
-	Resources            Resources               `json:"resources"`
+	Generation           uint64                  `json:"generation" binding:"required"`
+	Mode                 string                  `json:"mode" enums:",nodes,direct" binding:"required"`
+	Resources            Resources               `json:"resources" binding:"required"`
 	Configuration        json.RawMessage         `json:"configuration,omitempty" swaggertype:"object"`
 	Metadata             json.RawMessage         `json:"metadata,omitempty" swaggertype:"object"`
-	CredentialConfigured bool                    `json:"credential_configured"`
+	CredentialConfigured bool                    `json:"credential_configured" binding:"required"`
 	// Idle suspension policy; null unless the selected Provider declares checkpoint support.
-	Suspension     *Suspension `json:"suspension" extensions:"x-nullable"`
-	InstallationID string      `json:"installation_id"`
-	Provider       string      `json:"provider"`
-	Reset          *Reset      `json:"reset" extensions:"x-nullable"`
-	OwnerEpoch     uint64      `json:"owner_epoch"`
+	Suspension     *Suspension `json:"suspension" extensions:"x-nullable" binding:"required"`
+	InstallationID string      `json:"installation_id" binding:"required"`
+	Provider       string      `json:"provider" binding:"required"`
+	Reset          *Reset      `json:"reset" extensions:"x-nullable" binding:"required"`
+	OwnerEpoch     uint64      `json:"owner_epoch" binding:"required"`
 	// Read-only: the installation public URL (OAC_PUBLIC_URL), which nodes and sandboxes use to reach Core. The deployment API does not accept it.
-	CoreURL string `json:"core_url"`
+	CoreURL string `json:"core_url" binding:"required"`
 }
 
 // Resources counts what still belongs to the deployment.
 type Resources struct {
-	Allocations int64 `json:"allocations"`
-	Pending     int64 `json:"pending"`
+	Allocations int64 `json:"allocations" binding:"required"`
+	Pending     int64 `json:"pending" binding:"required"`
 }
 
 // Suspension is Core's idle suspension policy, which applies to every Provider
 // that declares checkpoint support.
 type Suspension struct {
-	IdleSeconds      int64 `json:"idle_seconds"`
-	RetentionSeconds int64 `json:"retention_seconds"`
+	IdleSeconds      int64 `json:"idle_seconds" binding:"required"`
+	RetentionSeconds int64 `json:"retention_seconds" binding:"required"`
 }
 
 type NodeRollout struct {
 	// Target preparation, independent of an old pin's serving readiness.
-	State string `json:"state" enums:"ready,preparing,failed,update_required,unknown"`
+	State string `json:"state" enums:"ready,preparing,failed,update_required,unknown" binding:"required"`
 	// Durable serving-generation pin; online and provider_ready still gate placement.
-	ReadyGeneration *uint64 `json:"ready_generation" extensions:"x-nullable"`
+	ReadyGeneration *uint64 `json:"ready_generation" extensions:"x-nullable" binding:"required"`
 	Diagnostic      string  `json:"diagnostic,omitempty" enums:"provider_unavailable,host_unsupported,artifacts_unavailable,runtime_download_failed,runtime_image_unavailable,capacity_insufficient"`
 }
 
 type RolloutNodes struct {
-	Ready          int64 `json:"ready"`
-	Preparing      int64 `json:"preparing"`
-	Failed         int64 `json:"failed"`
-	UpdateRequired int64 `json:"update_required"`
-	Unknown        int64 `json:"unknown"`
+	Ready          int64 `json:"ready" binding:"required"`
+	Preparing      int64 `json:"preparing" binding:"required"`
+	Failed         int64 `json:"failed" binding:"required"`
+	UpdateRequired int64 `json:"update_required" binding:"required"`
+	Unknown        int64 `json:"unknown" binding:"required"`
 }
 
 type Rollout struct {
-	State                       string        `json:"state" enums:"settled,preparing"`
-	PreviousGenerationSandboxes int64         `json:"previous_generation_sandboxes"`
-	Nodes                       *RolloutNodes `json:"nodes" extensions:"x-nullable"`
+	State                       string        `json:"state" enums:"settled,preparing" binding:"required"`
+	PreviousGenerationSandboxes int64         `json:"previous_generation_sandboxes" binding:"required"`
+	Nodes                       *RolloutNodes `json:"nodes" extensions:"x-nullable" binding:"required"`
 }
 
