launch

package
v0.72.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 26, 2026 License: MIT Imports: 27 Imported by: 0

Documentation

Overview

Package launch defines the versioned contracts shared by launch orchestration, harness adapters, and terminal backends.

Package launch trust state uses physical project identity and fails closed where that identity is unavailable. Windows callers must surface exit 6 (action_required); they must never substitute a path-based identity.

Index

Constants

View Source 
const (
	ClaudeProvider = "claude"
	CodexProvider  = "codex"
	CursorProvider = "cursor-agent"
	GrokProvider   = "grok"
)
View Source 
const (
	ApplyOutcomeApplied                             = "applied"
	ApplyOutcomeActionRequired                      = "action_required"
	ApplyOutcomeProvisionedNoRunnable               = "provisioned_no_runnable"
	ApplyReasonPrepareActionRequiredWithoutDecision = "prepare_action_required_without_decision"
)
View Source 
const (
	BindingVersion     = 1
	ResourceSetVersion = 1
)
View Source 
const (
	MaxCallerContextEntries    = 32
	MaxCallerContextKeyBytes   = 64
	MaxCallerContextValueBytes = 1024
	MaxCallerContextTotalBytes = 16 * 1024
)
View Source 
const (
	CommandsBackendName = "commands"
	// InternalLaunchNonceEnv marks a command emitted by the trusted launch
	// reconciler. coop exec consumes it and never forwards it to the provider.
	InternalLaunchNonceEnv  = "AMQ_INTERNAL_LAUNCH_NONCE"
	PlanOnlyInspectEvidence = "plan_only backend has no query surface"
	PlanOnlyCloseReason     = "plan_only backend owns no terminal resource"
)
View Source 
const (
	ProjectConfigSchema = 1
	LocalConfigSchema   = 1
	DefaultSessionName  = "collab"
	LayoutColumns       = "columns"
	LauncherCMux        = "cmux"
	LauncherGhostty     = "ghostty"
	LauncherTMux        = "tmux"
	LauncherCommands    = "commands"
)
View Source 
const (
	ExecutableTypeFile      = "file"
	ExecutableTypeSymlink   = "symlink"
	ExecutableTypeDirectory = "directory"
	ExecutableTypeOther     = "other"
)
View Source 
const (
	SeatKept    = "kept"
	SeatCreated = "created"
	SeatRefused = "refused"
)
View Source 
const (
	ReasonLiveParticipantRefused = "live_participant_refused"
	ReasonCohortRefused          = "cohort_refused"
)
View Source 
const (
	StartModeResumed = "resumed"
	StartModeFresh   = "fresh"
)
View Source 
const (
	OnLiveRefuse = "refuse"
	OnLiveKeep   = "keep"
)
View Source 
const (
	PlacementTargetCurrentWindow = "current_window"
	PlacementTargetNewWindow     = "new_window"
	PlacementTargetSession       = "session"

	PlacementLayoutColumns = "columns"
	PlacementLayoutRows    = "rows"
	PlacementLayoutTiled   = "tiled"

	PlacementUnsupportedReason = "placement_unsupported"
)
View Source 
const (
	PrepareOutcomeReady          = "ready"
	PrepareOutcomeActionRequired = "action_required"
	PrepareOutcomeUnsupported    = "unsupported"
	SubjectSchemaV1              = 1
	SubjectSchemaV2              = 2
)
View Source 
const (
	ReasonNoSavedConversation    = "no_saved_conversation"
	ReasonNoAgentLaunched        = "no_agent_launched"
	ReasonPriorLaunchNotExecuted = "prior_launch_not_executed"
	ReasonStaleConversation      = "stale_conversation"
)
View Source 
const (
	WrapperProjectContainedCode  = "wrapper_project_contained"
	ProviderProjectContainedCode = "provider_project_contained"
	AMQProjectContainedCode      = "amq_launcher_project_contained"
)
View Source 
const CodexNotifyPayloadLimit = 1 << 20
View Source 
const (
	ConversationVersion = 1
)
View Source 
const (
	EvidenceVersion = 1
)
View Source 
const ExecutionTicketVersion = 1
View Source 
const (
	JournalVersion = 1
)
View Source 
const LauncherAuto = "auto"
View Source 
const (
	LeaseVersion = 1
)
View Source 
const LifecycleOutcomeInspected = "inspected"
View Source 
const MaxInitialInputBytes = 256 * 1024
View Source 
const PlanVersion = 1
View Source 
const TrustVersion = 1

Variables

View Source 
var ErrPrepareAuthorityDrift = errors.New("prepare authority drift")

Functions

func BindingPath 

func BindingPath(sessionRoot string) string

BindingPath is for diagnostics and tests only. I/O must use a pinned root.

func ClearJournal 

func ClearJournal(root *fsq.DeliveryRoot, lease *Lease, expected LaunchJournal) error

func ClearJournalRaw added in v0.65.3 

func ClearJournalRaw(root *fsq.DeliveryRoot, lease *Lease, expected []byte) error

ClearJournalRaw removes a journal after an exact byte-for-byte compare. It is reserved for operator cleanup of a journal whose semantic validation fails, while retaining the same lease and replacement guard as ClearJournal.

func ConversationPath 

func ConversationPath(sessionRoot, handle string) string

func DefaultBackends added in v0.63.0 

func DefaultBackends() map[string]Backend

DefaultBackends is the production launcher map. Every CLI and public API entry must use this set so a new managed backend cannot be omitted from one facade.

func DefaultLaunchStateDir added in v0.62.0 

func DefaultLaunchStateDir() (string, error)

DefaultLaunchStateDir returns the existing platform-specific trust-state root without creating it.

func EligibleToKeep added in v0.64.0 

func EligibleToKeep(facts SeatFacts) bool

func EvidencePath added in v0.62.0 

func EvidencePath(sessionRoot, id string) string

func ExecutionTicketPath 

func ExecutionTicketPath(sessionRoot, handle string) string

func ExecutionTrustDigest 

func ExecutionTrustDigest(plan Plan, session string, root *fsq.DeliveryRoot) (string, error)

ExecutionTrustDigest binds the static provider plan to the session root in which the plan will be emitted. The plan digest alone cannot distinguish a selector-free launch after default_session changes.

func ExecutionTrustDigestWithAuthority added in v0.64.0 

func ExecutionTrustDigestWithAuthority(plan Plan, session string, root *fsq.DeliveryRoot, authorityDigest string) (string, error)

func JournalPath 

func JournalPath(sessionRoot string) string

func LeasePath 

func LeasePath(sessionRoot string) string

func MarshalExecutableIdentity added in v0.64.0 

func MarshalExecutableIdentity(identity ExecutableIdentity) ([]byte, error)

MarshalExecutableIdentity emits canonical JSON: struct field order, no HTML escape, empty symlink_chain as [], integers as decimal JSON numbers.

func MarshalLocalConfig 

func MarshalLocalConfig(cfg LocalConfig) ([]byte, error)

func MarshalProjectConfig 

func MarshalProjectConfig(cfg ProjectConfig) ([]byte, error)

func PartitionStaticProviderArgs added in v0.62.0 

func PartitionStaticProviderArgs(provider string, args []string) (committed, bypass []string, err error)

PartitionStaticProviderArgs separates ordinary committed arguments from the adapter's explicit operator-bypass arguments. Callers must first validate the complete input with ValidateStaticProviderInput.

func PlacementSupported added in v0.64.0 

func PlacementSupported(backend string, requested Placement) bool

PlacementSupported reports whether the backend can realize the complete requested tuple. The table is the amq-94w safe set; it is not inferred field-by-field.

func PreparePlanDigest added in v0.62.0 

func PreparePlanDigest(p Plan) (string, error)

PreparePlanDigest hashes the nonce-free static plan used by Prepare. Unlike a backend execution Plan, it permits zero runnable agents so a participant- only session still has one deterministic plan subject.

func PrepareTrustDigest added in v0.62.0 

func PrepareTrustDigest(planDigest, session, rootPath, rootIdentity string, onLiveKeep []string) (string, error)

PrepareTrustDigest binds a nonce-free plan digest to the canonical target and its physical identity. For an absent session, rootIdentity is a stable intended-child identity derived from the pinned parent and child name. onLiveKeep is sorted handles with explicit keep; empty preserves the v0.61 digest.

func PrepareTrustDigestWithAuthority added in v0.64.0 

func PrepareTrustDigestWithAuthority(planDigest, session, rootPath, rootIdentity, authorityDigest string, onLiveKeep []string) (string, error)

func PrepareTrustPlanDigest added in v0.64.0 

func PrepareTrustPlanDigest(p Plan) (string, error)

func ProviderForExecutable added in v0.65.3 

func ProviderForExecutable(executable string) string

ProviderForExecutable maps a configured executable basename to the stable adapter/provider identity. Cursor's current CLI is "agent"; cursor-agent remains a supported legacy executable alias.

func ReadEvidence added in v0.62.0 

func ReadEvidence(root *fsq.DeliveryRoot, id string) (EvidenceRecord, EvidenceRef, error)

func RemoveExecutionTicket 

func RemoveExecutionTicket(root *fsq.DeliveryRoot, lease *Lease, handle, nonce string) error

RemoveExecutionTicket removes only the exact pending generation while the caller still holds both the launch lease and the handle lock.

func ResolveExecutionArgv added in v0.63.0 

func ResolveExecutionArgv(ticket ExecutionTicket) ([]string, error)

ResolveExecutionArgv replaces only declared dynamic slots after the ticket has durably acquired their values. Static argv remains byte-identical.

func RevertExecution 

func RevertExecution(root *fsq.DeliveryRoot, handle, nonce string) (returnErr error)

