selfheal

type Action string

type ActionExecutor interface {
	// Execute applies the action to the candidate and reports the immediate
	// outcome string. Only ever called in single_action/full AFTER the §9 gaps
	// close and Ashesh re-approves.
	Execute(c Candidate, a Action) (outcome string, err error)
}

type Candidate struct {
	// Identity (carried into the audit event).
	SessionID string
	Title     string
	Group     string
	Profile   string
	Account   string

	// Coarse status + additive substate (Honest Status v2, v1.9.66).
	Status   string
	Substate tmux.Substate

	// Busy is the canonical busy-first signal (tmux.go busy-first ordering). A
	// live busy indicator is AUTHORITATIVE and disqualifying (§1.3 #2 / §3.1).
	Busy bool

	// HookRunningFresh is true when a hook-status "running" was seen within the
	// freshness window (sessionstatus freshnessFor). Mid-turn → never act
	// (§1.3 #3 / §3.2).
	HookRunningFresh bool

	// OutputSig is a stable signature (hash) of the recent pane/output content
	// THIS read. OutputMoved is true when it differs from the previous read's
	// signature — token/output movement means mid-turn, disqualifying (§1.3 #3).
	OutputSig   string
	OutputMoved bool

	// Stopped marks a user-intentional stopped session (highest precedence,
	// §1.3 #5). Such a session is never a candidate.
	Stopped bool

	// OptedOut is the per-session or group-level "never self-heal me" flag,
	// checked as a quick disqualifier in the predicate (§3.7).
	OptedOut bool

	// StatusChangedAt anchors the dwell clock: when the current status/substate
	// was entered. Zero means unknown (treated as not-yet-dwelled).
	StatusChangedAt time.Time

	// LastSentAt is when self-heal/the keysender last delivered input to this
	// session. idle_at_empty_prompt only counts as stuck AFTER a send (§1.3 #4,
	// §1.4): the dwell for that class is measured from LastSentAt. Zero means
	// "we never sent it anything" → a long-waiting deliberate-idle session,
	// never a candidate.
	LastSentAt time.Time
}

type Caps struct {
	// PerSession6h is the max recoveries per session per rolling 6h window
	// (default 2). auth_401 is special-cased to 1 (PerSessionAuth401).
	PerSession6h int
	// PerSessionAuth401 is the per-session cap for the auth_401 class (default 1):
	// a 401 that survives one restart trips the breaker immediately (§2.2/§3.4).
	PerSessionAuth401 int
	// GlobalPerHour is the max recoveries across the WHOLE fleet per hour
	// (default 5 = TriageMaxPerHour). On hitting it → escalate-only, one
	// consolidated incident (§3.3).
	GlobalPerHour int
	// BreakerK is the consecutive-failed-recovery count that opens the per-session
	// circuit breaker (default 2; 1 for auth_401, BreakerKAuth401) (§3.4).
	BreakerK        int
	BreakerKAuth401 int
}

type CapsState struct {
	Session6h    int  `json:"session_6h"`
	GlobalHour   int  `json:"global_hour"`
	BreakerFails int  `json:"breaker_fails"`
	BreakerOpen  bool `json:"breaker_open"`
}

type Config struct {
	Mode Mode
	Caps Caps
	Sink EventSink
}

type Decision string

type Engine struct {
	// contains filtered or unexported fields
}

type Event struct {
	TS        string  `json:"ts"`
	SessionID string  `json:"session_id"`
	Title     string  `json:"title"`
	Conductor string  `json:"conductor,omitempty"`
	Group     string  `json:"group,omitempty"`
	Profile   string  `json:"profile"`
	Account   string  `json:"account,omitempty"`
	Substate  string  `json:"substate"`
	Dwell     float64 `json:"dwell_seconds"`

	Reads []ReadSig `json:"reads"`

	Decision Decision `json:"decision"`
	// Action is the action TAKEN (null/empty on skip and in observe mode — observe
	// never takes an action). WouldHave carries the observe-mode would-be action.
	Action       Action         `json:"action,omitempty"`
	ActionParams map[string]any `json:"action_params,omitempty"`
	Caps         CapsState      `json:"caps"`
	Outcome      string         `json:"outcome,omitempty"`
	Stage        Mode           `json:"stage"`
	// WouldHave is present in observe mode: the action self-heal WOULD have taken
	// had it been authorized. Empty when the decision was a skip.
	WouldHave Action `json:"would_have,omitempty"`
}

type EventSink interface {
	Append(Event) error
}

type MemorySink struct {
	Events []Event
	// contains filtered or unexported fields
}

type Mode string

type NDJSONSink struct {
	// contains filtered or unexported fields
}

type PolicyMachine struct {
	// contains filtered or unexported fields
}

type PredicateResult struct {
	// Candidate is true only when ALL §1.3 conditions hold for this read. The
	// two-read confirm is layered ON TOP by the Engine (one read is never enough,
	// §1.3 #4 / PLAYBOOK F5).
	Candidate bool
	// Decision is the most-precise reason the predicate reached its verdict. For
	// a true candidate it is DecisionAct (pending the 2-read confirm); for a
	// false one it names the disqualifier.
	Decision Decision
	// Dwell is the measured dwell at evaluation time (0 if no anchor).
	Dwell time.Duration
}

type ReadSig struct {
	T   string `json:"t"`
	Sig string `json:"sig"`
}