core

package
v0.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 7, 2026 License: MIT Imports: 31 Imported by: 0

Documentation

Index

Constants

View Source
const (
	MaturityProven       Maturity = "proven"
	MaturityGated        Maturity = "gated"
	MaturityExperimental Maturity = "experimental"
	MaturityUnclaimed    Maturity = "unclaimed"

	AssuranceAdvisory Assurance = "advisory"
)
View Source
const (
	AuthorityNone     = "none"
	AuthorityActor    = "actor_identity"
	AuthorityHumanID  = "human_identity"
	ScopeNone         = "none"
	ScopeRoot         = "root"
	ScopeChange       = "change"
	ScopeDeclaredFile = "task_declared_files"
)

Authority provenance: where the identity an operation acts under comes from.

View Source
const (
	ExitClassSuccess = "success"
	ExitClassFailure = "failure"
	ExitClassRefusal = "refusal"
)

Exit classes. They stay distinct so a refusal is never mistaken for a failed gate and a failed gate is never mistaken for success.

View Source
const ApprovalAssuranceAdvisory = "advisory"
View Source
const ApprovalSchemaVersion = 1
View Source
const (
	AttemptAssurance = "advisory"
)
View Source
const OperationSchemaVersion = 1

OperationSchemaVersion versions the operation metadata contract. Every consumer (terminal help, agent JSON, generated guidance, docs, adapters) pins against it, so an incompatible shape change is visible instead of silently reinterpreted.

Variables

This section is empty.

Functions

func CanTransitionTaskActivity

func CanTransitionTaskActivity(from, to TaskActivity) bool

CanTransitionTaskActivity is the single exhaustive owner of legal edges.

func CheckPolicyTransition

func CheckPolicyTransition(recorded string, current Policy, transition *PolicyTransition) error

CheckPolicyTransition refuses to apply a changed policy to work bound to an earlier digest until a human records the transition. It authorizes the new policy; it never substitutes for proof under it.

func DefaultPolicyDigest

func DefaultPolicyDigest() string

func DeferredDomains

func DeferredDomains() []string

DeferredDomains is the D14 vocabulary as an independent copy. The operation registry projects it as the friction domain enum, so the flag and the recorder can never disagree about which domains exist.

func OperationFactsJSON

func OperationFactsJSON(facts OperationFacts) ([]byte, error)

OperationFactsJSON is the machine-readable schema surface. It is the same projection, marshalled; no consumer restates operation shape in JSON.

func RecoverTransactions

func RecoverTransactions(root string, now time.Time) error

RecoverTransactions resolves any interrupted sync or archive. Every mutating command runs it before its own work, so an interruption is detected and given its one deterministic action instead of waiting for the operation that caused it to be retried.

func RenderOperationDocs

func RenderOperationDocs(facts OperationFacts) string

RenderOperationDocs is the documentation surface. docs/operations.md is generated from it, so no operation table is ever hand-written.

func RenderOperationHelp

func RenderOperationHelp(facts OperationFacts) string

RenderOperationHelp is the terminal help surface, built from the projection.

func ResolveApprovalIdentity

func ResolveApprovalIdentity(gitEmail, environment string) (string, error)

func TaskContractHash

func TaskContractHash(task plan.Task) string

TaskContractHash is the canonical identity of an authored task contract. Callers must use this instead of maintaining a second hashing algorithm.

func ValidateApprovalTransition

func ValidateApprovalTransition(from, to Lifecycle) error

func ValidateOperations

func ValidateOperations() error

ValidateOperations fails closed on incomplete, duplicate, or contradictory metadata.

func WriteOperationDocs

func WriteOperationDocs(path string) error

WriteOperationDocs regenerates the documentation surface at path. It goes through the one atomic-replacement owner: a crash mid-regeneration leaves the previous generated file, never a torn one. Generated documentation is world-readable, unlike harness-owned state; the atomic owner writes 0600, so the published mode is restored after promotion.