RevertExecution records a provider exec failure. It demotes only a ready mint generation created by this exact ticket; an older resumed identity is retained.

func RunConformance 

func RunConformance(t *testing.T, b Backend)

RunConformance exercises declared capabilities identically for any backend and requires stable unsupported / unknown for the rest. The Inspect-unknown injection and typo-refusal cases always run so tmux/cmux/ghostty can reuse them unchanged.

func ValidateAdapterCapabilities 

func ValidateAdapterCapabilities(adapter HarnessAdapter, capabilities AdapterCapabilities) error

func ValidateAdapterPlan 

func ValidateAdapterPlan(adapter HarnessAdapter, plan AgentPlan) error

func ValidateCallerContext added in v0.64.0 

func ValidateCallerContext(context map[string]string) error

ValidateCallerContext validates opaque caller-owned correlation metadata.

func ValidateCommittedConfig 

func ValidateCommittedConfig(adapter HarnessAdapter, request CommittedConfigRequest) error

func ValidateExecutionEnvelope 

func ValidateExecutionEnvelope(root *fsq.DeliveryRoot, ticket ExecutionTicket, envelope ExecutionEnvelope) error

func ValidateExecutionOptions added in v0.62.0 

func ValidateExecutionOptions(root *fsq.DeliveryRoot, handle, nonce string, options *PrepareExecutionOptions) error

ValidateExecutionOptions performs the read-only ticket check required before coop exec can use wake or injector settings. PrepareExecution repeats the same check at the final provider boundary before changing ticket state.

func ValidatePrepareExecutionOptionsGrammar added in v0.62.0 

func ValidatePrepareExecutionOptionsGrammar(options PrepareExecutionOptions, presence PrepareExecutionOptionsPresence) error

ValidatePrepareExecutionOptionsGrammar is the single input-grammar validator for public launch intents and the managed execution-options codec.

func ValidateStaticProviderInput added in v0.62.0 

func ValidateStaticProviderInput(executable string, args []string, env map[string]string) (string, error)

ValidateStaticProviderInput validates caller-owned provider argv and environment without resolving runtime identity or generating a plan. The executable selects one built-in adapter by basename. Operator bypass flags remain explicit static input, but are accepted only from that adapter's fixed allow-list.

func WithSessionCreationLock added in v0.62.0 

func WithSessionCreationLock(base *fsq.DeliveryRoot, session string, operation func() error) (returnErr error)

WithSessionCreationLock serializes in-repository creators for one direct session child. Filesystem-exclusive creation remains the correctness boundary against callers that do not cooperate with this advisory lock.

func WriteBinding 

func WriteBinding(root *fsq.DeliveryRoot, lease *Lease, record BindingRecord) error

WriteBinding replaces the session binding. A live *Lease is required; there is no lease-free write path.

func WriteConversation 

func WriteConversation(root *fsq.DeliveryRoot, lease *Lease, record ConversationRecord) error

func WriteExecutionTicket 

func WriteExecutionTicket(root *fsq.DeliveryRoot, lease *Lease, ticket ExecutionTicket) error

func WriteJournal 

func WriteJournal(root *fsq.DeliveryRoot, lease *Lease, record LaunchJournal) error

Types

type AdapterCapabilities 

type AdapterCapabilities struct {
	Provider        string      `json:"provider"`
	Mode            AdapterMode `json:"mode"`
	Available       bool        `json:"available"`
	Executable      string      `json:"executable,omitempty"`
	ProviderVersion string      `json:"provider_version,omitempty"`
	Fresh           bool        `json:"fresh"`
	Resume          bool        `json:"resume"`
	Capture         bool        `json:"capture"`
	PreSpawnAcquire bool        `json:"pre_spawn_acquire"`
	Reason          string      `json:"reason,omitempty"`
}

type AdapterFactory added in v0.62.0 

type AdapterFactory func(provider, executable string) HarnessAdapter

type AdapterMode 

type AdapterMode string
const (
	AdapterModeMint        AdapterMode = "mint"
	AdapterModeCapture     AdapterMode = "capture"
	AdapterModeUnsupported AdapterMode = "unsupported"
)

type AgentPlan 

type AgentPlan struct {
	Handle          string            `json:"handle"`
	Argv            []string          `json:"argv"`
	EnvOverlay      map[string]string `json:"env_overlay,omitempty"`
	Cwd             string            `json:"cwd"`
	AdapterMode     AdapterMode       `json:"adapter_mode"`
	ResumePolicy    ResumePolicy      `json:"resume_policy"`
	LaunchNonce     string            `json:"launch_nonce,omitempty"`
	ConversationID  string            `json:"conversation_id,omitempty"`
	DynamicArgv     []DynamicArg      `json:"dynamic_argv,omitempty"`
	PreSpawnAcquire bool              `json:"pre_spawn_acquire,omitempty"`
	// Execution is the normalized coop-exec wrapper policy. Keeping it in the
	// plan makes journal recovery lossless before the wrapper consumes it.
	Execution    *PrepareExecutionOptions `json:"execution,omitempty"`
	InitialInput *PlannedInitialInput     `json:"initial_input,omitempty"`
	Wrapper      *Wrapper                 `json:"wrapper,omitempty"`
}

func (AgentPlan) Validate 

func (a AgentPlan) Validate() error

Validate checks one backend-ready agent plan independently of its parent.

type AgentReconcileResult 

type AgentReconcileResult struct {
	Handle                  string                  `json:"handle"`
	Code                    int                     `json:"code"`
	ConversationDisposition ConversationDisposition `json:"conversation_disposition"`
	Reason                  string                  `json:"reason"`
}

type ApplyDecision added in v0.62.0 

type ApplyDecision struct {
	ActionID string
	Choice   string
}

type ApplyDependencies added in v0.62.0 

type ApplyDependencies struct {
	PrepareDependencies
	AMQPath   string
	CrashHook func(string) error
}

type ApplyRequest added in v0.62.0 

type ApplyRequest struct {
	Prepare       PrepareRequest
	SubjectDigest string
	Decisions     []ApplyDecision
}

type ApplyResult added in v0.62.0 

type ApplyResult struct {
	Outcome           string
	ReasonCode        string
	FailureDetail     string
	SubjectSchema     int
	SubjectDigest     string
	PlanDigest        string
	TrustDigest       string
	Backend           string
	Profile           string
	Disposition       MutationDisposition
	BindingGeneration string
	Roster            PrepareRoster
	Observations      []PrepareObservation
	Commands          []EmittedCommand
	RequiredActions   []PrepareRequiredAction
	Evidence          []EvidenceRef
	CallerContext     map[string]string
}

func Apply added in v0.62.0 

func Apply(ctx context.Context, request ApplyRequest, dependencies ApplyDependencies) (result ApplyResult, returnErr error)

Apply retains the same authority from its re-Prepare through roster and launch mutation. Stable authority-lock inodes are substrate; all decision, trust, roster, journal, ticket, binding, and backend state remains untouched until the exact subject and decisions are accepted.

type ArbitraryCommandGrant 

type ArbitraryCommandGrant struct {
	Name       string            `json:"name"`
	Argv       []string          `json:"argv"`
	EnvOverlay map[string]string `json:"env_overlay,omitempty"`
	Cwd        string            `json:"cwd"`
}

type AuthorizedParticipantIdentity added in v0.65.3 

type AuthorizedParticipantIdentity struct {
	Executable  *ConsultedExecutable
	Wrapper     *ConsultedExecutable
	CwdIdentity string
}

type Backend 

type Backend interface {
	Detect() DetectResult
	Create(CreateRequest) (CreateResult, error)
	Inspect(InspectRequest) (InspectResult, error)
	Close(CloseRequest) (CloseResult, error)
}

Backend is the launcher contract from #480 v1.1 §6. Attach-or-recreate is an orchestration decision from Inspect evidence, never a backend method.

type BackendFocuser 

type BackendFocuser interface {
	Focus(FocusRequest) (FocusResult, error)
}

BackendFocuser is the optional managed attach surface. It stays separate from the four-method backend floor: plan_only backends do not own resources, while a managed profile that declares CapFocus must implement this seam.

type BackendReclaimer 

type BackendReclaimer interface {
	Reclaim(ReclaimRequest) (ReclaimResult, error)
}

BackendReclaimer is the optional recovery surface for a managed resource that may have been created before its authoritative binding was committed. It must inspect only the exact journal generation and must not mutate it.

type BindingRecord 

type BindingRecord struct {
	Version          int                 `json:"version"`
	Backend          string              `json:"backend"`
	HostIdentity     string              `json:"host_identity"`
	InstanceIdentity string              `json:"instance_identity"`
	Profile          string              `json:"profile"`
	LaunchNonce      string              `json:"launch_nonce"`
	Resources        ResourceIdentitySet `json:"resources"`
	Placement        PlacementPreview    `json:"placement,omitempty"`
	CallerContext    map[string]string   `json:"caller_context,omitempty"`
}

BindingRecord is disposable runtime state. It never identifies an AMQ session and never grants authority to execute a plan.

