Documentation
¶
Overview ¶
Package compile turns a declared organisation specification into a concrete, resolved specification and an effective manifest (§4.2, §4.6, §6.1).
Template merge rules (§4.2):
- A template may extend one other template; cycles are rejected.
- Scalars (parameters, roles) are overridden by the more derived definition.
- Ordered instruction lists are concatenated base-first, preserving declared order; a reference that appears twice keeps its first position.
- Keyed permission records (shared_memory) merge by key. The same key with different operations is an ambiguous conflict and is rejected, because permission grants must remain explicit.
Index ¶
- Variables
- func ModelUses(m *Manifest) map[string][]ModelUse
- func RequiredConnections(m *Manifest, cat Catalog) map[string]bool
- func Revision(sm SeatManifest) string
- type BackendInfo
- type Capability
- type Catalog
- type ConnectorInfo
- type Errors
- type FieldError
- type HarnessInfo
- type InstructionSource
- type Manifest
- type ModelUse
- type RouteEdge
- type SeatManifest
Constants ¶
This section is empty.
Variables ¶
var MemoryOperations = []string{"read", "search", "write", "revise", "archive", "publish", "history"}
MemoryOperations are the operations a grant may name on a memory store.
var PersonalMemoryOperations = []string{"read", "search", "write", "revise", "archive", "publish", "history"}
Personal-memory operations implicitly granted to the seat that selects the store (§5.2).
var WorkspaceOperations = []string{"read", "write"}
WorkspaceOperations are the operations a grant may name on a shared workspace.
Functions ¶
func ModelUses ¶ added in v0.2.0
ModelUses lists, per model connection, the models and APIs the seats' harness profiles and declared native pool templates use, sorted. Readiness checks each of them.
func RequiredConnections ¶ added in v0.2.0
RequiredConnections reports, per declared connection, whether it must authenticate before the organisation is operationally ready. An explicit `required` wins. Otherwise a connection is required when the organisation cannot work without it: a model connection a seat's harness uses, or a communication connection carrying channel bindings. Everything else, such as a work tracker, is optional: its failures are reported but never block readiness or internal work.
func Revision ¶ added in v0.2.0
func Revision(sm SeatManifest) string
Revision is a seat's config revision. Access that applies live (egress hosts, repository grants) is left out, so changing it never restarts the seat.
Types ¶
type BackendInfo ¶
type BackendInfo struct {
Features []string
}
type Capability ¶
type Capability struct {
Resource string `json:"resource"` // memory:<k>, connection:<k>, workspace:<k>
Operations []string `json:"operations"`
Targets []string `json:"targets,omitempty"`
Sources []string `json:"sources"` // grant:<k>, implicit:personal_memory, team:<k>/shared_memory, ...
}
Capability is one OR clause in a seat's resolved capability manifest (§5.2). Operations and targets belong together; a resource may have several clauses.
type Catalog ¶
type Catalog struct {
Harnesses map[string]HarnessInfo
Backends map[string]BackendInfo
Connectors map[string]ConnectorInfo
IdlePolicies map[string]string // idle policy -> required backend feature
}
Catalog describes the adapters and backends this platform release supports. Compatibility validation (§4.4) checks declarations against it; unsupported combinations fail explicitly rather than falling back to weaker behaviour.
func DefaultCatalog ¶
func DefaultCatalog() Catalog
DefaultCatalog is the catalog of the first release.
type ConnectorInfo ¶
type ConnectorInfo struct {
// Operations a grant may name on a connection of this adapter.
Operations []string
// Kind is communication, tracker or model.
Kind string
// ManagedOwnership means the adapter can create and own external resources.
ManagedOwnership bool
// ModelAPIs are the APIs a model connection serves when it declares
// none. Empty for a model adapter means the connection must declare them.
ModelAPIs []string
// DefaultAuth is how a model connection sends its credential by default.
DefaultAuth string
}
type FieldError ¶
FieldError is a validation failure at a specification path.
func (FieldError) Error ¶
func (e FieldError) Error() string
type HarnessInfo ¶
type InstructionSource ¶
type InstructionSource struct {
Ref string `json:"ref"`
Scope string `json:"scope"` // organisation, team:<key>, role, seat
Order int `json:"order"`
}
InstructionSource records one entry of a seat's ordered instruction manifest (§4.3).
type Manifest ¶
type Manifest struct {
SchemaVersion string `json:"schema_version"`
DefaultsVersion int `json:"defaults_version"`
Spec spec.OrganizationSpec `json:"spec"`
Seats map[string]SeatManifest `json:"seats"`
// TemplateLineage maps team key to the template chain it was resolved from, base first.
TemplateLineage map[string][]string `json:"template_lineage,omitempty"`
Digest string `json:"digest"`
}
Manifest is the effective, resolved organisation.
type RouteEdge ¶
type RouteEdge struct {
Seat string `json:"seat"`
Reply bool `json:"reply"`
Routes []string `json:"routes"`
}
RouteEdge is a permitted message direction from the seat that owns it.
type SeatManifest ¶
type SeatManifest struct {
// PoolTeam is runtime provenance, never a declarative seat membership field.
PoolTeam string `json:"pool_team,omitempty"`
Key string `json:"key"`
DisplayName string `json:"display_name"`
RoleRef string `json:"role_ref"`
Teams []string `json:"teams,omitempty"`
HarnessProfile string `json:"harness_profile"`
ExecutionProfile string `json:"execution_profile"`
SandboxProfile string `json:"sandbox_profile"`
Harness spec.HarnessProfile `json:"harness"`
Execution spec.ExecutionProfile `json:"execution"`
Sandbox spec.SandboxProfile `json:"sandbox"`
PersonalMemory string `json:"personal_memory,omitempty"`
Workspace spec.WorkspaceBinding `json:"workspace"`
Instructions []InstructionSource `json:"instructions"`
Capabilities []Capability `json:"capabilities"`
SendTo []RouteEdge `json:"send_to,omitempty"`
ReceiveFrom []RouteEdge `json:"receive_from,omitempty"`
ChannelBindings []string `json:"channel_bindings,omitempty"`
AdoptFrom string `json:"adopt_from,omitempty"`
IsRepresentative bool `json:"is_representative"`
// Timezone is where the seat reads and schedules times of day: its
// human's for a representative, otherwise the organisation's.
Timezone string `json:"timezone"`
Context *spec.TeamContext `json:"context,omitempty"`
// Access is what the seat may do from its sandbox (access profiles).
Access *access.SeatAccess `json:"access,omitempty"`
ConfigRevision string `json:"config_revision"`
}
SeatManifest is the effective configuration of one seat.
func CompilePoolSeat ¶ added in v0.7.0
func CompilePoolSeat(in spec.OrganizationSpec, cat Catalog, teamKey, templateKey, seatKey string) (*SeatManifest, error)
CompilePoolSeat compiles one independently authorized runtime identity. The caller may include other live members in in.Seats for ordinary route expansion. The input and declared membership are never mutated.