Types

type ApprovalArtifact

type ApprovalArtifact struct {
	Path string `json:"path"`
	Hash string `json:"hash"`
}

type ApprovalHandoff

type ApprovalHandoff struct {
	HumanApprovalRequired bool               `json:"humanApprovalRequired"`
	Gate                  string             `json:"gate"`
	Findings              []gates.Finding    `json:"findings"`
	ReviewedArtifacts     []ApprovalArtifact `json:"reviewedArtifacts"`
	HumanInstruction      string             `json:"humanInstruction"`
	Assurance             string             `json:"assurance"`
}

func ApprovalHandoffFor

func ApprovalHandoffFor(root, change string) (*ApprovalHandoff, error)

ApprovalHandoffFor projects read-only agent handoff data. It never performs approval, emits evidence, or treats configuration as host proof.

type ApprovalIdentity

type ApprovalIdentity struct {
	Artifacts     []ApprovalArtifact `json:"artifacts"`
	AggregateHash string             `json:"aggregate_hash"`
}

func ComputeApprovalIdentity

func ComputeApprovalIdentity(changeRoot string, covered []string) (ApprovalIdentity, error)

type ApprovalOperationFacts

type ApprovalOperationFacts struct {
	Operation       string `json:"operation"`
	HumanOnly       bool   `json:"humanOnly"`
	AgentCallable   bool   `json:"agentCallable"`
	CreatesEvidence bool   `json:"createsEvidence"`
	Assurance       string `json:"assurance"`
}

func ApprovalHumanOnlyFacts

func ApprovalHumanOnlyFacts() ApprovalOperationFacts

func (ApprovalOperationFacts) AuthorizeAgentCapableRoute

func (facts ApprovalOperationFacts) AuthorizeAgentCapableRoute() error

type ApprovalRecord

type ApprovalRecord struct {
	SchemaVersion   int                `json:"schema_version"`
	ID              string             `json:"id"`
	Change          string             `json:"change"`
	Gate            string             `json:"gate"`
	LifecycleFrom   Lifecycle          `json:"lifecycle_from"`
	LifecycleTo     Lifecycle          `json:"lifecycle_to"`
	Approver        string             `json:"approver"`
	ActorClass      string             `json:"actor_class"`
	Artifacts       []ApprovalArtifact `json:"artifacts"`
	AggregateHash   string             `json:"aggregate_hash"`
	RegistryVersion string             `json:"registry_version"`
	PolicyDigest    string             `json:"policy_digest"`
	RevisionBefore  uint64             `json:"revision_before"`
	RevisionAfter   uint64             `json:"revision_after"`
	Timestamp       string             `json:"timestamp"`
	Reason          string             `json:"reason"`
	Assurance       string             `json:"assurance"`
}

func Approve

func Approve(root, change string, intent ApproveIntent) (ApprovalRecord, error)

func (ApprovalRecord) Validate

func (record ApprovalRecord) Validate() error

type ApprovalRoute

type ApprovalRoute string
const (
	ApprovalRouteHumanTerminal ApprovalRoute = "human_terminal"
	ApprovalRouteAgentCapable  ApprovalRoute = "agent_capable"
)

type ApprovalStatus

type ApprovalStatus struct {
	Change           string          `json:"change"`
	Current          bool            `json:"current"`
	Approval         *ApprovalRecord `json:"approval,omitempty"`
	BlockingArtifact string          `json:"blocking_artifact,omitempty"`
	Reason           string          `json:"reason,omitempty"`
	Recovery         string          `json:"recovery,omitempty"`
}

func CurrentApprovalStatus

func CurrentApprovalStatus(root, change string) (ApprovalStatus, error)

func ProjectApprovalStatus

func ProjectApprovalStatus(root, change, registryVersion, policyDigest string) (ApprovalStatus, error)

ProjectApprovalStatus accepts policy identities explicitly so callers can project staleness when a deployed registry or policy changes.

type ApproveIntent

type ApproveIntent struct {
	GitEmail, EnvironmentApprover string
	ClaimedApprover, Reason       string
	Interactive, Confirmed        bool
	Route                         ApprovalRoute
	AfterHistory                  func() error
}

type ArchiveOptions

type ArchiveOptions struct {
	Actor string
	Now   time.Time
	Hook  persist.Hook
}

