execution

type Config struct {
	// State is the capability-local rollout state (Gateway). Required.
	State *rollout.State
	// Broker materializes the approved-server credential (nil ⇒ no credential is
	// attached; the upstream call carries no Authorization).
	Broker *broker.Broker
	// Events is the PR-8 durable-event manager. Required for the commit-before-
	// side-effect guarantee; a nil Events fails every execution closed.
	Events *events.Manager
	// Upstream is the bounded upstream MCP client. Required.
	Upstream UpstreamCaller
	// ResponseProfile is the PR-7 inspection profile used to inspect + DLP the
	// upstream response before returning it to the client.
	ResponseProfile inspection.Profile
	// Metrics is the optional rollout telemetry sink.
	Metrics Metrics
	// Clock is injected for tests; nil ⇒ time.Now.
	Clock func() time.Time
	// Actor labels events emitted by this executor.
	Actor string
}

type Discovery struct {
	Registry *registry.Registry
	Catalog  *catalog.Catalog
	Upstream UpstreamCaller
}

type Executor struct {
	// contains filtered or unexported fields
}

type Metrics interface {
	ObserveResolution(capability string, res rollout.Resolution)
	ObserveBlock(capability string, reason mcperr.Reason)
	ObserveExecution(capability string, ok bool)
	ObserveUpstream(capability string, outcome string)
	ObserveDLPBlock(capability string, response bool)
	// ObserveOutcomeEvidenceLoss records that a post-execution outcome event could
	// not be committed. The side effect already happened, so this is the archive
	// losing its record of it — best-effort must mean "does not block the response",
	// never "fails invisibly".
	ObserveOutcomeEvidenceLoss(capability string)
}

type UpstreamCaller interface {
	Call(ctx context.Context, target upstreamclient.Target, method string, params json.RawMessage, opts upstreamclient.CallOptions) (*upstreamclient.Response, error)
}