runtimecontent

package
v0.0.0-...-804b954 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 13, 2026 License: MIT Imports: 14 Imported by: 0

Documentation

Overview

Package runtimecontent owns runtime-scoped immutable Agent specification and Input content.

Index

Constants

View Source 
const (
	// AgentSpecificationMediaTypeV1 identifies the canonical Agent specification envelope.
	AgentSpecificationMediaTypeV1 = "application/vnd.agent-runtime.agent-specification+cbor;version=1"
	// AgentSpecificationBodyMediaTypeV1 identifies an identity-free canonical Agent specification body.
	AgentSpecificationBodyMediaTypeV1 = "application/vnd.agent-runtime.agent-specification-body+cbor;version=1"
	// InputEnvelopeMediaTypeV1 identifies the canonical identity-free Input envelope.
	InputEnvelopeMediaTypeV1 = "application/vnd.agent-runtime.input+cbor;version=1"
	// ConversationEntryMediaTypeV1 identifies opaque immutable semantic context.
	ConversationEntryMediaTypeV1    = "application/vnd.agent-runtime.conversation-entry+octets;version=1"
	ToolActionDescriptorMediaTypeV1 = "application/vnd.agent-runtime.tool-action+octets;version=1"
)

Variables

View Source 
var (
	// ErrNotFoundOrDenied prevents callers from enumerating runtime content.
	ErrNotFoundOrDenied = errors.New("runtime content not found or denied")
	// ErrUnavailable identifies a runtime-content object-store failure without exposing its details.
	ErrUnavailable = errors.New("runtime content unavailable")
	// ErrIntegrity identifies invalid, altered, or conflicting immutable runtime content.
	ErrIntegrity = errors.New("runtime content integrity failure")
)

Functions

func BindToolActionDescriptor 

func BindToolActionDescriptor(descriptor, arguments []byte) ([]byte, error)

BindToolActionDescriptor seals canonical model arguments to one opaque adapter descriptor before it is staged. The wrapper is private runtime content: it is never used as an Approval summary or exposed through the public API. Descriptor bytes are base64 encoded because concrete adapters are allowed to use non-JSON descriptor formats.

func UnbindToolActionDescriptor 

func UnbindToolActionDescriptor(body []byte) (descriptor, arguments []byte, err error)

UnbindToolActionDescriptor restores the exact adapter descriptor and its immutable canonical arguments. Legacy opaque descriptors remain readable for recovery and intentionally report no model arguments.

Types

type AgentSpecificationBody 

type AgentSpecificationBody struct {
	Name         string
	ModelProfile string
	Instructions string
	Tools        []agentruntime.ToolDefinition
}

AgentSpecificationBody is the immutable behavior content before a runtime state authority allocates an Agent revision identity.

func (AgentSpecificationBody) Clone 

func (body AgentSpecificationBody) Clone() AgentSpecificationBody

Clone returns an independent Agent specification body.

type AgentSpecificationBodyCommitment 

type AgentSpecificationBodyCommitment struct {
	Tenant       TenantID
	Reference    Reference
	Name         string
	ModelProfile string
}

AgentSpecificationBodyCommitment is the bounded metadata a state command may persist after validating a staged body handoff.

type AgentSpecificationBodyReader 

type AgentSpecificationBodyReader struct {
	// contains filtered or unexported fields
}

AgentSpecificationBodyReader synthesizes an Agent specification from authorized revision metadata and identity-free immutable content.

func NewAgentSpecificationBodyReader 

func NewAgentSpecificationBodyReader(store *Store, repository AgentSpecificationBodyRepository) (*AgentSpecificationBodyReader, error)

NewAgentSpecificationBodyReader constructs the metadata-bound Agent specification body read boundary.

func (*AgentSpecificationBodyReader) ReadAgentSpecification 

func (reader *AgentSpecificationBodyReader) ReadAgentSpecification(ctx context.Context, tenant TenantID, agentID agentruntime.AgentID, revisionID agentruntime.AgentRevisionID) (agentruntime.AgentSpecification, error)

ReadAgentSpecification authorizes identity-free content and synthesizes one exact immutable Agent revision.