ArchiveOptions carries the acting identity and the injected local clock. The clock is injected because the archive prefix is a local calendar date, which the harness must not read from the machine's UTC offset by accident.

type ArchiveResult

type ArchiveResult struct {
	SchemaVersion  int      `json:"schema_version"`
	Change         string   `json:"change"`
	Source         string   `json:"source"`
	Target         string   `json:"target"`
	ChangeHash     string   `json:"change_hash"`
	Accepted       []string `json:"accepted"`
	EvidenceSet    string   `json:"evidence_set"`
	Approver       string   `json:"approver"`
	SyncRecord     string   `json:"sync_record"`
	TransactionID  string   `json:"transaction"`
	HistoryID      string   `json:"history_id"`
	RevisionBefore uint64   `json:"revision_before"`
	RevisionAfter  uint64   `json:"revision_after"`
}

ArchiveResult reports one completed local archive. It names no external system: archive never deploys, commits, pushes, or opens anything.

func Archive

func Archive(root, change string, options ArchiveOptions) (ArchiveResult, error)

Archive validates the whole change before moving a single byte, then moves the complete change folder as one recoverable transaction.

type Assurance added in v0.4.0

type Assurance string

type Attempt

type Attempt = record.AttemptPayload

func CurrentAttempt

func CurrentAttempt(current state.State, taskID string) (Attempt, bool, error)

func StartAttempt

func StartAttempt(root, change string, request AttemptRequest) (Attempt, error)

func StartTaskAttempt

func StartTaskAttempt(root, change string, intent StartAttemptIntent) (Attempt, error)

StartTaskAttempt is the harness-owned admission route. It keeps authority construction inside core while exposing one explicit, revision-checked operation to command adapters.

type AttemptRequest

type AttemptRequest struct {
	TaskID           string
	Authority        TaskTransitionAuthority
	ExpectedRevision uint64
	AfterHistory     func() error
}

type CheckResult

type CheckResult struct {
	Root            string          `json:"root"`
	Change          string          `json:"change"`
	StateRevision   uint64          `json:"stateRevision"`
	RegistryVersion string          `json:"registryVersion"`
	PolicyDigest    string          `json:"policyDigest"`
	Findings        []gates.Finding `json:"findings"`
	Success         bool            `json:"success"`
}

func EvaluateCheck

func EvaluateCheck(snapshot CheckSnapshot) CheckResult

func RunCheck

func RunCheck(root, change, policyDigest string) (CheckResult, error)

type CheckSnapshot

type CheckSnapshot struct {
	// contains filtered or unexported fields
}

func AssembleCheck

func AssembleCheck(root, change, policyDigest string) (CheckSnapshot, error)

AssembleCheck performs all filesystem reads once. Evaluation and approval reuse the returned value snapshot without another parser or state read.

type CompleteRequest

type CompleteRequest struct {
	TaskID           string
	ExpectedRevision uint64
	Authority        CompletionAuthority
	// Profile is empty for the default loop. Production adds blockers on top of
	// every core guard below; it never replaces or relaxes one.
	Profile          string
	PolicyTransition *PolicyTransition
	BeforeHistory    func() error
	AfterHistory     func() error
}

type Completion

type Completion struct {
	SchemaVersion  int    `json:"schema_version"`
	Change         string `json:"change"`
	TaskID         string `json:"task"`
	AttemptID      string `json:"attempt"`
	EvidenceID     string `json:"evidence"`
	RevisionBefore uint64 `json:"revision_before"`
	RevisionAfter  uint64 `json:"revision_after"`
	HistoryID      string `json:"history_id"`
}

func CompleteTask

func CompleteTask(root, change string, request CompleteRequest) (Completion, error)

type CompletionAuthority

type CompletionAuthority struct {
	// contains filtered or unexported fields
}

CompletionAuthority is sealed to harness-owned completion operations.