func LoadBinding 

func LoadBinding(root *fsq.DeliveryRoot) (BindingRecord, error)

func (BindingRecord) Validate 

func (record BindingRecord) Validate() error

type CallerContextValidationError added in v0.64.0 

type CallerContextValidationError struct{ Reason string }

func (*CallerContextValidationError) Error added in v0.64.0 

func (err *CallerContextValidationError) Error() string

type Capability 

type Capability string
const (
	// CapPlanOnly is the commands-backend floor: emit an executable plan,
	// never claim a managed terminal resource.
	CapPlanOnly Capability = "plan_only"
	// CapCreate is managed layout creation (writes a binding).
	CapCreate Capability = "create"
	// CapInspect means the backend can distinguish present from absent.
	CapInspect Capability = "inspect"
	// CapClose means the backend can dispose of a resource it owns.
	CapClose Capability = "close"
	// CapFocus means the backend can attach to a present layout.
	CapFocus Capability = "focus"
	// CapReclaim means the backend can prove the state of a journaled create.
	CapReclaim Capability = "reclaim"
)

type CaptureEvidence 

type CaptureEvidence struct {
	// contains filtered or unexported fields
}

CaptureEvidence is an observer-correlated envelope around provider-owned evidence. Source names the provider protocol event; LaunchNonce binds the observation to the launch generation held by the caller's session lease.

func ParseCodexNotifyEvidence added in v0.63.0 

func ParseCodexNotifyEvidence(raw []byte, launchNonce, handle, expectedVersion, expectedCwd string) (CaptureEvidence, error)

ParseCodexNotifyEvidence verifies the pinned Codex legacy notify wire shape and binds it to the exact managed launch generation. It does not scan the Codex session store or accept newest-file evidence.

func ParseCursorCreateChatEvidence added in v0.63.0 

func ParseCursorCreateChatEvidence(raw []byte, launchNonce, handle, providerVersion string) (CaptureEvidence, error)

ParseCursorCreateChatEvidence validates the exact stdout returned by the pinned cursor-agent create-chat command. The executing channel supplies the nonce, handle, and version bindings; provider output is never authority for those values.

type CaptureEvidenceSource 

type CaptureEvidenceSource string
const CodexNotifyV1 CaptureEvidenceSource = "codex_notify_v1"
const CursorCreateChatV1 CaptureEvidenceSource = "cursor_create_chat_v1"

type CaptureReason 

type CaptureReason string
const (
	CaptureReasonAdapterMintsIdentity CaptureReason = "adapter_mints_identity"
	CaptureReasonEvidenceMissing      CaptureReason = "evidence_missing"
	CaptureReasonEvidenceAmbiguous    CaptureReason = "evidence_ambiguous"
	CaptureReasonProviderMismatch     CaptureReason = "provider_mismatch"
	CaptureReasonProviderVersion      CaptureReason = "provider_version_mismatch"
	CaptureReasonLaunchNonceMismatch  CaptureReason = "launch_nonce_mismatch"
	CaptureReasonEvidenceSource       CaptureReason = "evidence_source_unsupported"
	CaptureReasonEvidenceUnverified   CaptureReason = "evidence_unverified"
	CaptureReasonInvalidIdentity      CaptureReason = "invalid_conversation_identity"
	CaptureReasonConversationActive   CaptureReason = "conversation_active_elsewhere"
)

type CaptureRequest 

type CaptureRequest struct {
	LaunchNonce             string
	ExpectedProviderVersion string
	Final                   bool
	Evidence                []CaptureEvidence
}

type CaptureResult 

type CaptureResult struct {
	State    CaptureState
	Identity ConversationIdentity
	Degraded bool
	Reason   CaptureReason
}

func (CaptureResult) CanPersist 

func (result CaptureResult) CanPersist() bool

type CaptureState 

type CaptureState string
const (
	CapturePending     CaptureState = "pending"
	CaptureReady       CaptureState = "ready"
	CaptureStale       CaptureState = "stale"
	CaptureUnsupported CaptureState = "unsupported"
)

type ClaudeAdapter 

type ClaudeAdapter struct {
	// contains filtered or unexported fields
}

func NewClaudeAdapter 

func NewClaudeAdapter(executable string) *ClaudeAdapter

func (*ClaudeAdapter) Capabilities 

func (adapter *ClaudeAdapter) Capabilities(ctx context.Context) AdapterCapabilities

func (*ClaudeAdapter) CaptureIdentity 

func (adapter *ClaudeAdapter) CaptureIdentity(CaptureRequest) CaptureResult

func (*ClaudeAdapter) CommittedEnvKeys 

func (adapter *ClaudeAdapter) CommittedEnvKeys() []string

func (*ClaudeAdapter) Mode 

func (adapter *ClaudeAdapter) Mode() AdapterMode

func (*ClaudeAdapter) Name 

func (adapter *ClaudeAdapter) Name() string

func (*ClaudeAdapter) PlanFresh 

func (adapter *ClaudeAdapter) PlanFresh(request PlanRequest) (AgentPlan, error)

func (*ClaudeAdapter) PlanResume 

func (adapter *ClaudeAdapter) PlanResume(request ResumeRequest) (AgentPlan, error)

func (*ClaudeAdapter) ValidateCommittedConfig 

func (adapter *ClaudeAdapter) ValidateCommittedConfig(request CommittedConfigRequest) error

type CloseRequest 

type CloseRequest struct {
	Binding BindingRecord
	Root    *fsq.DeliveryRoot
}

type CloseResult 

type CloseResult struct {
	Outcome Outcome `json:"outcome"`
	Reason  string  `json:"reason,omitempty"`
}

type CmuxBackend added in v0.63.0 

type CmuxBackend struct {
	// contains filtered or unexported fields
}

CmuxBackend manages one cmux workspace per AMQ project/session generation.

func NewCmuxBackend added in v0.63.0 

func NewCmuxBackend(binary string) *CmuxBackend

func (*CmuxBackend) Close added in v0.63.0 

func (b *CmuxBackend) Close(req CloseRequest) (CloseResult, error)

func (*CmuxBackend) Create added in v0.63.0 

func (b *CmuxBackend) Create(req CreateRequest) (CreateResult, error)

func (*CmuxBackend) Detect added in v0.63.0 

func (b *CmuxBackend) Detect() DetectResult

func (*CmuxBackend) Focus added in v0.63.0 

func (b *CmuxBackend) Focus(req FocusRequest) (FocusResult, error)

func (*CmuxBackend) Inspect added in v0.63.0 

func (b *CmuxBackend) Inspect(req InspectRequest) (InspectResult, error)

func (*CmuxBackend) Reclaim added in v0.63.0 

func (b *CmuxBackend) Reclaim(req ReclaimRequest) (ReclaimResult, error)

type CodexAdapter 

type CodexAdapter struct {
	// contains filtered or unexported fields
}

func NewCodexAdapter 

func NewCodexAdapter(executable string) *CodexAdapter

func (*CodexAdapter) Capabilities 

func (adapter *CodexAdapter) Capabilities(ctx context.Context) AdapterCapabilities

func (*CodexAdapter) CaptureIdentity 

func (adapter *CodexAdapter) CaptureIdentity(request CaptureRequest) CaptureResult

func (*CodexAdapter) CommittedEnvKeys 

func (adapter *CodexAdapter) CommittedEnvKeys() []string

func (*CodexAdapter) Mode 

func (adapter *CodexAdapter) Mode() AdapterMode

func (*CodexAdapter) Name 

func (adapter *CodexAdapter) Name() string

func (*CodexAdapter) PlanFresh 

func (adapter *CodexAdapter) PlanFresh(request PlanRequest) (AgentPlan, error)

func (*CodexAdapter) PlanResume 

func (adapter *CodexAdapter) PlanResume(request ResumeRequest) (AgentPlan, error)

func (*CodexAdapter) ValidateCommittedConfig 

func (adapter *CodexAdapter) ValidateCommittedConfig(request CommittedConfigRequest) error

type CodexNotifyConflictError added in v0.63.0 

type CodexNotifyConflictError struct {
	Existing string
	Observed string
}

func (*CodexNotifyConflictError) Error added in v0.63.0 

func (err *CodexNotifyConflictError) Error() string

type CodexNotifyResult added in v0.63.0 

type CodexNotifyResult struct {
	ConversationID string
	EvidenceRef    string
	AlreadyReady   bool
}

func RecordCodexNotify added in v0.63.0 

func RecordCodexNotify(root *fsq.DeliveryRoot, handle, nonce, amqExecutable string, raw []byte) (CodexNotifyResult, error)

RecordCodexNotify binds one provider-owned turn-complete notification to the exact managed launch, persists immutable evidence, and only then makes the provider identity resumable.

type Commands 

type Commands struct{}

Commands is the plan_only backend. It emits exact coop-exec invocations from a prebuilt plan and never owns a terminal resource.

func (Commands) Close 

func (Commands) Close(CloseRequest) (CloseResult, error)

func (Commands) Create 

func (Commands) Create(req CreateRequest) (CreateResult, error)

func (Commands) Detect 

func (Commands) Detect() DetectResult

func (Commands) Inspect 

func (Commands) Inspect(InspectRequest) (InspectResult, error)

type CommittedConfigRequest 

type CommittedConfigRequest struct {
	ProjectRoot string
	Cwd         string
	Args        []string
	EnvOverlay  map[string]string
}

CommittedConfigRequest is the static, repository-controlled subset of an adapter plan. Validation does not require the provider executable to be installed, so setup can reject unsafe committed carriers on any machine.

type CommittedConfigValidator 

type CommittedConfigValidator interface {
	ValidateCommittedConfig(CommittedConfigRequest) error
}

CommittedConfigValidator is implemented by adapters that can own committed argv, environment, and cwd validation independently from live capability probing and per-launch identity generation.

type ConfigAuthorityConflictError 

type ConfigAuthorityConflictError struct {
	Path  string
	Field string
}

func (*ConfigAuthorityConflictError) Error 

func (e *ConfigAuthorityConflictError) Error() string

type ConfigOverrideCapability added in v0.64.0 

type ConfigOverrideCapability struct {
	Key           string
	AllowedValues []string
}

type ConfirmRebindFunc 

type ConfirmRebindFunc func(BindingRecord, bool) (RebindDisposition, bool, error)

type ConfirmTrustFunc 

type ConfirmTrustFunc func(Plan, string) (bool, error)

type ConsultedExecutable added in v0.64.0 

type ConsultedExecutable struct {
	Requested string          `json:"requested"`
	Consulted string          `json:"consulted"`
	Identity  json.RawMessage `json:"identity,omitempty"`
}

