opencodeevent

type Admission ¶ added in v1.48.0

type Admission struct {
	ControlRoot string
	Clock       ClockAuthority
	TimePolicy  TimePolicy
}

func (a Admission) Admit(ctx context.Context, r AdmissionRequest) (*Handoff, AdmissionStatus)

type AdmissionPort ¶ added in v1.48.0

type AdmissionPort interface {
	Admit(context.Context, AdmissionRequest) (*Handoff, AdmissionStatus)
}

type AdmissionRequest ¶ added in v1.48.0

type AdmissionRequest struct {
	Fact                     FactIdentity
	Origin                   string
	Provenance               Provenance
	Expected                 installruntime.PolicySnapshot
	Executable, GOOS, GOARCH string
	CommandStarted           time.Time
}

type AdmissionStatus ¶ added in v1.48.0

type AdmissionStatus string

const (
	Admitted         AdmissionStatus = "admitted"
	InvalidFact      AdmissionStatus = "invalid_fact"
	NotRegistered    AdmissionStatus = "not_registered"
	SnapshotChanged  AdmissionStatus = "snapshot_changed"
	TimeUnverified   AdmissionStatus = "time_authority_unverified"
	Expired          AdmissionStatus = "expired"
	StoreUnavailable AdmissionStatus = "store_unavailable"
	Duplicate        AdmissionStatus = "duplicate"
	Capacity         AdmissionStatus = "capacity"
)

type ChannelGate ¶

type ChannelGate interface {
	Channels(context.Context) (desktop, webhook bool)
}

ChannelGate binds a product setup decision to the same event observation. Legacy test gates retain their existing allow-all-channel behavior.

type Clock ¶

type Clock interface {
	Now() (bootID string, seconds float64, err error)
}

type ClockAuthority ¶ added in v1.48.0

type ClockAuthority interface {
	Snapshot(context.Context) (ClockSample, error)
}

ClockAuthority belongs to trusted system composition, never the wire sender. All ticks and epochs use integer nanoseconds; native qualification is external.

type ClockPort ¶ added in v1.48.0

type ClockPort struct {
	Counter CounterPort
	Wall    WallPort
}

ClockPort is shared by the private helper and future admission. Wall is an anchor only: this port does not establish original event age or continuity.

func (p ClockPort) SampleSnapshot() (ClockSnapshot, error)

type ClockSample ¶ added in v1.48.0

type ClockSample struct {
	BootID, Domain, Kind, Fence   string
	TickNS, WallNS, UncertaintyNS int64
}

type ClockSelection ¶ added in v1.48.0

type ClockSelection struct {
	Policy                    TimePolicy
	CalibrationID, Generation string
	TranslationBoundNS        int64
}

ClockSelection is supplied only by trusted packaged composition. It binds the native clock and original source conversion, never a sender or config grant.

func SelectTrustedClock(goos, goarch string) (ClockSelection, error)

func SelectTrustedImageClock(key opencodecodec.ImageKey) (ClockSelection, error)

type ClockSnapshot ¶ added in v1.48.0

type ClockSnapshot struct {
	Boot, ClockDomain, ClockKind                  string
	MonoLoNs, MonoHiNs, WallUnixNs, UncertaintyNs int64
}

func (s ClockSnapshot) JSON() ([]byte, error)

type ComposedConsumer ¶ added in v1.48.0

type ComposedConsumer struct {
	ControlRoot, Executable, GOOS, GOARCH string
	Source                                SnapshotPort
	Selection                             ClockSelection
	ReadPolicy                            func(context.Context, string) (installruntime.PolicySnapshot, error)
	Desktop                               func(*Handoff) notification.DeliveryPort
	SendWebhook                           func(context.Context, *config.Config, webhook.SendContext) error
	Assets                                config.AssetContext
}

ComposedConsumer is the production boundary: one snapshot and one E1 claim. Trusted ports permit independent test authority without a shipped test profile.

func (c ComposedConsumer) Consume(ctx context.Context, started time.Time, input io.ReadCloser) Receipt

func (c ComposedConsumer) ConsumeEntry(entry *Entry, input io.ReadCloser) Receipt

type Consumer ¶

type Consumer struct {
	Gate        Gate
	Config      *config.Config
	Desktop     notification.DeliveryPort
	Clock       Clock
	SendWebhook WebhookSender
}

func (c Consumer) Consume(ctx context.Context, input io.Reader) Receipt

type CounterPort ¶ added in v1.48.0

type CounterPort interface{ SampleCounter() (CounterSample, bool) }

type CounterSample ¶ added in v1.48.0

type CounterSample struct {
	Boot, Domain, Kind string
	Sec, Nsec          int64
}

CounterSample names the OS coordinate; neither caller-supplied quality nor wall time can authorize a counter kind.

type Entry ¶ added in v1.48.0

type Entry struct {
	Started time.Time
	// contains filtered or unexported fields
}

Entry owns the original timer and joined continuous watcher. E0 checks are independent of source qualification: availability alone grants no admission.

func BeginEntry(parent context.Context, started time.Time, source SnapshotPort) (*Entry, error)

func (e *Entry) Check() bool

func (e *Entry) Close()

func (e *Entry) Context() context.Context

func (e *Entry) Tighten(p Provenance, policy TimePolicy) bool

type FactIdentity ¶ added in v1.48.0

type FactIdentity struct {
	Kind, Session, Execution, Terminal, Request string
	Root                                        bool
}

type Gate ¶

type Gate interface{ Enabled(context.Context) bool }

Gate is the current, read-only opt-in and registration decision. A nil gate denies delivery. PR4 supplies the persisted implementation at composition.

type GateFunc ¶

type GateFunc func(context.Context) bool

func (f GateFunc) Enabled(ctx context.Context) bool

type Handoff ¶ added in v1.48.0

type Handoff struct {
	// contains filtered or unexported fields
}

Handoff is one durable claim for all channels. Close after bounded IO actually returns. Cancellation never reopens the claim or releases an active native ref.

func (h *Handoff) Channels() (bool, bool)

func (h *Handoff) Close()

func (h *Handoff) Context() context.Context

func (h *Handoff) Deadline() notification.Deadline

type NativeTerminalIdentity ¶ added in v1.48.0

type NativeTerminalIdentity struct {
	Kind TerminalIdentityKind
	ID   string
}

NativeTerminalIdentity is supplied only after strict decoder/native binding validation. Neutral V1 decoding alone does not establish this authority.

type PrivateEvent ¶ added in v1.48.0

type PrivateEvent struct {
	Event      uap.ObservedEvent
	Display    json.RawMessage
	Origin     string
	Fact       FactIdentity
	Provenance Provenance
}

func DecodePrivate(raw []byte, selected ClockSelection) (PrivateEvent, error)

type Provenance ¶ added in v1.48.0

type Provenance struct {
	Clock                                                       ClockSample
	NativeCreatedNS, IngressTickNS, SpawnTickNS, DeadlineTickNS int64
	SourceEpoch                                                 string
	EpochStartedTickNS                                          int64
	TerminalBinding                                             NativeTerminalIdentity
}

type Receipt ¶

type Receipt struct {
	Status  string `json:"status"`
	Reason  string `json:"reason,omitempty"`
	Desktop string `json:"desktop,omitempty"`
	Webhook string `json:"webhook,omitempty"`
}

Receipt contains only stable classification. It never includes event IDs, raw data, transport errors, configuration, or remote response content.

type SnapshotPort ¶ added in v1.48.0

type SnapshotPort interface{ SampleSnapshot() (ClockSnapshot, error) }

func NewSystemSnapshotPort() SnapshotPort

type TerminalIdentityKind ¶ added in v1.48.0

type TerminalIdentityKind string

const (
	V1FinalMessage  TerminalIdentityKind = "v1_final_message"
	V2TerminalEvent TerminalIdentityKind = "v2_terminal_event"
)

type TimePolicy ¶ added in v1.48.0

type TimePolicy struct {
	ProfileID, RawKind, OriginalNativeAge string
	NativeReadBoundNS, ComparisonBoundNS  int64
}

TimePolicy is immutable trusted composition, selected from the qualified platform ledger. Wire provenance cannot select or enlarge either bound. R is native-only; T includes the independently qualified source/JS terms.

func (p TimePolicy) Fence(boot, domain string) string

type TrustedClock ¶ added in v1.48.0

type TrustedClock struct {
	Source    SnapshotPort
	Selection ClockSelection
}

TrustedClock is a thin E0 adapter. Snapshot takes no sender arguments.

func (c TrustedClock) Snapshot(ctx context.Context) (ClockSample, error)

type WallPort ¶ added in v1.48.0

type WallPort interface{ SampleWall() time.Time }

type WebhookSender ¶

type WebhookSender func(*config.Config, webhook.SendContext) error

WebhookSender allows a single, non-replayed external attempt.