func AuthorizeCompletion

func AuthorizeCompletion(actor string) CompletionAuthority

AuthorizeCompletion is the narrow harness operation boundary used by the command adapter. Request payloads cannot populate CompletionAuthority.

type Friction

type Friction = record.FrictionPayload

Friction is one recorded observation that a real current blocker was caused by a missing deferred domain. It is evidence for D14 and never authority.

func RecordFriction

func RecordFriction(root, change string, request FrictionRequest) (Friction, error)

RecordFriction appends one friction observation for a task the readiness owner currently reports as blocked. It writes no state: the record carries no revision transition, so recording friction can never move lifecycle, approval, authority, or task activity.

type FrictionEligibility

type FrictionEligibility struct {
	Domain   string `json:"domain"`
	Records  int    `json:"records"`
	Eligible bool   `json:"eligible"`
}

FrictionEligibility is the derived D14 projection for one deferred domain. Records counts distinct change/task observations; Eligible means the root owner may now decide, not that anything is unblocked or authorized.

func ProjectFrictionEligibility

func ProjectFrictionEligibility(root string) ([]FrictionEligibility, error)

ProjectFrictionEligibility derives D14 eligibility from history alone. It is a read-only projection: it confers no authority, changes no policy, and unblocks no operation. Two records count as independent only when they name both a different change and a different task.

type FrictionRequest

type FrictionRequest struct {
	TaskID           string
	Operation        string
	Domain           string
	Consequence      string
	Actor            string
	ExpectedRevision uint64
}

type Lifecycle

type Lifecycle string
const (
	LifecyclePlanning    Lifecycle = "planning"
	LifecycleApproved    Lifecycle = "approved"
	LifecycleExecuting   Lifecycle = "executing"
	LifecycleReconciling Lifecycle = "reconciling"
	LifecycleArchived    Lifecycle = "archived"
)

func Lifecycles

func Lifecycles() []Lifecycle

Lifecycles is every declared change lifecycle stage, in order. An operation applicable to all of them is unrestricted.

type Maturity added in v0.4.0

type Maturity string

Maturity and Assurance are published claim levels. Maturity describes what has been observed; assurance describes whether the host contains a process.

type MaturityClaim added in v0.4.0

type MaturityClaim struct {
	Category  string
	Subject   string
	Maturity  Maturity
	Assurance Assurance
	Observed  string
	Evidence  string
}

MaturityClaim is one published platform, profile, guarantee, or coverage claim. Exactly one of Maturity and Assurance is set.

func MaturityClaims added in v0.4.0

func MaturityClaims() []MaturityClaim

MaturityClaims returns the registry in stable declaration order. Callers get a copy so a projection cannot mutate published truth.

type Operation

type Operation struct {
	ID      string          `json:"id"`
	Summary string          `json:"summary"`
	Actor   OperationActor  `json:"actor"`
	Effect  OperationEffect `json:"effect"`
	// Lifecycles is the set of change lifecycle stages the operation applies
	// to. It is empty exactly when the operation resolves no existing change.
	Lifecycles []Lifecycle `json:"lifecycles"`
	// RequiresChange means the operation resolves an existing change and its
	// harness-owned state; `new` names a change but creates it, so it is false.
	RequiresRoot    bool                `json:"requiresRoot"`
	RequiresChange  bool                `json:"requiresChange"`
	RequiresTask    bool                `json:"requiresTask"`
	AuthoritySource string              `json:"authoritySource"`
	ScopeSource     string              `json:"scopeSource"`
	Arguments       []OperationArgument `json:"arguments"`
	Flags           []OperationFlag     `json:"flags"`
	Exits           []OperationExit     `json:"exits"`
	ResultType      string              `json:"resultType,omitempty"`
	AgentVisible    bool                `json:"agentVisible"`
	// Executable is false for a registered contract whose handler does not
	// exist yet. A non-executable entry can never be dispatched or advertised
	// as callable.
	Executable bool `json:"executable"`
	// Example is display data only. It is never parsed, expanded, or executed.
	Example string `json:"example"`
}

Operation is the sole owner of operation metadata. Handlers own behavior and restate nothing from this record.