 // Reset contains only durable state and a single-snapshot resource partition.
 type Reset struct {
-	Clear       string         `json:"clear"`
-	RequestedAt time.Time      `json:"requested_at"`
-	DeadlineAt  *time.Time     `json:"deadline_at" extensions:"x-nullable"`
-	ForcedAt    *time.Time     `json:"forced_at" extensions:"x-nullable"`
-	Remaining   ResetRemaining `json:"remaining"`
+	Clear       string         `json:"clear" enums:"auto,force" binding:"required"`
+	RequestedAt time.Time      `json:"requested_at" binding:"required"`
+	DeadlineAt  *time.Time     `json:"deadline_at" extensions:"x-nullable" binding:"required"`
+	ForcedAt    *time.Time     `json:"forced_at" extensions:"x-nullable" binding:"required"`
+	Remaining   ResetRemaining `json:"remaining" binding:"required"`
 }
 
 type ResetRemaining struct {
-	Busy           int64              `json:"busy"`
-	Idle           int64              `json:"idle"`
-	Cleanup        int64              `json:"cleanup"`
-	OnOfflineNodes int64              `json:"on_offline_nodes"`
-	OfflineNodes   []ResetOfflineNode `json:"offline_nodes"`
+	Busy           int64              `json:"busy" binding:"required"`
+	Idle           int64              `json:"idle" binding:"required"`
+	Cleanup        int64              `json:"cleanup" binding:"required"`
+	OnOfflineNodes int64              `json:"on_offline_nodes" binding:"required"`
+	OfflineNodes   []ResetOfflineNode `json:"offline_nodes" binding:"required"`
 }
 
 type ResetOfflineNode struct {
-	NodeID    string `json:"node_id"`
-	Name      string `json:"name"`
-	Resources int64  `json:"resources"`
+	NodeID    string `json:"node_id" binding:"required"`
+	Name      string `json:"name" binding:"required"`
+	Resources int64  `json:"resources" binding:"required"`
 }
diff --git a/services/core/internal/projects/api_key.go b/services/core/internal/projects/api_key.go
index 05c64dc8b..15df1a460 100644
--- a/services/core/internal/projects/api_key.go
+++ b/services/core/internal/projects/api_key.go
@@ -12,18 +12,18 @@ import (
 // APIKey is the safe metadata of a Project API key. Core stores only the
 // secret's SHA-256 digest and its display prefix.
 type APIKey struct {
-	ID        string     `json:"id"`
-	ProjectID string     `json:"project_id"`
-	Name      string     `json:"name"`
-	Prefix    string     `json:"prefix"`
-	CreatedAt time.Time  `json:"created_at"`
-	RevokedAt *time.Time `json:"revoked_at"`
+	ID        string     `json:"id" binding:"required"`
+	ProjectID string     `json:"project_id" binding:"required"`
+	Name      string     `json:"name" binding:"required"`
+	Prefix    string     `json:"prefix" binding:"required"`
+	CreatedAt time.Time  `json:"created_at" binding:"required"`
+	RevokedAt *time.Time `json:"revoked_at" extensions:"x-nullable" binding:"required"`
 }
 
 // IssuedAPIKey carries the secret once, in the response that issues it.
 type IssuedAPIKey struct {
 	APIKey
-	Key string `json:"key"`
+	Key string `json:"key" binding:"required"`
 }
 
 // KeyBinding is an active key with the principal it authenticates as.
@@ -34,8 +34,8 @@ type KeyBinding struct {
 
 // KeyPage is one page of a Project's keys ordered by ID.
 type KeyPage struct {
-	Data    []APIKey `json:"data"`
-	HasMore bool     `json:"has_more"`
+	Data    []APIKey `json:"data" binding:"required"`
+	HasMore bool     `json:"has_more" binding:"required"`
 }
 
 // keyPrefixLength covers "pc_" and eight secret characters.
diff --git a/services/core/internal/projects/project.go b/services/core/internal/projects/project.go
index 869fc3894..2c2a2d6cc 100644
--- a/services/core/internal/projects/project.go
+++ b/services/core/internal/projects/project.go
@@ -8,11 +8,11 @@ import (
 
 // Project is a Core Project as administrators see it.
 type Project struct {
-	ID             string     `json:"id"`
-	Name           string     `json:"name"`
-	CreatedAt      time.Time  `json:"created_at"`
-	ArchivedAt     *time.Time `json:"archived_at"`
-	ActiveKeyCount int64      `json:"active_key_count"`
+	ID             string     `json:"id" binding:"required"`
+	Name           string     `json:"name" binding:"required"`
+	CreatedAt      time.Time  `json:"created_at" binding:"required"`
+	ArchivedAt     *time.Time `json:"archived_at" extensions:"x-nullable" binding:"required"`
+	ActiveKeyCount int64      `json:"active_key_count" binding:"required"`
 	TenantID       string     `json:"-"`
 }
 
@@ -24,8 +24,8 @@ type Binding struct {
 
 // Page is one page of Projects ordered by ID.
 type Page struct {
-	Data    []Project `json:"data"`
-	HasMore bool      `json:"has_more"`
+	Data    []Project `json:"data" binding:"required"`
+	HasMore bool      `json:"has_more" binding:"required"`
 }
 
