The Navigator cross-service wire contract: every name and shape that the OSINT
service (auth authority), the Data service (thin auth client), and the
published navigator-cli must agree on.
Constants and Pydantic models only — no logic. Validation, quota
accounting, and hashing live in the OSINT service.
Compatibility obligation
Three consumers, two deployment models:
The OSINT and Data services deploy together from the monorepo.
Released navigator-cli versions are installed on member machines and
cannot be redeployed. Server changes to /auth/cli/*, /api/tools/*,
and PAT semantics must stay additive/compatible with every released CLI
version. Removing or renaming anything here is a breaking release.
Models tolerate unknown extra fields by design (forward compatibility for
installed CLIs talking to a newer authority).