func AgentOperations

func AgentOperations() []Operation

AgentOperations is the agent-callable palette. Human-only and reserved operations are absent; nothing widens the palette back.

func OperationByID

func OperationByID(id string) (Operation, bool)

OperationByID resolves one operation. A miss is a miss: callers refuse instead of guessing a neighbour.

func Operations

func Operations() []Operation

Operations returns every registered operation in deterministic order.

func (Operation) AppliesTo

func (operation Operation) AppliesTo(lifecycle string) bool

AppliesTo reports whether the operation is legal in a lifecycle stage. An operation that resolves no change applies everywhere.

func (Operation) Facts

func (operation Operation) Facts() []OperationFact

Facts renders every projected field of one operation. The row order is the declaration order of Operation, so all surfaces agree on order too.

func (Operation) Flag

func (operation Operation) Flag(name string) (OperationFlag, bool)

Flag resolves one declared flag of this operation.

func (Operation) RequiredArguments

func (operation Operation) RequiredArguments() int

RequiredArguments is the count of leading positional arguments that must be supplied; len(Arguments) is the maximum.

func (Operation) Usage

func (operation Operation) Usage() string

Usage renders the invocation shape from metadata so no surface hand-writes a usage line that can drift from the registry.

type OperationActor

type OperationActor string

OperationActor is who may invoke an operation. There is no fallback value: an undeclared actor fails registry validation rather than defaulting to a wider class.

const (
	ActorAgent  OperationActor = "agent"
	ActorHuman  OperationActor = "human"
	ActorEither OperationActor = "either"
)

type OperationArgument

type OperationArgument struct {
	Name        string `json:"name"`
	Required    bool   `json:"required"`
	Description string `json:"description"`
}

type OperationEffect

type OperationEffect string

OperationEffect is what an operation may write. `read` touches no managed truth, `project_write` writes project files outside change state, and `state_write` mutates harness-owned state, history, or evidence.

const (
	EffectRead         OperationEffect = "read"
	EffectProjectWrite OperationEffect = "project_write"
	EffectStateWrite   OperationEffect = "state_write"
)

type OperationExit

type OperationExit struct {
	Code    int    `json:"code"`
	Class   string `json:"class"`
	Meaning string `json:"meaning"`
}

type OperationFact

type OperationFact struct {
	Field string `json:"field"`
	Value string `json:"value"`
}

OperationFact is one public operation fact, keyed by its projection field name. Every consumer — terminal help, JSON, generated guidance, docs, and adapter exposure — renders these rows, so a field can never appear on one surface and not another.

type OperationFacts

type OperationFacts struct {
	SchemaVersion int         `json:"schemaVersion"`
	Operations    []Operation `json:"operations"`
}

OperationFacts is the whole public projection in registry order.

func ProjectAgentOperations

func ProjectAgentOperations() OperationFacts

ProjectAgentOperations is the agent-callable projection. It is the same projection filtered by declared visibility: it never widens an actor, effect, or scope, and human-only operations are absent.

func ProjectOperations

func ProjectOperations() OperationFacts

ProjectOperations is the one ordered projection every consumer reads.

type OperationFlag

type OperationFlag struct {
	Name        string   `json:"name"`
	Type        string   `json:"type"`
	Required    bool     `json:"required,omitempty"`
	Enum        []string `json:"enum,omitempty"`
	Default     string   `json:"default,omitempty"`
	Description string   `json:"description"`
}

type Policy

type Policy struct {
	Profile            Profile
	FullDesign         bool
	BidirectionalTrace bool
	AcceptanceReach    bool
	RequiredChecks     []evidence.RequiredCheck
}

Policy is the one built-in policy model. Production is strictly additive: it adds planning rules and required proof, and can never remove, weaken, or reinterpret a default-profile check.

func DefaultPolicy

func DefaultPolicy() Policy

func ProductionPolicy

func ProductionPolicy() Policy

ProductionPolicy is the single built-in production policy. Its required checks are the proof classes stage 8 adds beside the approved task verification command, which remains the test-run class owned by completion.