ConsultedExecutable is the Prepare-subject binding for one provider executable. Requested is the caller string; Consulted is the PATH lookup or absolute path that was probed. Identity is MarshalExecutableIdentity JSON.

func ResolveConsultedExecutable added in v0.64.0 

func ResolveConsultedExecutable(requested string) (ConsultedExecutable, error)

ResolveConsultedExecutable looks up requested on PATH when it is not absolute, then probes the consulted path when it exists. Missing paths stay identity-free so schema v2 stays stable for plan-only names.

type ConversationDisposition 

type ConversationDisposition string
const (
	DispositionResumed         ConversationDisposition = "resumed"
	DispositionFresh           ConversationDisposition = "fresh"
	DispositionFreshAfterStale ConversationDisposition = "fresh_after_stale"
	DispositionDisabled        ConversationDisposition = "disabled"
	DispositionUnsupported     ConversationDisposition = "unsupported"
	DispositionDegraded        ConversationDisposition = "degraded"
	DispositionActionRequired  ConversationDisposition = "action_required"
)

type ConversationExecutionEvidence 

type ConversationExecutionEvidence struct {
	Backend        string  `json:"backend"`
	Profile        string  `json:"profile"`
	Outcome        Outcome `json:"outcome"`
	LaunchNonce    string  `json:"launch_nonce"`
	ConversationID string  `json:"conversation_id,omitempty"`
}

ConversationExecutionEvidence records the managed backend result that proves a planned agent process started. It does not grant execution authority; it prevents a minted identity from becoming resumable from plan output alone.

type ConversationIdentity 

type ConversationIdentity struct {
	Provider string `json:"provider"`
	ID       string `json:"id"`
}

type ConversationRecord 

type ConversationRecord struct {
	Version           int                            `json:"version"`
	Handle            string                         `json:"handle"`
	State             CaptureState                   `json:"state"`
	Identity          ConversationIdentity           `json:"identity,omitempty"`
	ProviderVersion   string                         `json:"provider_version,omitempty"`
	LaunchNonce       string                         `json:"launch_nonce"`
	ExecutionEvidence *ConversationExecutionEvidence `json:"execution_evidence,omitempty"`
	EvidenceRefs      []string                       `json:"evidence_refs,omitempty"`
	Reason            CaptureReason                  `json:"reason,omitempty"`
}

ConversationRecord is provider-qualified runtime state for one (session, handle). It carries no execution authority.

func LoadConversation 

func LoadConversation(root *fsq.DeliveryRoot, handle string) (ConversationRecord, error)

func (ConversationRecord) Validate 

func (record ConversationRecord) Validate() error

type CreateRequest 

type CreateRequest struct {
	ProjectRoot string
	Session     string
	Plan        Plan
	AMQPath     string
	Root        *fsq.DeliveryRoot
	// Placement is the caller-requested tuple. Nil preserves v0.61 Create.
	Placement *Placement
	// JoinBinding, when set, adds Plan agents into this owned session instead
	// of creating a new generation. Nil preserves create-from-absent.
	JoinBinding *BindingRecord
	// JoinDeltas records windows already added to JoinBinding so a retry can
	// skip them. JoinProgress is called after each added window is marked.
	JoinDeltas   []JoinDelta
	JoinProgress func(JoinDelta) error
	// PersistCandidate stores an exact managed binding before Create returns.
	// Backends use it as an immutable crash marker; nil means the caller does
	// not own a journaled create transaction.
	PersistCandidate func(BindingRecord) error
}

type CreateResult 

type CreateResult struct {
	Outcome        Outcome `json:"outcome"`
	ActionRequired bool    `json:"action_required"`
	Profile        string  `json:"profile,omitempty"`
	// Binding is a managed backend's candidate runtime record. The
	// reconciliation engine is the only layer allowed to persist it under the
	// session lease. plan_only backends leave it empty.
	Binding         BindingRecord                `json:"binding,omitempty"`
	CaptureEvidence map[string][]CaptureEvidence `json:"-"`
	Commands        []EmittedCommand             `json:"commands,omitempty"`
	Plan            []byte                       `json:"plan,omitempty"`
	Reason          string                       `json:"reason,omitempty"`
}

type CursorAdapter added in v0.63.0 

type CursorAdapter struct {
	// contains filtered or unexported fields
}

func NewCursorAdapter added in v0.63.0 

func NewCursorAdapter(executable string) *CursorAdapter

func (*CursorAdapter) Capabilities added in v0.63.0 

func (adapter *CursorAdapter) Capabilities(ctx context.Context) AdapterCapabilities

func (*CursorAdapter) CaptureIdentity added in v0.63.0 

func (adapter *CursorAdapter) CaptureIdentity(request CaptureRequest) CaptureResult

func (*CursorAdapter) CommittedEnvKeys added in v0.63.0 

func (adapter *CursorAdapter) CommittedEnvKeys() []string

func (*CursorAdapter) Mode added in v0.63.0 

func (adapter *CursorAdapter) Mode() AdapterMode

func (*CursorAdapter) Name added in v0.63.0 

func (adapter *CursorAdapter) Name() string

func (*CursorAdapter) PlanFresh added in v0.63.0 

func (adapter *CursorAdapter) PlanFresh(request PlanRequest) (AgentPlan, error)

func (*CursorAdapter) PlanResume added in v0.63.0 

func (adapter *CursorAdapter) PlanResume(request ResumeRequest) (AgentPlan, error)

func (*CursorAdapter) ValidateCommittedConfig added in v0.63.0 

func (adapter *CursorAdapter) ValidateCommittedConfig(request CommittedConfigRequest) error

type DefinitePreCreateError 

type DefinitePreCreateError struct{ Err error }

DefinitePreCreateError means Create proved that it made no backend resource. All other Create errors are uncertain and retain the journal for recovery.

func (*DefinitePreCreateError) Error 

func (e *DefinitePreCreateError) Error() string

func (*DefinitePreCreateError) Unwrap 

func (e *DefinitePreCreateError) Unwrap() error

type Degradation 

type Degradation struct {
	Capability Capability `json:"capability"`
	Reason     string     `json:"reason"`
}

type DetectResult 

type DetectResult struct {
	Available        bool          `json:"available"`
	Profile          Profile       `json:"profile"`
	HostIdentity     string        `json:"host_identity,omitempty"`
	InstanceIdentity string        `json:"instance_identity,omitempty"`
	Effective        []Capability  `json:"effective"`
	Degradations     []Degradation `json:"degradations,omitempty"`
}

func (DetectResult) Validate 

func (d DetectResult) Validate() error

type DynamicArg 

type DynamicArg struct {
	Index int            `json:"index"`
	Kind  DynamicArgKind `json:"kind"`
}

DynamicArg marks one runtime-generated argv value. Unmarked argv values are always trust-bearing. Version 1 has no dynamic environment slots; adding them requires a plan schema version change when an adapter needs one.

type DynamicArgKind 

type DynamicArgKind string
const (
	DynamicArgLaunchNonce    DynamicArgKind = "launch_nonce"
	DynamicArgConversationID DynamicArgKind = "conversation_id"
)

type EmittedCommand 

type EmittedCommand struct {
	Handle      string            `json:"handle"`
	Argv        []string          `json:"argv"`
	Cwd         string            `json:"cwd"`
	Env         map[string]string `json:"env,omitempty"`
	LaunchNonce string            `json:"launch_nonce,omitempty"`
	Line        string            `json:"line"`
}

type EvidenceCorruptError added in v0.62.0 

type EvidenceCorruptError struct {
	ID     string
	Reason string
}

func (*EvidenceCorruptError) Error added in v0.62.0 

func (e *EvidenceCorruptError) Error() string

type EvidenceExistsError added in v0.62.0 

type EvidenceExistsError struct{ ID string }

func (*EvidenceExistsError) Error added in v0.62.0 

func (e *EvidenceExistsError) Error() string

type EvidenceKind added in v0.62.0 

type EvidenceKind string
const (
	EvidenceProviderCapture EvidenceKind = "provider_capture"
	EvidenceRetainedCapture EvidenceKind = "retained_capture"
	EvidenceFixture         EvidenceKind = "fixture"
	EvidenceManual          EvidenceKind = "manual"
)

type EvidenceRecord added in v0.62.0 

type EvidenceRecord struct {
	EvidenceVersion int               `json:"evidence_version"`
	Kind            EvidenceKind      `json:"kind"`
	Handle          string            `json:"handle"`
	ObservedAt      time.Time         `json:"observed_at"`
	PayloadSHA256   string            `json:"payload_sha256"`
	Payload         json.RawMessage   `json:"payload"`
	CallerContext   map[string]string `json:"caller_context,omitempty"`
}

func (EvidenceRecord) Validate added in v0.62.0 

func (record EvidenceRecord) Validate() error

type EvidenceRef added in v0.62.0 

type EvidenceRef struct {
	EvidenceVersion int               `json:"evidence_version"`
	ID              string            `json:"id"`
	Kind            EvidenceKind      `json:"kind"`
	SHA256          string            `json:"sha256"`
	ObservedAt      time.Time         `json:"observed_at"`
	CallerContext   map[string]string `json:"caller_context,omitempty"`
}

func CollectEvidenceRefs added in v0.62.0 

func CollectEvidenceRefs(root *fsq.DeliveryRoot, handles []string) ([]EvidenceRef, error)

func WriteEvidence added in v0.62.0 

func WriteEvidence(root *fsq.DeliveryRoot, lease *Lease, request EvidenceWriteRequest) (EvidenceRef, error)

type EvidenceWriteRequest added in v0.62.0 

type EvidenceWriteRequest struct {
	Kind          EvidenceKind
	Handle        string
	ObservedAt    time.Time
	Payload       []byte
	CallerContext map[string]string
}

type ExecutableIdentity added in v0.64.0 

type ExecutableIdentity struct {
	CanonicalPath string               `json:"canonical_path"`
	Type          string               `json:"type"`
	Dev           uint64               `json:"dev"`
	Inode         uint64               `json:"inode"`
	VolumeID      uint64               `json:"volume_id"`
	FileID        uint64               `json:"file_id"`
	Size          int64                `json:"size"`
	MtimeNS       int64                `json:"mtime_ns"`
	SymlinkChain  []ExecutableIdentity `json:"symlink_chain"`
}

