qualification

package
v0.0.0-...-b0b31a8 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 3, 2026 License: MIT Imports: 26 Imported by: 0

Documentation

Overview

Package qualification retains host-owned qualification evidence. It is not wired to the host and supplies neither a candidate runner nor authorization.

Index

Constants

This section is empty.

Variables

View Source
var (
	ErrInvalid     = errors.New("qualification: invalid input")
	ErrConflict    = errors.New("qualification: conflict")
	ErrBusy        = errors.New("qualification: writer busy")
	ErrIntegrity   = errors.New("qualification: integrity failure")
	ErrUnavailable = errors.New("qualification: store unavailable")
	ErrIneligible  = errors.New("qualification: ineligible")
)

Functions

func CandidateSessionID

func CandidateSessionID(runID, slotID string) string

CandidateSessionID binds a semantic slot to one run; it is not admission authority.

func ValidateModelLabel

func ValidateModelLabel(model string) error

ValidateModelLabel checks the label contract used by qualification journals. Native preparation must refuse a deployment that no journal can represent.

func ValidatePlan

func ValidatePlan(p Plan) error

ValidatePlan checks the existing admission bounds without a store or admission. Reserve the largest encoded valid request identity fields so any valid key/requester fits alongside this plan. '<' takes six JSON bytes with the existing HTML escaping. It neither normalizes nor mutates the plan.

Types

type Assertion

type Assertion struct {
	ID, Kind, Value string
	MinScore        int
	// JudgeModel is the expected harness request label; the runner must also
	// bind the actual host-selected judge deployment independently.
	JudgeModel string
}

type BlobRef

type BlobRef struct {
	Digest string
	Size   int64
}

type BudgetCall

type BudgetCall struct {
	SlotID, BindingID, CaseID, AssertionID string
	Run, JudgeSample                       int
}

BudgetCall maps an opaque transport slot to one required semantic call. Run is one-based. JudgeSample is 1/2 for judges, zero for candidates.

type BudgetRequest

type BudgetRequest struct {
	Plan              Plan
	RunID, LedgerPath string
	MaxInputTokens    *int
	Candidate         modeltransport.RunBinding
	Judges            map[string]modeltransport.RunBinding
}

BudgetRequest supplies trusted host bindings, not a package or a verdict. Judge bindings currently have no package-derived provenance contract: this preflight reserves spend only and cannot authorize judge execution.

type Case

type Case struct {
	ID, Digest, InputDigest string
	Runs, MinPasses         int
	Assertions              []Assertion
}

type ExecutionInfo

type ExecutionInfo struct {
	RunID, PlanDigest, AuthoredModel, Deployment string
}

ExecutionInfo describes a trusted host executor, not qualification or authority. Deployment is the selected host binding, not a provider attestation.

type ExecutionJournal

type ExecutionJournal struct {
	RunID, PlanDigest, SessionID, ExecutionID, HeadHash string
	Call                                                BudgetCall
	Count                                               int
	Records                                             []eventlog.Record
}

ExecutionJournal carries original producer records and separately captured anchors. The future orchestrator retains them before deriving any verdict.

type ExecutionScope

type ExecutionScope struct{ RunID, PlanDigest string }

ExecutionScope is a non-authorizing identity supplied by the durable runner.

func ExecutionScopeForRecord

func ExecutionScopeForRecord(r Record) ExecutionScope

ExecutionScopeForRecord locates already-started run artifacts from readback. Interrupt fences the lease by incrementing Generation; artifacts still belong to the preceding generation. This identity grants no execution authority.

type Executor

type Executor interface {
	Info() ExecutionInfo
	Plan() Plan
	Calls() []BudgetCall
	Execute(context.Context, string) (ExecutionJournal, error)
	Close() error
}

Executor is a host-owned execution seam, never a caller-supplied verdict or untrusted plugin. Its journal backing and run identity are host responsibilities. Close drains executor work; ownership of supplied storage/policy stays with its caller.