func ResolveProfile

func ResolveProfile(name string) (Policy, error)

ResolveProfile fails closed on any unknown selection and names the one legal next action together with the policy digest that is currently known.

func (Policy) Digest

func (policy Policy) Digest() string

Digest is the semantic policy identity carried by every production result and refusal. The default profile keeps the canonical stage-3 digest unchanged, so approvals and evidence recorded without production remain exactly as valid.

func (Policy) Production

func (policy Policy) Production() bool

func (Policy) Rules

func (policy Policy) Rules() []string

Rules is the normalized semantic content of a policy. Ordering is canonical, so two processes holding the same semantics always produce the same bytes.

func (Policy) Validate

func (policy Policy) Validate() error

Validate refuses a policy whose profile and rules disagree, so production rules can never travel under the lean default digest.

type PolicyTransition

type PolicyTransition struct {
	From     string
	To       string
	Approver string
	Reason   string
}

PolicyTransition is the explicit human record that must precede applying a semantically different policy to work already proven under an earlier one.

type Profile

type Profile string

Profile selects one built-in policy. The first release ships exactly two, so a flag is the whole selection surface: no config file, no schema engine.

const (
	ProfileDefault    Profile = "default"
	ProfileProduction Profile = "production"
)

type Readiness

type Readiness string
const (
	ReadinessReady             Readiness = "ready"
	ReadinessWaitingDependency Readiness = "waiting_dependency"
	ReadinessWaitingApproval   Readiness = "waiting_approval"
	ReadinessActive            Readiness = "active"
	ReadinessTerminal          Readiness = "terminal"
	ReadinessBlocked           Readiness = "blocked"
)

type ReadinessBlocker

type ReadinessBlocker struct {
	Code   string `json:"code"`
	Owner  string `json:"owner"`
	Action string `json:"action"`
}

type ReadinessModel

type ReadinessModel struct {
	// contains filtered or unexported fields
}

func ProjectReadiness

func ProjectReadiness(tasks plan.Tasks, persisted map[string]json.RawMessage, lifecycle string, approval ApprovalStatus) ReadinessModel

ProjectReadiness is pure: its canonical plan, persisted activity values, lifecycle, and approval projection are value inputs; it performs no I/O.

func (ReadinessModel) AllComplete

func (model ReadinessModel) AllComplete() bool

func (ReadinessModel) CanRetry

func (model ReadinessModel) CanRetry(id string) bool

CanRetry reports whether a failed task may return to in_progress. It is frontier membership with one substitution — the task is failed instead of pending — so the rule stays in this owner with the frontier rule.

func (ReadinessModel) Frontier

func (model ReadinessModel) Frontier() []string

func (ReadinessModel) InFrontier

func (model ReadinessModel) InFrontier(id string) bool

func (ReadinessModel) Outcome

func (model ReadinessModel) Outcome() ReadinessOutcome

func (ReadinessModel) PlanBlocker

func (model ReadinessModel) PlanBlocker() *ReadinessBlocker

func (ReadinessModel) PrimaryBlocker

func (model ReadinessModel) PrimaryBlocker() *ReadinessBlocker

func (ReadinessModel) Task

func (model ReadinessModel) Task(id string) (TaskReadiness, bool)

func (ReadinessModel) Tasks

func (model ReadinessModel) Tasks() []TaskReadiness

type ReadinessOutcome

type ReadinessOutcome struct {
	Classification string            `json:"classification"`
	Blocker        *ReadinessBlocker `json:"blocker,omitempty"`
}

type ReadinessSnapshot

type ReadinessSnapshot struct {
	// contains filtered or unexported fields
}

func LoadReadinessSnapshot

func LoadReadinessSnapshot(root, change string) (ReadinessSnapshot, error)

LoadReadinessSnapshot reads every readiness/status input under one change lock. Consumers render this value and perform no recovery or mutation.

