diff --git a/go/gen/compass/v1/compass.pb.go b/go/gen/compass/v1/compass.pb.go
index c8fa53c7..b0cde22c 100644
--- a/go/gen/compass/v1/compass.pb.go
+++ b/go/gen/compass/v1/compass.pb.go
@@ -182,6 +182,116 @@ func (ServerState) EnumDescriptor() ([]byte, []int) {
 	return file_compass_v1_compass_proto_rawDescGZIP(), []int{2}
 }
 
+// The runtime tier an agent workload runs on. `HOST` runs agents as direct
+// child processes of the Runner, with no container or VM boundary.
+type RuntimeTier int32
+
+const (
+	RuntimeTier_RUNTIME_TIER_UNSPECIFIED     RuntimeTier = 0
+	RuntimeTier_RUNTIME_TIER_PODMAN          RuntimeTier = 1
+	RuntimeTier_RUNTIME_TIER_MICROVM         RuntimeTier = 2
+	RuntimeTier_RUNTIME_TIER_APPLE_CONTAINER RuntimeTier = 3
+	RuntimeTier_RUNTIME_TIER_HOST            RuntimeTier = 4
+)
+
+// Enum value maps for RuntimeTier.
+var (
+	RuntimeTier_name = map[int32]string{
+		0: "RUNTIME_TIER_UNSPECIFIED",
+		1: "RUNTIME_TIER_PODMAN",
+		2: "RUNTIME_TIER_MICROVM",
+		3: "RUNTIME_TIER_APPLE_CONTAINER",
+		4: "RUNTIME_TIER_HOST",
+	}
+	RuntimeTier_value = map[string]int32{
+		"RUNTIME_TIER_UNSPECIFIED":     0,
+		"RUNTIME_TIER_PODMAN":          1,
+		"RUNTIME_TIER_MICROVM":         2,
+		"RUNTIME_TIER_APPLE_CONTAINER": 3,
+		"RUNTIME_TIER_HOST":            4,
+	}
+)
+
+func (x RuntimeTier) Enum() *RuntimeTier {
+	p := new(RuntimeTier)
+	*p = x
+	return p
+}
+
+func (x RuntimeTier) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (RuntimeTier) Descriptor() protoreflect.EnumDescriptor {
+	return file_compass_v1_compass_proto_enumTypes[3].Descriptor()
+}
+
+func (RuntimeTier) Type() protoreflect.EnumType {
+	return &file_compass_v1_compass_proto_enumTypes[3]
+}
+
+func (x RuntimeTier) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use RuntimeTier.Descriptor instead.
+func (RuntimeTier) EnumDescriptor() ([]byte, []int) {
+	return file_compass_v1_compass_proto_rawDescGZIP(), []int{3}
+}
+
+// How an agent's egress is constrained. `UNENFORCED` means the tier cannot
+// constrain it at all — a host process shares the host's network namespace, so
+// there is no boundary to firewall. It is a declared posture, never a failed
+// arm, and a client must not render it as contained.
+type EgressPosture int32
+
+const (
+	EgressPosture_EGRESS_POSTURE_UNSPECIFIED EgressPosture = 0
+	EgressPosture_EGRESS_POSTURE_ARMED       EgressPosture = 1
+	EgressPosture_EGRESS_POSTURE_UNENFORCED  EgressPosture = 2
+)
+
+// Enum value maps for EgressPosture.
+var (
+	EgressPosture_name = map[int32]string{
+		0: "EGRESS_POSTURE_UNSPECIFIED",
+		1: "EGRESS_POSTURE_ARMED",
+		2: "EGRESS_POSTURE_UNENFORCED",
+	}
+	EgressPosture_value = map[string]int32{
+		"EGRESS_POSTURE_UNSPECIFIED": 0,
+		"EGRESS_POSTURE_ARMED":       1,
+		"EGRESS_POSTURE_UNENFORCED":  2,
+	}
+)
+
+func (x EgressPosture) Enum() *EgressPosture {
+	p := new(EgressPosture)
+	*p = x
+	return p
+}
+
+func (x EgressPosture) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (EgressPosture) Descriptor() protoreflect.EnumDescriptor {
+	return file_compass_v1_compass_proto_enumTypes[4].Descriptor()
+}
+
+func (EgressPosture) Type() protoreflect.EnumType {
+	return &file_compass_v1_compass_proto_enumTypes[4]
+}
+
+func (x EgressPosture) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use EgressPosture.Descriptor instead.
+func (EgressPosture) EnumDescriptor() ([]byte, []int) {
+	return file_compass_v1_compass_proto_rawDescGZIP(), []int{4}
+}
+
 // Agent-session lifecycle states. `ERRORED` is an unexpected agent exit (OOM,
 // panic, engine restart); recovery is an explicit ReloadAgentSession, never an
 // automatic reconnect. `DISCONNECTED` is distinct: the owning Runner's link
@@ -244,11 +354,11 @@ func (x AgentSessionState) String() string {
 }
 
 func (AgentSessionState) Descriptor() protoreflect.EnumDescriptor {
-	return file_compass_v1_compass_proto_enumTypes[3].Descriptor()
+	return file_compass_v1_compass_proto_enumTypes[5].Descriptor()
 }
 
 func (AgentSessionState) Type() protoreflect.EnumType {
-	return &file_compass_v1_compass_proto_enumTypes[3]
+	return &file_compass_v1_compass_proto_enumTypes[5]
 }
 
 func (x AgentSessionState) Number() protoreflect.EnumNumber {
@@ -257,7 +367,7 @@ func (x AgentSessionState) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use AgentSessionState.Descriptor instead.
 func (AgentSessionState) EnumDescriptor() ([]byte, []int) {
-	return file_compass_v1_compass_proto_rawDescGZIP(), []int{3}
+	return file_compass_v1_compass_proto_rawDescGZIP(), []int{5}
 }
 
 type AgentToolCallStatus int32
@@ -299,11 +409,11 @@ func (x AgentToolCallStatus) String() string {
 }
 
 func (AgentToolCallStatus) Descriptor() protoreflect.EnumDescriptor {
-	return file_compass_v1_compass_proto_enumTypes[4].Descriptor()
+	return file_compass_v1_compass_proto_enumTypes[6].Descriptor()
 }
 
 func (AgentToolCallStatus) Type() protoreflect.EnumType {
-	return &file_compass_v1_compass_proto_enumTypes[4]
+	return &file_compass_v1_compass_proto_enumTypes[6]
 }
 
 func (x AgentToolCallStatus) Number() protoreflect.EnumNumber {
@@ -312,7 +422,7 @@ func (x AgentToolCallStatus) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use AgentToolCallStatus.Descriptor instead.
 func (AgentToolCallStatus) EnumDescriptor() ([]byte, []int) {
-	return file_compass_v1_compass_proto_rawDescGZIP(), []int{4}
+	return file_compass_v1_compass_proto_rawDescGZIP(), []int{6}
 }
 
 type AgentPlanEntryStatus int32
@@ -351,11 +461,11 @@ func (x AgentPlanEntryStatus) String() string {
 }
 
 func (AgentPlanEntryStatus) Descriptor() protoreflect.EnumDescriptor {
-	return file_compass_v1_compass_proto_enumTypes[5].Descriptor()
+	return file_compass_v1_compass_proto_enumTypes[7].Descriptor()
 }
 
 func (AgentPlanEntryStatus) Type() protoreflect.EnumType {
-	return &file_compass_v1_compass_proto_enumTypes[5]
+	return &file_compass_v1_compass_proto_enumTypes[7]
 }
 
 func (x AgentPlanEntryStatus) Number() protoreflect.EnumNumber {
@@ -364,7 +474,7 @@ func (x AgentPlanEntryStatus) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use AgentPlanEntryStatus.Descriptor instead.
 func (AgentPlanEntryStatus) EnumDescriptor() ([]byte, []int) {
-	return file_compass_v1_compass_proto_rawDescGZIP(), []int{5}
+	return file_compass_v1_compass_proto_rawDescGZIP(), []int{7}
 }
 
 // The control op-kind a SessionInjection records. Mirrors the internal
@@ -405,11 +515,11 @@ func (x SessionInjectionKind) String() string {
 }
 
 func (SessionInjectionKind) Descriptor() protoreflect.EnumDescriptor {
-	return file_compass_v1_compass_proto_enumTypes[6].Descriptor()
+	return file_compass_v1_compass_proto_enumTypes[8].Descriptor()
 }
 
 func (SessionInjectionKind) Type() protoreflect.EnumType {
-	return &file_compass_v1_compass_proto_enumTypes[6]
+	return &file_compass_v1_compass_proto_enumTypes[8]
 }
 
 func (x SessionInjectionKind) Number() protoreflect.EnumNumber {
@@ -418,7 +528,7 @@ func (x SessionInjectionKind) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use SessionInjectionKind.Descriptor instead.
 func (SessionInjectionKind) EnumDescriptor() ([]byte, []int) {
-	return file_compass_v1_compass_proto_rawDescGZIP(), []int{6}
+	return file_compass_v1_compass_proto_rawDescGZIP(), []int{8}
 }
 
 // The class of a SessionError. ERROR pairs with the ERRORED lifecycle
@@ -457,11 +567,11 @@ func (x SessionErrorKind) String() string {
 }
 
 func (SessionErrorKind) Descriptor() protoreflect.EnumDescriptor {
-	return file_compass_v1_compass_proto_enumTypes[7].Descriptor()
+	return file_compass_v1_compass_proto_enumTypes[9].Descriptor()
 }
 
 func (SessionErrorKind) Type() protoreflect.EnumType {
-	return &file_compass_v1_compass_proto_enumTypes[7]
+	return &file_compass_v1_compass_proto_enumTypes[9]
 }
 
 func (x SessionErrorKind) Number() protoreflect.EnumNumber {
@@ -470,7 +580,7 @@ func (x SessionErrorKind) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use SessionErrorKind.Descriptor instead.
 func (SessionErrorKind) EnumDescriptor() ([]byte, []int) {
-	return file_compass_v1_compass_proto_rawDescGZIP(), []int{7}
+	return file_compass_v1_compass_proto_rawDescGZIP(), []int{9}
 }
 
 // The Compass issue lifecycle, server-owned (DL-032/DL-033 + terminal ARCHIVED,
@@ -529,11 +639,11 @@ func (x IssueState) String() string {
 }
 
 func (IssueState) Descriptor() protoreflect.EnumDescriptor {
-	return file_compass_v1_compass_proto_enumTypes[8].Descriptor()
+	return file_compass_v1_compass_proto_enumTypes[10].Descriptor()
 }
 
 func (IssueState) Type() protoreflect.EnumType {
-	return &file_compass_v1_compass_proto_enumTypes[8]
+	return &file_compass_v1_compass_proto_enumTypes[10]
 }
 
 func (x IssueState) Number() protoreflect.EnumNumber {
@@ -542,7 +652,7 @@ func (x IssueState) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use IssueState.Descriptor instead.
 func (IssueState) EnumDescriptor() ([]byte, []int) {
-	return file_compass_v1_compass_proto_rawDescGZIP(), []int{8}
+	return file_compass_v1_compass_proto_rawDescGZIP(), []int{10}
 }
 
 // Which forge (and which host, for self-hosted instances) an artifact lives on.
@@ -587,11 +697,11 @@ func (x ForgeProvider) String() string {
 }
 
 func (ForgeProvider) Descriptor() protoreflect.EnumDescriptor {
-	return file_compass_v1_compass_proto_enumTypes[9].Descriptor()
+	return file_compass_v1_compass_proto_enumTypes[11].Descriptor()
 }
 
 func (ForgeProvider) Type() protoreflect.EnumType {
-	return &file_compass_v1_compass_proto_enumTypes[9]
+	return &file_compass_v1_compass_proto_enumTypes[11]
 }
 
 func (x ForgeProvider) Number() protoreflect.EnumNumber {
@@ -600,7 +710,7 @@ func (x ForgeProvider) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ForgeProvider.Descriptor instead.
 func (ForgeProvider) EnumDescriptor() ([]byte, []int) {
-	return file_compass_v1_compass_proto_rawDescGZIP(), []int{9}
+	return file_compass_v1_compass_proto_rawDescGZIP(), []int{11}
 }
 
 type SetSecretRequest struct {
@@ -1943,8 +2053,17 @@ type AgentSessionStatus struct {
 	// binding is no longer resolvable — a status emitted after a Runner reconnect
 	// cleared the live-session maps carries none (the stated residual gap).
 	AgentAccountId string `protobuf:"bytes,3,opt,name=agent_account_id,json=agentAccountId,proto3" json:"agent_account_id,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	// The runtime tier this session's workload runs on, and how its egress is
+	// constrained. Both are backward-compatible appends (buf: non-breaking) and
+	// both are reported by the Runner that owns the session, because it is the
+	// component that resolved the backend. Posture is carried separately rather
+	// than inferred from the tier: a tier's enforcement is a property of the
+	// backend, and a client deriving one from the other would render a stale
+	// answer the moment that changes.
+	RuntimeTier   RuntimeTier   `protobuf:"varint,4,opt,name=runtime_tier,json=runtimeTier,proto3,enum=compass.v1.RuntimeTier" json:"runtime_tier,omitempty"`
+	EgressPosture EgressPosture `protobuf:"varint,5,opt,name=egress_posture,json=egressPosture,proto3,enum=compass.v1.EgressPosture" json:"egress_posture,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *AgentSessionStatus) Reset() {
@@ -1998,6 +2117,20 @@ func (x *AgentSessionStatus) GetAgentAccountId() string {
 	return ""
 }
 
+func (x *AgentSessionStatus) GetRuntimeTier() RuntimeTier {
+	if x != nil {
+		return x.RuntimeTier
+	}
+	return RuntimeTier_RUNTIME_TIER_UNSPECIFIED
+}
+
+func (x *AgentSessionStatus) GetEgressPosture() EgressPosture {
+	if x != nil {
+		return x.EgressPosture
+	}
+	return EgressPosture_EGRESS_POSTURE_UNSPECIFIED
+}
+
 // A chunk of the agent's message stream (assistant text / thought), relayed
 // from the Runner's agent event stream.
 type AgentMessageChunk struct {
@@ -5869,12 +6002,14 @@ const file_compass_v1_compass_proto_rawDesc = "" +
 	"\x06issues\x18\x01 \x03(\v2\x11.compass.v1.IssueR\x06issues\"=\n" +
 	"\fServerStatus\x12-\n" +
 	"\x05state\x18\x01 \x01(\x0e2\x17.compass.v1.ServerStateR\x05state\"\x10\n" +
-	"\x0eResyncRequired\"\x92\x01\n" +
+	"\x0eResyncRequired\"\x90\x02\n" +
 	"\x12AgentSessionStatus\x12\x1d\n" +
 	"\n" +
 	"session_id\x18\x01 \x01(\tR\tsessionId\x123\n" +
 	"\x05state\x18\x02 \x01(\x0e2\x1d.compass.v1.AgentSessionStateR\x05state\x12(\n" +
-	"\x10agent_account_id\x18\x03 \x01(\tR\x0eagentAccountId\"e\n" +
+	"\x10agent_account_id\x18\x03 \x01(\tR\x0eagentAccountId\x12:\n" +
+	"\fruntime_tier\x18\x04 \x01(\x0e2\x17.compass.v1.RuntimeTierR\vruntimeTier\x12@\n" +
+	"\x0eegress_posture\x18\x05 \x01(\x0e2\x19.compass.v1.EgressPostureR\regressPosture\"e\n" +
 	"\x11AgentMessageChunk\x12\x1d\n" +
 	"\n" +
 	"session_id\x18\x01 \x01(\tR\tsessionId\x12\x12\n" +
@@ -6149,7 +6284,17 @@ const file_compass_v1_compass_proto_rawDesc = "" +
 	"\x0eSECRET_KIND_GH\x10\x03*C\n" +
 	"\vServerState\x12\x1c\n" +
 	"\x18SERVER_STATE_UNSPECIFIED\x10\x00\x12\x16\n" +
-	"\x12SERVER_STATE_READY\x10\x01*\x82\x02\n" +
+	"\x12SERVER_STATE_READY\x10\x01*\x97\x01\n" +
+	"\vRuntimeTier\x12\x1c\n" +
+	"\x18RUNTIME_TIER_UNSPECIFIED\x10\x00\x12\x17\n" +
+	"\x13RUNTIME_TIER_PODMAN\x10\x01\x12\x18\n" +
+	"\x14RUNTIME_TIER_MICROVM\x10\x02\x12 \n" +
+	"\x1cRUNTIME_TIER_APPLE_CONTAINER\x10\x03\x12\x15\n" +
+	"\x11RUNTIME_TIER_HOST\x10\x04*h\n" +
+	"\rEgressPosture\x12\x1e\n" +
+	"\x1aEGRESS_POSTURE_UNSPECIFIED\x10\x00\x12\x18\n" +
+	"\x14EGRESS_POSTURE_ARMED\x10\x01\x12\x1d\n" +
+	"\x19EGRESS_POSTURE_UNENFORCED\x10\x02*\x82\x02\n" +
 	"\x11AgentSessionState\x12#\n" +
 	"\x1fAGENT_SESSION_STATE_UNSPECIFIED\x10\x00\x12 \n" +
 	"\x1cAGENT_SESSION_STATE_STARTING\x10\x01\x12\x1d\n" +
@@ -6237,223 +6382,227 @@ func file_compass_v1_compass_proto_rawDescGZIP() []byte {
 	return file_compass_v1_compass_proto_rawDescData
 }
 
-var file_compass_v1_compass_proto_enumTypes = make([]protoimpl.EnumInfo, 10)
+var file_compass_v1_compass_proto_enumTypes = make([]protoimpl.EnumInfo, 12)
 var file_compass_v1_compass_proto_msgTypes = make([]protoimpl.MessageInfo, 87)
 var file_compass_v1_compass_proto_goTypes = []any{
 	(SecretDelivery)(0),                     // 0: compass.v1.SecretDelivery
 	(SecretKind)(0),                         // 1: compass.v1.SecretKind
 	(ServerState)(0),                        // 2: compass.v1.ServerState
-	(AgentSessionState)(0),                  // 3: compass.v1.AgentSessionState
-	(AgentToolCallStatus)(0),                // 4: compass.v1.AgentToolCallStatus
-	(AgentPlanEntryStatus)(0),               // 5: compass.v1.AgentPlanEntryStatus
-	(SessionInjectionKind)(0),               // 6: compass.v1.SessionInjectionKind
-	(SessionErrorKind)(0),                   // 7: compass.v1.SessionErrorKind
-	(IssueState)(0),                         // 8: compass.v1.IssueState
-	(ForgeProvider)(0),                      // 9: compass.v1.ForgeProvider
-	(*SetSecretRequest)(nil),                // 10: compass.v1.SetSecretRequest
-	(*SetSecretResponse)(nil),               // 11: compass.v1.SetSecretResponse
-	(*ListSecretsRequest)(nil),              // 12: compass.v1.ListSecretsRequest
-	(*ListSecretsResponse)(nil),             // 13: compass.v1.ListSecretsResponse
-	(*SecretStatus)(nil),                    // 14: compass.v1.SecretStatus
-	(*DeleteSecretRequest)(nil),             // 15: compass.v1.DeleteSecretRequest
-	(*DeleteSecretResponse)(nil),            // 16: compass.v1.DeleteSecretResponse
-	(*SetServerSecretRequest)(nil),          // 17: compass.v1.SetServerSecretRequest
-	(*SetServerSecretResponse)(nil),         // 18: compass.v1.SetServerSecretResponse
-	(*DeleteServerSecretRequest)(nil),       // 19: compass.v1.DeleteServerSecretRequest
-	(*DeleteServerSecretResponse)(nil),      // 20: compass.v1.DeleteServerSecretResponse
-	(*ListServerSecretsRequest)(nil),        // 21: compass.v1.ListServerSecretsRequest
-	(*ListServerSecretsResponse)(nil),       // 22: compass.v1.ListServerSecretsResponse
-	(*ServerSecretStatus)(nil),              // 23: compass.v1.ServerSecretStatus
-	(*GetServerInfoRequest)(nil),            // 24: compass.v1.GetServerInfoRequest
-	(*GetServerInfoResponse)(nil),           // 25: compass.v1.GetServerInfoResponse
-	(*WhoAmIRequest)(nil),                   // 26: compass.v1.WhoAmIRequest
-	(*WhoAmIResponse)(nil),                  // 27: compass.v1.WhoAmIResponse
-	(*SubscribeEventsRequest)(nil),          // 28: compass.v1.SubscribeEventsRequest
-	(*SubscribeEventsResponse)(nil),         // 29: compass.v1.SubscribeEventsResponse
-	(*ListBoardIssuesRequest)(nil),          // 30: compass.v1.ListBoardIssuesRequest
-	(*ListBoardIssuesResponse)(nil),         // 31: compass.v1.ListBoardIssuesResponse
-	(*ServerStatus)(nil),                    // 32: compass.v1.ServerStatus
-	(*ResyncRequired)(nil),                  // 33: compass.v1.ResyncRequired
-	(*AgentSessionStatus)(nil),              // 34: compass.v1.AgentSessionStatus
-	(*AgentMessageChunk)(nil),               // 35: compass.v1.AgentMessageChunk
-	(*AgentToolCall)(nil),                   // 36: compass.v1.AgentToolCall
-	(*AgentPlan)(nil),                       // 37: compass.v1.AgentPlan
-	(*AgentPlanEntry)(nil),                  // 38: compass.v1.AgentPlanEntry
-	(*SessionEvent)(nil),                    // 39: compass.v1.SessionEvent
-	(*SessionAssistantText)(nil),            // 40: compass.v1.SessionAssistantText
-	(*SessionThinking)(nil),                 // 41: compass.v1.SessionThinking
-	(*SessionToolCall)(nil),                 // 42: compass.v1.SessionToolCall
-	(*SessionToolCallUpdate)(nil),           // 43: compass.v1.SessionToolCallUpdate
-	(*SessionFileDiff)(nil),                 // 44: compass.v1.SessionFileDiff
-	(*SessionPlan)(nil),                     // 45: compass.v1.SessionPlan
-	(*SessionNotice)(nil),                   // 46: compass.v1.SessionNotice
-	(*SessionInjection)(nil),                // 47: compass.v1.SessionInjection
-	(*SessionError)(nil),                    // 48: compass.v1.SessionError
-	(*SubscribeAgentSessionRequest)(nil),    // 49: compass.v1.SubscribeAgentSessionRequest
-	(*AgentSessionFrame)(nil),               // 50: compass.v1.AgentSessionFrame
-	(*ProvisionAgentWorkspaceRequest)(nil),  // 51: compass.v1.ProvisionAgentWorkspaceRequest
-	(*ProvisionAgentWorkspaceResponse)(nil), // 52: compass.v1.ProvisionAgentWorkspaceResponse
-	(*RemoveAgentWorkspaceRequest)(nil),     // 53: compass.v1.RemoveAgentWorkspaceRequest
-	(*RemoveAgentWorkspaceResponse)(nil),    // 54: compass.v1.RemoveAgentWorkspaceResponse
-	(*StartAgentSessionRequest)(nil),        // 55: compass.v1.StartAgentSessionRequest
-	(*StartAgentSessionResponse)(nil),       // 56: compass.v1.StartAgentSessionResponse
-	(*SpawnAgentRequest)(nil),               // 57: compass.v1.SpawnAgentRequest
-	(*SpawnAgentResponse)(nil),              // 58: compass.v1.SpawnAgentResponse
-	(*StopAgentSessionRequest)(nil),         // 59: compass.v1.StopAgentSessionRequest
-	(*StopAgentSessionResponse)(nil),        // 60: compass.v1.StopAgentSessionResponse
-	(*ReloadAgentSessionRequest)(nil),       // 61: compass.v1.ReloadAgentSessionRequest
-	(*ReloadAgentSessionResponse)(nil),      // 62: compass.v1.ReloadAgentSessionResponse
-	(*GetAgentStatusRequest)(nil),           // 63: compass.v1.GetAgentStatusRequest
-	(*GetAgentStatusResponse)(nil),          // 64: compass.v1.GetAgentStatusResponse
-	(*IssueTokenRequest)(nil),               // 65: compass.v1.IssueTokenRequest
-	(*IssueTokenResponse)(nil),              // 66: compass.v1.IssueTokenResponse
-	(*RevokeTokenRequest)(nil),              // 67: compass.v1.RevokeTokenRequest
-	(*RevokeTokenResponse)(nil),             // 68: compass.v1.RevokeTokenResponse
-	(*PutAgentConfigRequest)(nil),           // 69: compass.v1.PutAgentConfigRequest
-	(*PutAgentConfigResponse)(nil),          // 70: compass.v1.PutAgentConfigResponse
-	(*GetAgentConfigInfoRequest)(nil),       // 71: compass.v1.GetAgentConfigInfoRequest
-	(*GetAgentConfigInfoResponse)(nil),      // 72: compass.v1.GetAgentConfigInfoResponse
-	(*DeleteAgentConfigRequest)(nil),        // 73: compass.v1.DeleteAgentConfigRequest
-	(*DeleteAgentConfigResponse)(nil),       // 74: compass.v1.DeleteAgentConfigResponse
-	(*ModelCandidate)(nil),                  // 75: compass.v1.ModelCandidate
-	(*ModelMetadata)(nil),                   // 76: compass.v1.ModelMetadata
-	(*ModelRegistryEntry)(nil),              // 77: compass.v1.ModelRegistryEntry
-	(*ModelRegistry)(nil),                   // 78: compass.v1.ModelRegistry
-	(*PutModelRegistryRequest)(nil),         // 79: compass.v1.PutModelRegistryRequest
-	(*PutModelRegistryResponse)(nil),        // 80: compass.v1.PutModelRegistryResponse
-	(*GetModelRegistryRequest)(nil),         // 81: compass.v1.GetModelRegistryRequest
-	(*GetModelRegistryResponse)(nil),        // 82: compass.v1.GetModelRegistryResponse
-	(*DeleteModelRegistryRequest)(nil),      // 83: compass.v1.DeleteModelRegistryRequest
-	(*DeleteModelRegistryResponse)(nil),     // 84: compass.v1.DeleteModelRegistryResponse
-	(*AgentAttribution)(nil),                // 85: compass.v1.AgentAttribution
-	(*ForgeRef)(nil),                        // 86: compass.v1.ForgeRef
-	(*Issue)(nil),                           // 87: compass.v1.Issue
-	(*PullRequest)(nil),                     // 88: compass.v1.PullRequest
-	(*ChecksSummary)(nil),                   // 89: compass.v1.ChecksSummary
-	(*Check)(nil),                           // 90: compass.v1.Check
-	(*ChangedStats)(nil),                    // 91: compass.v1.ChangedStats
-	(*TrackerRef)(nil),                      // 92: compass.v1.TrackerRef
-	(*Review)(nil),                          // 93: compass.v1.Review
-	(*ReviewThread)(nil),                    // 94: compass.v1.ReviewThread
-	(*Comment)(nil),                         // 95: compass.v1.Comment
-	nil,                                     // 96: compass.v1.ModelRegistry.EntriesEntry
-	(*timestamppb.Timestamp)(nil),           // 97: google.protobuf.Timestamp
+	(RuntimeTier)(0),                        // 3: compass.v1.RuntimeTier
+	(EgressPosture)(0),                      // 4: compass.v1.EgressPosture
+	(AgentSessionState)(0),                  // 5: compass.v1.AgentSessionState
+	(AgentToolCallStatus)(0),                // 6: compass.v1.AgentToolCallStatus
+	(AgentPlanEntryStatus)(0),               // 7: compass.v1.AgentPlanEntryStatus
+	(SessionInjectionKind)(0),               // 8: compass.v1.SessionInjectionKind
+	(SessionErrorKind)(0),                   // 9: compass.v1.SessionErrorKind
+	(IssueState)(0),                         // 10: compass.v1.IssueState
+	(ForgeProvider)(0),                      // 11: compass.v1.ForgeProvider
+	(*SetSecretRequest)(nil),                // 12: compass.v1.SetSecretRequest
+	(*SetSecretResponse)(nil),               // 13: compass.v1.SetSecretResponse
+	(*ListSecretsRequest)(nil),              // 14: compass.v1.ListSecretsRequest
+	(*ListSecretsResponse)(nil),             // 15: compass.v1.ListSecretsResponse
+	(*SecretStatus)(nil),                    // 16: compass.v1.SecretStatus
+	(*DeleteSecretRequest)(nil),             // 17: compass.v1.DeleteSecretRequest
+	(*DeleteSecretResponse)(nil),            // 18: compass.v1.DeleteSecretResponse
+	(*SetServerSecretRequest)(nil),          // 19: compass.v1.SetServerSecretRequest
+	(*SetServerSecretResponse)(nil),         // 20: compass.v1.SetServerSecretResponse
+	(*DeleteServerSecretRequest)(nil),       // 21: compass.v1.DeleteServerSecretRequest
+	(*DeleteServerSecretResponse)(nil),      // 22: compass.v1.DeleteServerSecretResponse
+	(*ListServerSecretsRequest)(nil),        // 23: compass.v1.ListServerSecretsRequest
+	(*ListServerSecretsResponse)(nil),       // 24: compass.v1.ListServerSecretsResponse
+	(*ServerSecretStatus)(nil),              // 25: compass.v1.ServerSecretStatus
+	(*GetServerInfoRequest)(nil),            // 26: compass.v1.GetServerInfoRequest
+	(*GetServerInfoResponse)(nil),           // 27: compass.v1.GetServerInfoResponse
+	(*WhoAmIRequest)(nil),                   // 28: compass.v1.WhoAmIRequest
+	(*WhoAmIResponse)(nil),                  // 29: compass.v1.WhoAmIResponse
+	(*SubscribeEventsRequest)(nil),          // 30: compass.v1.SubscribeEventsRequest
+	(*SubscribeEventsResponse)(nil),         // 31: compass.v1.SubscribeEventsResponse
+	(*ListBoardIssuesRequest)(nil),          // 32: compass.v1.ListBoardIssuesRequest
+	(*ListBoardIssuesResponse)(nil),         // 33: compass.v1.ListBoardIssuesResponse
+	(*ServerStatus)(nil),                    // 34: compass.v1.ServerStatus
+	(*ResyncRequired)(nil),                  // 35: compass.v1.ResyncRequired
+	(*AgentSessionStatus)(nil),              // 36: compass.v1.AgentSessionStatus
+	(*AgentMessageChunk)(nil),               // 37: compass.v1.AgentMessageChunk
+	(*AgentToolCall)(nil),                   // 38: compass.v1.AgentToolCall
+	(*AgentPlan)(nil),                       // 39: compass.v1.AgentPlan
+	(*AgentPlanEntry)(nil),                  // 40: compass.v1.AgentPlanEntry
+	(*SessionEvent)(nil),                    // 41: compass.v1.SessionEvent
+	(*SessionAssistantText)(nil),            // 42: compass.v1.SessionAssistantText
+	(*SessionThinking)(nil),                 // 43: compass.v1.SessionThinking
+	(*SessionToolCall)(nil),                 // 44: compass.v1.SessionToolCall
+	(*SessionToolCallUpdate)(nil),           // 45: compass.v1.SessionToolCallUpdate
+	(*SessionFileDiff)(nil),                 // 46: compass.v1.SessionFileDiff
+	(*SessionPlan)(nil),                     // 47: compass.v1.SessionPlan
+	(*SessionNotice)(nil),                   // 48: compass.v1.SessionNotice
+	(*SessionInjection)(nil),                // 49: compass.v1.SessionInjection
+	(*SessionError)(nil),                    // 50: compass.v1.SessionError
+	(*SubscribeAgentSessionRequest)(nil),    // 51: compass.v1.SubscribeAgentSessionRequest
+	(*AgentSessionFrame)(nil),               // 52: compass.v1.AgentSessionFrame
+	(*ProvisionAgentWorkspaceRequest)(nil),  // 53: compass.v1.ProvisionAgentWorkspaceRequest
+	(*ProvisionAgentWorkspaceResponse)(nil), // 54: compass.v1.ProvisionAgentWorkspaceResponse
+	(*RemoveAgentWorkspaceRequest)(nil),     // 55: compass.v1.RemoveAgentWorkspaceRequest
+	(*RemoveAgentWorkspaceResponse)(nil),    // 56: compass.v1.RemoveAgentWorkspaceResponse
+	(*StartAgentSessionRequest)(nil),        // 57: compass.v1.StartAgentSessionRequest
+	(*StartAgentSessionResponse)(nil),       // 58: compass.v1.StartAgentSessionResponse
+	(*SpawnAgentRequest)(nil),               // 59: compass.v1.SpawnAgentRequest
+	(*SpawnAgentResponse)(nil),              // 60: compass.v1.SpawnAgentResponse
+	(*StopAgentSessionRequest)(nil),         // 61: compass.v1.StopAgentSessionRequest
+	(*StopAgentSessionResponse)(nil),        // 62: compass.v1.StopAgentSessionResponse
+	(*ReloadAgentSessionRequest)(nil),       // 63: compass.v1.ReloadAgentSessionRequest
+	(*ReloadAgentSessionResponse)(nil),      // 64: compass.v1.ReloadAgentSessionResponse
+	(*GetAgentStatusRequest)(nil),           // 65: compass.v1.GetAgentStatusRequest
+	(*GetAgentStatusResponse)(nil),          // 66: compass.v1.GetAgentStatusResponse
+	(*IssueTokenRequest)(nil),               // 67: compass.v1.IssueTokenRequest
+	(*IssueTokenResponse)(nil),              // 68: compass.v1.IssueTokenResponse
+	(*RevokeTokenRequest)(nil),              // 69: compass.v1.RevokeTokenRequest
+	(*RevokeTokenResponse)(nil),             // 70: compass.v1.RevokeTokenResponse
+	(*PutAgentConfigRequest)(nil),           // 71: compass.v1.PutAgentConfigRequest
+	(*PutAgentConfigResponse)(nil),          // 72: compass.v1.PutAgentConfigResponse
+	(*GetAgentConfigInfoRequest)(nil),       // 73: compass.v1.GetAgentConfigInfoRequest
+	(*GetAgentConfigInfoResponse)(nil),      // 74: compass.v1.GetAgentConfigInfoResponse
+	(*DeleteAgentConfigRequest)(nil),        // 75: compass.v1.DeleteAgentConfigRequest
+	(*DeleteAgentConfigResponse)(nil),       // 76: compass.v1.DeleteAgentConfigResponse
+	(*ModelCandidate)(nil),                  // 77: compass.v1.ModelCandidate
+	(*ModelMetadata)(nil),                   // 78: compass.v1.ModelMetadata
+	(*ModelRegistryEntry)(nil),              // 79: compass.v1.ModelRegistryEntry
+	(*ModelRegistry)(nil),                   // 80: compass.v1.ModelRegistry
+	(*PutModelRegistryRequest)(nil),         // 81: compass.v1.PutModelRegistryRequest
+	(*PutModelRegistryResponse)(nil),        // 82: compass.v1.PutModelRegistryResponse
+	(*GetModelRegistryRequest)(nil),         // 83: compass.v1.GetModelRegistryRequest
+	(*GetModelRegistryResponse)(nil),        // 84: compass.v1.GetModelRegistryResponse
+	(*DeleteModelRegistryRequest)(nil),      // 85: compass.v1.DeleteModelRegistryRequest
+	(*DeleteModelRegistryResponse)(nil),     // 86: compass.v1.DeleteModelRegistryResponse
+	(*AgentAttribution)(nil),                // 87: compass.v1.AgentAttribution
+	(*ForgeRef)(nil),                        // 88: compass.v1.ForgeRef
+	(*Issue)(nil),                           // 89: compass.v1.Issue
+	(*PullRequest)(nil),                     // 90: compass.v1.PullRequest
+	(*ChecksSummary)(nil),                   // 91: compass.v1.ChecksSummary
+	(*Check)(nil),                           // 92: compass.v1.Check
+	(*ChangedStats)(nil),                    // 93: compass.v1.ChangedStats
+	(*TrackerRef)(nil),                      // 94: compass.v1.TrackerRef
+	(*Review)(nil),                          // 95: compass.v1.Review
+	(*ReviewThread)(nil),                    // 96: compass.v1.ReviewThread
+	(*Comment)(nil),                         // 97: compass.v1.Comment
+	nil,                                     // 98: compass.v1.ModelRegistry.EntriesEntry
+	(*timestamppb.Timestamp)(nil),           // 99: google.protobuf.Timestamp
 }
 var file_compass_v1_compass_proto_depIdxs = []int32{
 	0,  // 0: compass.v1.SetSecretRequest.delivery:type_name -> compass.v1.SecretDelivery
 	1,  // 1: compass.v1.SetSecretRequest.kind:type_name -> compass.v1.SecretKind
-	14, // 2: compass.v1.ListSecretsResponse.secrets:type_name -> compass.v1.SecretStatus
+	16, // 2: compass.v1.ListSecretsResponse.secrets:type_name -> compass.v1.SecretStatus
 	0,  // 3: compass.v1.SecretStatus.delivery:type_name -> compass.v1.SecretDelivery
 	1,  // 4: compass.v1.SecretStatus.kind:type_name -> compass.v1.SecretKind
-	23, // 5: compass.v1.ListServerSecretsResponse.server_secrets:type_name -> compass.v1.ServerSecretStatus
-	32, // 6: compass.v1.SubscribeEventsResponse.server_status:type_name -> compass.v1.ServerStatus
-	33, // 7: compass.v1.SubscribeEventsResponse.resync_required:type_name -> compass.v1.ResyncRequired
-	34, // 8: compass.v1.SubscribeEventsResponse.agent_session_status:type_name -> compass.v1.AgentSessionStatus
-	35, // 9: compass.v1.SubscribeEventsResponse.agent_message_chunk:type_name -> compass.v1.AgentMessageChunk
-	36, // 10: compass.v1.SubscribeEventsResponse.agent_tool_call:type_name -> compass.v1.AgentToolCall
-	37, // 11: compass.v1.SubscribeEventsResponse.agent_plan:type_name -> compass.v1.AgentPlan
-	87, // 12: compass.v1.SubscribeEventsResponse.issue:type_name -> compass.v1.Issue
-	87, // 13: compass.v1.ListBoardIssuesResponse.issues:type_name -> compass.v1.Issue
+	25, // 5: compass.v1.ListServerSecretsResponse.server_secrets:type_name -> compass.v1.ServerSecretStatus
+	34, // 6: compass.v1.SubscribeEventsResponse.server_status:type_name -> compass.v1.ServerStatus
+	35, // 7: compass.v1.SubscribeEventsResponse.resync_required:type_name -> compass.v1.ResyncRequired
+	36, // 8: compass.v1.SubscribeEventsResponse.agent_session_status:type_name -> compass.v1.AgentSessionStatus
+	37, // 9: compass.v1.SubscribeEventsResponse.agent_message_chunk:type_name -> compass.v1.AgentMessageChunk
+	38, // 10: compass.v1.SubscribeEventsResponse.agent_tool_call:type_name -> compass.v1.AgentToolCall
+	39, // 11: compass.v1.SubscribeEventsResponse.agent_plan:type_name -> compass.v1.AgentPlan
+	89, // 12: compass.v1.SubscribeEventsResponse.issue:type_name -> compass.v1.Issue
+	89, // 13: compass.v1.ListBoardIssuesResponse.issues:type_name -> compass.v1.Issue
 	2,  // 14: compass.v1.ServerStatus.state:type_name -> compass.v1.ServerState
-	3,  // 15: compass.v1.AgentSessionStatus.state:type_name -> compass.v1.AgentSessionState
-	4,  // 16: compass.v1.AgentToolCall.status:type_name -> compass.v1.AgentToolCallStatus
-	38, // 17: compass.v1.AgentPlan.entries:type_name -> compass.v1.AgentPlanEntry
-	5,  // 18: compass.v1.AgentPlanEntry.status:type_name -> compass.v1.AgentPlanEntryStatus
-	40, // 19: compass.v1.SessionEvent.assistant_text:type_name -> compass.v1.SessionAssistantText
-	41, // 20: compass.v1.SessionEvent.thinking:type_name -> compass.v1.SessionThinking
-	42, // 21: compass.v1.SessionEvent.tool_call:type_name -> compass.v1.SessionToolCall
-	43, // 22: compass.v1.SessionEvent.tool_call_update:type_name -> compass.v1.SessionToolCallUpdate
-	45, // 23: compass.v1.SessionEvent.plan:type_name -> compass.v1.SessionPlan
-	46, // 24: compass.v1.SessionEvent.notice:type_name -> compass.v1.SessionNotice
-	47, // 25: compass.v1.SessionEvent.session_injection:type_name -> compass.v1.SessionInjection
-	48, // 26: compass.v1.SessionEvent.session_error:type_name -> compass.v1.SessionError
-	4,  // 27: compass.v1.SessionToolCall.status:type_name -> compass.v1.AgentToolCallStatus
-	4,  // 28: compass.v1.SessionToolCallUpdate.status:type_name -> compass.v1.AgentToolCallStatus
-	44, // 29: compass.v1.SessionToolCallUpdate.diffs:type_name -> compass.v1.SessionFileDiff
-	38, // 30: compass.v1.SessionPlan.entries:type_name -> compass.v1.AgentPlanEntry
-	6,  // 31: compass.v1.SessionInjection.op_kind:type_name -> compass.v1.SessionInjectionKind
-	7,  // 32: compass.v1.SessionError.kind:type_name -> compass.v1.SessionErrorKind
-	39, // 33: compass.v1.AgentSessionFrame.event:type_name -> compass.v1.SessionEvent
-	3,  // 34: compass.v1.AgentSessionFrame.state:type_name -> compass.v1.AgentSessionState
-	34, // 35: compass.v1.GetAgentStatusResponse.statuses:type_name -> compass.v1.AgentSessionStatus
-	75, // 36: compass.v1.ModelRegistryEntry.candidates:type_name -> compass.v1.ModelCandidate
-	76, // 37: compass.v1.ModelRegistryEntry.metadata:type_name -> compass.v1.ModelMetadata
-	96, // 38: compass.v1.ModelRegistry.entries:type_name -> compass.v1.ModelRegistry.EntriesEntry
-	78, // 39: compass.v1.PutModelRegistryRequest.registry:type_name -> compass.v1.ModelRegistry
-	78, // 40: compass.v1.GetModelRegistryResponse.registry:type_name -> compass.v1.ModelRegistry
-	9,  // 41: compass.v1.ForgeRef.provider:type_name -> compass.v1.ForgeProvider
-	86, // 42: compass.v1.Issue.forge:type_name -> compass.v1.ForgeRef
-	85, // 43: compass.v1.Issue.agent:type_name -> compass.v1.AgentAttribution
-	97, // 44: compass.v1.Issue.updated_at:type_name -> google.protobuf.Timestamp
-	8,  // 45: compass.v1.Issue.state:type_name -> compass.v1.IssueState
-	88, // 46: compass.v1.Issue.prs:type_name -> compass.v1.PullRequest
-	92, // 47: compass.v1.Issue.tracker:type_name -> compass.v1.TrackerRef
-	86, // 48: compass.v1.PullRequest.forge:type_name -> compass.v1.ForgeRef
-	85, // 49: compass.v1.PullRequest.agent:type_name -> compass.v1.AgentAttribution
-	91, // 50: compass.v1.PullRequest.changed:type_name -> compass.v1.ChangedStats
-	89, // 51: compass.v1.PullRequest.checks:type_name -> compass.v1.ChecksSummary
-	93, // 52: compass.v1.PullRequest.reviews:type_name -> compass.v1.Review
-	94, // 53: compass.v1.PullRequest.threads:type_name -> compass.v1.ReviewThread
-	90, // 54: compass.v1.ChecksSummary.checks:type_name -> compass.v1.Check
-	95, // 55: compass.v1.ReviewThread.comments:type_name -> compass.v1.Comment
-	77, // 56: compass.v1.ModelRegistry.EntriesEntry.value:type_name -> compass.v1.ModelRegistryEntry
-	24, // 57: compass.v1.CompassService.GetServerInfo:input_type -> compass.v1.GetServerInfoRequest
-	26, // 58: compass.v1.CompassService.WhoAmI:input_type -> compass.v1.WhoAmIRequest
-	28, // 59: compass.v1.CompassService.SubscribeEvents:input_type -> compass.v1.SubscribeEventsRequest
-	30, // 60: compass.v1.CompassService.ListBoardIssues:input_type -> compass.v1.ListBoardIssuesRequest
-	51, // 61: compass.v1.CompassService.ProvisionAgentWorkspace:input_type -> compass.v1.ProvisionAgentWorkspaceRequest
-	55, // 62: compass.v1.CompassService.StartAgentSession:input_type -> compass.v1.StartAgentSessionRequest
-	57, // 63: compass.v1.CompassService.SpawnAgent:input_type -> compass.v1.SpawnAgentRequest
-	59, // 64: compass.v1.CompassService.StopAgentSession:input_type -> compass.v1.StopAgentSessionRequest
-	53, // 65: compass.v1.CompassService.RemoveAgentWorkspace:input_type -> compass.v1.RemoveAgentWorkspaceRequest
-	61, // 66: compass.v1.CompassService.ReloadAgentSession:input_type -> compass.v1.ReloadAgentSessionRequest
-	63, // 67: compass.v1.CompassService.GetAgentStatus:input_type -> compass.v1.GetAgentStatusRequest
-	49, // 68: compass.v1.CompassService.SubscribeAgentSession:input_type -> compass.v1.SubscribeAgentSessionRequest
-	65, // 69: compass.v1.CompassService.IssueToken:input_type -> compass.v1.IssueTokenRequest
-	67, // 70: compass.v1.CompassService.RevokeToken:input_type -> compass.v1.RevokeTokenRequest
-	69, // 71: compass.v1.CompassService.PutAgentConfig:input_type -> compass.v1.PutAgentConfigRequest
-	71, // 72: compass.v1.CompassService.GetAgentConfigInfo:input_type -> compass.v1.GetAgentConfigInfoRequest
-	73, // 73: compass.v1.CompassService.DeleteAgentConfig:input_type -> compass.v1.DeleteAgentConfigRequest
-	79, // 74: compass.v1.CompassService.PutModelRegistry:input_type -> compass.v1.PutModelRegistryRequest
-	81, // 75: compass.v1.CompassService.GetModelRegistry:input_type -> compass.v1.GetModelRegistryRequest
-	83, // 76: compass.v1.CompassService.DeleteModelRegistry:input_type -> compass.v1.DeleteModelRegistryRequest
-	10, // 77: compass.v1.SecretsService.SetSecret:input_type -> compass.v1.SetSecretRequest
-	12, // 78: compass.v1.SecretsService.ListSecrets:input_type -> compass.v1.ListSecretsRequest
-	15, // 79: compass.v1.SecretsService.DeleteSecret:input_type -> compass.v1.DeleteSecretRequest
-	17, // 80: compass.v1.SecretsService.SetServerSecret:input_type -> compass.v1.SetServerSecretRequest
-	19, // 81: compass.v1.SecretsService.DeleteServerSecret:input_type -> compass.v1.DeleteServerSecretRequest
-	21, // 82: compass.v1.SecretsService.ListServerSecrets:input_type -> compass.v1.ListServerSecretsRequest
-	25, // 83: compass.v1.CompassService.GetServerInfo:output_type -> compass.v1.GetServerInfoResponse
-	27, // 84: compass.v1.CompassService.WhoAmI:output_type -> compass.v1.WhoAmIResponse
-	29, // 85: compass.v1.CompassService.SubscribeEvents:output_type -> compass.v1.SubscribeEventsResponse
-	31, // 86: compass.v1.CompassService.ListBoardIssues:output_type -> compass.v1.ListBoardIssuesResponse
-	52, // 87: compass.v1.CompassService.ProvisionAgentWorkspace:output_type -> compass.v1.ProvisionAgentWorkspaceResponse
-	56, // 88: compass.v1.CompassService.StartAgentSession:output_type -> compass.v1.StartAgentSessionResponse
-	58, // 89: compass.v1.CompassService.SpawnAgent:output_type -> compass.v1.SpawnAgentResponse
-	60, // 90: compass.v1.CompassService.StopAgentSession:output_type -> compass.v1.StopAgentSessionResponse
-	54, // 91: compass.v1.CompassService.RemoveAgentWorkspace:output_type -> compass.v1.RemoveAgentWorkspaceResponse
-	62, // 92: compass.v1.CompassService.ReloadAgentSession:output_type -> compass.v1.ReloadAgentSessionResponse
-	64, // 93: compass.v1.CompassService.GetAgentStatus:output_type -> compass.v1.GetAgentStatusResponse
-	50, // 94: compass.v1.CompassService.SubscribeAgentSession:output_type -> compass.v1.AgentSessionFrame
-	66, // 95: compass.v1.CompassService.IssueToken:output_type -> compass.v1.IssueTokenResponse
-	68, // 96: compass.v1.CompassService.RevokeToken:output_type -> compass.v1.RevokeTokenResponse
-	70, // 97: compass.v1.CompassService.PutAgentConfig:output_type -> compass.v1.PutAgentConfigResponse
-	72, // 98: compass.v1.CompassService.GetAgentConfigInfo:output_type -> compass.v1.GetAgentConfigInfoResponse
-	74, // 99: compass.v1.CompassService.DeleteAgentConfig:output_type -> compass.v1.DeleteAgentConfigResponse
-	80, // 100: compass.v1.CompassService.PutModelRegistry:output_type -> compass.v1.PutModelRegistryResponse
-	82, // 101: compass.v1.CompassService.GetModelRegistry:output_type -> compass.v1.GetModelRegistryResponse
-	84, // 102: compass.v1.CompassService.DeleteModelRegistry:output_type -> compass.v1.DeleteModelRegistryResponse
-	11, // 103: compass.v1.SecretsService.SetSecret:output_type -> compass.v1.SetSecretResponse
-	13, // 104: compass.v1.SecretsService.ListSecrets:output_type -> compass.v1.ListSecretsResponse
-	16, // 105: compass.v1.SecretsService.DeleteSecret:output_type -> compass.v1.DeleteSecretResponse
-	18, // 106: compass.v1.SecretsService.SetServerSecret:output_type -> compass.v1.SetServerSecretResponse
-	20, // 107: compass.v1.SecretsService.DeleteServerSecret:output_type -> compass.v1.DeleteServerSecretResponse
-	22, // 108: compass.v1.SecretsService.ListServerSecrets:output_type -> compass.v1.ListServerSecretsResponse
-	83, // [83:109] is the sub-list for method output_type
-	57, // [57:83] is the sub-list for method input_type
-	57, // [57:57] is the sub-list for extension type_name
-	57, // [57:57] is the sub-list for extension extendee
-	0,  // [0:57] is the sub-list for field type_name
+	5,  // 15: compass.v1.AgentSessionStatus.state:type_name -> compass.v1.AgentSessionState
+	3,  // 16: compass.v1.AgentSessionStatus.runtime_tier:type_name -> compass.v1.RuntimeTier
+	4,  // 17: compass.v1.AgentSessionStatus.egress_posture:type_name -> compass.v1.EgressPosture
+	6,  // 18: compass.v1.AgentToolCall.status:type_name -> compass.v1.AgentToolCallStatus
+	40, // 19: compass.v1.AgentPlan.entries:type_name -> compass.v1.AgentPlanEntry
+	7,  // 20: compass.v1.AgentPlanEntry.status:type_name -> compass.v1.AgentPlanEntryStatus
+	42, // 21: compass.v1.SessionEvent.assistant_text:type_name -> compass.v1.SessionAssistantText
+	43, // 22: compass.v1.SessionEvent.thinking:type_name -> compass.v1.SessionThinking
+	44, // 23: compass.v1.SessionEvent.tool_call:type_name -> compass.v1.SessionToolCall
+	45, // 24: compass.v1.SessionEvent.tool_call_update:type_name -> compass.v1.SessionToolCallUpdate
+	47, // 25: compass.v1.SessionEvent.plan:type_name -> compass.v1.SessionPlan
+	48, // 26: compass.v1.SessionEvent.notice:type_name -> compass.v1.SessionNotice
+	49, // 27: compass.v1.SessionEvent.session_injection:type_name -> compass.v1.SessionInjection
+	50, // 28: compass.v1.SessionEvent.session_error:type_name -> compass.v1.SessionError
+	6,  // 29: compass.v1.SessionToolCall.status:type_name -> compass.v1.AgentToolCallStatus
+	6,  // 30: compass.v1.SessionToolCallUpdate.status:type_name -> compass.v1.AgentToolCallStatus
+	46, // 31: compass.v1.SessionToolCallUpdate.diffs:type_name -> compass.v1.SessionFileDiff
+	40, // 32: compass.v1.SessionPlan.entries:type_name -> compass.v1.AgentPlanEntry
+	8,  // 33: compass.v1.SessionInjection.op_kind:type_name -> compass.v1.SessionInjectionKind
+	9,  // 34: compass.v1.SessionError.kind:type_name -> compass.v1.SessionErrorKind
+	41, // 35: compass.v1.AgentSessionFrame.event:type_name -> compass.v1.SessionEvent
+	5,  // 36: compass.v1.AgentSessionFrame.state:type_name -> compass.v1.AgentSessionState
+	36, // 37: compass.v1.GetAgentStatusResponse.statuses:type_name -> compass.v1.AgentSessionStatus
+	77, // 38: compass.v1.ModelRegistryEntry.candidates:type_name -> compass.v1.ModelCandidate
+	78, // 39: compass.v1.ModelRegistryEntry.metadata:type_name -> compass.v1.ModelMetadata
+	98, // 40: compass.v1.ModelRegistry.entries:type_name -> compass.v1.ModelRegistry.EntriesEntry
+	80, // 41: compass.v1.PutModelRegistryRequest.registry:type_name -> compass.v1.ModelRegistry
+	80, // 42: compass.v1.GetModelRegistryResponse.registry:type_name -> compass.v1.ModelRegistry
+	11, // 43: compass.v1.ForgeRef.provider:type_name -> compass.v1.ForgeProvider
+	88, // 44: compass.v1.Issue.forge:type_name -> compass.v1.ForgeRef
+	87, // 45: compass.v1.Issue.agent:type_name -> compass.v1.AgentAttribution
+	99, // 46: compass.v1.Issue.updated_at:type_name -> google.protobuf.Timestamp
+	10, // 47: compass.v1.Issue.state:type_name -> compass.v1.IssueState
+	90, // 48: compass.v1.Issue.prs:type_name -> compass.v1.PullRequest
+	94, // 49: compass.v1.Issue.tracker:type_name -> compass.v1.TrackerRef
+	88, // 50: compass.v1.PullRequest.forge:type_name -> compass.v1.ForgeRef
+	87, // 51: compass.v1.PullRequest.agent:type_name -> compass.v1.AgentAttribution
+	93, // 52: compass.v1.PullRequest.changed:type_name -> compass.v1.ChangedStats
+	91, // 53: compass.v1.PullRequest.checks:type_name -> compass.v1.ChecksSummary
+	95, // 54: compass.v1.PullRequest.reviews:type_name -> compass.v1.Review
+	96, // 55: compass.v1.PullRequest.threads:type_name -> compass.v1.ReviewThread
+	92, // 56: compass.v1.ChecksSummary.checks:type_name -> compass.v1.Check
+	97, // 57: compass.v1.ReviewThread.comments:type_name -> compass.v1.Comment
+	79, // 58: compass.v1.ModelRegistry.EntriesEntry.value:type_name -> compass.v1.ModelRegistryEntry
+	26, // 59: compass.v1.CompassService.GetServerInfo:input_type -> compass.v1.GetServerInfoRequest
+	28, // 60: compass.v1.CompassService.WhoAmI:input_type -> compass.v1.WhoAmIRequest
+	30, // 61: compass.v1.CompassService.SubscribeEvents:input_type -> compass.v1.SubscribeEventsRequest
+	32, // 62: compass.v1.CompassService.ListBoardIssues:input_type -> compass.v1.ListBoardIssuesRequest
+	53, // 63: compass.v1.CompassService.ProvisionAgentWorkspace:input_type -> compass.v1.ProvisionAgentWorkspaceRequest
+	57, // 64: compass.v1.CompassService.StartAgentSession:input_type -> compass.v1.StartAgentSessionRequest
+	59, // 65: compass.v1.CompassService.SpawnAgent:input_type -> compass.v1.SpawnAgentRequest
+	61, // 66: compass.v1.CompassService.StopAgentSession:input_type -> compass.v1.StopAgentSessionRequest
+	55, // 67: compass.v1.CompassService.RemoveAgentWorkspace:input_type -> compass.v1.RemoveAgentWorkspaceRequest
+	63, // 68: compass.v1.CompassService.ReloadAgentSession:input_type -> compass.v1.ReloadAgentSessionRequest
+	65, // 69: compass.v1.CompassService.GetAgentStatus:input_type -> compass.v1.GetAgentStatusRequest
+	51, // 70: compass.v1.CompassService.SubscribeAgentSession:input_type -> compass.v1.SubscribeAgentSessionRequest
+	67, // 71: compass.v1.CompassService.IssueToken:input_type -> compass.v1.IssueTokenRequest
+	69, // 72: compass.v1.CompassService.RevokeToken:input_type -> compass.v1.RevokeTokenRequest
+	71, // 73: compass.v1.CompassService.PutAgentConfig:input_type -> compass.v1.PutAgentConfigRequest
+	73, // 74: compass.v1.CompassService.GetAgentConfigInfo:input_type -> compass.v1.GetAgentConfigInfoRequest
+	75, // 75: compass.v1.CompassService.DeleteAgentConfig:input_type -> compass.v1.DeleteAgentConfigRequest
+	81, // 76: compass.v1.CompassService.PutModelRegistry:input_type -> compass.v1.PutModelRegistryRequest
+	83, // 77: compass.v1.CompassService.GetModelRegistry:input_type -> compass.v1.GetModelRegistryRequest
+	85, // 78: compass.v1.CompassService.DeleteModelRegistry:input_type -> compass.v1.DeleteModelRegistryRequest
+	12, // 79: compass.v1.SecretsService.SetSecret:input_type -> compass.v1.SetSecretRequest
+	14, // 80: compass.v1.SecretsService.ListSecrets:input_type -> compass.v1.ListSecretsRequest
+	17, // 81: compass.v1.SecretsService.DeleteSecret:input_type -> compass.v1.DeleteSecretRequest
+	19, // 82: compass.v1.SecretsService.SetServerSecret:input_type -> compass.v1.SetServerSecretRequest
+	21, // 83: compass.v1.SecretsService.DeleteServerSecret:input_type -> compass.v1.DeleteServerSecretRequest
+	23, // 84: compass.v1.SecretsService.ListServerSecrets:input_type -> compass.v1.ListServerSecretsRequest
+	27, // 85: compass.v1.CompassService.GetServerInfo:output_type -> compass.v1.GetServerInfoResponse
+	29, // 86: compass.v1.CompassService.WhoAmI:output_type -> compass.v1.WhoAmIResponse
+	31, // 87: compass.v1.CompassService.SubscribeEvents:output_type -> compass.v1.SubscribeEventsResponse
+	33, // 88: compass.v1.CompassService.ListBoardIssues:output_type -> compass.v1.ListBoardIssuesResponse
+	54, // 89: compass.v1.CompassService.ProvisionAgentWorkspace:output_type -> compass.v1.ProvisionAgentWorkspaceResponse
+	58, // 90: compass.v1.CompassService.StartAgentSession:output_type -> compass.v1.StartAgentSessionResponse
+	60, // 91: compass.v1.CompassService.SpawnAgent:output_type -> compass.v1.SpawnAgentResponse
+	62, // 92: compass.v1.CompassService.StopAgentSession:output_type -> compass.v1.StopAgentSessionResponse
+	56, // 93: compass.v1.CompassService.RemoveAgentWorkspace:output_type -> compass.v1.RemoveAgentWorkspaceResponse
+	64, // 94: compass.v1.CompassService.ReloadAgentSession:output_type -> compass.v1.ReloadAgentSessionResponse
+	66, // 95: compass.v1.CompassService.GetAgentStatus:output_type -> compass.v1.GetAgentStatusResponse
+	52, // 96: compass.v1.CompassService.SubscribeAgentSession:output_type -> compass.v1.AgentSessionFrame
+	68, // 97: compass.v1.CompassService.IssueToken:output_type -> compass.v1.IssueTokenResponse
+	70, // 98: compass.v1.CompassService.RevokeToken:output_type -> compass.v1.RevokeTokenResponse
+	72, // 99: compass.v1.CompassService.PutAgentConfig:output_type -> compass.v1.PutAgentConfigResponse
+	74, // 100: compass.v1.CompassService.GetAgentConfigInfo:output_type -> compass.v1.GetAgentConfigInfoResponse
+	76, // 101: compass.v1.CompassService.DeleteAgentConfig:output_type -> compass.v1.DeleteAgentConfigResponse
+	82, // 102: compass.v1.CompassService.PutModelRegistry:output_type -> compass.v1.PutModelRegistryResponse
+	84, // 103: compass.v1.CompassService.GetModelRegistry:output_type -> compass.v1.GetModelRegistryResponse
+	86, // 104: compass.v1.CompassService.DeleteModelRegistry:output_type -> compass.v1.DeleteModelRegistryResponse
+	13, // 105: compass.v1.SecretsService.SetSecret:output_type -> compass.v1.SetSecretResponse
+	15, // 106: compass.v1.SecretsService.ListSecrets:output_type -> compass.v1.ListSecretsResponse
+	18, // 107: compass.v1.SecretsService.DeleteSecret:output_type -> compass.v1.DeleteSecretResponse
+	20, // 108: compass.v1.SecretsService.SetServerSecret:output_type -> compass.v1.SetServerSecretResponse
+	22, // 109: compass.v1.SecretsService.DeleteServerSecret:output_type -> compass.v1.DeleteServerSecretResponse
+	24, // 110: compass.v1.SecretsService.ListServerSecrets:output_type -> compass.v1.ListServerSecretsResponse
+	85, // [85:111] is the sub-list for method output_type
+	59, // [59:85] is the sub-list for method input_type
+	59, // [59:59] is the sub-list for extension type_name
+	59, // [59:59] is the sub-list for extension extendee
+	0,  // [0:59] is the sub-list for field type_name
 }
 
