// Agent management is metadata authority only; it never grants Git, review, check or landing authority.
CONTRACT ForgeAgentManagement {
  ENFORCEMENT_MODE: enforced
  CONTEXT {
    ENTITIES AgentManagementRequest {
      operation: string
      repository_matches_main: bool
      requester_is_human: bool
      requester_is_owner: bool
      target_exists: bool
      revision_matches: bool
      references_valid: bool
      resource_count: int
      active_run_count: int
      configuration_exists: bool
      retiring: bool
      enabling: bool
      outside_capability_count: int
      concurrency: int
      steps: int
      duration_ms: int
      input_tokens: int
      output_tokens: int
      total_tokens: int
      spend_microusd: int
      effect_hash: string
    }
    CONSTANTS {
      max_records: int == 1000 [SOURCE:FORGE-AGENTS-ZERO-SPEND-V1]
      max_concurrency: int == 4 [SOURCE:FORGE-AGENTS-ZERO-SPEND-V1]
      max_steps: int == 16 [SOURCE:FORGE-AGENTS-ZERO-SPEND-V1]
      max_duration_ms: int == 300000 [SOURCE:FORGE-AGENTS-ZERO-SPEND-V1]
      max_input_tokens: int == 16384 [SOURCE:FORGE-AGENTS-ZERO-SPEND-V1]
      max_output_tokens: int == 4096 [SOURCE:FORGE-AGENTS-ZERO-SPEND-V1]
      max_total_tokens: int == 32768 [SOURCE:FORGE-AGENTS-ZERO-SPEND-V1]
      max_spend_microusd: int == 0 [SOURCE:OWNER-ZERO-ADDITIONAL-SPEND]
    }
  }
  TRIGGER { manage_agents() }
  GUARANTEE {
    ENSURE manage_agents() WHEN AgentManagementRequest.repository_matches_main == true [SOURCE:management_repository]
  }
  PROHIBITION {
    FORBID manage_agents WHEN AgentManagementRequest.operation != "create_agent" AND AgentManagementRequest.operation != "configure_agent" AND AgentManagementRequest.operation != "set_agent_state" AND AgentManagementRequest.operation != "create_model" AND AgentManagementRequest.operation != "create_mcp" AND AgentManagementRequest.operation != "create_plan" AND AgentManagementRequest.operation != "version_plan" AND AgentManagementRequest.operation != "set_plan_state" AND AgentManagementRequest.operation != "connect_runtime" [SOURCE:management_operation]
    FORBID manage_agents WHEN AgentManagementRequest.requester_is_human == false [SOURCE:management_human]
    FORBID manage_agents WHEN AgentManagementRequest.requester_is_owner == false [SOURCE:management_owner]
    FORBID manage_agents WHEN AgentManagementRequest.revision_matches == false [SOURCE:management_revision]
    FORBID manage_agents WHEN AgentManagementRequest.references_valid == false [SOURCE:management_references]
    FORBID manage_agents WHEN (AgentManagementRequest.operation == "create_agent" OR AgentManagementRequest.operation == "create_model" OR AgentManagementRequest.operation == "create_mcp" OR AgentManagementRequest.operation == "create_plan") AND AgentManagementRequest.target_exists == true [SOURCE:management_duplicate]
    FORBID manage_agents WHEN (AgentManagementRequest.operation == "configure_agent" OR AgentManagementRequest.operation == "set_agent_state" OR AgentManagementRequest.operation == "version_plan" OR AgentManagementRequest.operation == "set_plan_state" OR AgentManagementRequest.operation == "connect_runtime") AND AgentManagementRequest.target_exists == false [SOURCE:management_existing_target]
    FORBID manage_agents WHEN (AgentManagementRequest.operation == "create_agent" OR AgentManagementRequest.operation == "create_model" OR AgentManagementRequest.operation == "create_mcp" OR AgentManagementRequest.operation == "create_plan") AND AgentManagementRequest.resource_count >= max_records [SOURCE:management_capacity]
    FORBID manage_agents WHEN AgentManagementRequest.retiring == true AND AgentManagementRequest.active_run_count > 0 [SOURCE:management_running_retirement]
    FORBID manage_agents WHEN AgentManagementRequest.enabling == true AND AgentManagementRequest.configuration_exists == false [SOURCE:management_configuration_required]
    FORBID manage_agents WHEN AgentManagementRequest.outside_capability_count > 0 [SOURCE:management_capability_scope]
    FORBID manage_agents WHEN AgentManagementRequest.concurrency > max_concurrency [SOURCE:management_concurrency]
    FORBID manage_agents WHEN AgentManagementRequest.steps > max_steps [SOURCE:management_steps]
    FORBID manage_agents WHEN AgentManagementRequest.duration_ms > max_duration_ms [SOURCE:management_duration]
    FORBID manage_agents WHEN AgentManagementRequest.input_tokens > max_input_tokens [SOURCE:management_input_tokens]
    FORBID manage_agents WHEN AgentManagementRequest.output_tokens > max_output_tokens [SOURCE:management_output_tokens]
    FORBID manage_agents WHEN AgentManagementRequest.total_tokens > max_total_tokens [SOURCE:management_total_tokens]
    FORBID manage_agents WHEN AgentManagementRequest.spend_microusd > max_spend_microusd [SOURCE:management_spending]
  }
  OBSERVABILITY { LOG "ForgeAgentManagement evaluated" ON decision }
}