func (ReadinessSnapshot) Approval

func (snapshot ReadinessSnapshot) Approval() ApprovalStatus

func (ReadinessSnapshot) Change

func (snapshot ReadinessSnapshot) Change() string

func (ReadinessSnapshot) Handoff

func (snapshot ReadinessSnapshot) Handoff() *ApprovalHandoff

func (ReadinessSnapshot) Model

func (snapshot ReadinessSnapshot) Model() ReadinessModel

func (ReadinessSnapshot) Plan

func (snapshot ReadinessSnapshot) Plan() plan.Change

func (ReadinessSnapshot) Projection

func (snapshot ReadinessSnapshot) Projection() state.Projection

func (ReadinessSnapshot) Root

func (snapshot ReadinessSnapshot) Root() string

func (ReadinessSnapshot) StateRevision

func (snapshot ReadinessSnapshot) StateRevision() uint64

func (ReadinessSnapshot) Valid

func (snapshot ReadinessSnapshot) Valid() bool

type ReopenIntent added in v0.5.0

type ReopenIntent struct {
	ExpectedRevision uint64
	Actor            string
	Reason           string
	AfterHistory     func() error
}

type ReopenResult added in v0.5.0

type ReopenResult struct {
	record.ReopenedPayload
	HistoryID string `json:"history_id"`
}

func Reopen added in v0.5.0

func Reopen(root, change string, intent ReopenIntent) (ReopenResult, error)

Reopen revokes execution authority without granting replacement authority.

type ScopeResult

type ScopeResult struct {
	AttemptID     string   `json:"attempt_id"`
	BaselineHEAD  string   `json:"baseline_head"`
	ChangedPaths  []string `json:"changed_paths"`
	DeclaredFiles []string `json:"declared_files"`
	Assurance     string   `json:"assurance"`
	Valid         bool     `json:"valid"`
}

func CheckScope

func CheckScope(root, change, taskID, attemptID string) (ScopeResult, error)

type StartAttemptIntent

type StartAttemptIntent struct {
	TaskID           string
	ExpectedRevision uint64
	Actor            string
}

type SyncCapability

type SyncCapability struct {
	Capability string `json:"capability"`
	Path       string `json:"path"`
	Before     string `json:"before,omitempty"`
	After      string `json:"after"`
	Created    bool   `json:"created"`
	NoOp       bool   `json:"no_op"`
}

SyncCapability is one reconciled accepted document as sync committed it.

type SyncOptions

type SyncOptions struct {
	GitEmail, EnvironmentApprover string
	ClaimedApprover, Reason       string
	Route                         ApprovalRoute
	Interactive, Confirmed        bool
	Now                           time.Time
	Hook                          persist.Hook
}

SyncOptions carries the human authorization inputs and the injected clock. Identity never arrives as a plain agent flag: ClaimedApprover must match the trusted identity resolved from git config user.email or SPECD_APPROVER.

type SyncResult

type SyncResult struct {
	SchemaVersion  int              `json:"schema_version"`
	Change         string           `json:"change"`
	Approver       string           `json:"approver"`
	PlanHash       string           `json:"plan_hash"`
	EvidenceSet    string           `json:"evidence_set"`
	Capabilities   []SyncCapability `json:"capabilities"`
	TransactionID  string           `json:"transaction,omitempty"`
	HistoryID      string           `json:"history_id"`
	ArchiveTarget  string           `json:"archive_target"`
	RevisionBefore uint64           `json:"revision_before"`
	RevisionAfter  uint64           `json:"revision_after"`
	NoOp           bool             `json:"no_op"`
}

SyncResult is the canonical sync outcome. It reports local accepted-truth facts only: no delivery, deployment, or remote state is implied.

func Sync

func Sync(root, change string, options SyncOptions) (SyncResult, error)

Sync makes reviewed proposed behavior accepted truth. Every precondition is rechecked under the change lock, the whole plan is built and validated in memory, and all outputs commit as one recoverable transaction. Nothing here bypasses approval, evidence, completion, or reconciliation: each stays a separate input that must independently hold.

type TaskActivity

type TaskActivity string

TaskActivity is persisted harness-owned task state. It is deliberately separate from derived readiness and authored Markdown.