 func init() { file_compass_v1_compass_proto_init() }
@@ -6488,7 +6637,7 @@ func file_compass_v1_compass_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_compass_v1_compass_proto_rawDesc), len(file_compass_v1_compass_proto_rawDesc)),
-			NumEnums:      10,
+			NumEnums:      12,
 			NumMessages:   87,
 			NumExtensions: 0,
 			NumServices:   2,
diff --git a/go/internal/runner/host.go b/go/internal/runner/host.go
index 42478df3..38ab054b 100644
--- a/go/internal/runner/host.go
+++ b/go/internal/runner/host.go
@@ -676,11 +676,11 @@ func (h *agentHost) Status(_ context.Context, sessionID string) ([]*compassv1.Ag
 		if !ok {
 			return nil, errSessionUnknown
 		}
-		return []*compassv1.AgentSessionStatus{{SessionId: s.sessionID, State: s.state, AgentAccountId: s.agentAccountID}}, nil
+		return []*compassv1.AgentSessionStatus{h.statusOf(s)}, nil
 	}
 	out := make([]*compassv1.AgentSessionStatus, 0, len(h.sessions))
 	for _, s := range h.sessions {
-		out = append(out, &compassv1.AgentSessionStatus{SessionId: s.sessionID, State: s.state, AgentAccountId: s.agentAccountID})
+		out = append(out, h.statusOf(s))
 	}
 	return out, nil
 }
@@ -837,6 +837,20 @@ func (h *agentHost) RefreshConfig(ctx context.Context) error {
 	return nil
 }
 