ExecutableIdentity is the freeze tuple for amq-xgc. Field names and decimal integer encoding are part of the contract. Schema-v2 subjects embed MarshalExecutableIdentity bytes as executable_identity.identity.

func ProbeExecutableIdentity added in v0.64.0 

func ProbeExecutableIdentity(path string) (ExecutableIdentity, error)

ProbeExecutableIdentity records the on-disk identity of path, including every symlink hop. It does not consult PATH; the caller resolves names.

type ExecutionEnvelope 

type ExecutionEnvelope struct {
	Cwd, AMQExecutable, ProviderExecutable string
	TargetArgv, Environment                []string
	Execution                              *PrepareExecutionOptions
}

type ExecutionState 

type ExecutionState string
const (
	ExecutionPending          ExecutionState = "pending"
	ExecutionIdentityAcquired ExecutionState = "identity_acquired"
	ExecutionSpawnAttempted   ExecutionState = "spawn_attempted"
	ExecutionAcknowledged     ExecutionState = "acknowledged"
)

type ExecutionTicket 

type ExecutionTicket struct {
	Version int `json:"version"`

	Handle          string      `json:"handle"`
	LaunchNonce     string      `json:"launch_nonce"`
	Mode            AdapterMode `json:"mode"`
	Provider        string      `json:"provider"`
	ProviderVersion string      `json:"provider_version,omitempty"`
	ConversationID  string      `json:"conversation_id,omitempty"`
	PreSpawnAcquire bool        `json:"pre_spawn_acquire,omitempty"`
	EvidenceRefs    []string    `json:"evidence_refs,omitempty"`
	Backend         string      `json:"backend,omitempty"`
	Profile         string      `json:"profile,omitempty"`

	ProjectRoot     string `json:"project_root"`
	ProjectIdentity string `json:"project_identity"`
	SessionRoot     string `json:"session_root"`
	SessionIdentity string `json:"session_identity"`
	Cwd             string `json:"cwd"`
	CwdIdentity     string `json:"cwd_identity"`

	ProviderExecutable         string   `json:"provider_executable"`
	ProviderExecutableIdentity string   `json:"provider_executable_identity"`
	AMQExecutable              string   `json:"amq_executable"`
	AMQExecutableIdentity      string   `json:"amq_executable_identity"`
	InjectorExecutable         string   `json:"injector_executable,omitempty"`
	InjectorExecutableIdentity string   `json:"injector_executable_identity,omitempty"`
	Wrapper                    *Wrapper `json:"wrapper,omitempty"`
	WrapperExecutableIdentity  string   `json:"wrapper_executable_identity,omitempty"`

	TargetArgv    []string                 `json:"target_argv"`
	DynamicArgv   []DynamicArg             `json:"dynamic_argv,omitempty"`
	InitialInput  *PlannedInitialInput     `json:"initial_input,omitempty"`
	TargetEnv     map[string]string        `json:"target_env,omitempty"`
	EnvDigest     string                   `json:"env_digest"`
	State         ExecutionState           `json:"state"`
	Reason        string                   `json:"reason,omitempty"`
	Execution     *PrepareExecutionOptions `json:"execution,omitempty"`
	CallerContext map[string]string        `json:"caller_context,omitempty"`
}

ExecutionTicket is the durable, nonce-bound handoff between planning and the process which actually starts a command. It is evidence, not execution authority: writes require the live launch lease and the matching handle lock.

func CompareAndSwapExecutionIdentity added in v0.63.0 

func CompareAndSwapExecutionIdentity(root *fsq.DeliveryRoot, lease *Lease, handle, conversationID, evidenceRef string) (ExecutionTicket, error)

CompareAndSwapExecutionIdentity publishes the provider-owned identity and its immutable evidence in the same pending-to-acquired ticket write.

func CompareAndSwapExecutionTicket 

func CompareAndSwapExecutionTicket(root *fsq.DeliveryRoot, lease *Lease, handle string, expected ExecutionState, next ExecutionState, reason string) (ExecutionTicket, error)

CompareAndSwapExecutionTicket changes one ticket state while the caller's live lease and handle lock exclude competing launch/reconcile operations.

func LoadExecutionTicket 

func LoadExecutionTicket(root *fsq.DeliveryRoot, handle string) (ExecutionTicket, error)

func NewExecutionTicket 

func NewExecutionTicket(request ExecutionTicketRequest) (ExecutionTicket, error)

NewExecutionTicket canonicalizes every filesystem input and snapshots its physical identity before the ticket can be persisted.

func PrepareExecution 

func PrepareExecution(root *fsq.DeliveryRoot, handle, nonce string, envelope ExecutionEnvelope) (ticket ExecutionTicket, returnErr error)

PrepareExecution performs the final envelope check and durable execution acknowledgement under the exact launch nonce and handle lock.

func (ExecutionTicket) Validate 

func (ticket ExecutionTicket) Validate() error

type ExecutionTicketRequest 

type ExecutionTicketRequest struct {
	Handle, LaunchNonce               string
	Mode                              AdapterMode
	Provider, ProviderVersion         string
	ConversationID                    string
	PreSpawnAcquire                   bool
	EvidenceRefs                      []string
	Backend, Profile                  string
	ProjectRoot, SessionRoot, Cwd     string
	ProviderExecutable, AMQExecutable string
	TargetArgv                        []string
	DynamicArgv                       []DynamicArg
	InitialInput                      *PlannedInitialInput
	TargetEnv                         map[string]string
	State                             ExecutionState
	Reason                            string
	Execution                         *PrepareExecutionOptions
	CallerContext                     map[string]string
	Wrapper                           *Wrapper
}

type FocusRequest 

type FocusRequest struct {
	Binding BindingRecord
	Root    *fsq.DeliveryRoot
}

type FocusResult 

type FocusResult struct {
	Outcome Outcome `json:"outcome"`
	Reason  string  `json:"reason,omitempty"`
}

type GhosttyBackend added in v0.63.0 

type GhosttyBackend struct {
	// contains filtered or unexported fields
}

GhosttyBackend manages one Ghostty window per AMQ project/session generation on macOS via AppleScript.

func NewGhosttyBackend added in v0.63.0 

func NewGhosttyBackend() *GhosttyBackend

func (*GhosttyBackend) Close added in v0.63.0 

func (b *GhosttyBackend) Close(req CloseRequest) (CloseResult, error)

func (*GhosttyBackend) Create added in v0.63.0 

func (b *GhosttyBackend) Create(req CreateRequest) (CreateResult, error)

func (*GhosttyBackend) Detect added in v0.63.0 

func (b *GhosttyBackend) Detect() DetectResult

func (*GhosttyBackend) Focus added in v0.63.0 

func (b *GhosttyBackend) Focus(req FocusRequest) (FocusResult, error)

func (*GhosttyBackend) Inspect added in v0.63.0 

func (b *GhosttyBackend) Inspect(req InspectRequest) (InspectResult, error)

func (*GhosttyBackend) Reclaim added in v0.63.0 

func (b *GhosttyBackend) Reclaim(req ReclaimRequest) (ReclaimResult, error)

type GrokAdapter added in v0.66.0 

type GrokAdapter struct {
	// contains filtered or unexported fields
}

func NewGrokAdapter added in v0.66.0 

func NewGrokAdapter(executable string) *GrokAdapter

func (*GrokAdapter) Capabilities added in v0.66.0 

func (adapter *GrokAdapter) Capabilities(ctx context.Context) AdapterCapabilities

func (*GrokAdapter) CaptureIdentity added in v0.66.0 

func (adapter *GrokAdapter) CaptureIdentity(CaptureRequest) CaptureResult

func (*GrokAdapter) CommittedEnvKeys added in v0.66.0 

func (adapter *GrokAdapter) CommittedEnvKeys() []string

func (*GrokAdapter) Mode added in v0.66.0 

func (adapter *GrokAdapter) Mode() AdapterMode

func (*GrokAdapter) Name added in v0.66.0 

func (adapter *GrokAdapter) Name() string

func (*GrokAdapter) PlanFresh added in v0.66.0 

func (adapter *GrokAdapter) PlanFresh(request PlanRequest) (AgentPlan, error)

func (*GrokAdapter) PlanResume added in v0.66.0 

func (adapter *GrokAdapter) PlanResume(request ResumeRequest) (AgentPlan, error)

func (*GrokAdapter) ValidateCommittedConfig added in v0.66.0 

func (adapter *GrokAdapter) ValidateCommittedConfig(request CommittedConfigRequest) error

type HarnessAdapter 

type HarnessAdapter interface {
	Name() string
	Mode() AdapterMode
	CommittedEnvKeys() []string
	Capabilities(context.Context) AdapterCapabilities
	PlanFresh(PlanRequest) (AgentPlan, error)
	PlanResume(ResumeRequest) (AgentPlan, error)
	CaptureIdentity(CaptureRequest) CaptureResult
}