const (
	TaskPending    TaskActivity = "pending"
	TaskInProgress TaskActivity = "in_progress"
	TaskCompleted  TaskActivity = "completed"
	TaskFailed     TaskActivity = "failed"
	TaskBlocked    TaskActivity = "blocked"
)

func NextTaskActivities

func NextTaskActivities(from TaskActivity) []TaskActivity

NextTaskActivities returns the legal successors in stable contract order.

func ProjectTaskActivity

func ProjectTaskActivity(persisted map[string]json.RawMessage, taskID string) (TaskActivity, error)

ProjectTaskActivity reads only harness-owned state. Markdown markers are not an input and therefore cannot grant or mutate activity.

func TaskActivities

func TaskActivities() []TaskActivity

TaskActivities returns the complete, stable activity vocabulary.

func (TaskActivity) Valid

func (activity TaskActivity) Valid() bool

type TaskActivityProjection

type TaskActivityProjection struct {
	ID       string       `json:"id"`
	Activity TaskActivity `json:"activity"`
}

func ProjectTaskActivities

func ProjectTaskActivities(canonicalIDs []string, persisted map[string]json.RawMessage) ([]TaskActivityProjection, error)

ProjectTaskActivities validates the complete persisted activity object against canonical task ids and returns rows in canonical authored order.

type TaskActivityRefusal

type TaskActivityRefusal struct {
	*failure.Refusal
	Owner string
}

func (*TaskActivityRefusal) Unwrap

func (r *TaskActivityRefusal) Unwrap() error

type TaskGraph

type TaskGraph struct {
	// contains filtered or unexported fields
}

TaskGraph is a pure projection of canonical tasks. Query methods return copies so consumers cannot mutate shared graph truth.

func BuildTaskGraph

func BuildTaskGraph(tasks plan.Tasks) (TaskGraph, error)

func (TaskGraph) AuthoredOrder

func (g TaskGraph) AuthoredOrder() []string

func (TaskGraph) Dependencies

func (g TaskGraph) Dependencies(id string) []string

func (TaskGraph) Dependents

func (g TaskGraph) Dependents(id string) []string

func (TaskGraph) TopologicalOrder

func (g TaskGraph) TopologicalOrder() []string

func (TaskGraph) Wave

func (g TaskGraph) Wave(id string) (int, bool)

func (TaskGraph) Waves

func (g TaskGraph) Waves() [][]string

type TaskGraphRefusal

type TaskGraphRefusal struct {
	*failure.Refusal
	Owner string
}

func (*TaskGraphRefusal) Unwrap

func (r *TaskGraphRefusal) Unwrap() error

type TaskReadiness

type TaskReadiness struct {
	ID           string            `json:"id"`
	Activity     TaskActivity      `json:"activity"`
	Readiness    Readiness         `json:"readiness"`
	Wave         int               `json:"wave"`
	Dependencies []string          `json:"dependencies"`
	Blocker      *ReadinessBlocker `json:"blocker,omitempty"`
}

type TaskTransition

type TaskTransition struct {
	SchemaVersion int          `json:"schema_version"`
	TaskID        string       `json:"task"`
	From          TaskActivity `json:"from"`
	To            TaskActivity `json:"to"`
}

func TransitionTaskActivity

func TransitionTaskActivity(root, change string, request TaskTransitionRequest) (TaskTransition, error)

type TaskTransitionAuthority

type TaskTransitionAuthority struct {
	// contains filtered or unexported fields
}

TaskTransitionAuthority is sealed to core-owned operation authorization. External request payloads cannot manufacture it from actor strings/booleans.

type TaskTransitionRequest

type TaskTransitionRequest struct {
	TaskID           string
	To               TaskActivity
	Authority        TaskTransitionAuthority
	ExpectedRevision uint64
	AfterHistory     func() error
}

Directories

Path Synopsis
Package report projects the four canonical read-only reports over local truth.
Package report projects the four canonical read-only reports over local truth.
Package transaction commits a bounded set of managed file writes inside one selected root as a single recoverable unit.
Package transaction commits a bounded set of managed file writes inside one selected root as a single recoverable unit.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL