Requires current synapse:event_sources:write authority in the exact environment. Publication pins only a public Ed25519 signing key, event age and capacity bounds, input mode, and the complete run configuration. It neither activates nor starts a run. Activation and retirement require human sessions; enabling also requires an available event admission worker. Preserve exact request and key after an unknown mutation. No automatic retry. Fixed mode refuses event input overrides; event_reference requires an exact current approved JSON content reference, never a raw event body. Replies expose execution_ready; false refuses enabling. Test and Live authority, reset and funding remain separate. Signing private keys must stay with the external source. This metadata API does not expose event admission receipts.
Model, tools, schemas and limits come from the immutable agent version. Paid Test Compute requires the exact consent funding the grant budget; the API checks it against current payer authority. The server locks canonical project and selected-agent Run authority and persists the binding atomically; selectors alone grant no authority. Other clients may supply both selectors to use the same project spending ceiling. Optional workspace selection requires the project/thread pair, live usage and an exact matching katara:locus workload grant. The server checks its currently configured immutable workspace agent/version, hosted grant, profile, preset, project and funding. Selection metadata supplies no authority.
Explicit destination for run artifacts. Store and key versions must still be active at admission and byte access. Choose retention from 60 seconds to 365 days; no silent default or destination substitution.
Explicit hosted workspace selection. The selected workload grant must have this exact grant_id and audience katara:locus. Profile and preset identify server-owned configuration; these names do not establish current authority or select a client-supplied agent version.
Stable; branch on it. Any operation can answer invalid_request, with param naming the refused field when there is one; human_session_required, when an API key, service account or workload calls an operation only a signed-in person may perform; reauthentication_required, when a person’s sign-in is too old for the operation; permission_denied; route_not_found and method_not_allowed, when no operation matches the path or method; and feature_unavailable, when the operation’s service is not enabled on this deployment.
string
>= 1 characters<= 100 characters
param
required
The request field a refusal is about, such as the agent_id or run_id query parameter; null when the refusal is not about one field.