refactor(schemas): reuse remaining defaults and fields (#162922)

## What Problem This Solves

A few config, protocol and tool definitions still duplicate defaults, field shapes and validation predicates already owned elsewhere.

## User Impact

No behavior or schema change. This removes 38 net production lines across eight files while preserving config defaults, validation results, protocol output and model-facing descriptors.

## Why This Change Was Made

Reuse the existing Voice Call context schemas for outer defaults, with `parse({})` preserving the existing independence of nested default arrays. Reuse protocol union/property owners for cron, coverage, reload metadata and `agents_list`, and use the existing closed-object helper for two remaining placement schemas. Config lookup and plugin-path matching use their established predicates.

No dependencies, public SDK exports, configuration options, protocol bumps or tests are added.

## Evidence

- Fresh independent Codex review through P2 found no actionable findings.
- Exact committed tree verified on an isolated AWS lease from the pinned base plus a verified Git bundle. Before/after captures preserve Voice Call manifest bytes, input/output schemas, raw and registered config parsing, cross-route identity and three mutation sequences; protocol schemas/validators, `agents_list` descriptors/compact hint/Code Mode API text, and config lookup results also match.
- Both cycle checks report zero. All 48 plugin-contract files / 1,132 tests passed; full `check-changed` passed in 961 seconds. Config schema and generated Voice Call manifest checks passed.
- SDK surface/API checks passed: no entrypoint or direct-export changes; 126 reachable declaration-reference changes are recorded separately from runtime/schema parity.
- The initial broad test selection referenced two retired test paths, and the isolated protocol check initially lacked its base-ref metadata. The corrected selection passed all eight shards in 155.01 seconds, including the full Voice Call suite (53 files / 614 tests), and protocol:check passed with zero generated drift. These were proof-harness repairs, not product changes.
- Hosted CI on the published head is the final test gate. No tests, checks or builds ran on the overloaded Mac.

extensions/voice-call/src/config.ts

@@ -272,20 +272,9 @@ const VoiceCallRealtimeConfigSchema = z
     toolPolicy: "safe-read-only",
     consultPolicy: "auto",
     tools: [],
-    fastContext: {
-      enabled: false,
-      timeoutMs: 800,
-      maxResults: 3,
-      sources: ["memory", "sessions"],
-      fallbackToConsult: false,
-    },
-    agentContext: {
-      enabled: false,
-      maxChars: 6000,
-      includeIdentity: true,
-      includeWorkspaceFiles: true,
-      files: ["SOUL.md", "IDENTITY.md", "USER.md"],
-    },
+    // Keep outer defaults' arrays independent of the inner object defaults.
+    fastContext: VoiceCallRealtimeFastContextConfigSchema.parse({}),
+    agentContext: VoiceCallRealtimeAgentContextConfigSchema.parse({}),
     providers: {},
   });
 export type VoiceCallRealtimeConfig = z.infer<typeof VoiceCallRealtimeConfigSchema>;

packages/gateway-protocol/src/schema/audit-run.ts

@@ -18,10 +18,7 @@ const ExecutionIdentityContextCoverageStateSchema = Type.Union([
 ]);
 const ExecutionIdentityDecisionCoverageStateSchema = Type.Union([
   Type.Literal("enforced"),
-  Type.Literal("attribution-only"),
-  Type.Literal("unattributed"),
-  Type.Literal("unknown"),
-  Type.Literal("unsupported"),
+  ...ExecutionIdentityContextCoverageStateSchema.anyOf,
 ]);
 const ExecutionIdentityRefArraySchema = Type.Array(ExecutionIdentityRefSchema, { maxItems: 16 });
 

packages/gateway-protocol/src/schema/config.ts

@@ -316,9 +316,7 @@ const ConfigSchemaLookupChildSchema = closedObject({
 export const ConfigSchemaLookupResultSchema = closedObject({
   path: NonEmptyString,
   schema: Type.Unknown(),
-  reloadKind: Type.Optional(
-    Type.Union([Type.Literal("restart"), Type.Literal("hot"), Type.Literal("none")]),
-  ),
+  reloadKind: ConfigSchemaLookupChildSchema.properties.reloadKind,
   hint: Type.Optional(ConfigUiHintSchema),
   hintPath: Type.Optional(Type.String()),
   children: Type.Array(ConfigSchemaLookupChildSchema),

packages/gateway-protocol/src/schema/cron.ts

@@ -245,10 +245,7 @@ const CronPayloadSchema = Type.Union([
 
 /** Reported payloads include the Gateway-owned heartbeat monitor. */
 const CronReportedPayloadSchema = Type.Union([
-  CronSystemEventPayloadSchema,
-  CronAgentTurnPayloadSchema,
-  CronCommandPayloadSchema,
-  CronScriptPayloadSchema,
+  ...CronPayloadSchema.anyOf,
   closedObject({ kind: Type.Literal("heartbeat") }),
 ]);
 
@@ -583,9 +580,7 @@ export const CronScratchSetParamsSchema = cronIdOrJobIdParams({
 export const CronScratchSetResultSchema = Type.Union([
   closedObject({
     ok: Type.Literal(true),
-    scratch: Type.Union([CronScratchSchema, Type.Null()]),
-    currentRevision: Type.Integer({ minimum: 0 }),
-    maxBytes: Type.Integer({ minimum: 1 }),
+    ...CronScratchGetResultSchema.properties,
   }),
   closedObject({
     ok: Type.Literal(false),

packages/gateway-protocol/src/schema/session-placement.ts

@@ -309,18 +309,15 @@ export const SessionsDispatchResultSchema = closedObject({
 });
 
 /** Stops a worker or explicitly recovers one failed placement onto the Gateway. */
-export const SessionsReclaimParamsSchema = Type.Object(
-  {
-    key: NonEmptyString,
-    agentId: Type.Optional(NonEmptyString),
-    recoverToGateway: Type.Optional(
-      closedObject({
-        expectedGeneration: Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),
-      }),
-    ),
-  },
-  { additionalProperties: false },
-);
+export const SessionsReclaimParamsSchema = closedObject({
+  key: NonEmptyString,
+  agentId: Type.Optional(NonEmptyString),
+  recoverToGateway: Type.Optional(
+    closedObject({
+      expectedGeneration: Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),
+    }),
+  ),
+});
 
 /** Terminal placement returned after a worker reclaim operation. */
 export const SessionsReclaimResultPlacementSchema = Type.Union([
@@ -329,15 +326,12 @@ export const SessionsReclaimResultPlacementSchema = Type.Union([
 ]);
 
 /** Result returned once worker ownership is reclaimed or a failed placement is cleared. */
-export const SessionsReclaimResultSchema = Type.Object(
-  {
-    ok: Type.Literal(true),
-    key: NonEmptyString,
-    sessionId: NonEmptyString,
-    placement: SessionsReclaimResultPlacementSchema,
-  },
-  { additionalProperties: false },
-);
+export const SessionsReclaimResultSchema = closedObject({
+  ok: Type.Literal(true),
+  key: NonEmptyString,
+  sessionId: NonEmptyString,
+  placement: SessionsReclaimResultPlacementSchema,
+});
 
 /** Exact active source observed before a session placement move. */
 export const SessionMoveExpectedSourceSchema = closedObject({

src/agents/tools/agents-list-tool.ts

@@ -1,4 +1,5 @@
 import { Type, type Static } from "typebox";
+import { GatewayAgentRuntimeSchema } from "../../../packages/gateway-protocol/src/schema/model-runtime-options.js";
 import { getRuntimeConfig } from "../../config/config.js";
 import { normalizeAgentId } from "../../routing/session-key.js";
 import { resolveModelAgentRuntimeMetadata } from "../agent-runtime-metadata.js";
@@ -12,16 +13,6 @@ import { jsonResult } from "./common.js";
 import { resolveInternalSessionKey, resolveMainSessionAlias } from "./sessions-helpers.js";
 
 const AgentsListToolSchema = Type.Object({});
-const AgentRuntimeSourceSchema = Type.Union([
-  Type.Literal("env"),
-  Type.Literal("agent"),
-  Type.Literal("defaults"),
-  Type.Literal("model"),
-  Type.Literal("provider"),
-  Type.Literal("implicit"),
-  Type.Literal("session"),
-  Type.Literal("session-key"),
-]);
 const AgentsListOutputSchema = Type.Object(
   {
     requester: Type.String(),
@@ -37,7 +28,7 @@ const AgentsListOutputSchema = Type.Object(
             Type.Object(
               {
                 id: Type.String(),
-                source: AgentRuntimeSourceSchema,
+                source: GatewayAgentRuntimeSchema.properties.source,
               },
               { additionalProperties: false },
             ),

src/config/schema.lookup.ts

@@ -1,4 +1,5 @@
 import type { ConfigSchemaLookupResult as ProtocolConfigSchemaLookupResult } from "../../packages/gateway-protocol/src/schema/config.js";
+import { isBlockedObjectKey } from "../infra/prototype-keys.js";
 import { parseConfigPathArrayIndex } from "../shared/path-array-index.js";
 import type { ConfigUiHints } from "./schema.hints.js";
 import {
@@ -11,7 +12,6 @@ import {
 
 type JsonSchemaNode = Record<string, unknown>;
 
-const FORBIDDEN_LOOKUP_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
 const LOOKUP_SCHEMA_STRING_KEYS = new Set([
   "$id",
   "$schema",
@@ -89,7 +89,7 @@ function resolveLookupChildSchema(
   schema: JsonSchemaObject,
   segment: string,
 ): JsonSchemaObject | null {
-  if (FORBIDDEN_LOOKUP_SEGMENTS.has(segment)) {
+  if (isBlockedObjectKey(segment)) {
     return null;
   }
 

src/config/validation-plugin-config.ts

@@ -180,9 +180,7 @@ export function validateExplicitPluginConfig(params: {
       if (
         resolvedLoadPath &&
         normalizePluginId(path.basename(resolvedLoadPath)) === normalizedPluginId &&
-        (sourcePath === resolvedLoadPath ||
-          isPathInside(resolvedLoadPath, sourcePath) ||
-          isPathInside(sourcePath, resolvedLoadPath))
+        (isPathInside(resolvedLoadPath, sourcePath) || isPathInside(sourcePath, resolvedLoadPath))
       ) {
         return true;
       }