type AgentSpecificationBodyRecord 

type AgentSpecificationBodyRecord struct {
	Tenant       TenantID
	AgentID      agentruntime.AgentID
	RevisionID   agentruntime.AgentRevisionID
	Revision     uint64
	Name         string
	ModelProfile string
	Reference    Reference
	CreatedAt    time.Time
}

AgentSpecificationBodyRecord is the exact durable metadata required to authorize one identity-free Agent specification body read.

type AgentSpecificationBodyRepository 

type AgentSpecificationBodyRepository interface {
	AuthorizeAgentSpecificationBodyRead(context.Context, TenantID, agentruntime.AgentID, agentruntime.AgentRevisionID) (AgentSpecificationBodyRecord, error)
}

AgentSpecificationBodyRepository authorizes one exact metadata-bound Agent specification body read.

type AgentSpecificationReader 

type AgentSpecificationReader struct {
	// contains filtered or unexported fields
}

AgentSpecificationReader reads Agent specification content only after repository authorization.

func NewAgentSpecificationReader 

func NewAgentSpecificationReader(store *Store, repository AgentSpecificationRepository) (*AgentSpecificationReader, error)

NewAgentSpecificationReader constructs the content-read boundary from an explicit Store and repository authority.

func (*AgentSpecificationReader) ReadAgentSpecification 

func (reader *AgentSpecificationReader) ReadAgentSpecification(ctx context.Context, tenant TenantID, agentID agentruntime.AgentID, revisionID agentruntime.AgentRevisionID) (agentruntime.AgentSpecification, error)

ReadAgentSpecification authorizes and reads one exact tenant-owned Agent revision.

type AgentSpecificationRecord 

type AgentSpecificationRecord struct {
	Tenant     TenantID
	AgentID    agentruntime.AgentID
	RevisionID agentruntime.AgentRevisionID
	Revision   uint64
	Reference  Reference
}

AgentSpecificationRecord is the exact durable metadata returned by a repository authorization check.

type AgentSpecificationRepository 

type AgentSpecificationRepository interface {
	AuthorizeAgentSpecificationRead(context.Context, TenantID, agentruntime.AgentID, agentruntime.AgentRevisionID) (AgentSpecificationRecord, error)
}

AgentSpecificationRepository authorizes one exact Agent revision content read.

type ArtifactCommitment 

type ArtifactCommitment struct {
	Tenant    TenantID
	Reference Reference
}

ArtifactCommitment is the bounded immutable content metadata a runtime state command may persist. It deliberately contains no storage locator or bytes.

type ArtifactReader 

type ArtifactReader struct {
	// contains filtered or unexported fields
}

ArtifactReader reads immutable bytes only after runtime-state authorization.

func NewArtifactReader 

func NewArtifactReader(store *Store, repository ArtifactRepository) (*ArtifactReader, error)

NewArtifactReader constructs the authorization-before-content-read boundary.

func (*ArtifactReader) OpenArtifact 

func (reader *ArtifactReader) OpenArtifact(ctx context.Context, tenant TenantID, principal PrincipalID, artifactID agentruntime.ArtifactID) (ArtifactStream, error)

OpenArtifact authorizes exact Artifact metadata before opening the object. It is intentionally additive to ReadArtifact for compatible callers.

func (*ArtifactReader) ReadArtifact 

func (reader *ArtifactReader) ReadArtifact(ctx context.Context, tenant TenantID, principal PrincipalID, artifactID agentruntime.ArtifactID) ([]byte, error)

ReadArtifact returns bounded immutable bytes after exact tenant/principal metadata authorization.

type ArtifactRecord 

type ArtifactRecord struct {
	Tenant     TenantID
	Principal  PrincipalID
	ArtifactID agentruntime.ArtifactID
	Reference  Reference
}

ArtifactRecord is the exact durable metadata required before immutable artifact bytes may be read. The object-store key remains private to Store.

type ArtifactRepository 

type ArtifactRepository interface {
	AuthorizeArtifactRead(context.Context, TenantID, PrincipalID, agentruntime.ArtifactID) (ArtifactRecord, error)
}

ArtifactRepository authorizes one exact artifact download under principal ownership.

type ArtifactStream 

type ArtifactStream struct {
	Reference Reference
	Body      io.ReadCloser
}

ArtifactStream contains state-authorized immutable metadata and a closable bounded byte stream. It never exposes an object-store key.

type ContentHandoff 

type ContentHandoff struct {
	// contains filtered or unexported fields
}

ContentHandoff is an opaque, in-process proof that Store wrote and read back one tenant-bound immutable content object.

It is not a persistent record or a public capability. A state composition validates it through the issuing Store before accepting its metadata.

type ContentHandoffValidator 

type ContentHandoffValidator interface {
	ValidateAgentSpecificationBodyHandoff(ContentHandoff) (AgentSpecificationBodyCommitment, error)
	ValidateInputEnvelopeHandoff(ContentHandoff) (InputEnvelopeCommitment, error)
	ValidateArtifactHandoff(ContentHandoff) (ArtifactCommitment, error)
	ValidateConversationEntryHandoff(ContentHandoff) (ConversationEntryCommitment, error)
	ValidateToolActionDescriptorHandoff(ContentHandoff) (ToolActionDescriptorCommitment, error)
}

ContentHandoffValidator validates opaque staged-content commitments before a runtime state command persists their metadata.

type ConversationEntryCommitment 

type ConversationEntryCommitment struct {
	Tenant    TenantID
	Reference Reference
}

ConversationEntryCommitment is the opaque immutable semantic-context reference a state transition may persist.

type ErasureAuthorizer 

type ErasureAuthorizer interface {
	AuthorizeErasure(context.Context, ErasureRequest) error
}

ErasureAuthorizer accepts one tenant-bound operator deletion request.

type ErasureReceipt 

type ErasureReceipt struct {
	Tenant  TenantID
	Deleted []Reference
	Failed  *Reference
}

ErasureReceipt reports bounded progress without storage keys or authorization material.

type ErasureRequest 

type ErasureRequest struct {
	Tenant          TenantID
	AuthorizationID string
	References      []Reference
}

ErasureRequest is an operator-only request to remove exact immutable objects.

type ImmutableObjectDeleter 

type ImmutableObjectDeleter interface {
	DeleteExact(context.Context, string) error
}

ImmutableObjectDeleter is an operator capability for removing one private object key. It is deliberately not part of ImmutableObjectStore used by runtime request paths.

type ImmutableObjectStore 

type ImmutableObjectStore interface {
	PutIfAbsent(context.Context, string, []byte) (created bool, err error)
	Get(context.Context, string, int) ([]byte, error)
}

ImmutableObjectStore conditionally stores and bounded-reads runtime-owned immutable bytes. A false created result requires Store to verify the existing object before success.

type ImmutableObjectStreamer 

type ImmutableObjectStreamer interface {
	Open(context.Context, string, int) (io.ReadCloser, error)
}

ImmutableObjectStreamer is an optional bounded streaming read capability. Buffered reads remain supported for legacy callers.

type InputEnvelopeCommitment 

type InputEnvelopeCommitment struct {
	Tenant    TenantID
	Reference Reference
}

InputEnvelopeCommitment is the bounded metadata a state command may persist after validating a staged Input handoff.

type InputEnvelopeReader 

type InputEnvelopeReader struct {
	// contains filtered or unexported fields
}

InputEnvelopeReader reads Input content only after runtime-state authorization.

func NewInputEnvelopeReader 

func NewInputEnvelopeReader(store *Store, repository InputEnvelopeRepository) (*InputEnvelopeReader, error)

NewInputEnvelopeReader constructs the metadata-bound Input envelope read boundary.

func (*InputEnvelopeReader) ReadInputEnvelope 

func (reader *InputEnvelopeReader) ReadInputEnvelope(ctx context.Context, tenant TenantID, principal PrincipalID, sessionID agentruntime.SessionID, inputID agentruntime.InputID) ([]agentruntime.ContentPart, error)

ReadInputEnvelope authorizes and reads one exact tenant-owned Input envelope.

type InputEnvelopeRecord 

type InputEnvelopeRecord struct {
	Tenant    TenantID
	Principal PrincipalID
	SessionID agentruntime.SessionID
	InputID   agentruntime.InputID
	Reference Reference
}

InputEnvelopeRecord is the exact durable metadata required to authorize one immutable Input envelope read.

