fix: align Forward and Managed API contracts with current documentation

CHANGELOG.md

@@ -5,6 +5,29 @@ existing `0.1.0` release; earlier development prereleases are not listed.
 
 ## [Unreleased]
 
+### Added
+
+- Add typed Forward Session budgets across create/update responses and events, including omission, explicit null clearing and decimal-string limits.
+- Add Forward Session `config.model` overrides and model `speed` configuration, plus optional approval evaluation details, Outcome/status event fields and cumulative top-level Credits on `session.usage`.
+- Add `startup_script` to Forward/Managed Environment models and Managed cloud/self-hosted parameters. It runs on sandbox start/resume; the external worker controls self-hosted execution.
+- Add Managed Memory `version`, version `redacted`, and Vault creation-response `credentials` fields. Vault creation still does not accept credentials in its request.
+
+### Fixed
+
+- Decode Forward event `evaluated_permission` as a string and align Managed Thread/coordinator nested model effort and context-window fields.
+- Add the current Memory version `updated` operation and list-item metadata/version fields; retain the legacy `Modified` constant as deprecated.
+
+### Breaking changes
+
+- Forward `SessionEvent.EvaluatedPermission` and the Managed Thread/coordinator union model `Effort` fields now use strings instead of object types.
+
+### Migration
+
+- Compare `event.EvaluatedPermission` directly to `"allow"`, `"ask"` or `"deny"`; automatic approval details are under `event.Evaluation.EvaluatedPermission`.
+- Read nested model `Effort` directly as a string. Legacy Managed model `Speed` and Thread `Usage` remain available but deprecated; current Thread responses omit usage.
+- Use `param.NullStruct[forward.SessionBudgetParam]()` to clear a budget and `param.NullStruct[forward.ModelConfigUnionParam]()` to clear an update's model override. Omit the model on create to inherit.
+- Treat `session.usage` Credits as cumulative snapshots: replace the previous values rather than adding successive events.
+
 ### Changed
 
 - Remove resource-specific sections and inventories from the README to keep it focused on SDK setup and shared client behavior.

README.md

@@ -15,6 +15,7 @@ The SDK ships two clients that share authentication, transport, retries, error h
 - [Requirements](#requirements)
 - [Usage](#usage)
 - [PAT and Service Account authentication](#pat-and-service-account-authentication)
+- [Environment startup scripts](#environment-startup-scripts)
 - [Streaming](#streaming)
 - [Request fields](#request-fields)
 - [Response objects](#response-objects)
@@ -160,6 +161,22 @@ cleanup verification, run `make test-live-sa-execution` with
 independent; `QODER_AUTH_MODE` switches examples, not the PAT test suites.
 See the [official authentication contract](https://docs.qoder.com/cloud-agents/api/conventions/authentication).
 
+## Environment startup scripts
+
+Both Forward and Managed accept `config.startup_script`. For cloud environments,
+it runs after `setup_script` on the first sandbox start and again on every resume,
+before the first tool call. The server enforces a 64 KB limit and a 5-minute
+timeout. Scripts must exit; start long-lived services in the background and wait
+for readiness when needed.
+
+Failure emits a `session.error` event whose `error.type` is
+`environment_startup_failed_error`; the session and sandbox remain usable.
+The script is not retried during the same start. For self-hosted environments,
+the API stores and returns the script; execution depends on the external worker.
+See the official [Forward](https://docs.qoder.com/cloud-agents/api/forward/environments/schemas#environment-startup-script)
+and [Managed](https://docs.qoder.com/cloud-agents/api/environments/schemas#environment-startup-script)
+contracts.
+
 ## Streaming
 
 Streaming responses are consumed incrementally. Close the stream when finished and handle interruption explicitly; closing a local stream does not cancel server-side work.