# Resolved Capability Manifest read surface (plan §U15 pt 2/3).
#
# Admin UI reads the last N manifests for a given agent so
# an operator can see exactly what capabilities the session was granted.
# The manifest_json field is opaque AWSJSON — the runtime (U15 pt 2
# Python capture) can evolve the shape without a server-side resolver
# rename.

type RuntimeManifest {
  id: ID!
  sessionId: String!
  tenantId: ID!
  agentId: ID
  userId: ID
  manifestJson: AWSJSON!
  createdAt: AWSDateTime!
}

extend type Query {
  runtimeManifestsByAgent(agentId: ID!, limit: Int): [RuntimeManifest!]!
}
