Documentation
¶
Overview ¶
Package qualification retains host-owned qualification evidence. It is not wired to the host and supplies neither a candidate runner nor authorization.
Index ¶
- Variables
- func CandidateSessionID(runID, slotID string) string
- func ValidateModelLabel(model string) error
- func ValidatePlan(p Plan) error
- type Assertion
- type BlobRef
- type BudgetCall
- type BudgetRequest
- type Case
- type ExecutionInfo
- type ExecutionJournal
- type ExecutionScope
- type Executor
- type ExecutorFactory
- type Journal
- type Judgment
- type Member
- type Observation
- type Plan
- type PreparedBudget
- type Record
- type Request
- type State
- type Store
- func (s *Store) Admit(ctx context.Context, req Request) (Record, error)
- func (s *Store) Close() error
- func (s *Store) Lineage() string
- func (s *Store) Read(ctx context.Context, id string) (Record, error)
- func (s *Store) Run(ctx context.Context, id string, create ExecutorFactory) (Record, error)
- func (s *Store) VerifyForActivation(ctx context.Context, id string, expected Plan, now time.Time) (Verified, error)
- type Subject
- type Verified
Constants ¶
This section is empty.
Variables ¶
Functions ¶
func CandidateSessionID ¶
CandidateSessionID binds a semantic slot to one run; it is not admission authority.
func ValidateModelLabel ¶
ValidateModelLabel checks the label contract used by qualification journals. Native preparation must refuse a deployment that no journal can represent.
func ValidatePlan ¶
ValidatePlan checks the existing admission bounds without a store or admission. Reserve the largest encoded valid request identity fields so any valid key/requester fits alongside this plan. '<' takes six JSON bytes with the existing HTML escaping. It neither normalizes nor mutates the plan.
Types ¶
type BudgetCall ¶
BudgetCall maps an opaque transport slot to one required semantic call. Run is one-based. JudgeSample is 1/2 for judges, zero for candidates.
type BudgetRequest ¶
type BudgetRequest struct {
Plan Plan
RunID, LedgerPath string
MaxInputTokens *int
Candidate modeltransport.RunBinding
Judges map[string]modeltransport.RunBinding
}
BudgetRequest supplies trusted host bindings, not a package or a verdict. Judge bindings currently have no package-derived provenance contract: this preflight reserves spend only and cannot authorize judge execution.
type ExecutionInfo ¶
type ExecutionInfo struct {
RunID, PlanDigest, AuthoredModel, Deployment string
}
ExecutionInfo describes a trusted host executor, not qualification or authority. Deployment is the selected host binding, not a provider attestation.
type ExecutionJournal ¶
type ExecutionJournal struct {
RunID, PlanDigest, SessionID, ExecutionID, HeadHash string
Call BudgetCall
Count int
Records []eventlog.Record
}
ExecutionJournal carries original producer records and separately captured anchors. The future orchestrator retains them before deriving any verdict.
type ExecutionScope ¶
type ExecutionScope struct{ RunID, PlanDigest string }
ExecutionScope is a non-authorizing identity supplied by the durable runner.
func ExecutionScopeForRecord ¶
func ExecutionScopeForRecord(r Record) ExecutionScope
ExecutionScopeForRecord locates already-started run artifacts from readback. Interrupt fences the lease by incrementing Generation; artifacts still belong to the preceding generation. This identity grants no execution authority.
type Executor ¶
type Executor interface {
Info() ExecutionInfo
Plan() Plan
Calls() []BudgetCall
Execute(context.Context, string) (ExecutionJournal, error)
Close() error
}
Executor is a host-owned execution seam, never a caller-supplied verdict or untrusted plugin. Its journal backing and run identity are host responsibilities. Close drains executor work; ownership of supplied storage/policy stays with its caller.
type ExecutorFactory ¶
type ExecutorFactory func(context.Context, ExecutionScope) (Executor, error)
type Journal ¶
Journal retains host-supplied anchors, not producer attestation. Execution IDs are unique only within a record; the trusted runner binds journals to the subject and frozen binding and prevents reuse across qualification runs.
type Observation ¶
type PreparedBudget ¶
type PreparedBudget struct {
Config modeltransport.RunConfig
Calls []BudgetCall
}
func PrepareRunBudget ¶
func PrepareRunBudget(r BudgetRequest) (PreparedBudget, error)
PrepareRunBudget derives the entire bounded inventory before allocating any ledger or transport. It neither mutates Plan nor replaces its serving policy. Native callers must also anchor the candidate tuple via agentcontroller's preparation wrapper. Neither function establishes qualification authority.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
func Create ¶
Create exclusively initializes a new private root. A partial failed creation is deliberately not adoptable by Open and is never automatically removed.
func Open ¶
Open never initializes absent state. lineage must come from independently retained host configuration, not be inferred from the files being opened.
func (*Store) Run ¶
Run is a host-only no-judge orchestration path, not admission or activation authority. Factory is trusted host code, never caller-uploaded executable logic. A record may dispatch once; repeat/recovery calls never adopt a run directory.
func (*Store) VerifyForActivation ¶
func (s *Store) VerifyForActivation(ctx context.Context, id string, expected Plan, now time.Time) (Verified, error)
VerifyForActivation verifies retained evidence against an independently resolved plan. It grants no permission and must be called inside the future activation authority's current-policy/target gate, not cached as approval. Execution uniqueness is local to one record. The trusted runner must bind journals to this subject/binding and prevent reuse across qualification runs. ModelCall.Model is a harness request label, not deployment attestation; the runner must independently bind the host-selected candidate/judge deployments.