type InputEnvelopeRepository 

type InputEnvelopeRepository interface {
	AuthorizeInputEnvelopeRead(context.Context, TenantID, PrincipalID, agentruntime.SessionID, agentruntime.InputID) (InputEnvelopeRecord, error)
}

InputEnvelopeRepository authorizes one exact metadata-bound Input envelope read.

type PrincipalID 

type PrincipalID string

PrincipalID is the strict, canonical identity used to authorize session-owned runtime content reads.

func ParsePrincipalID 

func ParsePrincipalID(raw string) (PrincipalID, error)

ParsePrincipalID validates one canonical runtime-content principal identity.

type Reference 

type Reference struct {
	Digest    string
	MediaType string
	SizeBytes int64
}

Reference contains immutable content metadata without a storage key.

type S3ImmutableClient 

type S3ImmutableClient interface {
	PutIfAbsent(context.Context, string, string, []byte) (bool, error)
	Get(context.Context, string, string, int) ([]byte, error)
}

S3ImmutableClient is the content-only conditional S3 data plane. It keeps bucket credentials and endpoints at the composition root, outside state.

func NewMinIOImmutableClient 

func NewMinIOImmutableClient(client *minio.Client) (S3ImmutableClient, error)

NewMinIOImmutableClient adapts an explicitly configured MinIO client to the runtimecontent-only conditional object interface.

type S3ImmutableObjects 

type S3ImmutableObjects struct {
	// contains filtered or unexported fields
}

S3ImmutableObjects adapts one declared bucket to runtimecontent's immutable object boundary. Its keys remain runtimecontent-owned and tenant-scoped.

func NewS3ImmutableObjects 

func NewS3ImmutableObjects(client S3ImmutableClient, bucket string) (*S3ImmutableObjects, error)

NewS3ImmutableObjects creates one bounded immutable runtime-content bucket adapter.

func (*S3ImmutableObjects) DeleteExact 

func (objects *S3ImmutableObjects) DeleteExact(ctx context.Context, key string) error

DeleteExact removes one private immutable key through the explicit operator-only lifecycle capability. Ordinary request paths receive only the ImmutableObjectStore surface and cannot call it.

func (*S3ImmutableObjects) Get 

func (objects *S3ImmutableObjects) Get(ctx context.Context, key string, maxBytes int) ([]byte, error)

Get reads at most maxBytes from one immutable runtime-content key.

func (*S3ImmutableObjects) Open 

func (objects *S3ImmutableObjects) Open(ctx context.Context, key string, maxBytes int) (io.ReadCloser, error)

Open opens a bounded immutable object stream when the configured client provides streaming support.

func (*S3ImmutableObjects) PutIfAbsent 

func (objects *S3ImmutableObjects) PutIfAbsent(ctx context.Context, key string, value []byte) (bool, error)

PutIfAbsent conditionally writes exact immutable runtime-content bytes.

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store owns one explicit runtime content namespace.

func New 

func New(contentRoot string, objects ImmutableObjectStore) (*Store, error)

New constructs a Store from the explicitly declared content root and immutable object port.

func (*Store) PutAgentSpecification 

func (store *Store) PutAgentSpecification(ctx context.Context, tenant TenantID, specification agentruntime.AgentSpecification) (Reference, error)

PutAgentSpecification canonically encodes and conditionally stores one immutable specification.

func (*Store) StageAgentSpecificationBody 

func (store *Store) StageAgentSpecificationBody(ctx context.Context, tenant TenantID, body AgentSpecificationBody) (ContentHandoff, error)

StageAgentSpecificationBody conditionally writes and reads back an identity-free Agent specification body before state admission.

func (*Store) StageArtifact 

func (store *Store) StageArtifact(ctx context.Context, tenant TenantID, mediaType string, data []byte) (ContentHandoff, error)

StageArtifact conditionally stores bounded immutable artifact bytes before state admission. The caller receives only an opaque handoff, never a key.

func (*Store) StageConversationEntry 

func (store *Store) StageConversationEntry(ctx context.Context, tenant TenantID, body []byte) (ContentHandoff, error)

StageConversationEntry stores one bounded opaque semantic-context entry. State admission supplies identity and optimistic versioning separately.