HarnessAdapter owns conversation identity and produces backend-ready plans. It must not create, inspect, focus, or close terminal resources.

type HolderIdentity 

type HolderIdentity struct {
	PID          int    `json:"pid"`
	ProcessStart string `json:"process_start,omitempty"`
	BootID       string `json:"boot_id,omitempty"`
}

HolderIdentity is the wake-lock idiom: pid plus kernel start token and boot id. A lease is stale only when that holder is proven dead; unverified fails closed.

type InitialInputKind added in v0.64.0 

type InitialInputKind string
const (
	InitialInputArgument InitialInputKind = "argument"
	InitialInputStdin    InitialInputKind = "stdin"
	InitialInputFile     InitialInputKind = "file"
)

type InitialInputRequest added in v0.64.0 

type InitialInputRequest struct {
	Kind   InitialInputKind
	Value  string
	SHA256 string
}

type InspectRequest 

type InspectRequest struct {
	Binding BindingRecord
	Root    *fsq.DeliveryRoot
}

type InspectResult 

type InspectResult struct {
	Status         InspectStatus `json:"status"`
	Evidence       string        `json:"evidence"`
	ActionRequired bool          `json:"action_required"`
}

type InspectStatus 

type InspectStatus string
const (
	InspectPresent InspectStatus = "present"
	InspectAbsent  InspectStatus = "absent"
	InspectUnknown InspectStatus = "unknown"
)

type JoinDelta added in v0.65.3 

type JoinDelta struct {
	Handle       string `json:"handle"`
	SessionID    string `json:"session_id"`
	SessionName  string `json:"session_name"`
	SessionNonce string `json:"session_nonce"`
	Epoch        string `json:"epoch,omitempty"`
	WindowID     string `json:"window_id"`
	PaneID       string `json:"pane_id"`
}

JoinDelta is the durable proof for one window added to an existing managed tmux session. Its session identity is checked before the next mutation.

type JournalPhase 

type JournalPhase string
const (
	JournalIntent  JournalPhase = "intent"
	JournalCreated JournalPhase = "created"
)

type LaunchJournal 

type LaunchJournal struct {
	Version          int                    `json:"version"`
	Phase            JournalPhase           `json:"phase"`
	ProjectIdentity  string                 `json:"project_identity"`
	RootIdentity     string                 `json:"root_identity"`
	ProjectPhysical  string                 `json:"project_physical_identity,omitempty"`
	RootPhysical     string                 `json:"root_physical_identity,omitempty"`
	Session          string                 `json:"session"`
	Backend          string                 `json:"backend"`
	Profile          string                 `json:"profile"`
	HostIdentity     string                 `json:"host_identity"`
	InstanceIdentity string                 `json:"instance_identity"`
	RosterDigest     string                 `json:"roster_digest"`
	PlanDigest       string                 `json:"plan_digest"`
	LaunchNonce      string                 `json:"launch_nonce"`
	CreatedAt        time.Time              `json:"created_at"`
	Plan             Plan                   `json:"plan"`
	Agents           []AgentReconcileResult `json:"agents"`
	Conversations    []ConversationRecord   `json:"conversations"`
	Binding          *BindingRecord         `json:"binding,omitempty"`
	JoinBinding      *BindingRecord         `json:"join_binding,omitempty"`
	JoinDeltas       []JoinDelta            `json:"join_deltas,omitempty"`
	Placement        PlacementPreview       `json:"placement,omitempty"`
	CallerContext    map[string]string      `json:"caller_context,omitempty"`
	// CandidateBinding is an immutable backend marker for an exact resource
	// discovered before reconciliation can publish the created phase.
	CandidateBinding *BindingRecord `json:"candidate_binding,omitempty"`
}

LaunchJournal is a recovery transaction, not a launcher binding. A resource recorded here is never owned or adoptable until a backend proves its live identity or a matching authoritative binding already exists.

func LoadJournal 

func LoadJournal(root *fsq.DeliveryRoot) (LaunchJournal, error)

func NewLaunchJournal 

func NewLaunchJournal(request ReconcileRequest, backend string, detect DetectResult, plan Plan, planDigest, nonce string, agents []AgentReconcileResult, conversations []ConversationRecord, now time.Time) (LaunchJournal, error)

func (LaunchJournal) Validate 

func (record LaunchJournal) Validate() error

func (LaunchJournal) ValidateRequest 

func (record LaunchJournal) ValidateRequest(request ReconcileRequest) error

type LaunchPathError added in v0.65.3 

type LaunchPathError struct {
	Code string
	Path string
}

func (*LaunchPathError) Error added in v0.65.3 

func (e *LaunchPathError) Error() string

type LayoutIntent 

type LayoutIntent struct {
	Type string `json:"type"`
}

type Lease 

type Lease struct {
	// contains filtered or unexported fields
}

Lease is a live, process-local capability. Unexported fields keep a forged value from authorizing WriteBinding.

func AcquireLease 

func AcquireLease(root *fsq.DeliveryRoot, nonce string) (*Lease, error)

func (*Lease) LaunchNonce 

func (l *Lease) LaunchNonce() string

func (*Lease) LockHandles 

func (l *Lease) LockHandles(handles ...string) error

func (*Lease) LockedHandles 

func (l *Lease) LockedHandles() []string

func (*Lease) Release 

func (l *Lease) Release() error

type LeaseHeldError 

type LeaseHeldError struct {
	Nonce    string
	Evidence string
}

func (*LeaseHeldError) Error 

func (e *LeaseHeldError) Error() string

type LeaseInspection 

type LeaseInspection struct {
	State    LeaseState
	Evidence string
	Holder   HolderIdentity
	Nonce    string
}

func InspectLease 

func InspectLease(root *fsq.DeliveryRoot) (LeaseInspection, error)

type LeaseState 

type LeaseState string
const (
	LeaseMissing    LeaseState = "missing"
	LeaseValid      LeaseState = "valid"
	LeaseStale      LeaseState = "stale"
	LeaseUnverified LeaseState = "unverified"
)

type LeaseUnverifiedError 

type LeaseUnverifiedError struct {
	Evidence string
}

func (*LeaseUnverifiedError) Error 

func (e *LeaseUnverifiedError) Error() string

type LifecycleDependencies added in v0.62.0 

type LifecycleDependencies struct{ Backends map[string]Backend }

type LifecycleRequest added in v0.62.0 

type LifecycleRequest struct{ Target PrepareTarget }

type LifecycleResult added in v0.62.0 

type LifecycleResult struct {
	Outcome           string
	ReasonCode        string
	Backend           string
	Profile           string
	Disposition       MutationDisposition
	BindingGeneration string
	State             string
	Observations      []PrepareObservation
	Evidence          []EvidenceRef
	CallerContext     map[string]string
}

func CloseLifecycle added in v0.62.0 

func CloseLifecycle(ctx context.Context, request LifecycleRequest, dependencies LifecycleDependencies) (LifecycleResult, error)

func FocusLifecycle added in v0.62.0 

func FocusLifecycle(ctx context.Context, request LifecycleRequest, dependencies LifecycleDependencies) (LifecycleResult, error)

func InspectLifecycle added in v0.62.0 

func InspectLifecycle(ctx context.Context, request LifecycleRequest, dependencies LifecycleDependencies) (LifecycleResult, error)

type LocalConfig 

type LocalConfig struct {
	Schema             int      `json:"schema"`
	LauncherPreference []string `json:"launcher_preference"`
}

LocalConfig is deliberately preference-only. Execution authority, roster, environment, cwd, bypass arguments, and session selection do not belong in this in-worktree file, even when the file is already tracked.

func ParseLocalConfig 

func ParseLocalConfig(path string, data []byte) (LocalConfig, error)

func (LocalConfig) Validate 

func (cfg LocalConfig) Validate() error

type MutationDisposition added in v0.65.3 

type MutationDisposition string
const (
	MutationNotApplied MutationDisposition = "not_applied"
	MutationCommitted  MutationDisposition = "committed"
	MutationUncertain  MutationDisposition = "uncertain"
)

type Outcome 

type Outcome string
const (
	OutcomeCreated         Outcome = "created"
	OutcomeCommandsEmitted Outcome = "commands_emitted"
	OutcomeActionRequired  Outcome = "action_required"
	OutcomeUnsupported     Outcome = "unsupported"
	OutcomeNoAction        Outcome = "no_action"
	OutcomeAttached        Outcome = "attached"
	OutcomeClosed          Outcome = "closed"
)

type Placement added in v0.64.0 

type Placement struct {
	Target       string `json:"target"`
	Layout       string `json:"layout"`
	StaggerMS    int    `json:"stagger_ms,omitempty"`
	LauncherPane string `json:"launcher_pane,omitempty"`
}

Placement is the internal complete-tuple form of public PlacementV1. launchapi wiring lands with ul7; backends consume this type directly.

func LegacyPlacement added in v0.64.0 

func LegacyPlacement(backend string) Placement

LegacyPlacement is each backend's v0.61 omitted-placement behavior.

func (Placement) Validate added in v0.64.0 

func (p Placement) Validate() error

type PlacementPreview added in v0.64.0 

type PlacementPreview struct {
	Requested  *Placement `json:"requested,omitempty"`
	Effective  Placement  `json:"effective"`
	Supported  bool       `json:"supported"`
	ReasonCode string     `json:"reason_code,omitempty"`
}

PlacementPreview is the internal form of public PlacementPreviewV1.

func ResolvePlacement added in v0.64.0 

func ResolvePlacement(backend string, requested *Placement) (PlacementPreview, error)

type Plan 

type Plan struct {
	Version int         `json:"version"`
	Agents  []AgentPlan `json:"agents"`
}

Plan is the public, backend-independent execution contract. Nonce and ConversationID are per-launch values and are deliberately not trusted.

func DecodePlan 

func DecodePlan(data []byte) (Plan, error)

func (Plan) SemanticDigest 

func (p Plan) SemanticDigest() (string, error)

SemanticDigest hashes the adapter-normalized static execution template. Fresh and resume argv shapes have different digests because only the resume shape carries a conversation slot; each shape therefore requires trust once.

func (Plan) TrustSemanticDigest added in v0.64.0 

func (p Plan) TrustSemanticDigest() (string, error)

TrustSemanticDigest excludes caller-generated initial-input content while retaining the selected carrier kind and argv position.

func (Plan) Validate 

func (p Plan) Validate() error

type PlanRequest 

type PlanRequest struct {
	Handle        string
	ProjectRoot   string
	SessionRoot   string
	AMQExecutable string
	Cwd           string
	// AllowExternalCwd is reserved for the public intent compiler. Public
	// intents can name an absolute sibling worktree after that path is
	// canonicalized and physically identified. Committed project config keeps
	// the historical project-contained rule.
	AllowExternalCwd bool
	LaunchNonce      string
	ResumePolicy     ResumePolicy
	CommittedArgs    []string
	BypassArgs       []string
	EnvOverlay       map[string]string
	InitialInput     *InitialInputRequest
	Wrapper          *Wrapper
}

type PlannedInitialInput added in v0.64.0 

type PlannedInitialInput struct {
	Kind      InitialInputKind `json:"kind"`
	SHA256    string           `json:"sha256"`
	ArgvIndex int              `json:"argv_index"`
}

type PlannedWrite added in v0.64.0 

type PlannedWrite struct {
	WriteID string           `json:"write_id"`
	Kind    PlannedWriteKind `json:"kind"`
	Path    string           `json:"path"`
	Handle  string           `json:"handle,omitempty"`
	SHA256  string           `json:"sha256,omitempty"`
}

type PlannedWriteKind added in v0.64.0 

type PlannedWriteKind string
const (
	PlannedWriteCreateBaseRoot PlannedWriteKind = "create_base_root"
	PlannedWriteInitialInput   PlannedWriteKind = "write_initial_input"
)

type PrepareCommand added in v0.62.0 

type PrepareCommand struct {
	Argv       []string          `json:"argv"`
	Cwd        string            `json:"cwd"`
	EnvOverlay map[string]string `json:"env_overlay,omitempty"`
}

type PrepareDependencies added in v0.62.0 

type PrepareDependencies struct {
	Backends     map[string]Backend
	Preferences  []string
	AdapterFor   AdapterFactory
	AMQPath      string
	TrustStore   *TrustStore
	HostIdentity string
}

type PrepareExecutionOptions added in v0.62.0 

type PrepareExecutionOptions struct {
	RequireWake          bool     `json:"require_wake"`
	NoGitignore          bool     `json:"no_gitignore"`
	WakeMode             string   `json:"wake_mode"`
	AuditReason          string   `json:"audit_reason,omitempty"`
	InjectorMode         string   `json:"injector_mode,omitempty"`
	InjectorVia          string   `json:"injector_via,omitempty"`
	InjectorArgs         []string `json:"injector_args,omitempty"`
	SymphonyEvents       []string `json:"symphony_events,omitempty"`
	SymphonyWorkspaceKey string   `json:"symphony_workspace_key,omitempty"`
}

func CanonicalExecutionOptions added in v0.62.0 

func CanonicalExecutionOptions(options *PrepareExecutionOptions) PrepareExecutionOptions

CanonicalExecutionOptions returns the normalized policy value used for ticket equality. A missing policy and an explicit all-default policy are equivalent; collection presence is not semantic.

type PrepareExecutionOptionsPresence added in v0.62.0 

type PrepareExecutionOptionsPresence struct {
	Injector bool
	Symphony bool
}

type PrepareInitialInput added in v0.64.0 

type PrepareInitialInput struct {
	Kind InitialInputKind
	Text string
}

type PrepareObservation added in v0.62.0 

type PrepareObservation struct {
	Handle                     string `json:"handle"`
	Mailbox                    string `json:"mailbox"`
	Runnable                   bool   `json:"runnable"`
	Conversation               string `json:"conversation"`
	ConversationIdentityDigest string `json:"conversation_identity_digest"`
	Execution                  string `json:"execution"`
	ExecutionIdentityDigest    string `json:"execution_identity_digest"`
	Resource                   string `json:"resource"`
	ReasonCode                 string `json:"reason_code,omitempty"`
	Disposition                string `json:"disposition,omitempty"`
	StartMode                  string `json:"start_mode,omitempty"`
}

type PrepareParticipant added in v0.62.0 

type PrepareParticipant struct {
	Handle       string
	Runnable     bool
	Provider     string
	Executable   string
	Args         []string
	BypassArgs   []string
	Cwd          string
	EnvOverlay   map[string]string
	ResumePolicy ResumePolicy
	Execution    PrepareExecutionOptions
	InitialInput *PrepareInitialInput
	OnLive       string
	Wrapper      *Wrapper
}

type PrepareRequest added in v0.62.0 

type PrepareRequest struct {
	Target        PrepareTarget
	Launcher      string
	IntentDigest  string
	Participants  []PrepareParticipant
	SubjectSchema int
	Placement     *Placement
	CallerContext map[string]string
}

type PrepareRequiredAction added in v0.62.0 

type PrepareRequiredAction struct {
	ActionID         string             `json:"action_id"`
	Kind             RequiredActionKind `json:"kind"`
	Handles          []string           `json:"handles,omitempty"`
	Resources        []string           `json:"resources,omitempty"`
	AllowedDecisions []string           `json:"allowed_decisions"`
	ReasonCode       string             `json:"reason_code"`
}

type PrepareResult added in v0.62.0 

type PrepareResult struct {
	Outcome             string
	Reason              string
	SubjectSchema       int
	SubjectDigest       string
	PlanDigest          string
	TrustDigest         string
	BaseAuthorityDigest string
	PlannedWrites       []PlannedWrite
	Target              PrepareTarget
	Backend             string
	Profile             string
	Participants        []PreparedParticipant
	Roster              PrepareRoster
	RequiredActions     []PrepareRequiredAction
	Observations        []PrepareObservation
	Placement           PlacementPreview
	CallerContext       map[string]string
}

func Prepare added in v0.62.0 

func Prepare(ctx context.Context, request PrepareRequest, dependencies PrepareDependencies) (PrepareResult, error)

Prepare compiles public caller intent and inspects current launch state. It deliberately has no write-capable dependency: no lease, Create, Close, Focus, trust replacement, journal writer, or mailbox repair callback is reachable from this function.

type PrepareRoster added in v0.62.0 

type PrepareRoster struct {
	Desired []string `json:"desired"`
	Present []string `json:"present"`
	Missing []string `json:"missing"`
	Extra   []string `json:"extra"`
}

type PrepareTarget added in v0.62.0 

type PrepareTarget struct {
	ProjectRoot string `json:"project_root"`
	BaseRoot    string `json:"base_root,omitempty"`
	SessionRoot string `json:"session_root"`
	Session     string `json:"session"`
}

type PreparedParticipant added in v0.62.0 

type PreparedParticipant struct {
	Handle         string                  `json:"handle"`
	Runnable       bool                    `json:"runnable"`
	Provider       string                  `json:"provider,omitempty"`
	Command        *PrepareCommand         `json:"command,omitempty"`
	ResumePolicy   ResumePolicy            `json:"resume_policy,omitempty"`
	Execution      PrepareExecutionOptions `json:"execution,omitempty"`
	PlannedOutcome string                  `json:"planned_outcome"`
	CwdIdentity    string                  `json:"cwd_identity,omitempty"`
	OnLive         string                  `json:"on_live,omitempty"`
	Executable     *ConsultedExecutable    `json:"executable_identity,omitempty"`
	Wrapper        *ConsultedExecutable    `json:"wrapper_executable_identity,omitempty"`
}

type Profile 

type Profile struct {
	Backend      string       `json:"backend"`
	Platform     string       `json:"platform"`
	VersionRange string       `json:"version_range"`
	Version      int          `json:"version"`
	Capabilities []Capability `json:"capabilities"`
}

Profile is the versioned static maximum envelope for one (backend, platform, version-range). Conformance graduates this identity; Detect reports the runtime subset separately so the envelope cannot shrink to dodge a failing test.