+// statusOf stamps a live session with the tier and egress posture of the
+// backend this Runner resolved. Both are Runner-wide, not per-session: the
+// Runner reports them because it is the component that picked the backend, so a
+// client never has to infer containment from a tier name.
+func (h *agentHost) statusOf(s *liveSession) *compassv1.AgentSessionStatus {
+	return &compassv1.AgentSessionStatus{
+		SessionId:      s.sessionID,
+		State:          s.state,
+		AgentAccountId: s.agentAccountID,
+		RuntimeTier:    runtimeTierProto(runtime.TierOf(h.engine)),
+		EgressPosture:  egressPostureProto(h.runtime.EgressPosture()),
+	}
+}
+
 // provisionVsockGateway is Provision's microVM leg: it launches the container
 // with NO agent-socket mount and NO config mount (record §(c)/§(f)), resolves
 // the per-session host-side gateway path the backend serves the AgentGateway on,
diff --git a/go/internal/runner/host_test.go b/go/internal/runner/host_test.go
index 97b7d10c..a98b7267 100644
--- a/go/internal/runner/host_test.go
+++ b/go/internal/runner/host_test.go
@@ -787,6 +787,68 @@ func TestCloseJoinsConcurrentTeardowns(t *testing.T) {
 // started session appears with its live state, and a stopped one is gone. The
 // Runner is authoritative for live truth. A bug that answered from a stale or
 // external source would not reflect the live set.
+// hostTierStubRuntime is the streaming stub that also answers the tier and
+// unenforced-egress capabilities, standing in for the host backend so the
+// Status stamp is exercisable without spawning host children.
+type hostTierStubRuntime struct {
+	*stubStreamingRuntime
+}
+
+func (hostTierStubRuntime) Tier() runtime.WorkloadTier { return runtime.WorkloadTierHost }
+func (hostTierStubRuntime) EgressUnenforced() bool     { return true }
+
+// TestStatusStampsTheTierAndEgressPosture: the Runner reports both, because it
+// is the component that resolved the backend. BOTH arms must stamp them — the
+// targeted one and the all-sessions one — mirroring the account stamp below; a
+// client reading the all-arm would otherwise render an uncontained host session
+// as unspecified.
+func TestStatusStampsTheTierAndEgressPosture(t *testing.T) {
+	// The host tier refuses a configured policy, which is the point of the
+	// posture — so its spec carries none, as the Runner's own resolution does.
+	hostSpec := liveSpec()
+	hostSpec.Egress = runtime.EgressPolicy{}
+	specs := &fakeSpecBuilder{spec: hostSpec}
+	engine := hostTierStubRuntime{stubStreamingRuntime: newStubStreamingRuntime(t)}
+	registry := runtime.NewAgentRegistry()
+	rt := runtime.NewAgentRuntimeWithRegistry(engine, registry)
+	link := newLink(newRunnerServiceServer(t, newCapturePublish()))
+	var n int
+	host := NewSessionHost(link, rt, registry, engine, specs,
+		AgentHostConfig{RuntimeDir: t.TempDir()}, discardLoggerRunner(),
+		func() string { n++; return "sess-" + string(rune('0'+n)) })
+	ctx := context.Background()
+
+	if _, err := host.Provision(ctx, &compassv1.ProvisionAgentWorkspaceRequest{AgentHandle: "0123456789abcdef0123456789abcdef"}); err != nil {
+		t.Fatalf("Provision = %v", err)
+	}
+	sessionID, err := host.Start(ctx, &compassv1.StartAgentSessionRequest{ContainerName: "cont-1"}, "")
+	if err != nil {
+		t.Fatalf("Start = %v", err)
+	}
+
+	one, err := host.Status(ctx, sessionID)
+	if err != nil || len(one) != 1 {
+		t.Fatalf("Status(one) = %+v, %v", one, err)
+	}
+	if got := one[0].GetRuntimeTier(); got != compassv1.RuntimeTier_RUNTIME_TIER_HOST {
+		t.Errorf("Status(one) tier = %v, want RUNTIME_TIER_HOST", got)
+	}
+	if got := one[0].GetEgressPosture(); got != compassv1.EgressPosture_EGRESS_POSTURE_UNENFORCED {
+		t.Errorf("Status(one) posture = %v, want EGRESS_POSTURE_UNENFORCED", got)
+	}
+
+	all, err := host.Status(ctx, "")
+	if err != nil || len(all) != 1 {
+		t.Fatalf("Status(all) = %+v, %v", all, err)
+	}
+	if got := all[0].GetRuntimeTier(); got != compassv1.RuntimeTier_RUNTIME_TIER_HOST {
+		t.Errorf("Status(all) tier = %v, want RUNTIME_TIER_HOST (the all-arm must stamp it too)", got)
+	}
+	if got := all[0].GetEgressPosture(); got != compassv1.EgressPosture_EGRESS_POSTURE_UNENFORCED {
+		t.Errorf("Status(all) posture = %v, want EGRESS_POSTURE_UNENFORCED (the all-arm must stamp it too)", got)
+	}
+}
+
 func TestStatusIsAnsweredFromLiveSet(t *testing.T) {
 	specs := &fakeSpecBuilder{spec: liveSpec()}
 	host, _, _ := newHostFixture(t, specs)
diff --git a/go/internal/runner/tier_proto.go b/go/internal/runner/tier_proto.go
new file mode 100644
index 00000000..6d7e4133
--- /dev/null
+++ b/go/internal/runner/tier_proto.go
@@ -0,0 +1,36 @@
+// Wire mapping for the runtime tier and egress posture a session reports.
+// Both map an unknown value onto UNSPECIFIED rather than a plausible default: a
+// security surface that guesses is worse than one that says it does not know.
+
+package runner
+
+import (
+	compassv1 "github.com/RigelBuild/compass/go/gen/compass/v1"
+	"github.com/RigelBuild/compass/go/internal/runtime"
+)
+
+func runtimeTierProto(tier runtime.WorkloadTier) compassv1.RuntimeTier {
+	switch tier {
+	case runtime.WorkloadTierPodman:
+		return compassv1.RuntimeTier_RUNTIME_TIER_PODMAN
+	case runtime.WorkloadTierMicroVM:
+		return compassv1.RuntimeTier_RUNTIME_TIER_MICROVM
+	case runtime.WorkloadTierAppleContainer:
+		return compassv1.RuntimeTier_RUNTIME_TIER_APPLE_CONTAINER
+	case runtime.WorkloadTierHost:
+		return compassv1.RuntimeTier_RUNTIME_TIER_HOST
+	default:
+		return compassv1.RuntimeTier_RUNTIME_TIER_UNSPECIFIED
+	}
+}
+
+func egressPostureProto(posture runtime.EgressPosture) compassv1.EgressPosture {
+	switch posture {
+	case runtime.EgressPostureArmed:
+		return compassv1.EgressPosture_EGRESS_POSTURE_ARMED
+	case runtime.EgressPostureUnenforced:
+		return compassv1.EgressPosture_EGRESS_POSTURE_UNENFORCED
+	default:
+		return compassv1.EgressPosture_EGRESS_POSTURE_UNSPECIFIED
+	}
+}
diff --git a/go/internal/runtime/tier.go b/go/internal/runtime/tier.go
new file mode 100644
index 00000000..37c36701
--- /dev/null
+++ b/go/internal/runtime/tier.go
@@ -0,0 +1,49 @@
+// Tier identity: what kind of isolation boundary a backend puts an agent
+// behind. Reported outward per session so an operator can see which boundary
+// their agent actually got, rather than inferring it from a green launch.
+
+package runtime
+
+// WorkloadTier names the isolation boundary a backend provides.
+type WorkloadTier string
+
+const (
+	// WorkloadTierPodman is a rootless container with its own network namespace.
+	WorkloadTierPodman WorkloadTier = "podman"
+	// WorkloadTierMicroVM is a hardware-virtualized guest.
+	WorkloadTierMicroVM WorkloadTier = "microvm"
+	// WorkloadTierAppleContainer is Apple's container runtime on macOS.
+	WorkloadTierAppleContainer WorkloadTier = "apple-container"
+	// WorkloadTierHost is a direct child process of the Runner — no boundary.
+	WorkloadTierHost WorkloadTier = "host"
+)
+
+// workloadTierNamer is a backend that names its own tier. Like the egress
+// markers, it is deliberately NOT a verb on the frozen WorkloadRuntime
+// interface (podman.go): callers probe for it. A WorkloadRuntime decorator must
+// re-expose Tier, or the session surface loses the tier it reports.
+type workloadTierNamer interface {
+	Tier() WorkloadTier
+}
+
+// TierOf names the tier a backend provides. An unrecognized backend reports the
+// empty tier rather than guessing: a wrong tier on a security surface is worse
+// than an absent one, and the wire's unspecified value renders as unknown.
+func TierOf(engine WorkloadRuntime) WorkloadTier {
+	if namer, ok := engine.(workloadTierNamer); ok {
+		return namer.Tier()
+	}
+	return ""
+}
+
+// Tier reports the podman tier.
+func (p *PodmanCLI) Tier() WorkloadTier { return WorkloadTierPodman }
+
+// Tier reports the microVM tier.
+func (m *MicroVMRuntime) Tier() WorkloadTier { return WorkloadTierMicroVM }
+
+// Tier reports the Apple-container tier.
+func (a *AppleContainerCLI) Tier() WorkloadTier { return WorkloadTierAppleContainer }
+
+// Tier reports the host tier.
+func (h *HostRuntime) Tier() WorkloadTier { return WorkloadTierHost }
diff --git a/go/internal/runtime/tier_test.go b/go/internal/runtime/tier_test.go
new file mode 100644
index 00000000..1d0b789a
--- /dev/null
+++ b/go/internal/runtime/tier_test.go
@@ -0,0 +1,56 @@
+package runtime
+
+import "testing"
+
+// TestEveryBackendNamesItsOwnTier: the tier is reported on a security surface,
+// so each production backend must name itself rather than fall through to the
+// empty tier. A backend added without a Tier method would fail here.
+func TestEveryBackendNamesItsOwnTier(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		engine WorkloadRuntime
+		want   WorkloadTier
+	}{
+		{"podman", NewPodmanCLI(), WorkloadTierPodman},
+		{"microvm", NewMicroVMRuntime(MicroVMConfig{}), WorkloadTierMicroVM},
+		{"apple-container", NewAppleContainerCLI(AppleContainerConfig{}), WorkloadTierAppleContainer},
+		{"host", NewHostRuntime(t.TempDir()), WorkloadTierHost},
+	} {
+		if got := TierOf(tc.engine); got != tc.want {
+			t.Errorf("TierOf(%s) = %q, want %q", tc.name, got, tc.want)
+		}
+	}
+}
+
+// TestTierOfReportsUnknownRatherThanGuessing: a backend that does not name its
+// tier reports the empty tier, which the wire renders as unspecified. Defaulting
+// to a plausible tier would mislabel a session on a surface an operator trusts.
+func TestTierOfReportsUnknownRatherThanGuessing(t *testing.T) {
+	if got := TierOf(newFakeRuntime(t)); got != "" {
+		t.Errorf("TierOf(a backend with no Tier method) = %q, want the empty tier", got)
+	}
+}
+
+// TestSelectBackendTierMatchesTheRequestedBackend closes the loop the two tests
+// above leave open: each is correct in isolation, but a mis-wired SelectBackend
+// arm would hand back a healthy backend of the WRONG tier and both would still
+// pass. The empty string is podman's documented default.
+func TestSelectBackendTierMatchesTheRequestedBackend(t *testing.T) {
+	for _, tc := range []struct {
+		backend string
+		want    WorkloadTier
+	}{
+		{"", WorkloadTierPodman},
+		{"podman", WorkloadTierPodman},
+		{"microvm", WorkloadTierMicroVM},
+		{"host", WorkloadTierHost},
+	} {
+		engine, err := SelectBackend(BackendConfig{Backend: tc.backend})
+		if err != nil {
+			t.Fatalf("SelectBackend(%q) error = %v", tc.backend, err)
+		}
+		if got := TierOf(engine); got != tc.want {
+			t.Errorf("SelectBackend(%q) resolved a backend of tier %q, want %q", tc.backend, got, tc.want)
+		}
+	}
+}
diff --git a/packages/compass-agent/src/gen/compass/v1/compass_pb.ts b/packages/compass-agent/src/gen/compass/v1/compass_pb.ts
index c62d151b..cc0b54ac 100644
--- a/packages/compass-agent/src/gen/compass/v1/compass_pb.ts
+++ b/packages/compass-agent/src/gen/compass/v1/compass_pb.ts
@@ -20,7 +20,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file compass/v1/compass.proto.
  */
 export const file_compass_v1_compass: GenFile = /*@__PURE__*/
-  fileDesc("Chhjb21wYXNzL3YxL2NvbXBhc3MucHJvdG8SCmNvbXBhc3MudjEiqAEKEFNldFNlY3JldFJlcXVlc3QSDAoEbmFtZRgBIAEoCRISCgV2YWx1ZRgCIAEoCUIDgAEBEiwKCGRlbGl2ZXJ5GAMgASgOMhouY29tcGFzcy52MS5TZWNyZXREZWxpdmVyeRIkCgRraW5kGAQgASgOMhYuY29tcGFzcy52MS5TZWNyZXRLaW5kEhAKCHByb3ZpZGVyGAUgASgJEgwKBGhvc3QYBiABKAkiEwoRU2V0U2VjcmV0UmVzcG9uc2UiFAoSTGlzdFNlY3JldHNSZXF1ZXN0IkAKE0xpc3RTZWNyZXRzUmVzcG9uc2USKQoHc2VjcmV0cxgBIAMoCzIYLmNvbXBhc3MudjEuU2VjcmV0U3RhdHVzIqABCgxTZWNyZXRTdGF0dXMSDAoEbmFtZRgBIAEoCRIOCgZpc19zZXQYAiABKAgSLAoIZGVsaXZlcnkYAyABKA4yGi5jb21wYXNzLnYxLlNlY3JldERlbGl2ZXJ5EiQKBGtpbmQYBCABKA4yFi5jb21wYXNzLnYxLlNlY3JldEtpbmQSEAoIcHJvdmlkZXIYBSABKAkSDAoEaG9zdBgGIAEoCSIjChNEZWxldGVTZWNyZXRSZXF1ZXN0EgwKBG5hbWUYASABKAkiFgoURGVsZXRlU2VjcmV0UmVzcG9uc2UiOgoWU2V0U2VydmVyU2VjcmV0UmVxdWVzdBIMCgRuYW1lGAEgASgJEhIKBXZhbHVlGAIgASgJQgOAAQEiGQoXU2V0U2VydmVyU2VjcmV0UmVzcG9uc2UiKQoZRGVsZXRlU2VydmVyU2VjcmV0UmVxdWVzdBIMCgRuYW1lGAEgASgJIhwKGkRlbGV0ZVNlcnZlclNlY3JldFJlc3BvbnNlIhoKGExpc3RTZXJ2ZXJTZWNyZXRzUmVxdWVzdCJTChlMaXN0U2VydmVyU2VjcmV0c1Jlc3BvbnNlEjYKDnNlcnZlcl9zZWNyZXRzGAEgAygLMh4uY29tcGFzcy52MS5TZXJ2ZXJTZWNyZXRTdGF0dXMiMgoSU2VydmVyU2VjcmV0U3RhdHVzEgwKBG5hbWUYASABKAkSDgoGaXNfc2V0GAIgASgIIhYKFEdldFNlcnZlckluZm9SZXF1ZXN0Ij0KFUdldFNlcnZlckluZm9SZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgJEhMKC2FwaV92ZXJzaW9uGAIgASgJIg8KDVdob0FtSVJlcXVlc3QiJAoOV2hvQW1JUmVzcG9uc2USEgoKYWNjb3VudF9pZBgBIAEoCSJDChZTdWJzY3JpYmVFdmVudHNSZXF1ZXN0EhEKCXNpbmNlX3NlcRgBIAEoBBIWCg5pbnN0YW5jZV9lcG9jaBgCIAEoBCLiAwoXU3Vic2NyaWJlRXZlbnRzUmVzcG9uc2USCwoDc2VxGAEgASgEEhIKCmF0X3VuaXhfbXMYAiABKAMSFgoOaW5zdGFuY2VfZXBvY2gYAyABKAQSFAoMc25hcHNob3Rfc2VxGAQgASgEEjEKDXNlcnZlcl9zdGF0dXMYCiABKAsyGC5jb21wYXNzLnYxLlNlcnZlclN0YXR1c0gAEjUKD3Jlc3luY19yZXF1aXJlZBgLIAEoCzIaLmNvbXBhc3MudjEuUmVzeW5jUmVxdWlyZWRIABI+ChRhZ2VudF9zZXNzaW9uX3N0YXR1cxgMIAEoCzIeLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uU3RhdHVzSAASPAoTYWdlbnRfbWVzc2FnZV9jaHVuaxgNIAEoCzIdLmNvbXBhc3MudjEuQWdlbnRNZXNzYWdlQ2h1bmtIABI0Cg9hZ2VudF90b29sX2NhbGwYDiABKAsyGS5jb21wYXNzLnYxLkFnZW50VG9vbENhbGxIABIrCgphZ2VudF9wbGFuGA8gASgLMhUuY29tcGFzcy52MS5BZ2VudFBsYW5IABIiCgVpc3N1ZRgQIAEoCzIRLmNvbXBhc3MudjEuSXNzdWVIAEIJCgdwYXlsb2FkIi4KFkxpc3RCb2FyZElzc3Vlc1JlcXVlc3QSFAoMc25hcHNob3Rfc2VxGAEgASgEIjwKF0xpc3RCb2FyZElzc3Vlc1Jlc3BvbnNlEiEKBmlzc3VlcxgBIAMoCzIRLmNvbXBhc3MudjEuSXNzdWUiNgoMU2VydmVyU3RhdHVzEiYKBXN0YXRlGAEgASgOMhcuY29tcGFzcy52MS5TZXJ2ZXJTdGF0ZSIQCg5SZXN5bmNSZXF1aXJlZCJwChJBZ2VudFNlc3Npb25TdGF0dXMSEgoKc2Vzc2lvbl9pZBgBIAEoCRIsCgVzdGF0ZRgCIAEoDjIdLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uU3RhdGUSGAoQYWdlbnRfYWNjb3VudF9pZBgDIAEoCSJJChFBZ2VudE1lc3NhZ2VDaHVuaxISCgpzZXNzaW9uX2lkGAEgASgJEgwKBHRleHQYAiABKAkSEgoKaXNfdGhvdWdodBgDIAEoCCJ5Cg1BZ2VudFRvb2xDYWxsEhIKCnNlc3Npb25faWQYASABKAkSFAoMdG9vbF9jYWxsX2lkGAIgASgJEg0KBXRpdGxlGAMgASgJEi8KBnN0YXR1cxgEIAEoDjIfLmNvbXBhc3MudjEuQWdlbnRUb29sQ2FsbFN0YXR1cyJMCglBZ2VudFBsYW4SEgoKc2Vzc2lvbl9pZBgBIAEoCRIrCgdlbnRyaWVzGAIgAygLMhouY29tcGFzcy52MS5BZ2VudFBsYW5FbnRyeSJTCg5BZ2VudFBsYW5FbnRyeRIPCgdjb250ZW50GAEgASgJEjAKBnN0YXR1cxgCIAEoDjIgLmNvbXBhc3MudjEuQWdlbnRQbGFuRW50cnlTdGF0dXMi3wMKDFNlc3Npb25FdmVudBIQCghldmVudF9pZBgBIAEoCRISCgphdF91bml4X21zGAIgASgDEjoKDmFzc2lzdGFudF90ZXh0GAMgASgLMiAuY29tcGFzcy52MS5TZXNzaW9uQXNzaXN0YW50VGV4dEgAEi8KCHRoaW5raW5nGAQgASgLMhsuY29tcGFzcy52MS5TZXNzaW9uVGhpbmtpbmdIABIwCgl0b29sX2NhbGwYBSABKAsyGy5jb21wYXNzLnYxLlNlc3Npb25Ub29sQ2FsbEgAEj0KEHRvb2xfY2FsbF91cGRhdGUYBiABKAsyIS5jb21wYXNzLnYxLlNlc3Npb25Ub29sQ2FsbFVwZGF0ZUgAEicKBHBsYW4YByABKAsyFy5jb21wYXNzLnYxLlNlc3Npb25QbGFuSAASKwoGbm90aWNlGAggASgLMhkuY29tcGFzcy52MS5TZXNzaW9uTm90aWNlSAASOQoRc2Vzc2lvbl9pbmplY3Rpb24YCSABKAsyHC5jb21wYXNzLnYxLlNlc3Npb25JbmplY3Rpb25IABIxCg1zZXNzaW9uX2Vycm9yGAogASgLMhguY29tcGFzcy52MS5TZXNzaW9uRXJyb3JIAEIHCgVldmVudCI4ChRTZXNzaW9uQXNzaXN0YW50VGV4dBIMCgR0ZXh0GAEgASgJEhIKCm1lc3NhZ2VfaWQYAiABKAkiMwoPU2Vzc2lvblRoaW5raW5nEgwKBHRleHQYASABKAkSEgoKbWVzc2FnZV9pZBgCIAEoCSJnCg9TZXNzaW9uVG9vbENhbGwSFAoMdG9vbF9jYWxsX2lkGAEgASgJEg0KBXRpdGxlGAIgASgJEi8KBnN0YXR1cxgDIAEoDjIfLmNvbXBhc3MudjEuQWdlbnRUb29sQ2FsbFN0YXR1cyKaAQoVU2Vzc2lvblRvb2xDYWxsVXBkYXRlEhQKDHRvb2xfY2FsbF9pZBgBIAEoCRIvCgZzdGF0dXMYAiABKA4yHy5jb21wYXNzLnYxLkFnZW50VG9vbENhbGxTdGF0dXMSDgoGb3V0cHV0GAMgASgJEioKBWRpZmZzGAQgAygLMhsuY29tcGFzcy52MS5TZXNzaW9uRmlsZURpZmYiVQoPU2Vzc2lvbkZpbGVEaWZmEgwKBHBhdGgYASABKAkSFQoIb2xkX3RleHQYAiABKAlIAIgBARIQCghuZXdfdGV4dBgDIAEoCUILCglfb2xkX3RleHQiOgoLU2Vzc2lvblBsYW4SKwoHZW50cmllcxgBIAMoCzIaLmNvbXBhc3MudjEuQWdlbnRQbGFuRW50cnkiOQoNU2Vzc2lvbk5vdGljZRIMCgR0ZXh0GAEgASgJEhEKBGxpbmsYAiABKAlIAIgBAUIHCgVfbGluayKDAQoQU2Vzc2lvbkluamVjdGlvbhIxCgdvcF9raW5kGAEgASgOMiAuY29tcGFzcy52MS5TZXNzaW9uSW5qZWN0aW9uS2luZBISCgptZXNzYWdlX2lkGAIgASgJEhMKC2Zyb21faGFuZGxlGAMgASgJEhMKC3RyYWNlcGFyZW50GAQgASgJImsKDFNlc3Npb25FcnJvchIqCgRraW5kGAEgASgOMhwuY29tcGFzcy52MS5TZXNzaW9uRXJyb3JLaW5kEg8KB21lc3NhZ2UYAiABKAkSEwoGc3RhdHVzGAMgASgFSACIAQFCCQoHX3N0YXR1cyIyChxTdWJzY3JpYmVBZ2VudFNlc3Npb25SZXF1ZXN0EhIKCnNlc3Npb25faWQYASABKAkifgoRQWdlbnRTZXNzaW9uRnJhbWUSEgoKc2Vzc2lvbl9pZBgBIAEoCRInCgVldmVudBgCIAEoCzIYLmNvbXBhc3MudjEuU2Vzc2lvbkV2ZW50EiwKBXN0YXRlGAMgASgOMh0uY29tcGFzcy52MS5BZ2VudFNlc3Npb25TdGF0ZSJwCh5Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlcXVlc3QSFAoMYWdlbnRfaGFuZGxlGAEgASgJEhkKEWNsaWVudF9yZXF1ZXN0X2lkGAIgASgJEg8KB3BlcnNvbmEYAyABKAkSDAoEcm9sZRgEIAEoCSI5Ch9Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlc3BvbnNlEhYKDmNvbnRhaW5lcl9uYW1lGAEgASgJIlAKG1JlbW92ZUFnZW50V29ya3NwYWNlUmVxdWVzdBIWCg5jb250YWluZXJfbmFtZRgBIAEoCRIZChFjbGllbnRfcmVxdWVzdF9pZBgCIAEoCSIeChxSZW1vdmVBZ2VudFdvcmtzcGFjZVJlc3BvbnNlImMKGFN0YXJ0QWdlbnRTZXNzaW9uUmVxdWVzdBIWCg5jb250YWluZXJfbmFtZRgBIAEoCRIZChFyZXN1bWVfc2Vzc2lvbl9pZBgDIAEoCUoECAIQA1IOaW5pdGlhbF9wcm9tcHQiLwoZU3RhcnRBZ2VudFNlc3Npb25SZXNwb25zZRISCgpzZXNzaW9uX2lkGAEgASgJIloKEVNwYXduQWdlbnRSZXF1ZXN0EhQKDGFnZW50X2hhbmRsZRgBIAEoCRIZChFjbGllbnRfcmVxdWVzdF9pZBgDIAEoCUoECAIQA1IOaW5pdGlhbF9wcm9tcHQiQAoSU3Bhd25BZ2VudFJlc3BvbnNlEhIKCnNlc3Npb25faWQYASABKAkSFgoOY29udGFpbmVyX25hbWUYAiABKAkiLQoXU3RvcEFnZW50U2Vzc2lvblJlcXVlc3QSEgoKc2Vzc2lvbl9pZBgBIAEoCSIaChhTdG9wQWdlbnRTZXNzaW9uUmVzcG9uc2UiLwoZUmVsb2FkQWdlbnRTZXNzaW9uUmVxdWVzdBISCgpzZXNzaW9uX2lkGAEgASgJIjAKGlJlbG9hZEFnZW50U2Vzc2lvblJlc3BvbnNlEhIKCnNlc3Npb25faWQYASABKAkiKwoVR2V0QWdlbnRTdGF0dXNSZXF1ZXN0EhIKCnNlc3Npb25faWQYASABKAkiSgoWR2V0QWdlbnRTdGF0dXNSZXNwb25zZRIwCghzdGF0dXNlcxgBIAMoCzIeLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uU3RhdHVzIisKEUlzc3VlVG9rZW5SZXF1ZXN0EhYKDmFjY291bnRfaGFuZGxlGAEgASgJIiMKEklzc3VlVG9rZW5SZXNwb25zZRINCgV0b2tlbhgBIAEoCSIoChJSZXZva2VUb2tlblJlcXVlc3QSEgoFdG9rZW4YASABKAlCA4ABASIVChNSZXZva2VUb2tlblJlc3BvbnNlIicKFVB1dEFnZW50Q29uZmlnUmVxdWVzdBIOCgZidW5kbGUYASABKAwiKQoWUHV0QWdlbnRDb25maWdSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgJIhsKGUdldEFnZW50Q29uZmlnSW5mb1JlcXVlc3Qi2gEKGkdldEFnZW50Q29uZmlnSW5mb1Jlc3BvbnNlEg8KB3ZlcnNpb24YASABKAkSDgoGc2tpbGxzGAIgAygJEhIKCmV4dGVuc2lvbnMYAyADKAkSEwoLbWNwX3NlcnZlcnMYBCADKAkSFAoMaGFzX3NldHRpbmdzGAUgASgIEhUKDWhhc19hZ2VudHNfbWQYBiABKAgSDQoFcnVsZXMYByADKAkSEQoJc3ViYWdlbnRzGAggAygJEhIKCmhhc19tb2RlbHMYCSABKAgSDwoHcHJvbXB0cxgKIAMoCSIaChhEZWxldGVBZ2VudENvbmZpZ1JlcXVlc3QiGwoZRGVsZXRlQWdlbnRDb25maWdSZXNwb25zZSI0Cg5Nb2RlbENhbmRpZGF0ZRIQCghwcm92aWRlchgBIAEoCRIQCghtb2RlbF9pZBgCIAEoCSJxCg1Nb2RlbE1ldGFkYXRhEhYKDmNvbnRleHRfd2luZG93GAEgASgDEhwKFGlucHV0X2Nvc3RfbWljcm9fdXNkGAIgASgDEh0KFW91dHB1dF9jb3N0X21pY3JvX3VzZBgDIAEoAxILCgNhcGkYBCABKAkihwEKEk1vZGVsUmVnaXN0cnlFbnRyeRIUCgxkaXNwbGF5X25hbWUYASABKAkSLgoKY2FuZGlkYXRlcxgCIAMoCzIaLmNvbXBhc3MudjEuTW9kZWxDYW5kaWRhdGUSKwoIbWV0YWRhdGEYAyABKAsyGS5jb21wYXNzLnYxLk1vZGVsTWV0YWRhdGEimAEKDU1vZGVsUmVnaXN0cnkSNwoHZW50cmllcxgBIAMoCzImLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeS5FbnRyaWVzRW50cnkaTgoMRW50cmllc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoCzIeLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeUVudHJ5OgI4ASJgChdQdXRNb2RlbFJlZ2lzdHJ5UmVxdWVzdBIrCghyZWdpc3RyeRgBIAEoCzIZLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeRIYChBleHBlY3RlZF92ZXJzaW9uGAIgASgDIisKGFB1dE1vZGVsUmVnaXN0cnlSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgDIhkKF0dldE1vZGVsUmVnaXN0cnlSZXF1ZXN0IlgKGEdldE1vZGVsUmVnaXN0cnlSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgDEisKCHJlZ2lzdHJ5GAIgASgLMhkuY29tcGFzcy52MS5Nb2RlbFJlZ2lzdHJ5IhwKGkRlbGV0ZU1vZGVsUmVnaXN0cnlSZXF1ZXN0Ih0KG0RlbGV0ZU1vZGVsUmVnaXN0cnlSZXNwb25zZSI+ChBBZ2VudEF0dHJpYnV0aW9uEhQKDGFnZW50X2hhbmRsZRgBIAEoCRIUCgxvd25lcl9oYW5kbGUYAiABKAkiRQoIRm9yZ2VSZWYSKwoIcHJvdmlkZXIYASABKA4yGS5jb21wYXNzLnYxLkZvcmdlUHJvdmlkZXISDAoEaG9zdBgCIAEoCSLUAwoFSXNzdWUSCgoCaWQYASABKAkSIwoFZm9yZ2UYAiABKAsyFC5jb21wYXNzLnYxLkZvcmdlUmVmEgwKBHJlcG8YAyABKAkSDgoGbnVtYmVyGAQgASgNEg0KBXRpdGxlGAUgASgJEgwKBGJvZHkYBiABKAkSEwoLZm9yZ2Vfc3RhdGUYByABKAkSCwoDdXJsGAggASgJEisKBWFnZW50GAkgASgLMhwuY29tcGFzcy52MS5BZ2VudEF0dHJpYnV0aW9uEhUKDWZvcmdlX2FjY291bnQYCiABKAkSDgoGbGFiZWxzGAsgAygJEi4KCnVwZGF0ZWRfYXQYEyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEiUKBXN0YXRlGAwgASgOMhYuY29tcGFzcy52MS5Jc3N1ZVN0YXRlEhAKCHByaW9yaXR5GA0gASgJEhAKCGFzc2lnbmVlGA4gASgJEg8KB3N1bW1hcnkYDyABKAkSDgoGYnJhbmNoGBAgASgJEiQKA3BycxgRIAMoCzIXLmNvbXBhc3MudjEuUHVsbFJlcXVlc3QSJwoHdHJhY2tlchgSIAEoCzIWLmNvbXBhc3MudjEuVHJhY2tlclJlZiKeAwoLUHVsbFJlcXVlc3QSIwoFZm9yZ2UYASABKAsyFC5jb21wYXNzLnYxLkZvcmdlUmVmEgwKBHJlcG8YAiABKAkSDgoGbnVtYmVyGAMgASgNEg0KBXRpdGxlGAQgASgJEhMKC2ZvcmdlX3N0YXRlGAUgASgJEgsKA3VybBgGIAEoCRIQCghoZWFkX3JlZhgHIAEoCRIQCghiYXNlX3JlZhgIIAEoCRIrCgVhZ2VudBgJIAEoCzIcLmNvbXBhc3MudjEuQWdlbnRBdHRyaWJ1dGlvbhIVCg1mb3JnZV9hY2NvdW50GAogASgJEg0KBWRyYWZ0GAsgASgIEikKB2NoYW5nZWQYDCABKAsyGC5jb21wYXNzLnYxLkNoYW5nZWRTdGF0cxIpCgZjaGVja3MYDSABKAsyGS5jb21wYXNzLnYxLkNoZWNrc1N1bW1hcnkSIwoHcmV2aWV3cxgOIAMoCzISLmNvbXBhc3MudjEuUmV2aWV3EikKB3RocmVhZHMYDyADKAsyGC5jb21wYXNzLnYxLlJldmlld1RocmVhZCJTCg1DaGVja3NTdW1tYXJ5EhAKCGhlYWRfc2hhGAEgASgJEg0KBXN0YXRlGAIgASgJEiEKBmNoZWNrcxgDIAMoCzIRLmNvbXBhc3MudjEuQ2hlY2siQwoFQ2hlY2sSDAoEbmFtZRgBIAEoCRINCgVzdGF0ZRgCIAEoCRILCgN1cmwYAyABKAkSEAoIcmVxdWlyZWQYBCABKAgiQwoMQ2hhbmdlZFN0YXRzEg0KBWZpbGVzGAEgASgNEhEKCWFkZGl0aW9ucxgCIAEoDRIRCglkZWxldGlvbnMYAyABKA0iQwoKVHJhY2tlclJlZhIMCgRraW5kGAEgASgJEgoKAmlkGAIgASgJEg4KBnN0YXR1cxgDIAEoCRILCgN1cmwYBCABKAkiRwoGUmV2aWV3Eg4KBmF1dGhvchgBIAEoCRIOCgZpc19ib3QYAiABKAgSDwoHdmVyZGljdBgDIAEoCRIMCgRib2R5GAQgASgJIlUKDFJldmlld1RocmVhZBIMCgRwYXRoGAEgASgJEhAKCHJlc29sdmVkGAIgASgIEiUKCGNvbW1lbnRzGAMgAygLMhMuY29tcGFzcy52MS5Db21tZW50IjcKB0NvbW1lbnQSDgoGYXV0aG9yGAEgASgJEg4KBmlzX2JvdBgCIAEoCBIMCgRib2R5GAMgASgJKmQKDlNlY3JldERlbGl2ZXJ5Eh8KG1NFQ1JFVF9ERUxJVkVSWV9VTlNQRUNJRklFRBAAEhgKFFNFQ1JFVF9ERUxJVkVSWV9GSUxFEAESFwoTU0VDUkVUX0RFTElWRVJZX0VOVhACKnAKClNlY3JldEtpbmQSGwoXU0VDUkVUX0tJTkRfVU5TUEVDSUZJRUQQABIXChNTRUNSRVRfS0lORF9HRU5FUklDEAESGAoUU0VDUkVUX0tJTkRfUFJPVklERVIQAhISCg5TRUNSRVRfS0lORF9HSBADKkMKC1NlcnZlclN0YXRlEhwKGFNFUlZFUl9TVEFURV9VTlNQRUNJRklFRBAAEhYKElNFUlZFUl9TVEFURV9SRUFEWRABKoICChFBZ2VudFNlc3Npb25TdGF0ZRIjCh9BR0VOVF9TRVNTSU9OX1NUQVRFX1VOU1BFQ0lGSUVEEAASIAocQUdFTlRfU0VTU0lPTl9TVEFURV9TVEFSVElORxABEh0KGUFHRU5UX1NFU1NJT05fU1RBVEVfUkVBRFkQAhIfChtBR0VOVF9TRVNTSU9OX1NUQVRFX1dPUktJTkcQAxIfChtBR0VOVF9TRVNTSU9OX1NUQVRFX1NUT1BQRUQQBBIfChtBR0VOVF9TRVNTSU9OX1NUQVRFX0VSUk9SRUQQBRIkCiBBR0VOVF9TRVNTSU9OX1NUQVRFX0RJU0NPTk5FQ1RFRBAGKtIBChNBZ2VudFRvb2xDYWxsU3RhdHVzEiYKIkFHRU5UX1RPT0xfQ0FMTF9TVEFUVVNfVU5TUEVDSUZJRUQQABIiCh5BR0VOVF9UT09MX0NBTExfU1RBVFVTX1BFTkRJTkcQARImCiJBR0VOVF9UT09MX0NBTExfU1RBVFVTX0lOX1BST0dSRVNTEAISJAogQUdFTlRfVE9PTF9DQUxMX1NUQVRVU19DT01QTEVURUQQAxIhCh1BR0VOVF9UT09MX0NBTExfU1RBVFVTX0ZBSUxFRBAEKrQBChRBZ2VudFBsYW5FbnRyeVN0YXR1cxInCiNBR0VOVF9QTEFOX0VOVFJZX1NUQVRVU19VTlNQRUNJRklFRBAAEiMKH0FHRU5UX1BMQU5fRU5UUllfU1RBVFVTX1BFTkRJTkcQARInCiNBR0VOVF9QTEFOX0VOVFJZX1NUQVRVU19JTl9QUk9HUkVTUxACEiUKIUFHRU5UX1BMQU5fRU5UUllfU1RBVFVTX0NPTVBMRVRFRBADKoQBChRTZXNzaW9uSW5qZWN0aW9uS2luZBImCiJTRVNTSU9OX0lOSkVDVElPTl9LSU5EX1VOU1BFQ0lGSUVEEAASIAocU0VTU0lPTl9JTkpFQ1RJT05fS0lORF9TVEVFUhABEiIKHlNFU1NJT05fSU5KRUNUSU9OX0tJTkRfREVMSVZFUhACKnQKEFNlc3Npb25FcnJvcktpbmQSIgoeU0VTU0lPTl9FUlJPUl9LSU5EX1VOU1BFQ0lGSUVEEAASHAoYU0VTU0lPTl9FUlJPUl9LSU5EX0VSUk9SEAESHgoaU0VTU0lPTl9FUlJPUl9LSU5EX0FCT1JURUQQAirxAQoKSXNzdWVTdGF0ZRIbChdJU1NVRV9TVEFURV9VTlNQRUNJRklFRBAAEhcKE0lTU1VFX1NUQVRFX0JBQ0tMT0cQARIUChBJU1NVRV9TVEFURV9UT0RPEAISFgoSSVNTVUVfU1RBVEVfUVVFVUVEEAMSFwoTSVNTVUVfU1RBVEVfQkxPQ0tFRBAEEhsKF0lTU1VFX1NUQVRFX0lOX1BST0dSRVNTEAUSGQoVSVNTVUVfU1RBVEVfSU5fUkVWSUVXEAYSFAoQSVNTVUVfU1RBVEVfRE9ORRAHEhgKFElTU1VFX1NUQVRFX0FSQ0hJVkVEEAgqnAEKDUZvcmdlUHJvdmlkZXISHgoaRk9SR0VfUFJPVklERVJfVU5TUEVDSUZJRUQQABIZChVGT1JHRV9QUk9WSURFUl9HSVRIVUIQARIZChVGT1JHRV9QUk9WSURFUl9HSVRMQUIQAhIaChZGT1JHRV9QUk9WSURFUl9GT1JHRUpPEAMSGQoVRk9SR0VfUFJPVklERVJfTElORUFSEAQy0w4KDkNvbXBhc3NTZXJ2aWNlElQKDUdldFNlcnZlckluZm8SIC5jb21wYXNzLnYxLkdldFNlcnZlckluZm9SZXF1ZXN0GiEuY29tcGFzcy52MS5HZXRTZXJ2ZXJJbmZvUmVzcG9uc2USPwoGV2hvQW1JEhkuY29tcGFzcy52MS5XaG9BbUlSZXF1ZXN0GhouY29tcGFzcy52MS5XaG9BbUlSZXNwb25zZRJcCg9TdWJzY3JpYmVFdmVudHMSIi5jb21wYXNzLnYxLlN1YnNjcmliZUV2ZW50c1JlcXVlc3QaIy5jb21wYXNzLnYxLlN1YnNjcmliZUV2ZW50c1Jlc3BvbnNlMAESWgoPTGlzdEJvYXJkSXNzdWVzEiIuY29tcGFzcy52MS5MaXN0Qm9hcmRJc3N1ZXNSZXF1ZXN0GiMuY29tcGFzcy52MS5MaXN0Qm9hcmRJc3N1ZXNSZXNwb25zZRJyChdQcm92aXNpb25BZ2VudFdvcmtzcGFjZRIqLmNvbXBhc3MudjEuUHJvdmlzaW9uQWdlbnRXb3Jrc3BhY2VSZXF1ZXN0GisuY29tcGFzcy52MS5Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlc3BvbnNlEmAKEVN0YXJ0QWdlbnRTZXNzaW9uEiQuY29tcGFzcy52MS5TdGFydEFnZW50U2Vzc2lvblJlcXVlc3QaJS5jb21wYXNzLnYxLlN0YXJ0QWdlbnRTZXNzaW9uUmVzcG9uc2USSwoKU3Bhd25BZ2VudBIdLmNvbXBhc3MudjEuU3Bhd25BZ2VudFJlcXVlc3QaHi5jb21wYXNzLnYxLlNwYXduQWdlbnRSZXNwb25zZRJdChBTdG9wQWdlbnRTZXNzaW9uEiMuY29tcGFzcy52MS5TdG9wQWdlbnRTZXNzaW9uUmVxdWVzdBokLmNvbXBhc3MudjEuU3RvcEFnZW50U2Vzc2lvblJlc3BvbnNlEmkKFFJlbW92ZUFnZW50V29ya3NwYWNlEicuY29tcGFzcy52MS5SZW1vdmVBZ2VudFdvcmtzcGFjZVJlcXVlc3QaKC5jb21wYXNzLnYxLlJlbW92ZUFnZW50V29ya3NwYWNlUmVzcG9uc2USYwoSUmVsb2FkQWdlbnRTZXNzaW9uEiUuY29tcGFzcy52MS5SZWxvYWRBZ2VudFNlc3Npb25SZXF1ZXN0GiYuY29tcGFzcy52MS5SZWxvYWRBZ2VudFNlc3Npb25SZXNwb25zZRJXCg5HZXRBZ2VudFN0YXR1cxIhLmNvbXBhc3MudjEuR2V0QWdlbnRTdGF0dXNSZXF1ZXN0GiIuY29tcGFzcy52MS5HZXRBZ2VudFN0YXR1c1Jlc3BvbnNlEmIKFVN1YnNjcmliZUFnZW50U2Vzc2lvbhIoLmNvbXBhc3MudjEuU3Vic2NyaWJlQWdlbnRTZXNzaW9uUmVxdWVzdBodLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uRnJhbWUwARJLCgpJc3N1ZVRva2VuEh0uY29tcGFzcy52MS5Jc3N1ZVRva2VuUmVxdWVzdBoeLmNvbXBhc3MudjEuSXNzdWVUb2tlblJlc3BvbnNlEk4KC1Jldm9rZVRva2VuEh4uY29tcGFzcy52MS5SZXZva2VUb2tlblJlcXVlc3QaHy5jb21wYXNzLnYxLlJldm9rZVRva2VuUmVzcG9uc2USVwoOUHV0QWdlbnRDb25maWcSIS5jb21wYXNzLnYxLlB1dEFnZW50Q29uZmlnUmVxdWVzdBoiLmNvbXBhc3MudjEuUHV0QWdlbnRDb25maWdSZXNwb25zZRJjChJHZXRBZ2VudENvbmZpZ0luZm8SJS5jb21wYXNzLnYxLkdldEFnZW50Q29uZmlnSW5mb1JlcXVlc3QaJi5jb21wYXNzLnYxLkdldEFnZW50Q29uZmlnSW5mb1Jlc3BvbnNlEmAKEURlbGV0ZUFnZW50Q29uZmlnEiQuY29tcGFzcy52MS5EZWxldGVBZ2VudENvbmZpZ1JlcXVlc3QaJS5jb21wYXNzLnYxLkRlbGV0ZUFnZW50Q29uZmlnUmVzcG9uc2USXQoQUHV0TW9kZWxSZWdpc3RyeRIjLmNvbXBhc3MudjEuUHV0TW9kZWxSZWdpc3RyeVJlcXVlc3QaJC5jb21wYXNzLnYxLlB1dE1vZGVsUmVnaXN0cnlSZXNwb25zZRJdChBHZXRNb2RlbFJlZ2lzdHJ5EiMuY29tcGFzcy52MS5HZXRNb2RlbFJlZ2lzdHJ5UmVxdWVzdBokLmNvbXBhc3MudjEuR2V0TW9kZWxSZWdpc3RyeVJlc3BvbnNlEmYKE0RlbGV0ZU1vZGVsUmVnaXN0cnkSJi5jb21wYXNzLnYxLkRlbGV0ZU1vZGVsUmVnaXN0cnlSZXF1ZXN0GicuY29tcGFzcy52MS5EZWxldGVNb2RlbFJlZ2lzdHJ5UmVzcG9uc2UyoAQKDlNlY3JldHNTZXJ2aWNlEkgKCVNldFNlY3JldBIcLmNvbXBhc3MudjEuU2V0U2VjcmV0UmVxdWVzdBodLmNvbXBhc3MudjEuU2V0U2VjcmV0UmVzcG9uc2USTgoLTGlzdFNlY3JldHMSHi5jb21wYXNzLnYxLkxpc3RTZWNyZXRzUmVxdWVzdBofLmNvbXBhc3MudjEuTGlzdFNlY3JldHNSZXNwb25zZRJRCgxEZWxldGVTZWNyZXQSHy5jb21wYXNzLnYxLkRlbGV0ZVNlY3JldFJlcXVlc3QaIC5jb21wYXNzLnYxLkRlbGV0ZVNlY3JldFJlc3BvbnNlEloKD1NldFNlcnZlclNlY3JldBIiLmNvbXBhc3MudjEuU2V0U2VydmVyU2VjcmV0UmVxdWVzdBojLmNvbXBhc3MudjEuU2V0U2VydmVyU2VjcmV0UmVzcG9uc2USYwoSRGVsZXRlU2VydmVyU2VjcmV0EiUuY29tcGFzcy52MS5EZWxldGVTZXJ2ZXJTZWNyZXRSZXF1ZXN0GiYuY29tcGFzcy52MS5EZWxldGVTZXJ2ZXJTZWNyZXRSZXNwb25zZRJgChFMaXN0U2VydmVyU2VjcmV0cxIkLmNvbXBhc3MudjEuTGlzdFNlcnZlclNlY3JldHNSZXF1ZXN0GiUuY29tcGFzcy52MS5MaXN0U2VydmVyU2VjcmV0c1Jlc3BvbnNlYgZwcm90bzM", [file_google_protobuf_timestamp]);
+  fileDesc("Chhjb21wYXNzL3YxL2NvbXBhc3MucHJvdG8SCmNvbXBhc3MudjEiqAEKEFNldFNlY3JldFJlcXVlc3QSDAoEbmFtZRgBIAEoCRISCgV2YWx1ZRgCIAEoCUIDgAEBEiwKCGRlbGl2ZXJ5GAMgASgOMhouY29tcGFzcy52MS5TZWNyZXREZWxpdmVyeRIkCgRraW5kGAQgASgOMhYuY29tcGFzcy52MS5TZWNyZXRLaW5kEhAKCHByb3ZpZGVyGAUgASgJEgwKBGhvc3QYBiABKAkiEwoRU2V0U2VjcmV0UmVzcG9uc2UiFAoSTGlzdFNlY3JldHNSZXF1ZXN0IkAKE0xpc3RTZWNyZXRzUmVzcG9uc2USKQoHc2VjcmV0cxgBIAMoCzIYLmNvbXBhc3MudjEuU2VjcmV0U3RhdHVzIqABCgxTZWNyZXRTdGF0dXMSDAoEbmFtZRgBIAEoCRIOCgZpc19zZXQYAiABKAgSLAoIZGVsaXZlcnkYAyABKA4yGi5jb21wYXNzLnYxLlNlY3JldERlbGl2ZXJ5EiQKBGtpbmQYBCABKA4yFi5jb21wYXNzLnYxLlNlY3JldEtpbmQSEAoIcHJvdmlkZXIYBSABKAkSDAoEaG9zdBgGIAEoCSIjChNEZWxldGVTZWNyZXRSZXF1ZXN0EgwKBG5hbWUYASABKAkiFgoURGVsZXRlU2VjcmV0UmVzcG9uc2UiOgoWU2V0U2VydmVyU2VjcmV0UmVxdWVzdBIMCgRuYW1lGAEgASgJEhIKBXZhbHVlGAIgASgJQgOAAQEiGQoXU2V0U2VydmVyU2VjcmV0UmVzcG9uc2UiKQoZRGVsZXRlU2VydmVyU2VjcmV0UmVxdWVzdBIMCgRuYW1lGAEgASgJIhwKGkRlbGV0ZVNlcnZlclNlY3JldFJlc3BvbnNlIhoKGExpc3RTZXJ2ZXJTZWNyZXRzUmVxdWVzdCJTChlMaXN0U2VydmVyU2VjcmV0c1Jlc3BvbnNlEjYKDnNlcnZlcl9zZWNyZXRzGAEgAygLMh4uY29tcGFzcy52MS5TZXJ2ZXJTZWNyZXRTdGF0dXMiMgoSU2VydmVyU2VjcmV0U3RhdHVzEgwKBG5hbWUYASABKAkSDgoGaXNfc2V0GAIgASgIIhYKFEdldFNlcnZlckluZm9SZXF1ZXN0Ij0KFUdldFNlcnZlckluZm9SZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgJEhMKC2FwaV92ZXJzaW9uGAIgASgJIg8KDVdob0FtSVJlcXVlc3QiJAoOV2hvQW1JUmVzcG9uc2USEgoKYWNjb3VudF9pZBgBIAEoCSJDChZTdWJzY3JpYmVFdmVudHNSZXF1ZXN0EhEKCXNpbmNlX3NlcRgBIAEoBBIWCg5pbnN0YW5jZV9lcG9jaBgCIAEoBCLiAwoXU3Vic2NyaWJlRXZlbnRzUmVzcG9uc2USCwoDc2VxGAEgASgEEhIKCmF0X3VuaXhfbXMYAiABKAMSFgoOaW5zdGFuY2VfZXBvY2gYAyABKAQSFAoMc25hcHNob3Rfc2VxGAQgASgEEjEKDXNlcnZlcl9zdGF0dXMYCiABKAsyGC5jb21wYXNzLnYxLlNlcnZlclN0YXR1c0gAEjUKD3Jlc3luY19yZXF1aXJlZBgLIAEoCzIaLmNvbXBhc3MudjEuUmVzeW5jUmVxdWlyZWRIABI+ChRhZ2VudF9zZXNzaW9uX3N0YXR1cxgMIAEoCzIeLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uU3RhdHVzSAASPAoTYWdlbnRfbWVzc2FnZV9jaHVuaxgNIAEoCzIdLmNvbXBhc3MudjEuQWdlbnRNZXNzYWdlQ2h1bmtIABI0Cg9hZ2VudF90b29sX2NhbGwYDiABKAsyGS5jb21wYXNzLnYxLkFnZW50VG9vbENhbGxIABIrCgphZ2VudF9wbGFuGA8gASgLMhUuY29tcGFzcy52MS5BZ2VudFBsYW5IABIiCgVpc3N1ZRgQIAEoCzIRLmNvbXBhc3MudjEuSXNzdWVIAEIJCgdwYXlsb2FkIi4KFkxpc3RCb2FyZElzc3Vlc1JlcXVlc3QSFAoMc25hcHNob3Rfc2VxGAEgASgEIjwKF0xpc3RCb2FyZElzc3Vlc1Jlc3BvbnNlEiEKBmlzc3VlcxgBIAMoCzIRLmNvbXBhc3MudjEuSXNzdWUiNgoMU2VydmVyU3RhdHVzEiYKBXN0YXRlGAEgASgOMhcuY29tcGFzcy52MS5TZXJ2ZXJTdGF0ZSIQCg5SZXN5bmNSZXF1aXJlZCLSAQoSQWdlbnRTZXNzaW9uU3RhdHVzEhIKCnNlc3Npb25faWQYASABKAkSLAoFc3RhdGUYAiABKA4yHS5jb21wYXNzLnYxLkFnZW50U2Vzc2lvblN0YXRlEhgKEGFnZW50X2FjY291bnRfaWQYAyABKAkSLQoMcnVudGltZV90aWVyGAQgASgOMhcuY29tcGFzcy52MS5SdW50aW1lVGllchIxCg5lZ3Jlc3NfcG9zdHVyZRgFIAEoDjIZLmNvbXBhc3MudjEuRWdyZXNzUG9zdHVyZSJJChFBZ2VudE1lc3NhZ2VDaHVuaxISCgpzZXNzaW9uX2lkGAEgASgJEgwKBHRleHQYAiABKAkSEgoKaXNfdGhvdWdodBgDIAEoCCJ5Cg1BZ2VudFRvb2xDYWxsEhIKCnNlc3Npb25faWQYASABKAkSFAoMdG9vbF9jYWxsX2lkGAIgASgJEg0KBXRpdGxlGAMgASgJEi8KBnN0YXR1cxgEIAEoDjIfLmNvbXBhc3MudjEuQWdlbnRUb29sQ2FsbFN0YXR1cyJMCglBZ2VudFBsYW4SEgoKc2Vzc2lvbl9pZBgBIAEoCRIrCgdlbnRyaWVzGAIgAygLMhouY29tcGFzcy52MS5BZ2VudFBsYW5FbnRyeSJTCg5BZ2VudFBsYW5FbnRyeRIPCgdjb250ZW50GAEgASgJEjAKBnN0YXR1cxgCIAEoDjIgLmNvbXBhc3MudjEuQWdlbnRQbGFuRW50cnlTdGF0dXMi3wMKDFNlc3Npb25FdmVudBIQCghldmVudF9pZBgBIAEoCRISCgphdF91bml4X21zGAIgASgDEjoKDmFzc2lzdGFudF90ZXh0GAMgASgLMiAuY29tcGFzcy52MS5TZXNzaW9uQXNzaXN0YW50VGV4dEgAEi8KCHRoaW5raW5nGAQgASgLMhsuY29tcGFzcy52MS5TZXNzaW9uVGhpbmtpbmdIABIwCgl0b29sX2NhbGwYBSABKAsyGy5jb21wYXNzLnYxLlNlc3Npb25Ub29sQ2FsbEgAEj0KEHRvb2xfY2FsbF91cGRhdGUYBiABKAsyIS5jb21wYXNzLnYxLlNlc3Npb25Ub29sQ2FsbFVwZGF0ZUgAEicKBHBsYW4YByABKAsyFy5jb21wYXNzLnYxLlNlc3Npb25QbGFuSAASKwoGbm90aWNlGAggASgLMhkuY29tcGFzcy52MS5TZXNzaW9uTm90aWNlSAASOQoRc2Vzc2lvbl9pbmplY3Rpb24YCSABKAsyHC5jb21wYXNzLnYxLlNlc3Npb25JbmplY3Rpb25IABIxCg1zZXNzaW9uX2Vycm9yGAogASgLMhguY29tcGFzcy52MS5TZXNzaW9uRXJyb3JIAEIHCgVldmVudCI4ChRTZXNzaW9uQXNzaXN0YW50VGV4dBIMCgR0ZXh0GAEgASgJEhIKCm1lc3NhZ2VfaWQYAiABKAkiMwoPU2Vzc2lvblRoaW5raW5nEgwKBHRleHQYASABKAkSEgoKbWVzc2FnZV9pZBgCIAEoCSJnCg9TZXNzaW9uVG9vbENhbGwSFAoMdG9vbF9jYWxsX2lkGAEgASgJEg0KBXRpdGxlGAIgASgJEi8KBnN0YXR1cxgDIAEoDjIfLmNvbXBhc3MudjEuQWdlbnRUb29sQ2FsbFN0YXR1cyKaAQoVU2Vzc2lvblRvb2xDYWxsVXBkYXRlEhQKDHRvb2xfY2FsbF9pZBgBIAEoCRIvCgZzdGF0dXMYAiABKA4yHy5jb21wYXNzLnYxLkFnZW50VG9vbENhbGxTdGF0dXMSDgoGb3V0cHV0GAMgASgJEioKBWRpZmZzGAQgAygLMhsuY29tcGFzcy52MS5TZXNzaW9uRmlsZURpZmYiVQoPU2Vzc2lvbkZpbGVEaWZmEgwKBHBhdGgYASABKAkSFQoIb2xkX3RleHQYAiABKAlIAIgBARIQCghuZXdfdGV4dBgDIAEoCUILCglfb2xkX3RleHQiOgoLU2Vzc2lvblBsYW4SKwoHZW50cmllcxgBIAMoCzIaLmNvbXBhc3MudjEuQWdlbnRQbGFuRW50cnkiOQoNU2Vzc2lvbk5vdGljZRIMCgR0ZXh0GAEgASgJEhEKBGxpbmsYAiABKAlIAIgBAUIHCgVfbGluayKDAQoQU2Vzc2lvbkluamVjdGlvbhIxCgdvcF9raW5kGAEgASgOMiAuY29tcGFzcy52MS5TZXNzaW9uSW5qZWN0aW9uS2luZBISCgptZXNzYWdlX2lkGAIgASgJEhMKC2Zyb21faGFuZGxlGAMgASgJEhMKC3RyYWNlcGFyZW50GAQgASgJImsKDFNlc3Npb25FcnJvchIqCgRraW5kGAEgASgOMhwuY29tcGFzcy52MS5TZXNzaW9uRXJyb3JLaW5kEg8KB21lc3NhZ2UYAiABKAkSEwoGc3RhdHVzGAMgASgFSACIAQFCCQoHX3N0YXR1cyIyChxTdWJzY3JpYmVBZ2VudFNlc3Npb25SZXF1ZXN0EhIKCnNlc3Npb25faWQYASABKAkifgoRQWdlbnRTZXNzaW9uRnJhbWUSEgoKc2Vzc2lvbl9pZBgBIAEoCRInCgVldmVudBgCIAEoCzIYLmNvbXBhc3MudjEuU2Vzc2lvbkV2ZW50EiwKBXN0YXRlGAMgASgOMh0uY29tcGFzcy52MS5BZ2VudFNlc3Npb25TdGF0ZSJwCh5Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlcXVlc3QSFAoMYWdlbnRfaGFuZGxlGAEgASgJEhkKEWNsaWVudF9yZXF1ZXN0X2lkGAIgASgJEg8KB3BlcnNvbmEYAyABKAkSDAoEcm9sZRgEIAEoCSI5Ch9Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlc3BvbnNlEhYKDmNvbnRhaW5lcl9uYW1lGAEgASgJIlAKG1JlbW92ZUFnZW50V29ya3NwYWNlUmVxdWVzdBIWCg5jb250YWluZXJfbmFtZRgBIAEoCRIZChFjbGllbnRfcmVxdWVzdF9pZBgCIAEoCSIeChxSZW1vdmVBZ2VudFdvcmtzcGFjZVJlc3BvbnNlImMKGFN0YXJ0QWdlbnRTZXNzaW9uUmVxdWVzdBIWCg5jb250YWluZXJfbmFtZRgBIAEoCRIZChFyZXN1bWVfc2Vzc2lvbl9pZBgDIAEoCUoECAIQA1IOaW5pdGlhbF9wcm9tcHQiLwoZU3RhcnRBZ2VudFNlc3Npb25SZXNwb25zZRISCgpzZXNzaW9uX2lkGAEgASgJIloKEVNwYXduQWdlbnRSZXF1ZXN0EhQKDGFnZW50X2hhbmRsZRgBIAEoCRIZChFjbGllbnRfcmVxdWVzdF9pZBgDIAEoCUoECAIQA1IOaW5pdGlhbF9wcm9tcHQiQAoSU3Bhd25BZ2VudFJlc3BvbnNlEhIKCnNlc3Npb25faWQYASABKAkSFgoOY29udGFpbmVyX25hbWUYAiABKAkiLQoXU3RvcEFnZW50U2Vzc2lvblJlcXVlc3QSEgoKc2Vzc2lvbl9pZBgBIAEoCSIaChhTdG9wQWdlbnRTZXNzaW9uUmVzcG9uc2UiLwoZUmVsb2FkQWdlbnRTZXNzaW9uUmVxdWVzdBISCgpzZXNzaW9uX2lkGAEgASgJIjAKGlJlbG9hZEFnZW50U2Vzc2lvblJlc3BvbnNlEhIKCnNlc3Npb25faWQYASABKAkiKwoVR2V0QWdlbnRTdGF0dXNSZXF1ZXN0EhIKCnNlc3Npb25faWQYASABKAkiSgoWR2V0QWdlbnRTdGF0dXNSZXNwb25zZRIwCghzdGF0dXNlcxgBIAMoCzIeLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uU3RhdHVzIisKEUlzc3VlVG9rZW5SZXF1ZXN0EhYKDmFjY291bnRfaGFuZGxlGAEgASgJIiMKEklzc3VlVG9rZW5SZXNwb25zZRINCgV0b2tlbhgBIAEoCSIoChJSZXZva2VUb2tlblJlcXVlc3QSEgoFdG9rZW4YASABKAlCA4ABASIVChNSZXZva2VUb2tlblJlc3BvbnNlIicKFVB1dEFnZW50Q29uZmlnUmVxdWVzdBIOCgZidW5kbGUYASABKAwiKQoWUHV0QWdlbnRDb25maWdSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgJIhsKGUdldEFnZW50Q29uZmlnSW5mb1JlcXVlc3Qi2gEKGkdldEFnZW50Q29uZmlnSW5mb1Jlc3BvbnNlEg8KB3ZlcnNpb24YASABKAkSDgoGc2tpbGxzGAIgAygJEhIKCmV4dGVuc2lvbnMYAyADKAkSEwoLbWNwX3NlcnZlcnMYBCADKAkSFAoMaGFzX3NldHRpbmdzGAUgASgIEhUKDWhhc19hZ2VudHNfbWQYBiABKAgSDQoFcnVsZXMYByADKAkSEQoJc3ViYWdlbnRzGAggAygJEhIKCmhhc19tb2RlbHMYCSABKAgSDwoHcHJvbXB0cxgKIAMoCSIaChhEZWxldGVBZ2VudENvbmZpZ1JlcXVlc3QiGwoZRGVsZXRlQWdlbnRDb25maWdSZXNwb25zZSI0Cg5Nb2RlbENhbmRpZGF0ZRIQCghwcm92aWRlchgBIAEoCRIQCghtb2RlbF9pZBgCIAEoCSJxCg1Nb2RlbE1ldGFkYXRhEhYKDmNvbnRleHRfd2luZG93GAEgASgDEhwKFGlucHV0X2Nvc3RfbWljcm9fdXNkGAIgASgDEh0KFW91dHB1dF9jb3N0X21pY3JvX3VzZBgDIAEoAxILCgNhcGkYBCABKAkihwEKEk1vZGVsUmVnaXN0cnlFbnRyeRIUCgxkaXNwbGF5X25hbWUYASABKAkSLgoKY2FuZGlkYXRlcxgCIAMoCzIaLmNvbXBhc3MudjEuTW9kZWxDYW5kaWRhdGUSKwoIbWV0YWRhdGEYAyABKAsyGS5jb21wYXNzLnYxLk1vZGVsTWV0YWRhdGEimAEKDU1vZGVsUmVnaXN0cnkSNwoHZW50cmllcxgBIAMoCzImLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeS5FbnRyaWVzRW50cnkaTgoMRW50cmllc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoCzIeLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeUVudHJ5OgI4ASJgChdQdXRNb2RlbFJlZ2lzdHJ5UmVxdWVzdBIrCghyZWdpc3RyeRgBIAEoCzIZLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeRIYChBleHBlY3RlZF92ZXJzaW9uGAIgASgDIisKGFB1dE1vZGVsUmVnaXN0cnlSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgDIhkKF0dldE1vZGVsUmVnaXN0cnlSZXF1ZXN0IlgKGEdldE1vZGVsUmVnaXN0cnlSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgDEisKCHJlZ2lzdHJ5GAIgASgLMhkuY29tcGFzcy52MS5Nb2RlbFJlZ2lzdHJ5IhwKGkRlbGV0ZU1vZGVsUmVnaXN0cnlSZXF1ZXN0Ih0KG0RlbGV0ZU1vZGVsUmVnaXN0cnlSZXNwb25zZSI+ChBBZ2VudEF0dHJpYnV0aW9uEhQKDGFnZW50X2hhbmRsZRgBIAEoCRIUCgxvd25lcl9oYW5kbGUYAiABKAkiRQoIRm9yZ2VSZWYSKwoIcHJvdmlkZXIYASABKA4yGS5jb21wYXNzLnYxLkZvcmdlUHJvdmlkZXISDAoEaG9zdBgCIAEoCSLUAwoFSXNzdWUSCgoCaWQYASABKAkSIwoFZm9yZ2UYAiABKAsyFC5jb21wYXNzLnYxLkZvcmdlUmVmEgwKBHJlcG8YAyABKAkSDgoGbnVtYmVyGAQgASgNEg0KBXRpdGxlGAUgASgJEgwKBGJvZHkYBiABKAkSEwoLZm9yZ2Vfc3RhdGUYByABKAkSCwoDdXJsGAggASgJEisKBWFnZW50GAkgASgLMhwuY29tcGFzcy52MS5BZ2VudEF0dHJpYnV0aW9uEhUKDWZvcmdlX2FjY291bnQYCiABKAkSDgoGbGFiZWxzGAsgAygJEi4KCnVwZGF0ZWRfYXQYEyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEiUKBXN0YXRlGAwgASgOMhYuY29tcGFzcy52MS5Jc3N1ZVN0YXRlEhAKCHByaW9yaXR5GA0gASgJEhAKCGFzc2lnbmVlGA4gASgJEg8KB3N1bW1hcnkYDyABKAkSDgoGYnJhbmNoGBAgASgJEiQKA3BycxgRIAMoCzIXLmNvbXBhc3MudjEuUHVsbFJlcXVlc3QSJwoHdHJhY2tlchgSIAEoCzIWLmNvbXBhc3MudjEuVHJhY2tlclJlZiKeAwoLUHVsbFJlcXVlc3QSIwoFZm9yZ2UYASABKAsyFC5jb21wYXNzLnYxLkZvcmdlUmVmEgwKBHJlcG8YAiABKAkSDgoGbnVtYmVyGAMgASgNEg0KBXRpdGxlGAQgASgJEhMKC2ZvcmdlX3N0YXRlGAUgASgJEgsKA3VybBgGIAEoCRIQCghoZWFkX3JlZhgHIAEoCRIQCghiYXNlX3JlZhgIIAEoCRIrCgVhZ2VudBgJIAEoCzIcLmNvbXBhc3MudjEuQWdlbnRBdHRyaWJ1dGlvbhIVCg1mb3JnZV9hY2NvdW50GAogASgJEg0KBWRyYWZ0GAsgASgIEikKB2NoYW5nZWQYDCABKAsyGC5jb21wYXNzLnYxLkNoYW5nZWRTdGF0cxIpCgZjaGVja3MYDSABKAsyGS5jb21wYXNzLnYxLkNoZWNrc1N1bW1hcnkSIwoHcmV2aWV3cxgOIAMoCzISLmNvbXBhc3MudjEuUmV2aWV3EikKB3RocmVhZHMYDyADKAsyGC5jb21wYXNzLnYxLlJldmlld1RocmVhZCJTCg1DaGVja3NTdW1tYXJ5EhAKCGhlYWRfc2hhGAEgASgJEg0KBXN0YXRlGAIgASgJEiEKBmNoZWNrcxgDIAMoCzIRLmNvbXBhc3MudjEuQ2hlY2siQwoFQ2hlY2sSDAoEbmFtZRgBIAEoCRINCgVzdGF0ZRgCIAEoCRILCgN1cmwYAyABKAkSEAoIcmVxdWlyZWQYBCABKAgiQwoMQ2hhbmdlZFN0YXRzEg0KBWZpbGVzGAEgASgNEhEKCWFkZGl0aW9ucxgCIAEoDRIRCglkZWxldGlvbnMYAyABKA0iQwoKVHJhY2tlclJlZhIMCgRraW5kGAEgASgJEgoKAmlkGAIgASgJEg4KBnN0YXR1cxgDIAEoCRILCgN1cmwYBCABKAkiRwoGUmV2aWV3Eg4KBmF1dGhvchgBIAEoCRIOCgZpc19ib3QYAiABKAgSDwoHdmVyZGljdBgDIAEoCRIMCgRib2R5GAQgASgJIlUKDFJldmlld1RocmVhZBIMCgRwYXRoGAEgASgJEhAKCHJlc29sdmVkGAIgASgIEiUKCGNvbW1lbnRzGAMgAygLMhMuY29tcGFzcy52MS5Db21tZW50IjcKB0NvbW1lbnQSDgoGYXV0aG9yGAEgASgJEg4KBmlzX2JvdBgCIAEoCBIMCgRib2R5GAMgASgJKmQKDlNlY3JldERlbGl2ZXJ5Eh8KG1NFQ1JFVF9ERUxJVkVSWV9VTlNQRUNJRklFRBAAEhgKFFNFQ1JFVF9ERUxJVkVSWV9GSUxFEAESFwoTU0VDUkVUX0RFTElWRVJZX0VOVhACKnAKClNlY3JldEtpbmQSGwoXU0VDUkVUX0tJTkRfVU5TUEVDSUZJRUQQABIXChNTRUNSRVRfS0lORF9HRU5FUklDEAESGAoUU0VDUkVUX0tJTkRfUFJPVklERVIQAhISCg5TRUNSRVRfS0lORF9HSBADKkMKC1NlcnZlclN0YXRlEhwKGFNFUlZFUl9TVEFURV9VTlNQRUNJRklFRBAAEhYKElNFUlZFUl9TVEFURV9SRUFEWRABKpcBCgtSdW50aW1lVGllchIcChhSVU5USU1FX1RJRVJfVU5TUEVDSUZJRUQQABIXChNSVU5USU1FX1RJRVJfUE9ETUFOEAESGAoUUlVOVElNRV9USUVSX01JQ1JPVk0QAhIgChxSVU5USU1FX1RJRVJfQVBQTEVfQ09OVEFJTkVSEAMSFQoRUlVOVElNRV9USUVSX0hPU1QQBCpoCg1FZ3Jlc3NQb3N0dXJlEh4KGkVHUkVTU19QT1NUVVJFX1VOU1BFQ0lGSUVEEAASGAoURUdSRVNTX1BPU1RVUkVfQVJNRUQQARIdChlFR1JFU1NfUE9TVFVSRV9VTkVORk9SQ0VEEAIqggIKEUFnZW50U2Vzc2lvblN0YXRlEiMKH0FHRU5UX1NFU1NJT05fU1RBVEVfVU5TUEVDSUZJRUQQABIgChxBR0VOVF9TRVNTSU9OX1NUQVRFX1NUQVJUSU5HEAESHQoZQUdFTlRfU0VTU0lPTl9TVEFURV9SRUFEWRACEh8KG0FHRU5UX1NFU1NJT05fU1RBVEVfV09SS0lORxADEh8KG0FHRU5UX1NFU1NJT05fU1RBVEVfU1RPUFBFRBAEEh8KG0FHRU5UX1NFU1NJT05fU1RBVEVfRVJST1JFRBAFEiQKIEFHRU5UX1NFU1NJT05fU1RBVEVfRElTQ09OTkVDVEVEEAYq0gEKE0FnZW50VG9vbENhbGxTdGF0dXMSJgoiQUdFTlRfVE9PTF9DQUxMX1NUQVRVU19VTlNQRUNJRklFRBAAEiIKHkFHRU5UX1RPT0xfQ0FMTF9TVEFUVVNfUEVORElORxABEiYKIkFHRU5UX1RPT0xfQ0FMTF9TVEFUVVNfSU5fUFJPR1JFU1MQAhIkCiBBR0VOVF9UT09MX0NBTExfU1RBVFVTX0NPTVBMRVRFRBADEiEKHUFHRU5UX1RPT0xfQ0FMTF9TVEFUVVNfRkFJTEVEEAQqtAEKFEFnZW50UGxhbkVudHJ5U3RhdHVzEicKI0FHRU5UX1BMQU5fRU5UUllfU1RBVFVTX1VOU1BFQ0lGSUVEEAASIwofQUdFTlRfUExBTl9FTlRSWV9TVEFUVVNfUEVORElORxABEicKI0FHRU5UX1BMQU5fRU5UUllfU1RBVFVTX0lOX1BST0dSRVNTEAISJQohQUdFTlRfUExBTl9FTlRSWV9TVEFUVVNfQ09NUExFVEVEEAMqhAEKFFNlc3Npb25JbmplY3Rpb25LaW5kEiYKIlNFU1NJT05fSU5KRUNUSU9OX0tJTkRfVU5TUEVDSUZJRUQQABIgChxTRVNTSU9OX0lOSkVDVElPTl9LSU5EX1NURUVSEAESIgoeU0VTU0lPTl9JTkpFQ1RJT05fS0lORF9ERUxJVkVSEAIqdAoQU2Vzc2lvbkVycm9yS2luZBIiCh5TRVNTSU9OX0VSUk9SX0tJTkRfVU5TUEVDSUZJRUQQABIcChhTRVNTSU9OX0VSUk9SX0tJTkRfRVJST1IQARIeChpTRVNTSU9OX0VSUk9SX0tJTkRfQUJPUlRFRBACKvEBCgpJc3N1ZVN0YXRlEhsKF0lTU1VFX1NUQVRFX1VOU1BFQ0lGSUVEEAASFwoTSVNTVUVfU1RBVEVfQkFDS0xPRxABEhQKEElTU1VFX1NUQVRFX1RPRE8QAhIWChJJU1NVRV9TVEFURV9RVUVVRUQQAxIXChNJU1NVRV9TVEFURV9CTE9DS0VEEAQSGwoXSVNTVUVfU1RBVEVfSU5fUFJPR1JFU1MQBRIZChVJU1NVRV9TVEFURV9JTl9SRVZJRVcQBhIUChBJU1NVRV9TVEFURV9ET05FEAcSGAoUSVNTVUVfU1RBVEVfQVJDSElWRUQQCCqcAQoNRm9yZ2VQcm92aWRlchIeChpGT1JHRV9QUk9WSURFUl9VTlNQRUNJRklFRBAAEhkKFUZPUkdFX1BST1ZJREVSX0dJVEhVQhABEhkKFUZPUkdFX1BST1ZJREVSX0dJVExBQhACEhoKFkZPUkdFX1BST1ZJREVSX0ZPUkdFSk8QAxIZChVGT1JHRV9QUk9WSURFUl9MSU5FQVIQBDLTDgoOQ29tcGFzc1NlcnZpY2USVAoNR2V0U2VydmVySW5mbxIgLmNvbXBhc3MudjEuR2V0U2VydmVySW5mb1JlcXVlc3QaIS5jb21wYXNzLnYxLkdldFNlcnZlckluZm9SZXNwb25zZRI/CgZXaG9BbUkSGS5jb21wYXNzLnYxLldob0FtSVJlcXVlc3QaGi5jb21wYXNzLnYxLldob0FtSVJlc3BvbnNlElwKD1N1YnNjcmliZUV2ZW50cxIiLmNvbXBhc3MudjEuU3Vic2NyaWJlRXZlbnRzUmVxdWVzdBojLmNvbXBhc3MudjEuU3Vic2NyaWJlRXZlbnRzUmVzcG9uc2UwARJaCg9MaXN0Qm9hcmRJc3N1ZXMSIi5jb21wYXNzLnYxLkxpc3RCb2FyZElzc3Vlc1JlcXVlc3QaIy5jb21wYXNzLnYxLkxpc3RCb2FyZElzc3Vlc1Jlc3BvbnNlEnIKF1Byb3Zpc2lvbkFnZW50V29ya3NwYWNlEiouY29tcGFzcy52MS5Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlcXVlc3QaKy5jb21wYXNzLnYxLlByb3Zpc2lvbkFnZW50V29ya3NwYWNlUmVzcG9uc2USYAoRU3RhcnRBZ2VudFNlc3Npb24SJC5jb21wYXNzLnYxLlN0YXJ0QWdlbnRTZXNzaW9uUmVxdWVzdBolLmNvbXBhc3MudjEuU3RhcnRBZ2VudFNlc3Npb25SZXNwb25zZRJLCgpTcGF3bkFnZW50Eh0uY29tcGFzcy52MS5TcGF3bkFnZW50UmVxdWVzdBoeLmNvbXBhc3MudjEuU3Bhd25BZ2VudFJlc3BvbnNlEl0KEFN0b3BBZ2VudFNlc3Npb24SIy5jb21wYXNzLnYxLlN0b3BBZ2VudFNlc3Npb25SZXF1ZXN0GiQuY29tcGFzcy52MS5TdG9wQWdlbnRTZXNzaW9uUmVzcG9uc2USaQoUUmVtb3ZlQWdlbnRXb3Jrc3BhY2USJy5jb21wYXNzLnYxLlJlbW92ZUFnZW50V29ya3NwYWNlUmVxdWVzdBooLmNvbXBhc3MudjEuUmVtb3ZlQWdlbnRXb3Jrc3BhY2VSZXNwb25zZRJjChJSZWxvYWRBZ2VudFNlc3Npb24SJS5jb21wYXNzLnYxLlJlbG9hZEFnZW50U2Vzc2lvblJlcXVlc3QaJi5jb21wYXNzLnYxLlJlbG9hZEFnZW50U2Vzc2lvblJlc3BvbnNlElcKDkdldEFnZW50U3RhdHVzEiEuY29tcGFzcy52MS5HZXRBZ2VudFN0YXR1c1JlcXVlc3QaIi5jb21wYXNzLnYxLkdldEFnZW50U3RhdHVzUmVzcG9uc2USYgoVU3Vic2NyaWJlQWdlbnRTZXNzaW9uEiguY29tcGFzcy52MS5TdWJzY3JpYmVBZ2VudFNlc3Npb25SZXF1ZXN0Gh0uY29tcGFzcy52MS5BZ2VudFNlc3Npb25GcmFtZTABEksKCklzc3VlVG9rZW4SHS5jb21wYXNzLnYxLklzc3VlVG9rZW5SZXF1ZXN0Gh4uY29tcGFzcy52MS5Jc3N1ZVRva2VuUmVzcG9uc2USTgoLUmV2b2tlVG9rZW4SHi5jb21wYXNzLnYxLlJldm9rZVRva2VuUmVxdWVzdBofLmNvbXBhc3MudjEuUmV2b2tlVG9rZW5SZXNwb25zZRJXCg5QdXRBZ2VudENvbmZpZxIhLmNvbXBhc3MudjEuUHV0QWdlbnRDb25maWdSZXF1ZXN0GiIuY29tcGFzcy52MS5QdXRBZ2VudENvbmZpZ1Jlc3BvbnNlEmMKEkdldEFnZW50Q29uZmlnSW5mbxIlLmNvbXBhc3MudjEuR2V0QWdlbnRDb25maWdJbmZvUmVxdWVzdBomLmNvbXBhc3MudjEuR2V0QWdlbnRDb25maWdJbmZvUmVzcG9uc2USYAoRRGVsZXRlQWdlbnRDb25maWcSJC5jb21wYXNzLnYxLkRlbGV0ZUFnZW50Q29uZmlnUmVxdWVzdBolLmNvbXBhc3MudjEuRGVsZXRlQWdlbnRDb25maWdSZXNwb25zZRJdChBQdXRNb2RlbFJlZ2lzdHJ5EiMuY29tcGFzcy52MS5QdXRNb2RlbFJlZ2lzdHJ5UmVxdWVzdBokLmNvbXBhc3MudjEuUHV0TW9kZWxSZWdpc3RyeVJlc3BvbnNlEl0KEEdldE1vZGVsUmVnaXN0cnkSIy5jb21wYXNzLnYxLkdldE1vZGVsUmVnaXN0cnlSZXF1ZXN0GiQuY29tcGFzcy52MS5HZXRNb2RlbFJlZ2lzdHJ5UmVzcG9uc2USZgoTRGVsZXRlTW9kZWxSZWdpc3RyeRImLmNvbXBhc3MudjEuRGVsZXRlTW9kZWxSZWdpc3RyeVJlcXVlc3QaJy5jb21wYXNzLnYxLkRlbGV0ZU1vZGVsUmVnaXN0cnlSZXNwb25zZTKgBAoOU2VjcmV0c1NlcnZpY2USSAoJU2V0U2VjcmV0EhwuY29tcGFzcy52MS5TZXRTZWNyZXRSZXF1ZXN0Gh0uY29tcGFzcy52MS5TZXRTZWNyZXRSZXNwb25zZRJOCgtMaXN0U2VjcmV0cxIeLmNvbXBhc3MudjEuTGlzdFNlY3JldHNSZXF1ZXN0Gh8uY29tcGFzcy52MS5MaXN0U2VjcmV0c1Jlc3BvbnNlElEKDERlbGV0ZVNlY3JldBIfLmNvbXBhc3MudjEuRGVsZXRlU2VjcmV0UmVxdWVzdBogLmNvbXBhc3MudjEuRGVsZXRlU2VjcmV0UmVzcG9uc2USWgoPU2V0U2VydmVyU2VjcmV0EiIuY29tcGFzcy52MS5TZXRTZXJ2ZXJTZWNyZXRSZXF1ZXN0GiMuY29tcGFzcy52MS5TZXRTZXJ2ZXJTZWNyZXRSZXNwb25zZRJjChJEZWxldGVTZXJ2ZXJTZWNyZXQSJS5jb21wYXNzLnYxLkRlbGV0ZVNlcnZlclNlY3JldFJlcXVlc3QaJi5jb21wYXNzLnYxLkRlbGV0ZVNlcnZlclNlY3JldFJlc3BvbnNlEmAKEUxpc3RTZXJ2ZXJTZWNyZXRzEiQuY29tcGFzcy52MS5MaXN0U2VydmVyU2VjcmV0c1JlcXVlc3QaJS5jb21wYXNzLnYxLkxpc3RTZXJ2ZXJTZWNyZXRzUmVzcG9uc2ViBnByb3RvMw", [file_google_protobuf_timestamp]);
 
 /**
  * @generated from message compass.v1.SetSecretRequest
@@ -660,6 +660,24 @@ export type AgentSessionStatus = Message<"compass.v1.AgentSessionStatus"> & {
    * @generated from field: string agent_account_id = 3;
    */
   agentAccountId: string;
+
+  /**
+   * The runtime tier this session's workload runs on, and how its egress is
+   * constrained. Both are backward-compatible appends (buf: non-breaking) and
+   * both are reported by the Runner that owns the session, because it is the
+   * component that resolved the backend. Posture is carried separately rather
+   * than inferred from the tier: a tier's enforcement is a property of the
+   * backend, and a client deriving one from the other would render a stale
+   * answer the moment that changes.
+   *
+   * @generated from field: compass.v1.RuntimeTier runtime_tier = 4;
+   */
+  runtimeTier: RuntimeTier;
+
+  /**
+   * @generated from field: compass.v1.EgressPosture egress_posture = 5;
+   */
+  egressPosture: EgressPosture;
 };
 
 /**
@@ -2723,6 +2741,76 @@ export enum ServerState {
 export const ServerStateSchema: GenEnum<ServerState> = /*@__PURE__*/
   enumDesc(file_compass_v1_compass, 2);
 
+/**
+ * The runtime tier an agent workload runs on. `HOST` runs agents as direct
+ * child processes of the Runner, with no container or VM boundary.
+ *
+ * @generated from enum compass.v1.RuntimeTier
+ */
+export enum RuntimeTier {
+  /**
+   * @generated from enum value: RUNTIME_TIER_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: RUNTIME_TIER_PODMAN = 1;
+   */
+  PODMAN = 1,
+
+  /**
+   * @generated from enum value: RUNTIME_TIER_MICROVM = 2;
+   */
+  MICROVM = 2,
+
+  /**
+   * @generated from enum value: RUNTIME_TIER_APPLE_CONTAINER = 3;
+   */
+  APPLE_CONTAINER = 3,
+
+  /**
+   * @generated from enum value: RUNTIME_TIER_HOST = 4;
+   */
+  HOST = 4,
+}
+
+/**
+ * Describes the enum compass.v1.RuntimeTier.
+ */
+export const RuntimeTierSchema: GenEnum<RuntimeTier> = /*@__PURE__*/
+  enumDesc(file_compass_v1_compass, 3);
+
+/**
+ * How an agent's egress is constrained. `UNENFORCED` means the tier cannot
+ * constrain it at all — a host process shares the host's network namespace, so
+ * there is no boundary to firewall. It is a declared posture, never a failed
+ * arm, and a client must not render it as contained.
+ *
+ * @generated from enum compass.v1.EgressPosture
+ */
+export enum EgressPosture {
+  /**
+   * @generated from enum value: EGRESS_POSTURE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: EGRESS_POSTURE_ARMED = 1;
+   */
+  ARMED = 1,
+
+  /**
+   * @generated from enum value: EGRESS_POSTURE_UNENFORCED = 2;
+   */
+  UNENFORCED = 2,
+}
+
+/**
+ * Describes the enum compass.v1.EgressPosture.
+ */
+export const EgressPostureSchema: GenEnum<EgressPosture> = /*@__PURE__*/
+  enumDesc(file_compass_v1_compass, 4);
+
 /**
  * Agent-session lifecycle states. `ERRORED` is an unexpected agent exit (OOM,
  * panic, engine restart); recovery is an explicit ReloadAgentSession, never an
@@ -2786,7 +2874,7 @@ export enum AgentSessionState {
  * Describes the enum compass.v1.AgentSessionState.
  */
 export const AgentSessionStateSchema: GenEnum<AgentSessionState> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 3);
+  enumDesc(file_compass_v1_compass, 5);
 
 /**
  * @generated from enum compass.v1.AgentToolCallStatus
@@ -2822,7 +2910,7 @@ export enum AgentToolCallStatus {
  * Describes the enum compass.v1.AgentToolCallStatus.
  */
 export const AgentToolCallStatusSchema: GenEnum<AgentToolCallStatus> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 4);
+  enumDesc(file_compass_v1_compass, 6);
 
 /**
  * @generated from enum compass.v1.AgentPlanEntryStatus
@@ -2853,7 +2941,7 @@ export enum AgentPlanEntryStatus {
  * Describes the enum compass.v1.AgentPlanEntryStatus.
  */
 export const AgentPlanEntryStatusSchema: GenEnum<AgentPlanEntryStatus> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 5);
+  enumDesc(file_compass_v1_compass, 7);
 
 /**
  * The control op-kind a SessionInjection records. Mirrors the internal
@@ -2885,7 +2973,7 @@ export enum SessionInjectionKind {
  * Describes the enum compass.v1.SessionInjectionKind.
  */
 export const SessionInjectionKindSchema: GenEnum<SessionInjectionKind> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 6);
+  enumDesc(file_compass_v1_compass, 8);
 
 /**
  * The class of a SessionError. ERROR pairs with the ERRORED lifecycle
@@ -2915,7 +3003,7 @@ export enum SessionErrorKind {
  * Describes the enum compass.v1.SessionErrorKind.
  */
 export const SessionErrorKindSchema: GenEnum<SessionErrorKind> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 7);
+  enumDesc(file_compass_v1_compass, 9);
 
 /**
  * The Compass issue lifecycle, server-owned (DL-032/DL-033 + terminal ARCHIVED,
@@ -2979,7 +3067,7 @@ export enum IssueState {
  * Describes the enum compass.v1.IssueState.
  */
 export const IssueStateSchema: GenEnum<IssueState> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 8);
+  enumDesc(file_compass_v1_compass, 10);
 
 /**
  * Which forge (and which host, for self-hosted instances) an artifact lives on.
@@ -3021,7 +3109,7 @@ export enum ForgeProvider {
  * Describes the enum compass.v1.ForgeProvider.
  */
 export const ForgeProviderSchema: GenEnum<ForgeProvider> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 9);
+  enumDesc(file_compass_v1_compass, 11);
 
 /**
  * The Compass server service.
diff --git a/packages/compass-client/src/gen/compass/v1/compass_pb.ts b/packages/compass-client/src/gen/compass/v1/compass_pb.ts
index c62d151b..cc0b54ac 100644
--- a/packages/compass-client/src/gen/compass/v1/compass_pb.ts
+++ b/packages/compass-client/src/gen/compass/v1/compass_pb.ts
@@ -20,7 +20,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file compass/v1/compass.proto.
  */
 export const file_compass_v1_compass: GenFile = /*@__PURE__*/
-  fileDesc("Chhjb21wYXNzL3YxL2NvbXBhc3MucHJvdG8SCmNvbXBhc3MudjEiqAEKEFNldFNlY3JldFJlcXVlc3QSDAoEbmFtZRgBIAEoCRISCgV2YWx1ZRgCIAEoCUIDgAEBEiwKCGRlbGl2ZXJ5GAMgASgOMhouY29tcGFzcy52MS5TZWNyZXREZWxpdmVyeRIkCgRraW5kGAQgASgOMhYuY29tcGFzcy52MS5TZWNyZXRLaW5kEhAKCHByb3ZpZGVyGAUgASgJEgwKBGhvc3QYBiABKAkiEwoRU2V0U2VjcmV0UmVzcG9uc2UiFAoSTGlzdFNlY3JldHNSZXF1ZXN0IkAKE0xpc3RTZWNyZXRzUmVzcG9uc2USKQoHc2VjcmV0cxgBIAMoCzIYLmNvbXBhc3MudjEuU2VjcmV0U3RhdHVzIqABCgxTZWNyZXRTdGF0dXMSDAoEbmFtZRgBIAEoCRIOCgZpc19zZXQYAiABKAgSLAoIZGVsaXZlcnkYAyABKA4yGi5jb21wYXNzLnYxLlNlY3JldERlbGl2ZXJ5EiQKBGtpbmQYBCABKA4yFi5jb21wYXNzLnYxLlNlY3JldEtpbmQSEAoIcHJvdmlkZXIYBSABKAkSDAoEaG9zdBgGIAEoCSIjChNEZWxldGVTZWNyZXRSZXF1ZXN0EgwKBG5hbWUYASABKAkiFgoURGVsZXRlU2VjcmV0UmVzcG9uc2UiOgoWU2V0U2VydmVyU2VjcmV0UmVxdWVzdBIMCgRuYW1lGAEgASgJEhIKBXZhbHVlGAIgASgJQgOAAQEiGQoXU2V0U2VydmVyU2VjcmV0UmVzcG9uc2UiKQoZRGVsZXRlU2VydmVyU2VjcmV0UmVxdWVzdBIMCgRuYW1lGAEgASgJIhwKGkRlbGV0ZVNlcnZlclNlY3JldFJlc3BvbnNlIhoKGExpc3RTZXJ2ZXJTZWNyZXRzUmVxdWVzdCJTChlMaXN0U2VydmVyU2VjcmV0c1Jlc3BvbnNlEjYKDnNlcnZlcl9zZWNyZXRzGAEgAygLMh4uY29tcGFzcy52MS5TZXJ2ZXJTZWNyZXRTdGF0dXMiMgoSU2VydmVyU2VjcmV0U3RhdHVzEgwKBG5hbWUYASABKAkSDgoGaXNfc2V0GAIgASgIIhYKFEdldFNlcnZlckluZm9SZXF1ZXN0Ij0KFUdldFNlcnZlckluZm9SZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgJEhMKC2FwaV92ZXJzaW9uGAIgASgJIg8KDVdob0FtSVJlcXVlc3QiJAoOV2hvQW1JUmVzcG9uc2USEgoKYWNjb3VudF9pZBgBIAEoCSJDChZTdWJzY3JpYmVFdmVudHNSZXF1ZXN0EhEKCXNpbmNlX3NlcRgBIAEoBBIWCg5pbnN0YW5jZV9lcG9jaBgCIAEoBCLiAwoXU3Vic2NyaWJlRXZlbnRzUmVzcG9uc2USCwoDc2VxGAEgASgEEhIKCmF0X3VuaXhfbXMYAiABKAMSFgoOaW5zdGFuY2VfZXBvY2gYAyABKAQSFAoMc25hcHNob3Rfc2VxGAQgASgEEjEKDXNlcnZlcl9zdGF0dXMYCiABKAsyGC5jb21wYXNzLnYxLlNlcnZlclN0YXR1c0gAEjUKD3Jlc3luY19yZXF1aXJlZBgLIAEoCzIaLmNvbXBhc3MudjEuUmVzeW5jUmVxdWlyZWRIABI+ChRhZ2VudF9zZXNzaW9uX3N0YXR1cxgMIAEoCzIeLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uU3RhdHVzSAASPAoTYWdlbnRfbWVzc2FnZV9jaHVuaxgNIAEoCzIdLmNvbXBhc3MudjEuQWdlbnRNZXNzYWdlQ2h1bmtIABI0Cg9hZ2VudF90b29sX2NhbGwYDiABKAsyGS5jb21wYXNzLnYxLkFnZW50VG9vbENhbGxIABIrCgphZ2VudF9wbGFuGA8gASgLMhUuY29tcGFzcy52MS5BZ2VudFBsYW5IABIiCgVpc3N1ZRgQIAEoCzIRLmNvbXBhc3MudjEuSXNzdWVIAEIJCgdwYXlsb2FkIi4KFkxpc3RCb2FyZElzc3Vlc1JlcXVlc3QSFAoMc25hcHNob3Rfc2VxGAEgASgEIjwKF0xpc3RCb2FyZElzc3Vlc1Jlc3BvbnNlEiEKBmlzc3VlcxgBIAMoCzIRLmNvbXBhc3MudjEuSXNzdWUiNgoMU2VydmVyU3RhdHVzEiYKBXN0YXRlGAEgASgOMhcuY29tcGFzcy52MS5TZXJ2ZXJTdGF0ZSIQCg5SZXN5bmNSZXF1aXJlZCJwChJBZ2VudFNlc3Npb25TdGF0dXMSEgoKc2Vzc2lvbl9pZBgBIAEoCRIsCgVzdGF0ZRgCIAEoDjIdLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uU3RhdGUSGAoQYWdlbnRfYWNjb3VudF9pZBgDIAEoCSJJChFBZ2VudE1lc3NhZ2VDaHVuaxISCgpzZXNzaW9uX2lkGAEgASgJEgwKBHRleHQYAiABKAkSEgoKaXNfdGhvdWdodBgDIAEoCCJ5Cg1BZ2VudFRvb2xDYWxsEhIKCnNlc3Npb25faWQYASABKAkSFAoMdG9vbF9jYWxsX2lkGAIgASgJEg0KBXRpdGxlGAMgASgJEi8KBnN0YXR1cxgEIAEoDjIfLmNvbXBhc3MudjEuQWdlbnRUb29sQ2FsbFN0YXR1cyJMCglBZ2VudFBsYW4SEgoKc2Vzc2lvbl9pZBgBIAEoCRIrCgdlbnRyaWVzGAIgAygLMhouY29tcGFzcy52MS5BZ2VudFBsYW5FbnRyeSJTCg5BZ2VudFBsYW5FbnRyeRIPCgdjb250ZW50GAEgASgJEjAKBnN0YXR1cxgCIAEoDjIgLmNvbXBhc3MudjEuQWdlbnRQbGFuRW50cnlTdGF0dXMi3wMKDFNlc3Npb25FdmVudBIQCghldmVudF9pZBgBIAEoCRISCgphdF91bml4X21zGAIgASgDEjoKDmFzc2lzdGFudF90ZXh0GAMgASgLMiAuY29tcGFzcy52MS5TZXNzaW9uQXNzaXN0YW50VGV4dEgAEi8KCHRoaW5raW5nGAQgASgLMhsuY29tcGFzcy52MS5TZXNzaW9uVGhpbmtpbmdIABIwCgl0b29sX2NhbGwYBSABKAsyGy5jb21wYXNzLnYxLlNlc3Npb25Ub29sQ2FsbEgAEj0KEHRvb2xfY2FsbF91cGRhdGUYBiABKAsyIS5jb21wYXNzLnYxLlNlc3Npb25Ub29sQ2FsbFVwZGF0ZUgAEicKBHBsYW4YByABKAsyFy5jb21wYXNzLnYxLlNlc3Npb25QbGFuSAASKwoGbm90aWNlGAggASgLMhkuY29tcGFzcy52MS5TZXNzaW9uTm90aWNlSAASOQoRc2Vzc2lvbl9pbmplY3Rpb24YCSABKAsyHC5jb21wYXNzLnYxLlNlc3Npb25JbmplY3Rpb25IABIxCg1zZXNzaW9uX2Vycm9yGAogASgLMhguY29tcGFzcy52MS5TZXNzaW9uRXJyb3JIAEIHCgVldmVudCI4ChRTZXNzaW9uQXNzaXN0YW50VGV4dBIMCgR0ZXh0GAEgASgJEhIKCm1lc3NhZ2VfaWQYAiABKAkiMwoPU2Vzc2lvblRoaW5raW5nEgwKBHRleHQYASABKAkSEgoKbWVzc2FnZV9pZBgCIAEoCSJnCg9TZXNzaW9uVG9vbENhbGwSFAoMdG9vbF9jYWxsX2lkGAEgASgJEg0KBXRpdGxlGAIgASgJEi8KBnN0YXR1cxgDIAEoDjIfLmNvbXBhc3MudjEuQWdlbnRUb29sQ2FsbFN0YXR1cyKaAQoVU2Vzc2lvblRvb2xDYWxsVXBkYXRlEhQKDHRvb2xfY2FsbF9pZBgBIAEoCRIvCgZzdGF0dXMYAiABKA4yHy5jb21wYXNzLnYxLkFnZW50VG9vbENhbGxTdGF0dXMSDgoGb3V0cHV0GAMgASgJEioKBWRpZmZzGAQgAygLMhsuY29tcGFzcy52MS5TZXNzaW9uRmlsZURpZmYiVQoPU2Vzc2lvbkZpbGVEaWZmEgwKBHBhdGgYASABKAkSFQoIb2xkX3RleHQYAiABKAlIAIgBARIQCghuZXdfdGV4dBgDIAEoCUILCglfb2xkX3RleHQiOgoLU2Vzc2lvblBsYW4SKwoHZW50cmllcxgBIAMoCzIaLmNvbXBhc3MudjEuQWdlbnRQbGFuRW50cnkiOQoNU2Vzc2lvbk5vdGljZRIMCgR0ZXh0GAEgASgJEhEKBGxpbmsYAiABKAlIAIgBAUIHCgVfbGluayKDAQoQU2Vzc2lvbkluamVjdGlvbhIxCgdvcF9raW5kGAEgASgOMiAuY29tcGFzcy52MS5TZXNzaW9uSW5qZWN0aW9uS2luZBISCgptZXNzYWdlX2lkGAIgASgJEhMKC2Zyb21faGFuZGxlGAMgASgJEhMKC3RyYWNlcGFyZW50GAQgASgJImsKDFNlc3Npb25FcnJvchIqCgRraW5kGAEgASgOMhwuY29tcGFzcy52MS5TZXNzaW9uRXJyb3JLaW5kEg8KB21lc3NhZ2UYAiABKAkSEwoGc3RhdHVzGAMgASgFSACIAQFCCQoHX3N0YXR1cyIyChxTdWJzY3JpYmVBZ2VudFNlc3Npb25SZXF1ZXN0EhIKCnNlc3Npb25faWQYASABKAkifgoRQWdlbnRTZXNzaW9uRnJhbWUSEgoKc2Vzc2lvbl9pZBgBIAEoCRInCgVldmVudBgCIAEoCzIYLmNvbXBhc3MudjEuU2Vzc2lvbkV2ZW50EiwKBXN0YXRlGAMgASgOMh0uY29tcGFzcy52MS5BZ2VudFNlc3Npb25TdGF0ZSJwCh5Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlcXVlc3QSFAoMYWdlbnRfaGFuZGxlGAEgASgJEhkKEWNsaWVudF9yZXF1ZXN0X2lkGAIgASgJEg8KB3BlcnNvbmEYAyABKAkSDAoEcm9sZRgEIAEoCSI5Ch9Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlc3BvbnNlEhYKDmNvbnRhaW5lcl9uYW1lGAEgASgJIlAKG1JlbW92ZUFnZW50V29ya3NwYWNlUmVxdWVzdBIWCg5jb250YWluZXJfbmFtZRgBIAEoCRIZChFjbGllbnRfcmVxdWVzdF9pZBgCIAEoCSIeChxSZW1vdmVBZ2VudFdvcmtzcGFjZVJlc3BvbnNlImMKGFN0YXJ0QWdlbnRTZXNzaW9uUmVxdWVzdBIWCg5jb250YWluZXJfbmFtZRgBIAEoCRIZChFyZXN1bWVfc2Vzc2lvbl9pZBgDIAEoCUoECAIQA1IOaW5pdGlhbF9wcm9tcHQiLwoZU3RhcnRBZ2VudFNlc3Npb25SZXNwb25zZRISCgpzZXNzaW9uX2lkGAEgASgJIloKEVNwYXduQWdlbnRSZXF1ZXN0EhQKDGFnZW50X2hhbmRsZRgBIAEoCRIZChFjbGllbnRfcmVxdWVzdF9pZBgDIAEoCUoECAIQA1IOaW5pdGlhbF9wcm9tcHQiQAoSU3Bhd25BZ2VudFJlc3BvbnNlEhIKCnNlc3Npb25faWQYASABKAkSFgoOY29udGFpbmVyX25hbWUYAiABKAkiLQoXU3RvcEFnZW50U2Vzc2lvblJlcXVlc3QSEgoKc2Vzc2lvbl9pZBgBIAEoCSIaChhTdG9wQWdlbnRTZXNzaW9uUmVzcG9uc2UiLwoZUmVsb2FkQWdlbnRTZXNzaW9uUmVxdWVzdBISCgpzZXNzaW9uX2lkGAEgASgJIjAKGlJlbG9hZEFnZW50U2Vzc2lvblJlc3BvbnNlEhIKCnNlc3Npb25faWQYASABKAkiKwoVR2V0QWdlbnRTdGF0dXNSZXF1ZXN0EhIKCnNlc3Npb25faWQYASABKAkiSgoWR2V0QWdlbnRTdGF0dXNSZXNwb25zZRIwCghzdGF0dXNlcxgBIAMoCzIeLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uU3RhdHVzIisKEUlzc3VlVG9rZW5SZXF1ZXN0EhYKDmFjY291bnRfaGFuZGxlGAEgASgJIiMKEklzc3VlVG9rZW5SZXNwb25zZRINCgV0b2tlbhgBIAEoCSIoChJSZXZva2VUb2tlblJlcXVlc3QSEgoFdG9rZW4YASABKAlCA4ABASIVChNSZXZva2VUb2tlblJlc3BvbnNlIicKFVB1dEFnZW50Q29uZmlnUmVxdWVzdBIOCgZidW5kbGUYASABKAwiKQoWUHV0QWdlbnRDb25maWdSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgJIhsKGUdldEFnZW50Q29uZmlnSW5mb1JlcXVlc3Qi2gEKGkdldEFnZW50Q29uZmlnSW5mb1Jlc3BvbnNlEg8KB3ZlcnNpb24YASABKAkSDgoGc2tpbGxzGAIgAygJEhIKCmV4dGVuc2lvbnMYAyADKAkSEwoLbWNwX3NlcnZlcnMYBCADKAkSFAoMaGFzX3NldHRpbmdzGAUgASgIEhUKDWhhc19hZ2VudHNfbWQYBiABKAgSDQoFcnVsZXMYByADKAkSEQoJc3ViYWdlbnRzGAggAygJEhIKCmhhc19tb2RlbHMYCSABKAgSDwoHcHJvbXB0cxgKIAMoCSIaChhEZWxldGVBZ2VudENvbmZpZ1JlcXVlc3QiGwoZRGVsZXRlQWdlbnRDb25maWdSZXNwb25zZSI0Cg5Nb2RlbENhbmRpZGF0ZRIQCghwcm92aWRlchgBIAEoCRIQCghtb2RlbF9pZBgCIAEoCSJxCg1Nb2RlbE1ldGFkYXRhEhYKDmNvbnRleHRfd2luZG93GAEgASgDEhwKFGlucHV0X2Nvc3RfbWljcm9fdXNkGAIgASgDEh0KFW91dHB1dF9jb3N0X21pY3JvX3VzZBgDIAEoAxILCgNhcGkYBCABKAkihwEKEk1vZGVsUmVnaXN0cnlFbnRyeRIUCgxkaXNwbGF5X25hbWUYASABKAkSLgoKY2FuZGlkYXRlcxgCIAMoCzIaLmNvbXBhc3MudjEuTW9kZWxDYW5kaWRhdGUSKwoIbWV0YWRhdGEYAyABKAsyGS5jb21wYXNzLnYxLk1vZGVsTWV0YWRhdGEimAEKDU1vZGVsUmVnaXN0cnkSNwoHZW50cmllcxgBIAMoCzImLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeS5FbnRyaWVzRW50cnkaTgoMRW50cmllc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoCzIeLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeUVudHJ5OgI4ASJgChdQdXRNb2RlbFJlZ2lzdHJ5UmVxdWVzdBIrCghyZWdpc3RyeRgBIAEoCzIZLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeRIYChBleHBlY3RlZF92ZXJzaW9uGAIgASgDIisKGFB1dE1vZGVsUmVnaXN0cnlSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgDIhkKF0dldE1vZGVsUmVnaXN0cnlSZXF1ZXN0IlgKGEdldE1vZGVsUmVnaXN0cnlSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgDEisKCHJlZ2lzdHJ5GAIgASgLMhkuY29tcGFzcy52MS5Nb2RlbFJlZ2lzdHJ5IhwKGkRlbGV0ZU1vZGVsUmVnaXN0cnlSZXF1ZXN0Ih0KG0RlbGV0ZU1vZGVsUmVnaXN0cnlSZXNwb25zZSI+ChBBZ2VudEF0dHJpYnV0aW9uEhQKDGFnZW50X2hhbmRsZRgBIAEoCRIUCgxvd25lcl9oYW5kbGUYAiABKAkiRQoIRm9yZ2VSZWYSKwoIcHJvdmlkZXIYASABKA4yGS5jb21wYXNzLnYxLkZvcmdlUHJvdmlkZXISDAoEaG9zdBgCIAEoCSLUAwoFSXNzdWUSCgoCaWQYASABKAkSIwoFZm9yZ2UYAiABKAsyFC5jb21wYXNzLnYxLkZvcmdlUmVmEgwKBHJlcG8YAyABKAkSDgoGbnVtYmVyGAQgASgNEg0KBXRpdGxlGAUgASgJEgwKBGJvZHkYBiABKAkSEwoLZm9yZ2Vfc3RhdGUYByABKAkSCwoDdXJsGAggASgJEisKBWFnZW50GAkgASgLMhwuY29tcGFzcy52MS5BZ2VudEF0dHJpYnV0aW9uEhUKDWZvcmdlX2FjY291bnQYCiABKAkSDgoGbGFiZWxzGAsgAygJEi4KCnVwZGF0ZWRfYXQYEyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEiUKBXN0YXRlGAwgASgOMhYuY29tcGFzcy52MS5Jc3N1ZVN0YXRlEhAKCHByaW9yaXR5GA0gASgJEhAKCGFzc2lnbmVlGA4gASgJEg8KB3N1bW1hcnkYDyABKAkSDgoGYnJhbmNoGBAgASgJEiQKA3BycxgRIAMoCzIXLmNvbXBhc3MudjEuUHVsbFJlcXVlc3QSJwoHdHJhY2tlchgSIAEoCzIWLmNvbXBhc3MudjEuVHJhY2tlclJlZiKeAwoLUHVsbFJlcXVlc3QSIwoFZm9yZ2UYASABKAsyFC5jb21wYXNzLnYxLkZvcmdlUmVmEgwKBHJlcG8YAiABKAkSDgoGbnVtYmVyGAMgASgNEg0KBXRpdGxlGAQgASgJEhMKC2ZvcmdlX3N0YXRlGAUgASgJEgsKA3VybBgGIAEoCRIQCghoZWFkX3JlZhgHIAEoCRIQCghiYXNlX3JlZhgIIAEoCRIrCgVhZ2VudBgJIAEoCzIcLmNvbXBhc3MudjEuQWdlbnRBdHRyaWJ1dGlvbhIVCg1mb3JnZV9hY2NvdW50GAogASgJEg0KBWRyYWZ0GAsgASgIEikKB2NoYW5nZWQYDCABKAsyGC5jb21wYXNzLnYxLkNoYW5nZWRTdGF0cxIpCgZjaGVja3MYDSABKAsyGS5jb21wYXNzLnYxLkNoZWNrc1N1bW1hcnkSIwoHcmV2aWV3cxgOIAMoCzISLmNvbXBhc3MudjEuUmV2aWV3EikKB3RocmVhZHMYDyADKAsyGC5jb21wYXNzLnYxLlJldmlld1RocmVhZCJTCg1DaGVja3NTdW1tYXJ5EhAKCGhlYWRfc2hhGAEgASgJEg0KBXN0YXRlGAIgASgJEiEKBmNoZWNrcxgDIAMoCzIRLmNvbXBhc3MudjEuQ2hlY2siQwoFQ2hlY2sSDAoEbmFtZRgBIAEoCRINCgVzdGF0ZRgCIAEoCRILCgN1cmwYAyABKAkSEAoIcmVxdWlyZWQYBCABKAgiQwoMQ2hhbmdlZFN0YXRzEg0KBWZpbGVzGAEgASgNEhEKCWFkZGl0aW9ucxgCIAEoDRIRCglkZWxldGlvbnMYAyABKA0iQwoKVHJhY2tlclJlZhIMCgRraW5kGAEgASgJEgoKAmlkGAIgASgJEg4KBnN0YXR1cxgDIAEoCRILCgN1cmwYBCABKAkiRwoGUmV2aWV3Eg4KBmF1dGhvchgBIAEoCRIOCgZpc19ib3QYAiABKAgSDwoHdmVyZGljdBgDIAEoCRIMCgRib2R5GAQgASgJIlUKDFJldmlld1RocmVhZBIMCgRwYXRoGAEgASgJEhAKCHJlc29sdmVkGAIgASgIEiUKCGNvbW1lbnRzGAMgAygLMhMuY29tcGFzcy52MS5Db21tZW50IjcKB0NvbW1lbnQSDgoGYXV0aG9yGAEgASgJEg4KBmlzX2JvdBgCIAEoCBIMCgRib2R5GAMgASgJKmQKDlNlY3JldERlbGl2ZXJ5Eh8KG1NFQ1JFVF9ERUxJVkVSWV9VTlNQRUNJRklFRBAAEhgKFFNFQ1JFVF9ERUxJVkVSWV9GSUxFEAESFwoTU0VDUkVUX0RFTElWRVJZX0VOVhACKnAKClNlY3JldEtpbmQSGwoXU0VDUkVUX0tJTkRfVU5TUEVDSUZJRUQQABIXChNTRUNSRVRfS0lORF9HRU5FUklDEAESGAoUU0VDUkVUX0tJTkRfUFJPVklERVIQAhISCg5TRUNSRVRfS0lORF9HSBADKkMKC1NlcnZlclN0YXRlEhwKGFNFUlZFUl9TVEFURV9VTlNQRUNJRklFRBAAEhYKElNFUlZFUl9TVEFURV9SRUFEWRABKoICChFBZ2VudFNlc3Npb25TdGF0ZRIjCh9BR0VOVF9TRVNTSU9OX1NUQVRFX1VOU1BFQ0lGSUVEEAASIAocQUdFTlRfU0VTU0lPTl9TVEFURV9TVEFSVElORxABEh0KGUFHRU5UX1NFU1NJT05fU1RBVEVfUkVBRFkQAhIfChtBR0VOVF9TRVNTSU9OX1NUQVRFX1dPUktJTkcQAxIfChtBR0VOVF9TRVNTSU9OX1NUQVRFX1NUT1BQRUQQBBIfChtBR0VOVF9TRVNTSU9OX1NUQVRFX0VSUk9SRUQQBRIkCiBBR0VOVF9TRVNTSU9OX1NUQVRFX0RJU0NPTk5FQ1RFRBAGKtIBChNBZ2VudFRvb2xDYWxsU3RhdHVzEiYKIkFHRU5UX1RPT0xfQ0FMTF9TVEFUVVNfVU5TUEVDSUZJRUQQABIiCh5BR0VOVF9UT09MX0NBTExfU1RBVFVTX1BFTkRJTkcQARImCiJBR0VOVF9UT09MX0NBTExfU1RBVFVTX0lOX1BST0dSRVNTEAISJAogQUdFTlRfVE9PTF9DQUxMX1NUQVRVU19DT01QTEVURUQQAxIhCh1BR0VOVF9UT09MX0NBTExfU1RBVFVTX0ZBSUxFRBAEKrQBChRBZ2VudFBsYW5FbnRyeVN0YXR1cxInCiNBR0VOVF9QTEFOX0VOVFJZX1NUQVRVU19VTlNQRUNJRklFRBAAEiMKH0FHRU5UX1BMQU5fRU5UUllfU1RBVFVTX1BFTkRJTkcQARInCiNBR0VOVF9QTEFOX0VOVFJZX1NUQVRVU19JTl9QUk9HUkVTUxACEiUKIUFHRU5UX1BMQU5fRU5UUllfU1RBVFVTX0NPTVBMRVRFRBADKoQBChRTZXNzaW9uSW5qZWN0aW9uS2luZBImCiJTRVNTSU9OX0lOSkVDVElPTl9LSU5EX1VOU1BFQ0lGSUVEEAASIAocU0VTU0lPTl9JTkpFQ1RJT05fS0lORF9TVEVFUhABEiIKHlNFU1NJT05fSU5KRUNUSU9OX0tJTkRfREVMSVZFUhACKnQKEFNlc3Npb25FcnJvcktpbmQSIgoeU0VTU0lPTl9FUlJPUl9LSU5EX1VOU1BFQ0lGSUVEEAASHAoYU0VTU0lPTl9FUlJPUl9LSU5EX0VSUk9SEAESHgoaU0VTU0lPTl9FUlJPUl9LSU5EX0FCT1JURUQQAirxAQoKSXNzdWVTdGF0ZRIbChdJU1NVRV9TVEFURV9VTlNQRUNJRklFRBAAEhcKE0lTU1VFX1NUQVRFX0JBQ0tMT0cQARIUChBJU1NVRV9TVEFURV9UT0RPEAISFgoSSVNTVUVfU1RBVEVfUVVFVUVEEAMSFwoTSVNTVUVfU1RBVEVfQkxPQ0tFRBAEEhsKF0lTU1VFX1NUQVRFX0lOX1BST0dSRVNTEAUSGQoVSVNTVUVfU1RBVEVfSU5fUkVWSUVXEAYSFAoQSVNTVUVfU1RBVEVfRE9ORRAHEhgKFElTU1VFX1NUQVRFX0FSQ0hJVkVEEAgqnAEKDUZvcmdlUHJvdmlkZXISHgoaRk9SR0VfUFJPVklERVJfVU5TUEVDSUZJRUQQABIZChVGT1JHRV9QUk9WSURFUl9HSVRIVUIQARIZChVGT1JHRV9QUk9WSURFUl9HSVRMQUIQAhIaChZGT1JHRV9QUk9WSURFUl9GT1JHRUpPEAMSGQoVRk9SR0VfUFJPVklERVJfTElORUFSEAQy0w4KDkNvbXBhc3NTZXJ2aWNlElQKDUdldFNlcnZlckluZm8SIC5jb21wYXNzLnYxLkdldFNlcnZlckluZm9SZXF1ZXN0GiEuY29tcGFzcy52MS5HZXRTZXJ2ZXJJbmZvUmVzcG9uc2USPwoGV2hvQW1JEhkuY29tcGFzcy52MS5XaG9BbUlSZXF1ZXN0GhouY29tcGFzcy52MS5XaG9BbUlSZXNwb25zZRJcCg9TdWJzY3JpYmVFdmVudHMSIi5jb21wYXNzLnYxLlN1YnNjcmliZUV2ZW50c1JlcXVlc3QaIy5jb21wYXNzLnYxLlN1YnNjcmliZUV2ZW50c1Jlc3BvbnNlMAESWgoPTGlzdEJvYXJkSXNzdWVzEiIuY29tcGFzcy52MS5MaXN0Qm9hcmRJc3N1ZXNSZXF1ZXN0GiMuY29tcGFzcy52MS5MaXN0Qm9hcmRJc3N1ZXNSZXNwb25zZRJyChdQcm92aXNpb25BZ2VudFdvcmtzcGFjZRIqLmNvbXBhc3MudjEuUHJvdmlzaW9uQWdlbnRXb3Jrc3BhY2VSZXF1ZXN0GisuY29tcGFzcy52MS5Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlc3BvbnNlEmAKEVN0YXJ0QWdlbnRTZXNzaW9uEiQuY29tcGFzcy52MS5TdGFydEFnZW50U2Vzc2lvblJlcXVlc3QaJS5jb21wYXNzLnYxLlN0YXJ0QWdlbnRTZXNzaW9uUmVzcG9uc2USSwoKU3Bhd25BZ2VudBIdLmNvbXBhc3MudjEuU3Bhd25BZ2VudFJlcXVlc3QaHi5jb21wYXNzLnYxLlNwYXduQWdlbnRSZXNwb25zZRJdChBTdG9wQWdlbnRTZXNzaW9uEiMuY29tcGFzcy52MS5TdG9wQWdlbnRTZXNzaW9uUmVxdWVzdBokLmNvbXBhc3MudjEuU3RvcEFnZW50U2Vzc2lvblJlc3BvbnNlEmkKFFJlbW92ZUFnZW50V29ya3NwYWNlEicuY29tcGFzcy52MS5SZW1vdmVBZ2VudFdvcmtzcGFjZVJlcXVlc3QaKC5jb21wYXNzLnYxLlJlbW92ZUFnZW50V29ya3NwYWNlUmVzcG9uc2USYwoSUmVsb2FkQWdlbnRTZXNzaW9uEiUuY29tcGFzcy52MS5SZWxvYWRBZ2VudFNlc3Npb25SZXF1ZXN0GiYuY29tcGFzcy52MS5SZWxvYWRBZ2VudFNlc3Npb25SZXNwb25zZRJXCg5HZXRBZ2VudFN0YXR1cxIhLmNvbXBhc3MudjEuR2V0QWdlbnRTdGF0dXNSZXF1ZXN0GiIuY29tcGFzcy52MS5HZXRBZ2VudFN0YXR1c1Jlc3BvbnNlEmIKFVN1YnNjcmliZUFnZW50U2Vzc2lvbhIoLmNvbXBhc3MudjEuU3Vic2NyaWJlQWdlbnRTZXNzaW9uUmVxdWVzdBodLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uRnJhbWUwARJLCgpJc3N1ZVRva2VuEh0uY29tcGFzcy52MS5Jc3N1ZVRva2VuUmVxdWVzdBoeLmNvbXBhc3MudjEuSXNzdWVUb2tlblJlc3BvbnNlEk4KC1Jldm9rZVRva2VuEh4uY29tcGFzcy52MS5SZXZva2VUb2tlblJlcXVlc3QaHy5jb21wYXNzLnYxLlJldm9rZVRva2VuUmVzcG9uc2USVwoOUHV0QWdlbnRDb25maWcSIS5jb21wYXNzLnYxLlB1dEFnZW50Q29uZmlnUmVxdWVzdBoiLmNvbXBhc3MudjEuUHV0QWdlbnRDb25maWdSZXNwb25zZRJjChJHZXRBZ2VudENvbmZpZ0luZm8SJS5jb21wYXNzLnYxLkdldEFnZW50Q29uZmlnSW5mb1JlcXVlc3QaJi5jb21wYXNzLnYxLkdldEFnZW50Q29uZmlnSW5mb1Jlc3BvbnNlEmAKEURlbGV0ZUFnZW50Q29uZmlnEiQuY29tcGFzcy52MS5EZWxldGVBZ2VudENvbmZpZ1JlcXVlc3QaJS5jb21wYXNzLnYxLkRlbGV0ZUFnZW50Q29uZmlnUmVzcG9uc2USXQoQUHV0TW9kZWxSZWdpc3RyeRIjLmNvbXBhc3MudjEuUHV0TW9kZWxSZWdpc3RyeVJlcXVlc3QaJC5jb21wYXNzLnYxLlB1dE1vZGVsUmVnaXN0cnlSZXNwb25zZRJdChBHZXRNb2RlbFJlZ2lzdHJ5EiMuY29tcGFzcy52MS5HZXRNb2RlbFJlZ2lzdHJ5UmVxdWVzdBokLmNvbXBhc3MudjEuR2V0TW9kZWxSZWdpc3RyeVJlc3BvbnNlEmYKE0RlbGV0ZU1vZGVsUmVnaXN0cnkSJi5jb21wYXNzLnYxLkRlbGV0ZU1vZGVsUmVnaXN0cnlSZXF1ZXN0GicuY29tcGFzcy52MS5EZWxldGVNb2RlbFJlZ2lzdHJ5UmVzcG9uc2UyoAQKDlNlY3JldHNTZXJ2aWNlEkgKCVNldFNlY3JldBIcLmNvbXBhc3MudjEuU2V0U2VjcmV0UmVxdWVzdBodLmNvbXBhc3MudjEuU2V0U2VjcmV0UmVzcG9uc2USTgoLTGlzdFNlY3JldHMSHi5jb21wYXNzLnYxLkxpc3RTZWNyZXRzUmVxdWVzdBofLmNvbXBhc3MudjEuTGlzdFNlY3JldHNSZXNwb25zZRJRCgxEZWxldGVTZWNyZXQSHy5jb21wYXNzLnYxLkRlbGV0ZVNlY3JldFJlcXVlc3QaIC5jb21wYXNzLnYxLkRlbGV0ZVNlY3JldFJlc3BvbnNlEloKD1NldFNlcnZlclNlY3JldBIiLmNvbXBhc3MudjEuU2V0U2VydmVyU2VjcmV0UmVxdWVzdBojLmNvbXBhc3MudjEuU2V0U2VydmVyU2VjcmV0UmVzcG9uc2USYwoSRGVsZXRlU2VydmVyU2VjcmV0EiUuY29tcGFzcy52MS5EZWxldGVTZXJ2ZXJTZWNyZXRSZXF1ZXN0GiYuY29tcGFzcy52MS5EZWxldGVTZXJ2ZXJTZWNyZXRSZXNwb25zZRJgChFMaXN0U2VydmVyU2VjcmV0cxIkLmNvbXBhc3MudjEuTGlzdFNlcnZlclNlY3JldHNSZXF1ZXN0GiUuY29tcGFzcy52MS5MaXN0U2VydmVyU2VjcmV0c1Jlc3BvbnNlYgZwcm90bzM", [file_google_protobuf_timestamp]);
+  fileDesc("Chhjb21wYXNzL3YxL2NvbXBhc3MucHJvdG8SCmNvbXBhc3MudjEiqAEKEFNldFNlY3JldFJlcXVlc3QSDAoEbmFtZRgBIAEoCRISCgV2YWx1ZRgCIAEoCUIDgAEBEiwKCGRlbGl2ZXJ5GAMgASgOMhouY29tcGFzcy52MS5TZWNyZXREZWxpdmVyeRIkCgRraW5kGAQgASgOMhYuY29tcGFzcy52MS5TZWNyZXRLaW5kEhAKCHByb3ZpZGVyGAUgASgJEgwKBGhvc3QYBiABKAkiEwoRU2V0U2VjcmV0UmVzcG9uc2UiFAoSTGlzdFNlY3JldHNSZXF1ZXN0IkAKE0xpc3RTZWNyZXRzUmVzcG9uc2USKQoHc2VjcmV0cxgBIAMoCzIYLmNvbXBhc3MudjEuU2VjcmV0U3RhdHVzIqABCgxTZWNyZXRTdGF0dXMSDAoEbmFtZRgBIAEoCRIOCgZpc19zZXQYAiABKAgSLAoIZGVsaXZlcnkYAyABKA4yGi5jb21wYXNzLnYxLlNlY3JldERlbGl2ZXJ5EiQKBGtpbmQYBCABKA4yFi5jb21wYXNzLnYxLlNlY3JldEtpbmQSEAoIcHJvdmlkZXIYBSABKAkSDAoEaG9zdBgGIAEoCSIjChNEZWxldGVTZWNyZXRSZXF1ZXN0EgwKBG5hbWUYASABKAkiFgoURGVsZXRlU2VjcmV0UmVzcG9uc2UiOgoWU2V0U2VydmVyU2VjcmV0UmVxdWVzdBIMCgRuYW1lGAEgASgJEhIKBXZhbHVlGAIgASgJQgOAAQEiGQoXU2V0U2VydmVyU2VjcmV0UmVzcG9uc2UiKQoZRGVsZXRlU2VydmVyU2VjcmV0UmVxdWVzdBIMCgRuYW1lGAEgASgJIhwKGkRlbGV0ZVNlcnZlclNlY3JldFJlc3BvbnNlIhoKGExpc3RTZXJ2ZXJTZWNyZXRzUmVxdWVzdCJTChlMaXN0U2VydmVyU2VjcmV0c1Jlc3BvbnNlEjYKDnNlcnZlcl9zZWNyZXRzGAEgAygLMh4uY29tcGFzcy52MS5TZXJ2ZXJTZWNyZXRTdGF0dXMiMgoSU2VydmVyU2VjcmV0U3RhdHVzEgwKBG5hbWUYASABKAkSDgoGaXNfc2V0GAIgASgIIhYKFEdldFNlcnZlckluZm9SZXF1ZXN0Ij0KFUdldFNlcnZlckluZm9SZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgJEhMKC2FwaV92ZXJzaW9uGAIgASgJIg8KDVdob0FtSVJlcXVlc3QiJAoOV2hvQW1JUmVzcG9uc2USEgoKYWNjb3VudF9pZBgBIAEoCSJDChZTdWJzY3JpYmVFdmVudHNSZXF1ZXN0EhEKCXNpbmNlX3NlcRgBIAEoBBIWCg5pbnN0YW5jZV9lcG9jaBgCIAEoBCLiAwoXU3Vic2NyaWJlRXZlbnRzUmVzcG9uc2USCwoDc2VxGAEgASgEEhIKCmF0X3VuaXhfbXMYAiABKAMSFgoOaW5zdGFuY2VfZXBvY2gYAyABKAQSFAoMc25hcHNob3Rfc2VxGAQgASgEEjEKDXNlcnZlcl9zdGF0dXMYCiABKAsyGC5jb21wYXNzLnYxLlNlcnZlclN0YXR1c0gAEjUKD3Jlc3luY19yZXF1aXJlZBgLIAEoCzIaLmNvbXBhc3MudjEuUmVzeW5jUmVxdWlyZWRIABI+ChRhZ2VudF9zZXNzaW9uX3N0YXR1cxgMIAEoCzIeLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uU3RhdHVzSAASPAoTYWdlbnRfbWVzc2FnZV9jaHVuaxgNIAEoCzIdLmNvbXBhc3MudjEuQWdlbnRNZXNzYWdlQ2h1bmtIABI0Cg9hZ2VudF90b29sX2NhbGwYDiABKAsyGS5jb21wYXNzLnYxLkFnZW50VG9vbENhbGxIABIrCgphZ2VudF9wbGFuGA8gASgLMhUuY29tcGFzcy52MS5BZ2VudFBsYW5IABIiCgVpc3N1ZRgQIAEoCzIRLmNvbXBhc3MudjEuSXNzdWVIAEIJCgdwYXlsb2FkIi4KFkxpc3RCb2FyZElzc3Vlc1JlcXVlc3QSFAoMc25hcHNob3Rfc2VxGAEgASgEIjwKF0xpc3RCb2FyZElzc3Vlc1Jlc3BvbnNlEiEKBmlzc3VlcxgBIAMoCzIRLmNvbXBhc3MudjEuSXNzdWUiNgoMU2VydmVyU3RhdHVzEiYKBXN0YXRlGAEgASgOMhcuY29tcGFzcy52MS5TZXJ2ZXJTdGF0ZSIQCg5SZXN5bmNSZXF1aXJlZCLSAQoSQWdlbnRTZXNzaW9uU3RhdHVzEhIKCnNlc3Npb25faWQYASABKAkSLAoFc3RhdGUYAiABKA4yHS5jb21wYXNzLnYxLkFnZW50U2Vzc2lvblN0YXRlEhgKEGFnZW50X2FjY291bnRfaWQYAyABKAkSLQoMcnVudGltZV90aWVyGAQgASgOMhcuY29tcGFzcy52MS5SdW50aW1lVGllchIxCg5lZ3Jlc3NfcG9zdHVyZRgFIAEoDjIZLmNvbXBhc3MudjEuRWdyZXNzUG9zdHVyZSJJChFBZ2VudE1lc3NhZ2VDaHVuaxISCgpzZXNzaW9uX2lkGAEgASgJEgwKBHRleHQYAiABKAkSEgoKaXNfdGhvdWdodBgDIAEoCCJ5Cg1BZ2VudFRvb2xDYWxsEhIKCnNlc3Npb25faWQYASABKAkSFAoMdG9vbF9jYWxsX2lkGAIgASgJEg0KBXRpdGxlGAMgASgJEi8KBnN0YXR1cxgEIAEoDjIfLmNvbXBhc3MudjEuQWdlbnRUb29sQ2FsbFN0YXR1cyJMCglBZ2VudFBsYW4SEgoKc2Vzc2lvbl9pZBgBIAEoCRIrCgdlbnRyaWVzGAIgAygLMhouY29tcGFzcy52MS5BZ2VudFBsYW5FbnRyeSJTCg5BZ2VudFBsYW5FbnRyeRIPCgdjb250ZW50GAEgASgJEjAKBnN0YXR1cxgCIAEoDjIgLmNvbXBhc3MudjEuQWdlbnRQbGFuRW50cnlTdGF0dXMi3wMKDFNlc3Npb25FdmVudBIQCghldmVudF9pZBgBIAEoCRISCgphdF91bml4X21zGAIgASgDEjoKDmFzc2lzdGFudF90ZXh0GAMgASgLMiAuY29tcGFzcy52MS5TZXNzaW9uQXNzaXN0YW50VGV4dEgAEi8KCHRoaW5raW5nGAQgASgLMhsuY29tcGFzcy52MS5TZXNzaW9uVGhpbmtpbmdIABIwCgl0b29sX2NhbGwYBSABKAsyGy5jb21wYXNzLnYxLlNlc3Npb25Ub29sQ2FsbEgAEj0KEHRvb2xfY2FsbF91cGRhdGUYBiABKAsyIS5jb21wYXNzLnYxLlNlc3Npb25Ub29sQ2FsbFVwZGF0ZUgAEicKBHBsYW4YByABKAsyFy5jb21wYXNzLnYxLlNlc3Npb25QbGFuSAASKwoGbm90aWNlGAggASgLMhkuY29tcGFzcy52MS5TZXNzaW9uTm90aWNlSAASOQoRc2Vzc2lvbl9pbmplY3Rpb24YCSABKAsyHC5jb21wYXNzLnYxLlNlc3Npb25JbmplY3Rpb25IABIxCg1zZXNzaW9uX2Vycm9yGAogASgLMhguY29tcGFzcy52MS5TZXNzaW9uRXJyb3JIAEIHCgVldmVudCI4ChRTZXNzaW9uQXNzaXN0YW50VGV4dBIMCgR0ZXh0GAEgASgJEhIKCm1lc3NhZ2VfaWQYAiABKAkiMwoPU2Vzc2lvblRoaW5raW5nEgwKBHRleHQYASABKAkSEgoKbWVzc2FnZV9pZBgCIAEoCSJnCg9TZXNzaW9uVG9vbENhbGwSFAoMdG9vbF9jYWxsX2lkGAEgASgJEg0KBXRpdGxlGAIgASgJEi8KBnN0YXR1cxgDIAEoDjIfLmNvbXBhc3MudjEuQWdlbnRUb29sQ2FsbFN0YXR1cyKaAQoVU2Vzc2lvblRvb2xDYWxsVXBkYXRlEhQKDHRvb2xfY2FsbF9pZBgBIAEoCRIvCgZzdGF0dXMYAiABKA4yHy5jb21wYXNzLnYxLkFnZW50VG9vbENhbGxTdGF0dXMSDgoGb3V0cHV0GAMgASgJEioKBWRpZmZzGAQgAygLMhsuY29tcGFzcy52MS5TZXNzaW9uRmlsZURpZmYiVQoPU2Vzc2lvbkZpbGVEaWZmEgwKBHBhdGgYASABKAkSFQoIb2xkX3RleHQYAiABKAlIAIgBARIQCghuZXdfdGV4dBgDIAEoCUILCglfb2xkX3RleHQiOgoLU2Vzc2lvblBsYW4SKwoHZW50cmllcxgBIAMoCzIaLmNvbXBhc3MudjEuQWdlbnRQbGFuRW50cnkiOQoNU2Vzc2lvbk5vdGljZRIMCgR0ZXh0GAEgASgJEhEKBGxpbmsYAiABKAlIAIgBAUIHCgVfbGluayKDAQoQU2Vzc2lvbkluamVjdGlvbhIxCgdvcF9raW5kGAEgASgOMiAuY29tcGFzcy52MS5TZXNzaW9uSW5qZWN0aW9uS2luZBISCgptZXNzYWdlX2lkGAIgASgJEhMKC2Zyb21faGFuZGxlGAMgASgJEhMKC3RyYWNlcGFyZW50GAQgASgJImsKDFNlc3Npb25FcnJvchIqCgRraW5kGAEgASgOMhwuY29tcGFzcy52MS5TZXNzaW9uRXJyb3JLaW5kEg8KB21lc3NhZ2UYAiABKAkSEwoGc3RhdHVzGAMgASgFSACIAQFCCQoHX3N0YXR1cyIyChxTdWJzY3JpYmVBZ2VudFNlc3Npb25SZXF1ZXN0EhIKCnNlc3Npb25faWQYASABKAkifgoRQWdlbnRTZXNzaW9uRnJhbWUSEgoKc2Vzc2lvbl9pZBgBIAEoCRInCgVldmVudBgCIAEoCzIYLmNvbXBhc3MudjEuU2Vzc2lvbkV2ZW50EiwKBXN0YXRlGAMgASgOMh0uY29tcGFzcy52MS5BZ2VudFNlc3Npb25TdGF0ZSJwCh5Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlcXVlc3QSFAoMYWdlbnRfaGFuZGxlGAEgASgJEhkKEWNsaWVudF9yZXF1ZXN0X2lkGAIgASgJEg8KB3BlcnNvbmEYAyABKAkSDAoEcm9sZRgEIAEoCSI5Ch9Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlc3BvbnNlEhYKDmNvbnRhaW5lcl9uYW1lGAEgASgJIlAKG1JlbW92ZUFnZW50V29ya3NwYWNlUmVxdWVzdBIWCg5jb250YWluZXJfbmFtZRgBIAEoCRIZChFjbGllbnRfcmVxdWVzdF9pZBgCIAEoCSIeChxSZW1vdmVBZ2VudFdvcmtzcGFjZVJlc3BvbnNlImMKGFN0YXJ0QWdlbnRTZXNzaW9uUmVxdWVzdBIWCg5jb250YWluZXJfbmFtZRgBIAEoCRIZChFyZXN1bWVfc2Vzc2lvbl9pZBgDIAEoCUoECAIQA1IOaW5pdGlhbF9wcm9tcHQiLwoZU3RhcnRBZ2VudFNlc3Npb25SZXNwb25zZRISCgpzZXNzaW9uX2lkGAEgASgJIloKEVNwYXduQWdlbnRSZXF1ZXN0EhQKDGFnZW50X2hhbmRsZRgBIAEoCRIZChFjbGllbnRfcmVxdWVzdF9pZBgDIAEoCUoECAIQA1IOaW5pdGlhbF9wcm9tcHQiQAoSU3Bhd25BZ2VudFJlc3BvbnNlEhIKCnNlc3Npb25faWQYASABKAkSFgoOY29udGFpbmVyX25hbWUYAiABKAkiLQoXU3RvcEFnZW50U2Vzc2lvblJlcXVlc3QSEgoKc2Vzc2lvbl9pZBgBIAEoCSIaChhTdG9wQWdlbnRTZXNzaW9uUmVzcG9uc2UiLwoZUmVsb2FkQWdlbnRTZXNzaW9uUmVxdWVzdBISCgpzZXNzaW9uX2lkGAEgASgJIjAKGlJlbG9hZEFnZW50U2Vzc2lvblJlc3BvbnNlEhIKCnNlc3Npb25faWQYASABKAkiKwoVR2V0QWdlbnRTdGF0dXNSZXF1ZXN0EhIKCnNlc3Npb25faWQYASABKAkiSgoWR2V0QWdlbnRTdGF0dXNSZXNwb25zZRIwCghzdGF0dXNlcxgBIAMoCzIeLmNvbXBhc3MudjEuQWdlbnRTZXNzaW9uU3RhdHVzIisKEUlzc3VlVG9rZW5SZXF1ZXN0EhYKDmFjY291bnRfaGFuZGxlGAEgASgJIiMKEklzc3VlVG9rZW5SZXNwb25zZRINCgV0b2tlbhgBIAEoCSIoChJSZXZva2VUb2tlblJlcXVlc3QSEgoFdG9rZW4YASABKAlCA4ABASIVChNSZXZva2VUb2tlblJlc3BvbnNlIicKFVB1dEFnZW50Q29uZmlnUmVxdWVzdBIOCgZidW5kbGUYASABKAwiKQoWUHV0QWdlbnRDb25maWdSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgJIhsKGUdldEFnZW50Q29uZmlnSW5mb1JlcXVlc3Qi2gEKGkdldEFnZW50Q29uZmlnSW5mb1Jlc3BvbnNlEg8KB3ZlcnNpb24YASABKAkSDgoGc2tpbGxzGAIgAygJEhIKCmV4dGVuc2lvbnMYAyADKAkSEwoLbWNwX3NlcnZlcnMYBCADKAkSFAoMaGFzX3NldHRpbmdzGAUgASgIEhUKDWhhc19hZ2VudHNfbWQYBiABKAgSDQoFcnVsZXMYByADKAkSEQoJc3ViYWdlbnRzGAggAygJEhIKCmhhc19tb2RlbHMYCSABKAgSDwoHcHJvbXB0cxgKIAMoCSIaChhEZWxldGVBZ2VudENvbmZpZ1JlcXVlc3QiGwoZRGVsZXRlQWdlbnRDb25maWdSZXNwb25zZSI0Cg5Nb2RlbENhbmRpZGF0ZRIQCghwcm92aWRlchgBIAEoCRIQCghtb2RlbF9pZBgCIAEoCSJxCg1Nb2RlbE1ldGFkYXRhEhYKDmNvbnRleHRfd2luZG93GAEgASgDEhwKFGlucHV0X2Nvc3RfbWljcm9fdXNkGAIgASgDEh0KFW91dHB1dF9jb3N0X21pY3JvX3VzZBgDIAEoAxILCgNhcGkYBCABKAkihwEKEk1vZGVsUmVnaXN0cnlFbnRyeRIUCgxkaXNwbGF5X25hbWUYASABKAkSLgoKY2FuZGlkYXRlcxgCIAMoCzIaLmNvbXBhc3MudjEuTW9kZWxDYW5kaWRhdGUSKwoIbWV0YWRhdGEYAyABKAsyGS5jb21wYXNzLnYxLk1vZGVsTWV0YWRhdGEimAEKDU1vZGVsUmVnaXN0cnkSNwoHZW50cmllcxgBIAMoCzImLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeS5FbnRyaWVzRW50cnkaTgoMRW50cmllc0VudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoCzIeLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeUVudHJ5OgI4ASJgChdQdXRNb2RlbFJlZ2lzdHJ5UmVxdWVzdBIrCghyZWdpc3RyeRgBIAEoCzIZLmNvbXBhc3MudjEuTW9kZWxSZWdpc3RyeRIYChBleHBlY3RlZF92ZXJzaW9uGAIgASgDIisKGFB1dE1vZGVsUmVnaXN0cnlSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgDIhkKF0dldE1vZGVsUmVnaXN0cnlSZXF1ZXN0IlgKGEdldE1vZGVsUmVnaXN0cnlSZXNwb25zZRIPCgd2ZXJzaW9uGAEgASgDEisKCHJlZ2lzdHJ5GAIgASgLMhkuY29tcGFzcy52MS5Nb2RlbFJlZ2lzdHJ5IhwKGkRlbGV0ZU1vZGVsUmVnaXN0cnlSZXF1ZXN0Ih0KG0RlbGV0ZU1vZGVsUmVnaXN0cnlSZXNwb25zZSI+ChBBZ2VudEF0dHJpYnV0aW9uEhQKDGFnZW50X2hhbmRsZRgBIAEoCRIUCgxvd25lcl9oYW5kbGUYAiABKAkiRQoIRm9yZ2VSZWYSKwoIcHJvdmlkZXIYASABKA4yGS5jb21wYXNzLnYxLkZvcmdlUHJvdmlkZXISDAoEaG9zdBgCIAEoCSLUAwoFSXNzdWUSCgoCaWQYASABKAkSIwoFZm9yZ2UYAiABKAsyFC5jb21wYXNzLnYxLkZvcmdlUmVmEgwKBHJlcG8YAyABKAkSDgoGbnVtYmVyGAQgASgNEg0KBXRpdGxlGAUgASgJEgwKBGJvZHkYBiABKAkSEwoLZm9yZ2Vfc3RhdGUYByABKAkSCwoDdXJsGAggASgJEisKBWFnZW50GAkgASgLMhwuY29tcGFzcy52MS5BZ2VudEF0dHJpYnV0aW9uEhUKDWZvcmdlX2FjY291bnQYCiABKAkSDgoGbGFiZWxzGAsgAygJEi4KCnVwZGF0ZWRfYXQYEyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEiUKBXN0YXRlGAwgASgOMhYuY29tcGFzcy52MS5Jc3N1ZVN0YXRlEhAKCHByaW9yaXR5GA0gASgJEhAKCGFzc2lnbmVlGA4gASgJEg8KB3N1bW1hcnkYDyABKAkSDgoGYnJhbmNoGBAgASgJEiQKA3BycxgRIAMoCzIXLmNvbXBhc3MudjEuUHVsbFJlcXVlc3QSJwoHdHJhY2tlchgSIAEoCzIWLmNvbXBhc3MudjEuVHJhY2tlclJlZiKeAwoLUHVsbFJlcXVlc3QSIwoFZm9yZ2UYASABKAsyFC5jb21wYXNzLnYxLkZvcmdlUmVmEgwKBHJlcG8YAiABKAkSDgoGbnVtYmVyGAMgASgNEg0KBXRpdGxlGAQgASgJEhMKC2ZvcmdlX3N0YXRlGAUgASgJEgsKA3VybBgGIAEoCRIQCghoZWFkX3JlZhgHIAEoCRIQCghiYXNlX3JlZhgIIAEoCRIrCgVhZ2VudBgJIAEoCzIcLmNvbXBhc3MudjEuQWdlbnRBdHRyaWJ1dGlvbhIVCg1mb3JnZV9hY2NvdW50GAogASgJEg0KBWRyYWZ0GAsgASgIEikKB2NoYW5nZWQYDCABKAsyGC5jb21wYXNzLnYxLkNoYW5nZWRTdGF0cxIpCgZjaGVja3MYDSABKAsyGS5jb21wYXNzLnYxLkNoZWNrc1N1bW1hcnkSIwoHcmV2aWV3cxgOIAMoCzISLmNvbXBhc3MudjEuUmV2aWV3EikKB3RocmVhZHMYDyADKAsyGC5jb21wYXNzLnYxLlJldmlld1RocmVhZCJTCg1DaGVja3NTdW1tYXJ5EhAKCGhlYWRfc2hhGAEgASgJEg0KBXN0YXRlGAIgASgJEiEKBmNoZWNrcxgDIAMoCzIRLmNvbXBhc3MudjEuQ2hlY2siQwoFQ2hlY2sSDAoEbmFtZRgBIAEoCRINCgVzdGF0ZRgCIAEoCRILCgN1cmwYAyABKAkSEAoIcmVxdWlyZWQYBCABKAgiQwoMQ2hhbmdlZFN0YXRzEg0KBWZpbGVzGAEgASgNEhEKCWFkZGl0aW9ucxgCIAEoDRIRCglkZWxldGlvbnMYAyABKA0iQwoKVHJhY2tlclJlZhIMCgRraW5kGAEgASgJEgoKAmlkGAIgASgJEg4KBnN0YXR1cxgDIAEoCRILCgN1cmwYBCABKAkiRwoGUmV2aWV3Eg4KBmF1dGhvchgBIAEoCRIOCgZpc19ib3QYAiABKAgSDwoHdmVyZGljdBgDIAEoCRIMCgRib2R5GAQgASgJIlUKDFJldmlld1RocmVhZBIMCgRwYXRoGAEgASgJEhAKCHJlc29sdmVkGAIgASgIEiUKCGNvbW1lbnRzGAMgAygLMhMuY29tcGFzcy52MS5Db21tZW50IjcKB0NvbW1lbnQSDgoGYXV0aG9yGAEgASgJEg4KBmlzX2JvdBgCIAEoCBIMCgRib2R5GAMgASgJKmQKDlNlY3JldERlbGl2ZXJ5Eh8KG1NFQ1JFVF9ERUxJVkVSWV9VTlNQRUNJRklFRBAAEhgKFFNFQ1JFVF9ERUxJVkVSWV9GSUxFEAESFwoTU0VDUkVUX0RFTElWRVJZX0VOVhACKnAKClNlY3JldEtpbmQSGwoXU0VDUkVUX0tJTkRfVU5TUEVDSUZJRUQQABIXChNTRUNSRVRfS0lORF9HRU5FUklDEAESGAoUU0VDUkVUX0tJTkRfUFJPVklERVIQAhISCg5TRUNSRVRfS0lORF9HSBADKkMKC1NlcnZlclN0YXRlEhwKGFNFUlZFUl9TVEFURV9VTlNQRUNJRklFRBAAEhYKElNFUlZFUl9TVEFURV9SRUFEWRABKpcBCgtSdW50aW1lVGllchIcChhSVU5USU1FX1RJRVJfVU5TUEVDSUZJRUQQABIXChNSVU5USU1FX1RJRVJfUE9ETUFOEAESGAoUUlVOVElNRV9USUVSX01JQ1JPVk0QAhIgChxSVU5USU1FX1RJRVJfQVBQTEVfQ09OVEFJTkVSEAMSFQoRUlVOVElNRV9USUVSX0hPU1QQBCpoCg1FZ3Jlc3NQb3N0dXJlEh4KGkVHUkVTU19QT1NUVVJFX1VOU1BFQ0lGSUVEEAASGAoURUdSRVNTX1BPU1RVUkVfQVJNRUQQARIdChlFR1JFU1NfUE9TVFVSRV9VTkVORk9SQ0VEEAIqggIKEUFnZW50U2Vzc2lvblN0YXRlEiMKH0FHRU5UX1NFU1NJT05fU1RBVEVfVU5TUEVDSUZJRUQQABIgChxBR0VOVF9TRVNTSU9OX1NUQVRFX1NUQVJUSU5HEAESHQoZQUdFTlRfU0VTU0lPTl9TVEFURV9SRUFEWRACEh8KG0FHRU5UX1NFU1NJT05fU1RBVEVfV09SS0lORxADEh8KG0FHRU5UX1NFU1NJT05fU1RBVEVfU1RPUFBFRBAEEh8KG0FHRU5UX1NFU1NJT05fU1RBVEVfRVJST1JFRBAFEiQKIEFHRU5UX1NFU1NJT05fU1RBVEVfRElTQ09OTkVDVEVEEAYq0gEKE0FnZW50VG9vbENhbGxTdGF0dXMSJgoiQUdFTlRfVE9PTF9DQUxMX1NUQVRVU19VTlNQRUNJRklFRBAAEiIKHkFHRU5UX1RPT0xfQ0FMTF9TVEFUVVNfUEVORElORxABEiYKIkFHRU5UX1RPT0xfQ0FMTF9TVEFUVVNfSU5fUFJPR1JFU1MQAhIkCiBBR0VOVF9UT09MX0NBTExfU1RBVFVTX0NPTVBMRVRFRBADEiEKHUFHRU5UX1RPT0xfQ0FMTF9TVEFUVVNfRkFJTEVEEAQqtAEKFEFnZW50UGxhbkVudHJ5U3RhdHVzEicKI0FHRU5UX1BMQU5fRU5UUllfU1RBVFVTX1VOU1BFQ0lGSUVEEAASIwofQUdFTlRfUExBTl9FTlRSWV9TVEFUVVNfUEVORElORxABEicKI0FHRU5UX1BMQU5fRU5UUllfU1RBVFVTX0lOX1BST0dSRVNTEAISJQohQUdFTlRfUExBTl9FTlRSWV9TVEFUVVNfQ09NUExFVEVEEAMqhAEKFFNlc3Npb25JbmplY3Rpb25LaW5kEiYKIlNFU1NJT05fSU5KRUNUSU9OX0tJTkRfVU5TUEVDSUZJRUQQABIgChxTRVNTSU9OX0lOSkVDVElPTl9LSU5EX1NURUVSEAESIgoeU0VTU0lPTl9JTkpFQ1RJT05fS0lORF9ERUxJVkVSEAIqdAoQU2Vzc2lvbkVycm9yS2luZBIiCh5TRVNTSU9OX0VSUk9SX0tJTkRfVU5TUEVDSUZJRUQQABIcChhTRVNTSU9OX0VSUk9SX0tJTkRfRVJST1IQARIeChpTRVNTSU9OX0VSUk9SX0tJTkRfQUJPUlRFRBACKvEBCgpJc3N1ZVN0YXRlEhsKF0lTU1VFX1NUQVRFX1VOU1BFQ0lGSUVEEAASFwoTSVNTVUVfU1RBVEVfQkFDS0xPRxABEhQKEElTU1VFX1NUQVRFX1RPRE8QAhIWChJJU1NVRV9TVEFURV9RVUVVRUQQAxIXChNJU1NVRV9TVEFURV9CTE9DS0VEEAQSGwoXSVNTVUVfU1RBVEVfSU5fUFJPR1JFU1MQBRIZChVJU1NVRV9TVEFURV9JTl9SRVZJRVcQBhIUChBJU1NVRV9TVEFURV9ET05FEAcSGAoUSVNTVUVfU1RBVEVfQVJDSElWRUQQCCqcAQoNRm9yZ2VQcm92aWRlchIeChpGT1JHRV9QUk9WSURFUl9VTlNQRUNJRklFRBAAEhkKFUZPUkdFX1BST1ZJREVSX0dJVEhVQhABEhkKFUZPUkdFX1BST1ZJREVSX0dJVExBQhACEhoKFkZPUkdFX1BST1ZJREVSX0ZPUkdFSk8QAxIZChVGT1JHRV9QUk9WSURFUl9MSU5FQVIQBDLTDgoOQ29tcGFzc1NlcnZpY2USVAoNR2V0U2VydmVySW5mbxIgLmNvbXBhc3MudjEuR2V0U2VydmVySW5mb1JlcXVlc3QaIS5jb21wYXNzLnYxLkdldFNlcnZlckluZm9SZXNwb25zZRI/CgZXaG9BbUkSGS5jb21wYXNzLnYxLldob0FtSVJlcXVlc3QaGi5jb21wYXNzLnYxLldob0FtSVJlc3BvbnNlElwKD1N1YnNjcmliZUV2ZW50cxIiLmNvbXBhc3MudjEuU3Vic2NyaWJlRXZlbnRzUmVxdWVzdBojLmNvbXBhc3MudjEuU3Vic2NyaWJlRXZlbnRzUmVzcG9uc2UwARJaCg9MaXN0Qm9hcmRJc3N1ZXMSIi5jb21wYXNzLnYxLkxpc3RCb2FyZElzc3Vlc1JlcXVlc3QaIy5jb21wYXNzLnYxLkxpc3RCb2FyZElzc3Vlc1Jlc3BvbnNlEnIKF1Byb3Zpc2lvbkFnZW50V29ya3NwYWNlEiouY29tcGFzcy52MS5Qcm92aXNpb25BZ2VudFdvcmtzcGFjZVJlcXVlc3QaKy5jb21wYXNzLnYxLlByb3Zpc2lvbkFnZW50V29ya3NwYWNlUmVzcG9uc2USYAoRU3RhcnRBZ2VudFNlc3Npb24SJC5jb21wYXNzLnYxLlN0YXJ0QWdlbnRTZXNzaW9uUmVxdWVzdBolLmNvbXBhc3MudjEuU3RhcnRBZ2VudFNlc3Npb25SZXNwb25zZRJLCgpTcGF3bkFnZW50Eh0uY29tcGFzcy52MS5TcGF3bkFnZW50UmVxdWVzdBoeLmNvbXBhc3MudjEuU3Bhd25BZ2VudFJlc3BvbnNlEl0KEFN0b3BBZ2VudFNlc3Npb24SIy5jb21wYXNzLnYxLlN0b3BBZ2VudFNlc3Npb25SZXF1ZXN0GiQuY29tcGFzcy52MS5TdG9wQWdlbnRTZXNzaW9uUmVzcG9uc2USaQoUUmVtb3ZlQWdlbnRXb3Jrc3BhY2USJy5jb21wYXNzLnYxLlJlbW92ZUFnZW50V29ya3NwYWNlUmVxdWVzdBooLmNvbXBhc3MudjEuUmVtb3ZlQWdlbnRXb3Jrc3BhY2VSZXNwb25zZRJjChJSZWxvYWRBZ2VudFNlc3Npb24SJS5jb21wYXNzLnYxLlJlbG9hZEFnZW50U2Vzc2lvblJlcXVlc3QaJi5jb21wYXNzLnYxLlJlbG9hZEFnZW50U2Vzc2lvblJlc3BvbnNlElcKDkdldEFnZW50U3RhdHVzEiEuY29tcGFzcy52MS5HZXRBZ2VudFN0YXR1c1JlcXVlc3QaIi5jb21wYXNzLnYxLkdldEFnZW50U3RhdHVzUmVzcG9uc2USYgoVU3Vic2NyaWJlQWdlbnRTZXNzaW9uEiguY29tcGFzcy52MS5TdWJzY3JpYmVBZ2VudFNlc3Npb25SZXF1ZXN0Gh0uY29tcGFzcy52MS5BZ2VudFNlc3Npb25GcmFtZTABEksKCklzc3VlVG9rZW4SHS5jb21wYXNzLnYxLklzc3VlVG9rZW5SZXF1ZXN0Gh4uY29tcGFzcy52MS5Jc3N1ZVRva2VuUmVzcG9uc2USTgoLUmV2b2tlVG9rZW4SHi5jb21wYXNzLnYxLlJldm9rZVRva2VuUmVxdWVzdBofLmNvbXBhc3MudjEuUmV2b2tlVG9rZW5SZXNwb25zZRJXCg5QdXRBZ2VudENvbmZpZxIhLmNvbXBhc3MudjEuUHV0QWdlbnRDb25maWdSZXF1ZXN0GiIuY29tcGFzcy52MS5QdXRBZ2VudENvbmZpZ1Jlc3BvbnNlEmMKEkdldEFnZW50Q29uZmlnSW5mbxIlLmNvbXBhc3MudjEuR2V0QWdlbnRDb25maWdJbmZvUmVxdWVzdBomLmNvbXBhc3MudjEuR2V0QWdlbnRDb25maWdJbmZvUmVzcG9uc2USYAoRRGVsZXRlQWdlbnRDb25maWcSJC5jb21wYXNzLnYxLkRlbGV0ZUFnZW50Q29uZmlnUmVxdWVzdBolLmNvbXBhc3MudjEuRGVsZXRlQWdlbnRDb25maWdSZXNwb25zZRJdChBQdXRNb2RlbFJlZ2lzdHJ5EiMuY29tcGFzcy52MS5QdXRNb2RlbFJlZ2lzdHJ5UmVxdWVzdBokLmNvbXBhc3MudjEuUHV0TW9kZWxSZWdpc3RyeVJlc3BvbnNlEl0KEEdldE1vZGVsUmVnaXN0cnkSIy5jb21wYXNzLnYxLkdldE1vZGVsUmVnaXN0cnlSZXF1ZXN0GiQuY29tcGFzcy52MS5HZXRNb2RlbFJlZ2lzdHJ5UmVzcG9uc2USZgoTRGVsZXRlTW9kZWxSZWdpc3RyeRImLmNvbXBhc3MudjEuRGVsZXRlTW9kZWxSZWdpc3RyeVJlcXVlc3QaJy5jb21wYXNzLnYxLkRlbGV0ZU1vZGVsUmVnaXN0cnlSZXNwb25zZTKgBAoOU2VjcmV0c1NlcnZpY2USSAoJU2V0U2VjcmV0EhwuY29tcGFzcy52MS5TZXRTZWNyZXRSZXF1ZXN0Gh0uY29tcGFzcy52MS5TZXRTZWNyZXRSZXNwb25zZRJOCgtMaXN0U2VjcmV0cxIeLmNvbXBhc3MudjEuTGlzdFNlY3JldHNSZXF1ZXN0Gh8uY29tcGFzcy52MS5MaXN0U2VjcmV0c1Jlc3BvbnNlElEKDERlbGV0ZVNlY3JldBIfLmNvbXBhc3MudjEuRGVsZXRlU2VjcmV0UmVxdWVzdBogLmNvbXBhc3MudjEuRGVsZXRlU2VjcmV0UmVzcG9uc2USWgoPU2V0U2VydmVyU2VjcmV0EiIuY29tcGFzcy52MS5TZXRTZXJ2ZXJTZWNyZXRSZXF1ZXN0GiMuY29tcGFzcy52MS5TZXRTZXJ2ZXJTZWNyZXRSZXNwb25zZRJjChJEZWxldGVTZXJ2ZXJTZWNyZXQSJS5jb21wYXNzLnYxLkRlbGV0ZVNlcnZlclNlY3JldFJlcXVlc3QaJi5jb21wYXNzLnYxLkRlbGV0ZVNlcnZlclNlY3JldFJlc3BvbnNlEmAKEUxpc3RTZXJ2ZXJTZWNyZXRzEiQuY29tcGFzcy52MS5MaXN0U2VydmVyU2VjcmV0c1JlcXVlc3QaJS5jb21wYXNzLnYxLkxpc3RTZXJ2ZXJTZWNyZXRzUmVzcG9uc2ViBnByb3RvMw", [file_google_protobuf_timestamp]);
 
 /**
  * @generated from message compass.v1.SetSecretRequest
@@ -660,6 +660,24 @@ export type AgentSessionStatus = Message<"compass.v1.AgentSessionStatus"> & {
    * @generated from field: string agent_account_id = 3;
    */
   agentAccountId: string;
+
+  /**
+   * The runtime tier this session's workload runs on, and how its egress is
+   * constrained. Both are backward-compatible appends (buf: non-breaking) and
+   * both are reported by the Runner that owns the session, because it is the
+   * component that resolved the backend. Posture is carried separately rather
+   * than inferred from the tier: a tier's enforcement is a property of the
+   * backend, and a client deriving one from the other would render a stale
+   * answer the moment that changes.
+   *
+   * @generated from field: compass.v1.RuntimeTier runtime_tier = 4;
+   */
+  runtimeTier: RuntimeTier;
+
+  /**
+   * @generated from field: compass.v1.EgressPosture egress_posture = 5;
+   */
+  egressPosture: EgressPosture;
 };
 
 /**
@@ -2723,6 +2741,76 @@ export enum ServerState {
 export const ServerStateSchema: GenEnum<ServerState> = /*@__PURE__*/
   enumDesc(file_compass_v1_compass, 2);
 
+/**
+ * The runtime tier an agent workload runs on. `HOST` runs agents as direct
+ * child processes of the Runner, with no container or VM boundary.
+ *
+ * @generated from enum compass.v1.RuntimeTier
+ */
+export enum RuntimeTier {
+  /**
+   * @generated from enum value: RUNTIME_TIER_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: RUNTIME_TIER_PODMAN = 1;
+   */
+  PODMAN = 1,
+
+  /**
+   * @generated from enum value: RUNTIME_TIER_MICROVM = 2;
+   */
+  MICROVM = 2,
+
+  /**
+   * @generated from enum value: RUNTIME_TIER_APPLE_CONTAINER = 3;
+   */
+  APPLE_CONTAINER = 3,
+
+  /**
+   * @generated from enum value: RUNTIME_TIER_HOST = 4;
+   */
+  HOST = 4,
+}
+
+/**
+ * Describes the enum compass.v1.RuntimeTier.
+ */
+export const RuntimeTierSchema: GenEnum<RuntimeTier> = /*@__PURE__*/
+  enumDesc(file_compass_v1_compass, 3);
+
+/**
+ * How an agent's egress is constrained. `UNENFORCED` means the tier cannot
+ * constrain it at all — a host process shares the host's network namespace, so
+ * there is no boundary to firewall. It is a declared posture, never a failed
+ * arm, and a client must not render it as contained.
+ *
+ * @generated from enum compass.v1.EgressPosture
+ */
+export enum EgressPosture {
+  /**
+   * @generated from enum value: EGRESS_POSTURE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: EGRESS_POSTURE_ARMED = 1;
+   */
+  ARMED = 1,
+
+  /**
+   * @generated from enum value: EGRESS_POSTURE_UNENFORCED = 2;
+   */
+  UNENFORCED = 2,
+}
+
+/**
+ * Describes the enum compass.v1.EgressPosture.
+ */
+export const EgressPostureSchema: GenEnum<EgressPosture> = /*@__PURE__*/
+  enumDesc(file_compass_v1_compass, 4);
+
 /**
  * Agent-session lifecycle states. `ERRORED` is an unexpected agent exit (OOM,
  * panic, engine restart); recovery is an explicit ReloadAgentSession, never an
@@ -2786,7 +2874,7 @@ export enum AgentSessionState {
  * Describes the enum compass.v1.AgentSessionState.
  */
 export const AgentSessionStateSchema: GenEnum<AgentSessionState> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 3);
+  enumDesc(file_compass_v1_compass, 5);
 
 /**
  * @generated from enum compass.v1.AgentToolCallStatus
@@ -2822,7 +2910,7 @@ export enum AgentToolCallStatus {
  * Describes the enum compass.v1.AgentToolCallStatus.
  */
 export const AgentToolCallStatusSchema: GenEnum<AgentToolCallStatus> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 4);
+  enumDesc(file_compass_v1_compass, 6);
 
 /**
  * @generated from enum compass.v1.AgentPlanEntryStatus
@@ -2853,7 +2941,7 @@ export enum AgentPlanEntryStatus {
  * Describes the enum compass.v1.AgentPlanEntryStatus.
  */
 export const AgentPlanEntryStatusSchema: GenEnum<AgentPlanEntryStatus> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 5);
+  enumDesc(file_compass_v1_compass, 7);
 
 /**
  * The control op-kind a SessionInjection records. Mirrors the internal
@@ -2885,7 +2973,7 @@ export enum SessionInjectionKind {
  * Describes the enum compass.v1.SessionInjectionKind.
  */
 export const SessionInjectionKindSchema: GenEnum<SessionInjectionKind> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 6);
+  enumDesc(file_compass_v1_compass, 8);
 
 /**
  * The class of a SessionError. ERROR pairs with the ERRORED lifecycle
@@ -2915,7 +3003,7 @@ export enum SessionErrorKind {
  * Describes the enum compass.v1.SessionErrorKind.
  */
 export const SessionErrorKindSchema: GenEnum<SessionErrorKind> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 7);
+  enumDesc(file_compass_v1_compass, 9);
 
 /**
  * The Compass issue lifecycle, server-owned (DL-032/DL-033 + terminal ARCHIVED,
@@ -2979,7 +3067,7 @@ export enum IssueState {
  * Describes the enum compass.v1.IssueState.
  */
 export const IssueStateSchema: GenEnum<IssueState> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 8);
+  enumDesc(file_compass_v1_compass, 10);
 
 /**
  * Which forge (and which host, for self-hosted instances) an artifact lives on.
@@ -3021,7 +3109,7 @@ export enum ForgeProvider {
  * Describes the enum compass.v1.ForgeProvider.
  */
 export const ForgeProviderSchema: GenEnum<ForgeProvider> = /*@__PURE__*/
-  enumDesc(file_compass_v1_compass, 9);
+  enumDesc(file_compass_v1_compass, 11);
 
 /**
  * The Compass server service.
diff --git a/proto/compass/v1/compass.proto b/proto/compass/v1/compass.proto
index eec0ff7c..d11a37fa 100644
--- a/proto/compass/v1/compass.proto
+++ b/proto/compass/v1/compass.proto
@@ -423,6 +423,35 @@ message AgentSessionStatus {
   // binding is no longer resolvable — a status emitted after a Runner reconnect
   // cleared the live-session maps carries none (the stated residual gap).
   string agent_account_id = 3;
+  // The runtime tier this session's workload runs on, and how its egress is
+  // constrained. Both are backward-compatible appends (buf: non-breaking) and
+  // both are reported by the Runner that owns the session, because it is the
+  // component that resolved the backend. Posture is carried separately rather
+  // than inferred from the tier: a tier's enforcement is a property of the
+  // backend, and a client deriving one from the other would render a stale
+  // answer the moment that changes.
+  RuntimeTier runtime_tier = 4;
+  EgressPosture egress_posture = 5;
+}
+
+// The runtime tier an agent workload runs on. `HOST` runs agents as direct
+// child processes of the Runner, with no container or VM boundary.
+enum RuntimeTier {
+  RUNTIME_TIER_UNSPECIFIED = 0;
+  RUNTIME_TIER_PODMAN = 1;
+  RUNTIME_TIER_MICROVM = 2;
+  RUNTIME_TIER_APPLE_CONTAINER = 3;
+  RUNTIME_TIER_HOST = 4;
+}
+
+// How an agent's egress is constrained. `UNENFORCED` means the tier cannot
+// constrain it at all — a host process shares the host's network namespace, so
+// there is no boundary to firewall. It is a declared posture, never a failed
+// arm, and a client must not render it as contained.
+enum EgressPosture {
+  EGRESS_POSTURE_UNSPECIFIED = 0;
+  EGRESS_POSTURE_ARMED = 1;
+  EGRESS_POSTURE_UNENFORCED = 2;
 }
 
 // Agent-session lifecycle states. `ERRORED` is an unexpected agent exit (OOM,