func (*Store) StageInputEnvelope 

func (store *Store) StageInputEnvelope(ctx context.Context, tenant TenantID, parts []agentruntime.ContentPart) (ContentHandoff, error)

StageInputEnvelope conditionally writes and reads back a canonical Input envelope before state admission.

func (*Store) StageToolActionDescriptor 

func (store *Store) StageToolActionDescriptor(ctx context.Context, tenant TenantID, body []byte) (ContentHandoff, error)

StageToolActionDescriptor stores one opaque immutable, adapter-authorized tool action descriptor.

func (*Store) ValidateAgentSpecificationBodyHandoff 

func (store *Store) ValidateAgentSpecificationBodyHandoff(handoff ContentHandoff) (AgentSpecificationBodyCommitment, error)

ValidateAgentSpecificationBodyHandoff returns metadata only when this Store issued an intact tenant-bound body handoff.

func (*Store) ValidateArtifactHandoff 

func (store *Store) ValidateArtifactHandoff(handoff ContentHandoff) (ArtifactCommitment, error)

ValidateArtifactHandoff returns digest metadata only for an intact handoff issued by this exact Store.

func (*Store) ValidateConversationEntryHandoff 

func (store *Store) ValidateConversationEntryHandoff(handoff ContentHandoff) (ConversationEntryCommitment, error)

ValidateConversationEntryHandoff returns only a tenant-bound immutable reference issued by this exact Store.

func (*Store) ValidateInputEnvelopeHandoff 

func (store *Store) ValidateInputEnvelopeHandoff(handoff ContentHandoff) (InputEnvelopeCommitment, error)

ValidateInputEnvelopeHandoff returns metadata only when this Store issued an intact tenant-bound Input handoff.

func (*Store) ValidateToolActionDescriptorHandoff 

func (store *Store) ValidateToolActionDescriptorHandoff(h ContentHandoff) (ToolActionDescriptorCommitment, error)

type TenantErasureController 

type TenantErasureController struct {
	// contains filtered or unexported fields
}

TenantErasureController deletes only explicitly authorized exact references.

func NewTenantErasureController 

func NewTenantErasureController(store *Store, authorizer ErasureAuthorizer, deleter ImmutableObjectDeleter) (*TenantErasureController, error)

NewTenantErasureController constructs the isolated content-deletion authority.

func (*TenantErasureController) Erase 

func (controller *TenantErasureController) Erase(ctx context.Context, request ErasureRequest) (ErasureReceipt, error)

Erase deletes every exact reference in order and returns a retry-safe partial receipt on failure.

type TenantID 

type TenantID string

TenantID is the strict, canonical identity used to partition runtime content.

func ParseTenantID 

func ParseTenantID(raw string) (TenantID, error)

ParseTenantID validates one canonical runtime-content tenant identity.

type ToolActionDescriptorCommitment 

type ToolActionDescriptorCommitment struct {
	Tenant    TenantID
	Reference Reference
}

type ToolActionDescriptorReader 

type ToolActionDescriptorReader struct {
	// contains filtered or unexported fields
}

ToolActionDescriptorReader reads one immutable sandbox-control descriptor only after a worker-specific state authorization. The descriptor object key never crosses this boundary.

func NewToolActionDescriptorReader 

func NewToolActionDescriptorReader(store *Store, repository ToolActionDescriptorRepository) (*ToolActionDescriptorReader, error)

NewToolActionDescriptorReader constructs the worker-only immutable action descriptor read boundary.

func (*ToolActionDescriptorReader) ReadToolActionDescriptor 

func (reader *ToolActionDescriptorReader) ReadToolActionDescriptor(ctx context.Context, tenant TenantID, principal PrincipalID, sessionID agentruntime.SessionID, turnID agentruntime.TurnID, toolCallID string) ([]byte, error)

ReadToolActionDescriptor returns exact immutable sandbox-control bytes only after a state-backed runtime-worker authorization for the same operation.

type ToolActionDescriptorRepository 

type ToolActionDescriptorRepository interface {
	AuthorizeToolActionDescriptorRead(context.Context, TenantID, PrincipalID, agentruntime.SessionID, agentruntime.TurnID, string) (ToolActionDescriptorCommitment, error)
}

ToolActionDescriptorRepository authorizes one exact immutable tool action descriptor for a worker-owned operation.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.