func CmuxProfile added in v0.63.0 

func CmuxProfile() Profile

func CommandsProfile 

func CommandsProfile() Profile

func GhosttyProfile added in v0.63.0 

func GhosttyProfile() Profile

func TmuxProfile 

func TmuxProfile() Profile

func (Profile) Has 

func (p Profile) Has(c Capability) bool

func (Profile) Identity 

func (p Profile) Identity() string

type ProjectAgentConfig 

type ProjectAgentConfig struct {
	Handle       string               `json:"handle"`
	Adapter      string               `json:"adapter"`
	Command      []string             `json:"command"`
	Env          map[string]string    `json:"env,omitempty"`
	Cwd          string               `json:"cwd,omitempty"`
	ResumePolicy ResumePolicy         `json:"resume_policy"`
	InitialInput *InitialInputRequest `json:"initial_input,omitempty"`
	Wrapper      *Wrapper             `json:"wrapper,omitempty"`
}

type ProjectConfig 

type ProjectConfig struct {
	Schema         int                  `json:"schema"`
	DefaultSession string               `json:"default_session"`
	Named          *bool                `json:"named,omitempty"`
	Agents         []ProjectAgentConfig `json:"agents"`
	Layout         LayoutIntent         `json:"layout"`
}

func ParseProjectConfig 

func ParseProjectConfig(data []byte) (ProjectConfig, error)

func (ProjectConfig) Validate 

func (cfg ProjectConfig) Validate() error

type RebindDisposition 

type RebindDisposition string
const (
	RebindClose RebindDisposition = "close"
	RebindLeave RebindDisposition = "leave"
)

type ReclaimRequest 

type ReclaimRequest struct {
	Context context.Context
	Journal LaunchJournal
	Root    *fsq.DeliveryRoot
}

type ReclaimResult 

type ReclaimResult struct {
	Status          ReclaimStatus                `json:"status"`
	Evidence        string                       `json:"evidence"`
	Resources       []ResourceIdentity           `json:"resources"`
	Binding         BindingRecord                `json:"binding,omitempty"`
	CaptureEvidence map[string][]CaptureEvidence `json:"-"`
}

type ReclaimStatus 

type ReclaimStatus string
const (
	ReclaimAbsent     ReclaimStatus = "absent"
	ReclaimAdoptable  ReclaimStatus = "adoptable"
	ReclaimIncomplete ReclaimStatus = "incomplete"
	ReclaimUnknown    ReclaimStatus = "unknown"
	ReclaimForeign    ReclaimStatus = "foreign"
)

type ReconcileRequest 

type ReconcileRequest struct {
	Context              context.Context
	ProjectRoot          string
	Session              string
	AMQPath              string
	Root                 *fsq.DeliveryRoot
	Config               ProjectConfig
	Launcher             string
	Preferences          []string
	Backends             map[string]Backend
	Adapters             map[string]HarnessAdapter
	TrustStore           *TrustStore
	TrustAuthorityDigest string
	ConfirmTrust         ConfirmTrustFunc
	ConfirmRebind        ConfirmRebindFunc
	Fresh                bool
	AllowFreshFallback   bool
	ResumeOnly           bool
	Rebind               bool
	HostIdentity         string
	CrashHook            func(string) error
	// HeldLease lets Apply retain session authority across its lease-held
	// re-Prepare, roster provisioning, and the existing reconciliation crash
	// contract. Reconcile validates but never releases a caller-owned lease.
	HeldLease *Lease
	// AllowExternalCwd is set only by the public intent seam, whose cwd identity
	// was already bound by lease-held Prepare.
	AllowExternalCwd bool
	// ExecutionOptions carries normalized wrapper policy into the plan, journal,
	// and ticket. The exact-root/options boundary owns later consumption.
	ExecutionOptions map[string]PrepareExecutionOptions
	// AuthorizedIdentities carries the physical provider, wrapper, and cwd
	// identities captured by Apply's authorization Prepare. Reconcile checks
	// these before any adapter capability probe or ticket creation.
	AuthorizedIdentities map[string]AuthorizedParticipantIdentity
	// Placement is the caller-requested tuple. Nil preserves v0.61 Create.
	Placement *Placement
	// OnLive is the per-handle live-seat policy. Missing keys are refuse.
	OnLive        map[string]string
	CallerContext map[string]string
}

type ReconcileResult 

type ReconcileResult struct {
	Session        string                 `json:"session"`
	Backend        string                 `json:"backend"`
	Outcome        Outcome                `json:"outcome"`
	AggregateCode  int                    `json:"aggregate_code"`
	Reason         string                 `json:"reason"`
	Agents         []AgentReconcileResult `json:"agents"`
	Commands       []EmittedCommand       `json:"commands"`
	Plan           *Plan                  `json:"plan"`
	SemanticDigest string                 `json:"semantic_digest"`
	Recovery       *RecoveryReport        `json:"recovery"`
	Seats          []SeatDisposition      `json:"-"`
}

func Reconcile 

func Reconcile(request ReconcileRequest) (result ReconcileResult, returnErr error)

type RecoveryReport 

type RecoveryReport struct {
	Status    ReclaimStatus      `json:"status"`
	Evidence  string             `json:"evidence"`
	Resources []ResourceIdentity `json:"resources"`
}

type RequiredActionKind added in v0.62.0 

type RequiredActionKind string
const (
	ActionTrustConfirmation     RequiredActionKind = "trust_confirmation"
	ActionStaleConversation     RequiredActionKind = "stale_conversation_decision"
	ActionRebindConfirmation    RequiredActionKind = "rebind_confirmation"
	ActionUnsupportedCapability RequiredActionKind = "unsupported_capability_ack"
)

type ResourceIdentity 

type ResourceIdentity struct {
	OpaqueID string `json:"opaque_id"`
	Agent    string `json:"agent,omitempty"`
}

type ResourceIdentitySet 

type ResourceIdentitySet struct {
	Version   int                `json:"version"`
	Resources []ResourceIdentity `json:"resources"`
}

type ResumePolicy 

type ResumePolicy string
const (
	ResumeEnabled  ResumePolicy = "resume"
	ResumeFresh    ResumePolicy = "fresh"
	ResumeDisabled ResumePolicy = "disabled"
)

type ResumeRequest 

type ResumeRequest struct {
	PlanRequest
	Conversation ConversationIdentity
}

type SeatDisposition added in v0.64.0 

type SeatDisposition struct {
	Handle     string
	Decision   string
	ReasonCode string
	StartMode  string
}

SeatDisposition is the Apply preflight row for one handle.

func ClassifyLiveSeats added in v0.64.0 

func ClassifyLiveSeats(roster []SeatFacts) []SeatDisposition

ClassifyLiveSeats applies the cohort rule as a pure function: any refused live seat turns remaining missing seats into cohort_refused; if every live seat is kept, missing seats are created.

type SeatFacts added in v0.64.0 

type SeatFacts struct {
	Handle       string
	Managed      bool
	Owned        bool
	Attached     bool
	Live         bool
	Inspect      InspectStatus
	Foreign      bool
	Stale        bool
	ProfileMatch bool
	Missing      bool
	OnLive       string
}

SeatFacts is the observation for one desired handle. Keep eligibility is the conjunction of managed, owned, attached, and live; hostile facts (foreign, stale, profile mismatch, unknown inspect) fail closed.

type StaticInputCapabilities added in v0.64.0 

type StaticInputCapabilities struct {
	GrammarVersion          int
	VerifiedProviderVersion string
	AllowedArgumentForms    []string
	ConfigOverrides         []ConfigOverrideCapability
	InitialInputKinds       []InitialInputKind
}

func ProviderStaticInputCapabilities added in v0.64.0 

func ProviderStaticInputCapabilities(provider string) StaticInputCapabilities

ProviderStaticInputCapabilities is the single public-compiler projection of the same deny-by-default tables used by validation.

type TmuxBackend 

type TmuxBackend struct {
	// contains filtered or unexported fields
}

TmuxBackend manages one deterministic tmux session per AMQ project/session. The socket namespace is stable across tmux server restarts; resource IDs are still live tmux IDs and are never reconstructed from display names.

func NewTmuxBackend 

func NewTmuxBackend(binary string) *TmuxBackend

func (*TmuxBackend) Close 

func (b *TmuxBackend) Close(req CloseRequest) (CloseResult, error)

func (*TmuxBackend) Create 

func (b *TmuxBackend) Create(req CreateRequest) (CreateResult, error)

func (*TmuxBackend) Detect 

func (b *TmuxBackend) Detect() DetectResult

func (*TmuxBackend) Focus 

func (b *TmuxBackend) Focus(req FocusRequest) (FocusResult, error)

func (*TmuxBackend) Inspect 

func (b *TmuxBackend) Inspect(req InspectRequest) (InspectResult, error)

func (*TmuxBackend) Reclaim 

func (b *TmuxBackend) Reclaim(req ReclaimRequest) (ReclaimResult, error)

type TrustRecord 

type TrustRecord struct {
	Version           int                     `json:"version"`
	ProjectIdentity   string                  `json:"project_identity"`
	SemanticDigest    string                  `json:"semantic_digest"`
	BypassArgs        map[string][]string     `json:"bypass_args,omitempty"`
	ArbitraryCommands []ArbitraryCommandGrant `json:"arbitrary_commands,omitempty"`
}

TrustRecord contains all local execution authority for one project. Replace overwrites the prior digest, so a semantic change invalidates every prior bypass argument and arbitrary-command grant.

type TrustStore 

type TrustStore struct {
	// contains filtered or unexported fields
}

func OpenTrustStore 

func OpenTrustStore(userStateDir, projectRoot string) (*TrustStore, error)

func OpenTrustStoreForBase added in v0.64.0 

func OpenTrustStoreForBase(userStateDir, projectRoot, baseRoot string) (*TrustStore, error)

func (*TrustStore) LoadForDigest 

func (store *TrustStore) LoadForDigest(digest string) (TrustRecord, bool, error)

LoadForDigest returns no record when the plan changed. Malformed, unreadable, cross-project, or overly permissive state is an error and must fail closed.

func (*TrustStore) Path 

func (store *TrustStore) Path() string

func (*TrustStore) Replace 

func (store *TrustStore) Replace(record TrustRecord) error

Replace atomically installs the only active authority record for a project.

type Wrapper added in v0.64.0 

type Wrapper struct {
	Executable string   `json:"executable"`
	Args       []string `json:"args,omitempty"`
}

func (Wrapper) Validate added in v0.64.0 

func (wrapper Wrapper) Validate() error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.