 // MaxListLimit bounds one page of Projects or API keys.
diff --git a/services/core/internal/sandbox/deployment.go b/services/core/internal/sandbox/deployment.go
index dbfda8746..4b96acb13 100644
--- a/services/core/internal/sandbox/deployment.go
+++ b/services/core/internal/sandbox/deployment.go
@@ -24,8 +24,8 @@ func validationBound(value uint32) *uint32 { return &value }
 // Resources describes one managed sandbox, independently of node concurrency.
 // Disk bounds are available only where the native provider enforces them.
 type Resources struct {
-	CPUs               uint32 `json:"cpus"`
-	MemoryMiB          uint32 `json:"memory_mib"`
+	CPUs               uint32 `json:"cpus" binding:"required"`
+	MemoryMiB          uint32 `json:"memory_mib" binding:"required"`
 	RootDiskMiB        uint32 `json:"root_disk_mib,omitempty"`
 	EnvironmentDiskMiB uint32 `json:"environment_disk_mib,omitempty"`
 }
@@ -59,12 +59,12 @@ func (r Resources) ValidatePolicy(provider string, rules DeploymentPolicy) error
 // may address the same archive by config ID or OCI manifest digest; microsandbox
 // has its own imported OCI identity. These are not interchangeable hashes.
 type RuntimeRelease struct {
-	SourceCommit        string `json:"source_commit"`
-	ImageID             string `json:"image_id"`
-	ImageManifestDigest string `json:"image_manifest_digest"`
-	MicrosandboxRef     string `json:"microsandbox_ref"`
-	RuntimeSHA256       string `json:"runtime_sha256"`
-	FirmwareSHA256      string `json:"firmware_sha256"`
+	SourceCommit        string `json:"source_commit" binding:"required"`
+	ImageID             string `json:"image_id" binding:"required"`
+	ImageManifestDigest string `json:"image_manifest_digest" binding:"required"`
+	MicrosandboxRef     string `json:"microsandbox_ref" binding:"required"`
+	RuntimeSHA256       string `json:"runtime_sha256" binding:"required"`
+	FirmwareSHA256      string `json:"firmware_sha256" binding:"required"`
 }
 
 func (r RuntimeRelease) Validate() error {
@@ -78,7 +78,7 @@ func (r RuntimeRelease) Validate() error {
 }
 
 type DeploymentSpec struct {
-	Resources Resources       `json:"resources"`
+	Resources Resources       `json:"resources" binding:"required"`
 	Runtime   *RuntimeRelease `json:"runtime,omitempty"`
 }
 
diff --git a/services/core/internal/sessions/admin.go b/services/core/internal/sessions/admin.go
index 3db0ce646..ab9ae4f58 100644
--- a/services/core/internal/sessions/admin.go
+++ b/services/core/internal/sessions/admin.go
@@ -21,12 +21,12 @@ type AdminSummaryFilter struct{ CreatedAfter, CreatedBefore *time.Time }
 
 // AdminAssetCounts counts a tenant's assets.
 type AdminAssetCounts struct {
-	Agents               int64 `json:"agents"`
-	Skills               int64 `json:"skills"`
-	EnvironmentTemplates int64 `json:"environment_templates"`
-	Files                int64 `json:"files"`
-	Vaults               int64 `json:"vaults"`
-	Credentials          int64 `json:"credentials"`
+	Agents               int64 `json:"agents" binding:"required"`
+	Skills               int64 `json:"skills" binding:"required"`
+	EnvironmentTemplates int64 `json:"environment_templates" binding:"required"`
+	Files                int64 `json:"files" binding:"required"`
+	Vaults               int64 `json:"vaults" binding:"required"`
+	Credentials          int64 `json:"credentials" binding:"required"`
 }
 
 // AdminReader reads the administrator's cross-Project Session views.
diff --git a/services/core/internal/sessions/executor_credentials.go b/services/core/internal/sessions/executor_credentials.go
index 9fb1ea412..d7581791f 100644
--- a/services/core/internal/sessions/executor_credentials.go
+++ b/services/core/internal/sessions/executor_credentials.go
@@ -31,17 +31,17 @@ type ExecutorCredentialReader interface {
 }
 
 type IssuedExecutorCredential struct {
-	KeyID         string `json:"key_id"`
+	KeyID         string `json:"key_id" binding:"required"`
 	EnvironmentID string `json:"environment_id,omitempty"`
-	Token         string `json:"executor_token"`
+	Token         string `json:"executor_token" binding:"required"`
 }
 
 // ExecutorCredential is the metadata of one Environment executor credential.
 // Its secret is returned only when issued or rotated.
 type ExecutorCredential struct {
-	KeyID     string     `json:"key_id" format:"uuid"`
-	CreatedAt time.Time  `json:"created_at"`
-	RevokedAt *time.Time `json:"revoked_at" extensions:"x-nullable"`
+	KeyID     string     `json:"key_id" format:"uuid" binding:"required"`
+	CreatedAt time.Time  `json:"created_at" binding:"required"`
+	RevokedAt *time.Time `json:"revoked_at" extensions:"x-nullable" binding:"required"`
 }
 
 // ExecutorConnectionState is an internal durable observation, never a wire payload.
diff --git a/services/core/internal/sessions/reads.go b/services/core/internal/sessions/reads.go
index 883dd24b8..9f4a167bd 100644
--- a/services/core/internal/sessions/reads.go
+++ b/services/core/internal/sessions/reads.go
@@ -67,7 +67,7 @@ type TurnDiagnosticsSnapshot struct {
 // ManagedArchive reports resource disposal, not archive request provenance
 // or Turn settlement. Existing expiry and failed provisioning use the same states.
 type ManagedArchive struct {
-	SessionID     string `json:"session_id"`
-	EnvironmentID string `json:"environment_id"`
-	State         string `json:"state"`
+	SessionID     string `json:"session_id" binding:"required"`
+	EnvironmentID string `json:"environment_id" binding:"required"`
+	State         string `json:"state" enums:"active,cleanup_pending,released" binding:"required"`
 }
diff --git a/services/core/internal/writeaudit/reader.go b/services/core/internal/writeaudit/reader.go
index e1a4be872..367f752df 100644
--- a/services/core/internal/writeaudit/reader.go
+++ b/services/core/internal/writeaudit/reader.go
@@ -20,31 +20,31 @@ type Reader interface {
 // APIKey is the recorded identity of the key that made a write, with its
 // current revocation time.
 type APIKey struct {
-	ID        string     `json:"id"`
-	Name      string     `json:"name"`
-	Prefix    string     `json:"prefix"`
-	Kind      string     `json:"kind"`
-	RevokedAt *time.Time `json:"revoked_at"`
+	ID        string     `json:"id" binding:"required"`
+	Name      string     `json:"name" binding:"required"`
+	Prefix    string     `json:"prefix" binding:"required"`
+	Kind      string     `json:"kind" enums:"issued" binding:"required"`
+	RevokedAt *time.Time `json:"revoked_at" extensions:"x-nullable" binding:"required"`
 }
 
 // ResourceOwner is the recorded creator of one resource. APIKey is null for a
 // resource without recorded creation provenance.
 type ResourceOwner struct {
-	ResourceID string  `json:"resource_id"`
-	APIKey     *APIKey `json:"api_key"`
+	ResourceID string  `json:"resource_id" binding:"required"`
+	APIKey     *APIKey `json:"api_key" extensions:"x-nullable" binding:"required"`
 }
 
 // Operation is one committed write.
 type Operation struct {
-	ID           string    `json:"id"`
-	Action       string    `json:"action"`
-	ResourceType string    `json:"resource_type"`
-	ResourceID   string    `json:"resource_id"`
-	ParentID     string    `json:"parent_id"`
-	RequestID    string    `json:"request_id"`
-	TraceID      string    `json:"trace_id"`
-	APIKey       APIKey    `json:"api_key"`
-	CreatedAt    time.Time `json:"created_at"`
+	ID           string    `json:"id" binding:"required"`
+	Action       string    `json:"action" enums:"create,update,delete,send_events,upload_file,upload_version,update_default_version" binding:"required"`
+	ResourceType string    `json:"resource_type" enums:"agent,session,environment,environment_template,skill,skill_version,file,vault,credential,artifact" binding:"required"`
+	ResourceID   string    `json:"resource_id" binding:"required"`
+	ParentID     string    `json:"parent_id" binding:"required"`
+	RequestID    string    `json:"request_id" binding:"required"`
+	TraceID      string    `json:"trace_id" binding:"required"`
+	APIKey       APIKey    `json:"api_key" binding:"required"`
+	CreatedAt    time.Time `json:"created_at" binding:"required"`
 }
 
 // Filter selects committed writes, newest first. A zero Limit is the default
@@ -56,9 +56,9 @@ type Filter struct {
 }
 
 type Page struct {
-	Data       []Operation `json:"data"`
-	HasMore    bool        `json:"has_more"`
-	NextCursor string      `json:"next_cursor"`
+	Data       []Operation `json:"data" binding:"required"`
+	HasMore    bool        `json:"has_more" binding:"required"`
+	NextCursor string      `json:"next_cursor" binding:"required"`
 }
 
 // Validate checks f and returns it with the default page size applied. The