type ExecutorFactory

type ExecutorFactory func(context.Context, ExecutionScope) (Executor, error)

type Journal

type Journal struct {
	SessionID, ExecutionID, HeadHash string
	Count                            int
	Blob                             BlobRef
}

Journal retains host-supplied anchors, not producer attestation. Execution IDs are unique only within a record; the trusted runner binds journals to the subject and frozen binding and prevents reuse across qualification runs.

type Judgment

type Judgment struct {
	AssertionID string
	Calls       []Journal
}

type Member

type Member struct{ ID, Digest string }

type Observation

type Observation struct {
	CaseID    string
	Run       int
	Candidate Journal
	Judges    []Judgment
}

type Plan

type Plan struct {
	Subject                                            Subject
	Members                                            []Member
	MemberID, CompositionDigest, Platform, IndexDigest string
	Cases                                              []Case
	ExpiresAt                                          time.Time
}

type PreparedBudget

type PreparedBudget struct {
	Config modeltransport.RunConfig
	Calls  []BudgetCall
}

func PrepareRunBudget

func PrepareRunBudget(r BudgetRequest) (PreparedBudget, error)

PrepareRunBudget derives the entire bounded inventory before allocating any ledger or transport. It neither mutates Plan nor replaces its serving policy. Native callers must also anchor the candidate tuple via agentcontroller's preparation wrapper. Neither function establishes qualification authority.

type Record

type Record struct {
	ID, Lineage, RequestDigest, PlanDigest string
	Request                                Request
	State                                  State
	Generation                             int64
	Observations                           []Observation
	Reason                                 string
	CompletedAt                            time.Time
	Digest                                 string
}

type Request

type Request struct {
	Key, Requester string
	Plan           Plan
}

type State

type State string
const (
	Admitted   State = "admitted"
	Running    State = "running"
	Verifying  State = "verifying"
	Passed     State = "passed"
	Failed     State = "failed"
	Refused    State = "refused"
	Incomplete State = "incomplete"
)

type Store

type Store struct {
	// contains filtered or unexported fields
}

func Create

func Create(dir string) (*Store, error)

Create exclusively initializes a new private root. A partial failed creation is deliberately not adoptable by Open and is never automatically removed.

func Open

func Open(dir, lineage string) (_ *Store, err error)

Open never initializes absent state. lineage must come from independently retained host configuration, not be inferred from the files being opened.

func (*Store) Admit

func (s *Store) Admit(ctx context.Context, req Request) (Record, error)

func (*Store) Close

func (s *Store) Close() error

Close cancels and drains active Run calls before releasing storage ownership.

func (*Store) Lineage

func (s *Store) Lineage() string

func (*Store) Read

func (s *Store) Read(ctx context.Context, id string) (Record, error)

func (*Store) Run

func (s *Store) Run(ctx context.Context, id string, create ExecutorFactory) (Record, error)

Run is a host-only no-judge orchestration path, not admission or activation authority. Factory is trusted host code, never caller-uploaded executable logic. A record may dispatch once; repeat/recovery calls never adopt a run directory.

func (*Store) VerifyForActivation

func (s *Store) VerifyForActivation(ctx context.Context, id string, expected Plan, now time.Time) (Verified, error)

VerifyForActivation verifies retained evidence against an independently resolved plan. It grants no permission and must be called inside the future activation authority's current-policy/target gate, not cached as approval. Execution uniqueness is local to one record. The trusted runner must bind journals to this subject/binding and prevent reuse across qualification runs. ModelCall.Model is a harness request label, not deployment attestation; the runner must independently bind the host-selected candidate/judge deployments.

type Subject

type Subject struct{ Workspace, Target, SuiteDigest, BindingDigest, ProfileDigest, ModelDigest, JudgeDigest, PolicyDigest string }

type Verified

type Verified struct {
	ID, Digest  string
	Subject     Subject
	CompletedAt time.Time
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL