sessioncontext

package
v0.131.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 31, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

Documentation

Overview

Package sessioncontext owns private, durable session context and immutable input pins. Source execution and Detective evaluation remain in their existing domains.

Index

Constants

View Source
const (
	Sessions      = "sessionContextSessions"
	Bags          = "sessionContextBags"
	Entries       = "sessionContextEntries"
	Revisions     = "sessionContextEntryRevisions"
	ContextSets   = "sessionContextSets"
	Operations    = "sessionContextOperations"
	Audit         = "sessionContextAudit"
	Inputs        = "sessionContextInputs"
	Runs          = "sessionContextRuns"
	Messages      = "sessionContextMessages"
	Outbox        = "sessionContextOutbox"
	LegacyImports = "sessionContextLegacyImports"
	// MaxSnapshotBytes caps the sum of serialized session, bag, context-set, current
	// entry and current/applied revision records returned by GetSnapshot.
	MaxSnapshotBytes = 4 * 1024 * 1024
	// MaxSnapshotEntries bounds current entries and applied references in one snapshot.
	MaxSnapshotEntries = 400
	// MaxSnapshotRevisions bounds the union of current and applied revisions.
	MaxSnapshotRevisions = 2 * MaxSnapshotEntries
)
View Source
const DetectiveOwners = "sessionContextDetectiveOwners"
View Source
const DetectiveWork = "sessionContextDetectiveWork"
View Source
const MaxDetectiveDefinitionBytes = 512 << 10
View Source
const MaxDetectiveQueryBytes = 64 << 10
View Source
const Redactions = "sessionContextRedactions"

Variables

View Source
var (
	ErrNotFound    = errors.New("session context: not found")
	ErrConflict    = errors.New("session context: version conflict")
	ErrInvalid     = errors.New("session context: invalid command")
	ErrForbidden   = errors.New("session context: access denied")
	ErrReadOnly    = errors.New("session context: session is read-only")
	ErrUnavailable = errors.New("session context: storage unavailable")
)
View Source
var ErrEmptyCheckSet = fmt.Errorf("%w: unsupported empty Check set", ErrInvalid)

Functions

func Collections

func Collections() []string

func ManifestCollectionsYAML

func ManifestCollectionsYAML() string

ManifestCollectionsYAML is the collections block beneath schemas in an OVDB manifest.

func SQLiteSchemaStatements

func SQLiteSchemaStatements() []string

SQLiteSchemaStatements provision the private local OVDB mount before opening it. These identifiers are compile-time constants; no user SQL is interpolated.

func SessionLifecycleID added in v0.125.0

func SessionLifecycleID(namespace NativeNamespace, sessionID string) (string, error)

SessionLifecycleID identifies a session by its operational namespace and stored session ID. The namespace must come from the owning repository: its digest binds the mount and private parent, not the native execution target. Owner is authorization/index metadata and is deliberately absent from the key. This identity establishes neither source authority nor complete project usage.

Types

type AcceptedDetectiveOperation added in v0.57.0

type AcceptedDetectiveOperation struct {
	Identity            DetectiveIdentity `json:"identity"`
	ClientRequestDigest string            `json:"clientRequestDigest"`
}

AcceptedDetectiveOperation is metadata-only transport recovery. Its request digest is the host's canonical client body, not the native operation payload. Adapters compare it before reading mutable Check/Case definitions on retry.

type AcceptedDetectiveStatus added in v0.56.0

type AcceptedDetectiveStatus struct {
	RunID         string `json:"runId"`
	State         string `json:"state"`
	FenceReason   string `json:"fenceReason,omitempty"`
	Produced      bool   `json:"produced"`
	Done          bool   `json:"done"`
	EvidenceState string `json:"evidenceState,omitempty"`
}

AcceptedDetectiveStatus contains no content, Case identity, labels, or input refs.

type AcceptedDetectiveWork added in v0.55.0

type AcceptedDetectiveWork struct {
	ID              string                            `json:"id"`
	Owner           string                            `json:"owner"`
	Namespace       NativeNamespace                   `json:"namespace"`
	SessionID       string                            `json:"sessionId"`
	RunID           string                            `json:"runId"`
	InputSnapshotID string                            `json:"inputSnapshotId"`
	Reference       apicontract.SessionInputReference `json:"reference"`
	Dispatch        DetectiveDispatchBinding          `json:"dispatch"`
	State           string                            `json:"state"`
	Version         int64                             `json:"version"`
	AcceptedAt      time.Time                         `json:"acceptedAt"`

	// SessionGeneration is captured atomically with acceptance, before any dispatch claim.
	SessionGeneration int64 `json:"sessionGeneration"`
	// OwnerProtocolVersion binds lifecycle generation; legacy unbound acceptances cannot dispatch.
	OwnerProtocolVersion int64 `json:"ownerProtocolVersion"`
	// ClientOperationID and AcceptanceDigest bind the durable metadata lookup.
	ClientOperationID   string `json:"clientOperationId,omitempty"`
	AcceptanceDigest    string `json:"acceptanceDigest,omitempty"`
	ClientRequestDigest string `json:"clientRequestDigest,omitempty"`
}

AcceptedDetectiveWork records private acceptance, never native execution or native acceptance. Its metadata is reserved for later authenticated recovery.

type Access

type Access struct {
	Principal Principal
	Action    string
	SessionID string
	Scope     *Scope
}

type AppliedContextSet

type AppliedContextSet struct {
	ID        string        `json:"id"`
	SessionID string        `json:"sessionId"`
	Enabled   bool          `json:"enabled"`
	Slots     []AppliedSlot `json:"slots"`
	CreatedAt time.Time     `json:"createdAt"`
}

type AppliedSlot

type AppliedSlot struct {
	Scope      Scope      `json:"scope"`
	BagID      string     `json:"bagId"`
	BagVersion int64      `json:"bagVersion"`
	Version    int64      `json:"version"`
	Entries    []EntryRef `json:"entries"`
}

A slot with an empty bagId is a cleared tombstone. Its version prevents ABA reuse.

type AuditEvent

type AuditEvent struct {
	OpID       string    `json:"opId"`
	Actor      string    `json:"actor"`
	Action     string    `json:"action"`
	SessionID  string    `json:"sessionId"`
	ResourceID string    `json:"resourceId,omitempty"`
	Count      int       `json:"count"`
	At         time.Time `json:"at"`
}

type Authorizer

type Authorizer func(context.Context, Access) error

type Bag

type Bag struct {
	ID           string   `json:"id"`
	SessionID    string   `json:"sessionId"`
	Title        string   `json:"title"`
	Scope        Scope    `json:"scope"`
	Version      int64    `json:"version"`
	ClearVersion int64    `json:"clearVersion,omitempty"`
	EntryIDs     []string `json:"entryIds"`
}

type BufferedRepository added in v0.79.1

type BufferedRepository struct {
	// contains filtered or unexported fields
}

BufferedRepository belongs to the caller's DALGO transaction. Commands queue their writes; Flush issues them only after the caller finishes all reads. No method may be used after Flush. The caller commits or aborts the enclosing transaction and must return every command/Flush error to that transaction.

func (*BufferedRepository) DatabaseID added in v0.79.1

func (b *BufferedRepository) DatabaseID() string

func (*BufferedRepository) Flush added in v0.79.1

func (b *BufferedRepository) Flush(ctx context.Context) error

func (*BufferedRepository) PrepareFlush added in v0.125.0

func (b *BufferedRepository) PrepareFlush(ctx context.Context) error

PrepareFlush performs reference-admission reads before a caller's first native write. It seals the pending session writes; subsequent commands are refused. Flush later writes the admitted fences and records without further reads. A repository with admission installed cannot skip this step in a coupled tx.

func (*BufferedRepository) Transact added in v0.79.1

func (b *BufferedRepository) Transact(ctx context.Context, f func(Transaction) error) error

func (*BufferedRepository) View added in v0.79.1

func (b *BufferedRepository) View(ctx context.Context, f func(Reader) error) error

type Command

type Command struct {
	OpID                 string         `json:"opId"`
	Action               string         `json:"action"`
	SessionID            string         `json:"sessionId"`
	ExpectedVersion      int64          `json:"expectedVersion,omitempty"`
	DatabaseID           string         `json:"databaseId,omitempty"`
	ProjectID            string         `json:"projectId,omitempty"`
	BagID                string         `json:"bagId,omitempty"`
	ExpectedBagVersion   int64          `json:"expectedBagVersion,omitempty"`
	ExpectedSlotVersion  int64          `json:"expectedSlotVersion,omitempty"`
	ExpectedContextSetID string         `json:"expectedContextSetId,omitempty"`
	EntryID              string         `json:"entryId,omitempty"`
	ExpectedEntryVersion int64          `json:"expectedEntryVersion,omitempty"`
	RevisionID           string         `json:"revisionId,omitempty"`
	Title                string         `json:"title,omitempty"`
	Alias                string         `json:"alias,omitempty"`
	Scope                *Scope         `json:"scope,omitempty"`
	Subject              *Subject       `json:"subject,omitempty"`
	Value                *ValueEnvelope `json:"value,omitempty"`
	Selection            []EntryRef     `json:"selection,omitempty"`
	Enabled              *bool          `json:"enabled,omitempty"`
	Transition           string         `json:"transition,omitempty"`
	// M3 input pins and durable run routing. Result rows remain in the existing result store.
	InputSnapshotID    string          `json:"inputSnapshotId,omitempty"`
	RunID              string          `json:"runId,omitempty"`
	Kind               string          `json:"kind,omitempty"`
	DefinitionID       string          `json:"definitionId,omitempty"`
	DefinitionRevision string          `json:"definitionRevision,omitempty"`
	DefinitionDocument json.RawMessage `json:"definitionDocument,omitempty"`
	ExecutionDocument  json.RawMessage `json:"executionDocument,omitempty"`
	Attachments        []EntryRef      `json:"attachments,omitempty"`
	Text               string          `json:"text,omitempty"`
	ExpectedRunVersion int64           `json:"expectedRunVersion,omitempty"`
	// reportClientRun accepts outcome-unknown only with the fixed
	// CLIENT_OUTCOME_UNKNOWN code and no result payload. It records uncertainty
	// after client interruption; it does not assert source failure or cancellation.
	RunState           string                            `json:"runState,omitempty"`
	Widgets            []WidgetOutcome                   `json:"widgets,omitempty"`
	ResultRefs         []string                          `json:"resultRefs,omitempty"`
	ErrorCode          string                            `json:"errorCode,omitempty"`
	CaseID             string                            `json:"caseId,omitempty"`
	DetectiveRunID     string                            `json:"detectiveRunId,omitempty"`
	ResolvedParameters map[string]apicontract.TypedValue `json:"resolvedParameters,omitempty"`
	LegacyImport       *LegacyImport                     `json:"legacyImport,omitempty"`
}

Command is shared by HTTP/terminal adapters. IDs are opaque, path-safe and stable. expectedVersion is the session version. expectedEntryVersion=0 creates an entry.

type CommandResult

type CommandResult struct {
	Receipt Receipt `json:"receipt"`
}

func CopyContext added in v0.79.1

func CopyContext(ctx context.Context, p Principal, source, destination *Service, c CopyContextCommand) (CommandResult, error)

CopyContext copies typed values and named bags within one transaction and project. source and destination must use the same Repository instance. A private destination must belong to the real actor; this is the execution snapshot path, not delegation of native execution ownership.

type ContextSource added in v0.79.1

type ContextSource struct {
	SessionID  string `json:"sessionId"`
	BagID      string `json:"bagId"`
	EntryID    string `json:"entryId"`
	RevisionID string `json:"revisionId"`
}

type CopyContextCommand added in v0.79.1

type CopyContextCommand struct {
	OpID, SourceSessionID, DestinationSessionID       string
	ExpectedSourceVersion, ExpectedDestinationVersion int64
	Selection                                         []EntryRef
}

CopyContextCommand selects exact current revisions. Both session heads are compared; refresh never replaces an entry subsequently edited in the child. Selection must be nonempty. Copied entries remain unapplied until applyContext.

type DALRepository

type DALRepository struct {
	// contains filtered or unexported fields
}

func NewDALRepository

func NewDALRepository(mounted MountedDatabase, parent *record.Key) (*DALRepository, error)

func NewNativePinRepository added in v0.55.0

func NewNativePinRepository(mounted MountedDatabase, parent *record.Key, storage, space, project string) (*DALRepository, error)

NewNativePinRepository explicitly binds pinning to the real mount and an owned repository parent. Ordinary NewDALRepository does not enable native pinning.

func (*DALRepository) BufferInTransaction added in v0.79.1

func (r *DALRepository) BufferInTransaction(tx dal.ReadwriteTransaction) (*BufferedRepository, error)

func (*DALRepository) DatabaseID

func (r *DALRepository) DatabaseID() string

func (*DALRepository) NativeNamespace added in v0.55.0

func (r *DALRepository) NativeNamespace() NativeNamespace

func (*DALRepository) ReaderInTransaction added in v0.56.0

func (r *DALRepository) ReaderInTransaction(tx dal.ReadTransaction) (Reader, error)

ReaderInTransaction binds the caller's existing transaction to this repository's operational parent. It never starts, commits, or writes a transaction. Its lifetime is the caller's transaction; do not retain it. On Firestore, use this before native writes so session fence reads participate in the same optimistic transaction conflict boundary as native finalization.

func (*DALRepository) RetainedInventoryInTransaction added in v0.125.0

func (r *DALRepository) RetainedInventoryInTransaction(ctx context.Context, tx dal.ReadTransaction, limits RetainedInventoryLimits) (RetainedInventory, error)

RetainedInventoryInTransaction scans all owners and all retained rows under this repository's explicitly bound native project parent. It does not filter by current session state, expiration, redaction or execution outcome. Retained tombstones and expired-but-unpurged snapshots still carry references.

The owning server must authorize this internal operation and prove that tx is on the SAME mounted database as this repository. Like ReaderInTransaction, this method cannot prove a transaction's database identity from DAL's interface. It starts no transaction and performs no writes. Call before the first write; the provider must share admission with every concurrent reference writer.

Every known source collection is scanned with a budget+1 limit. Any overflow, malformed envelope, query/read/close failure discards the entire result. This is a storage inventory, not a completeness certificate for other authorities.

func (*DALRepository) Transact

func (r *DALRepository) Transact(ctx context.Context, f func(Transaction) error) error

Transact queues every write until the worker has completed all reads. Firestore transactions prohibit reads after writes, so this ordering is part of the contract.

func (*DALRepository) View

func (r *DALRepository) View(ctx context.Context, f func(Reader) error) error

func (*DALRepository) WithRetainedWriteAdmission added in v0.125.0

func (r *DALRepository) WithRetainedWriteAdmission(admit RetainedWriteAdmission) (*DALRepository, error)

WithRetainedWriteAdmission creates an independently configured repository. It never mutates another service's repository or enables native pin commands. Only an explicitly bound native project repository may install this port.

type DetectiveAcceptedQueryPin added in v0.55.0

type DetectiveAcceptedQueryPin struct {
	QueryID        string          `json:"queryId"`
	Revision       string          `json:"revision"`
	DefinitionJSON json.RawMessage `json:"definitionJson"`
}

type DetectiveCheckDefinitionPin added in v0.55.0

type DetectiveCheckDefinitionPin struct {
	SchemaVersion       int                            `json:"schemaVersion"`
	Check               detective.Check                `json:"check"`
	Dependencies        []detective.Check              `json:"dependencies"`
	PublishedValidators []detective.PublishedValidator `json:"publishedValidators"`
	QueryValidators     []detective.QueryValidators    `json:"queryValidators"`
	Queries             []DetectiveAcceptedQueryPin    `json:"queries"`
	Scenario            *DetectiveScenarioStepIdentity `json:"scenario,omitempty"`
}

func CanonicalDetectiveDefinition added in v0.55.0

func CanonicalDetectiveDefinition(ctx context.Context, definition DetectiveCheckDefinitionPin) (DetectiveCheckDefinitionPin, string, error)

CanonicalDetectiveDefinition validates a complete private executable snapshot. It uses existing saved-query and catalog contracts, not source admission. Errors never include query text or validator/provider diagnostics.

type DetectiveDispatchBinding added in v0.55.0

type DetectiveDispatchBinding struct {
	NativeOperationID   string `json:"nativeOperationId"`
	NativeStoreID       string `json:"nativeStoreId"`
	NativeSpaceID       string `json:"nativeSpaceId,omitempty"`
	NativeProjectID     string `json:"nativeProjectId"`
	Action              string `json:"action"`
	CheckID             string `json:"checkId"`
	CheckVersion        int64  `json:"checkVersion"`
	DefinitionDigest    string `json:"definitionDigest"`
	NativeRequestDigest string `json:"nativeRequestDigest"`
	CaseID              string `json:"caseId,omitempty"`
	CaseVersion         int64  `json:"caseVersion,omitempty"`
	CaseContextDigest   string `json:"caseContextDigest,omitempty"`
}

type DetectiveFence added in v0.56.0

type DetectiveFence struct {
	SessionGeneration int64             `json:"sessionGeneration"`
	Identity          DetectiveIdentity `json:"identity"`
	Generation        int64             `json:"generation"`
}

type DetectiveIdentity added in v0.56.0

type DetectiveIdentity struct {
	Namespace         NativeNamespace `json:"namespace"`
	Actor             string          `json:"actor"`
	SessionID         string          `json:"sessionId"`
	RunID             string          `json:"runId"`
	NativeStoreID     string          `json:"nativeStoreId"`
	NativeSpaceID     string          `json:"nativeSpaceId,omitempty"`
	NativeProjectID   string          `json:"nativeProjectId"`
	NativeOperationID string          `json:"nativeOperationId"`
	Digest            string          `json:"digest"`
}

DetectiveIdentity binds both operational authorities. It is not a bearer grant. NativeOperationID and Digest must come from the native owner's accepted request.

type DetectiveInputPin added in v0.55.0

type DetectiveInputPin struct {
	Reference       apicontract.SessionInputReference `json:"reference"`
	Definition      DetectiveCheckDefinitionPin       `json:"definition"`
	EffectiveInputs map[string]detective.InputValue   `json:"effectiveInputs"`
	Dispatch        DetectiveDispatchBinding          `json:"dispatch"`
}

type DetectiveObservation added in v0.56.0

type DetectiveObservation struct {
	// FenceGeneration copies DetectiveFence.Generation (initially 1).
	// SessionGeneration copies DetectiveFence.SessionGeneration (initially 0).
	// The native owner persists both with its acceptance and checks them at finalization.
	FenceGeneration   int64             `json:"fenceGeneration"`
	SessionGeneration int64             `json:"sessionGeneration"`
	Identity          DetectiveIdentity `json:"identity"`
	Produced          bool              `json:"produced"`
	Done              bool              `json:"done"`
	NativeRunID       string            `json:"nativeRunId,omitempty"`
	NativeReceiptID   string            `json:"nativeReceiptId,omitempty"`
	State             string            `json:"state,omitempty"` // completed, failed, canceled
	CaseLinkStatus    string            `json:"caseLinkStatus,omitempty"`
}

DetectiveObservation is supplied only by an authenticated native owner lookup, never by command JSON or a browser. Produced means the result is durable, Done means native finalization has completed. A fence must never discard Produced.

type DetectiveOwner added in v0.56.0

type DetectiveOwner struct {
	// contains filtered or unexported fields
}

DetectiveOwner is deliberately separate from Service.Command. Its host must authenticate an active account for every gate call, even after content access is revoked, and supply a native lookup bound to the exact operation identity. Native execution must call CheckFence before source execution AND native finalization. A claim is recoverable ownership, never permission to reexecute. Cross-store adapters must serialize/check these fences at their native owner; Core cannot turn a remote check followed by a write into an atomic transaction.

func NewDetectiveOwner added in v0.56.0

func (*DetectiveOwner) CheckFence added in v0.56.0

func (o *DetectiveOwner) CheckFence(ctx context.Context, p Principal, token DetectiveFence) error

CheckFence observes the fence in a fresh session repository read. Native owners sharing the authority should use CheckFenceWithReader inside their existing transaction so concurrent fences cause a transaction conflict.

func (*DetectiveOwner) CheckFenceWithReader added in v0.56.0

func (o *DetectiveOwner) CheckFenceWithReader(ctx context.Context, p Principal, token DetectiveFence, r Reader) error

CheckFenceWithReader performs the same fence and authorization validation using the caller's transaction snapshot. It starts or commits no transaction. The trusted native owner must supply a namespace-bound Reader and perform all reads before writes where its storage engine requires that ordering.

func (*DetectiveOwner) ClaimDispatch added in v0.56.0

ClaimDispatch returns the SAME generation on retry. It has no clock or lease. Recovery must reconcile the native operation identity before any execution.

func (*DetectiveOwner) ClaimDispatchOnce added in v0.57.0

ClaimDispatchOnce distinguishes the successful first ownership claim from replay. Only first=true may begin original native acceptance; it is still subject to native admission/fencing and durable journaling before dispatch. first=false never authorizes execution merely because native work is absent. A native accepted-but-not-started continuation needs its own durable proof.

func (*DetectiveOwner) Fence added in v0.56.0

func (o *DetectiveOwner) Fence(ctx context.Context, p Principal, id DetectiveIdentity, reason string) error

Fence durably invalidates all prior dispatch tokens. Repeating a reason does not advance generation. No method clears fences or recreates private pins.

func (*DetectiveOwner) ReadHandoff added in v0.56.0

ReadHandoff is a trusted worker read, with ordinary content authorization. Reauthorization of the destination Case remains the native adapter's duty.

func (*DetectiveOwner) ReadStatus added in v0.56.0

func (*DetectiveOwner) Reconcile added in v0.56.0

Reconcile reads the native owner's authoritative operation. It cannot run a query or create a native Case link. Produced-but-unfinished results survive fences; only native Done observations can settle an accepted session run.

func (*DetectiveOwner) RedactPins added in v0.56.0

func (o *DetectiveOwner) RedactPins(ctx context.Context, p Principal, id DetectiveIdentity, deleteOpID, cursor string, limit int) (string, error)

RedactPins installs an irreversible content marker before bounded scrubbing. Cursor advances across owner-filtered input records, including other sessions; a caller resumes until NextCursor is empty. Repeating pages is safe. This removes session-side executable pins only; separately owned Case evidence, operational records, legacy stores, backups and source data are untouched.

func (*DetectiveOwner) ResolveOperation added in v0.57.0

func (o *DetectiveOwner) ResolveOperation(ctx context.Context, p Principal, clientOpID string) (AcceptedDetectiveOperation, error)

ResolveOperation uses the operation receipt and accepted work committed with the private pin as one durable mapping. It performs no content authorization, private input read, source execution or new native identity generation. The configured full-identity gate still runs for the accepted actor after metadata is found. A transport MUST authenticate its active caller before invoking this resolver, including missing/corrupt operation paths. Legacy acceptances without a client request binding cannot enter this transport path.

func (*DetectiveOwner) SettleHandoff added in v0.56.0

func (o *DetectiveOwner) SettleHandoff(ctx context.Context, p Principal, id DetectiveIdentity, expected int64, delivered bool, receiptID string) error

SettleHandoff records only an external receipt, after the adapter reauthorizes both resources and delivers selected input evidence idempotently. It never changes native CaseRunLink. The version is the outbox storage version.

type DetectiveScenarioStepIdentity added in v0.55.0

type DetectiveScenarioStepIdentity struct {
	ScenarioID      string `json:"scenarioId"`
	ScenarioVersion int64  `json:"scenarioVersion"`
	ApplicationID   string `json:"applicationId"`
	StepID          string `json:"stepId"`
}

type EntityKey

type EntityKey struct {
	Components []KeyComponent `json:"components"`
}

type Entry

type Entry struct {
	ID                string  `json:"id"`
	SessionID         string  `json:"sessionId"`
	BagID             string  `json:"bagId"`
	Alias             string  `json:"alias,omitempty"`
	Subject           Subject `json:"subject"`
	CurrentRevisionID string  `json:"currentRevisionId"`
	Version           int64   `json:"version"`
}

type EntryRef

type EntryRef struct {
	EntryID    string `json:"entryId"`
	RevisionID string `json:"revisionId"`
}

type EntryRevision

type EntryRevision struct {
	Source           *ContextSource `json:"source,omitempty"`
	ID               string         `json:"id"`
	EntryID          string         `json:"entryId"`
	BagID            string         `json:"bagId"`
	ParentRevisionID string         `json:"parentRevisionId,omitempty"`
	Subject          Subject        `json:"subject"`
	Value            ValueEnvelope  `json:"value"`
	CreatedAt        time.Time      `json:"createdAt"`
	Provenance       string         `json:"provenance,omitempty"`
	LegacySourceID   string         `json:"legacySourceId,omitempty"`
	SourceDigest     string         `json:"sourceDigest,omitempty"`
}

type EvidenceHandoff

type EvidenceHandoff struct {
	ID              string `json:"id"`
	SessionID       string `json:"sessionId"`
	RunID           string `json:"runId"`
	InputSnapshotID string `json:"inputSnapshotId"`
	CaseID          string `json:"caseId"`
	DetectiveRunID  string `json:"detectiveRunId"`
	State           string `json:"state"`
	ErrorCode       string `json:"errorCode,omitempty"`
}

EvidenceHandoff cannot replace Detective's native CaseRunLink transaction. A worker finalizes the native Detective operation, then marks this handoff delivered.

type InputSnapshot

type InputSnapshot struct {
	ID                 string                            `json:"id"`
	SessionID          string                            `json:"sessionId"`
	ContextSetID       string                            `json:"contextSetId"`
	Scope              Scope                             `json:"scope"`
	Entries            []EntryRef                        `json:"entries"`
	DefinitionDigest   string                            `json:"definitionDigest"`
	DefinitionDocument json.RawMessage                   `json:"definitionDocument"`
	ResolvedParameters map[string]apicontract.TypedValue `json:"resolvedParameters,omitempty"`
	ParametersOrigin   string                            `json:"parametersOrigin,omitempty"`
	CreatedAt          time.Time                         `json:"createdAt"`
	Detective          *DetectiveInputPin                `json:"detective,omitempty"`
}

type KeyComponent

type KeyComponent struct {
	Field string                 `json:"field"`
	Value apicontract.TypedValue `json:"value"`
}

type LegacyChatMessage

type LegacyChatMessage struct {
	ID        string    `json:"id"`
	Role      string    `json:"role"`
	Text      string    `json:"text"`
	CreatedAt time.Time `json:"createdAt,omitempty"`
}

type LegacyEntry

type LegacyEntry struct {
	ID        string        `json:"id"`
	Alias     string        `json:"alias,omitempty"`
	Subject   Subject       `json:"subject"`
	Value     ValueEnvelope `json:"value"`
	CreatedAt time.Time     `json:"createdAt,omitempty"`
}

type LegacyImport

type LegacyImport struct {
	SourceID string              `json:"sourceId"`
	Title    string              `json:"title,omitempty"`
	Scope    Scope               `json:"scope"`
	Entries  []LegacyEntry       `json:"entries,omitempty"`
	Messages []LegacyChatMessage `json:"messages,omitempty"`
}

LegacyImport is a bounded, read-only migration payload. It imports saved context values and historical chat turns; it never creates executable runs.

type LegacyImportManifest

type LegacyImportManifest struct {
	ID           string    `json:"id"`
	SessionID    string    `json:"sessionId"`
	BagID        string    `json:"bagId"`
	SourceID     string    `json:"sourceId"`
	SourceDigest string    `json:"sourceDigest"`
	Scope        Scope     `json:"scope"`
	CreatedAt    time.Time `json:"createdAt"`
}

LegacyImportManifest is private idempotency state keyed by a digest of the source identity, actor, project, and execution scope.

type Message

type Message struct {
	ID              string    `json:"id"`
	SessionID       string    `json:"sessionId"`
	InputSnapshotID string    `json:"inputSnapshotId"`
	Role            string    `json:"role"`
	Text            string    `json:"text"`
	CreatedAt       time.Time `json:"createdAt"`
	Provenance      string    `json:"provenance,omitempty"`
	LegacySourceID  string    `json:"legacySourceId,omitempty"`
	SourceDigest    string    `json:"sourceDigest,omitempty"`
	HistoricalAt    time.Time `json:"historicalAt,omitempty"`
	SourceScope     Scope     `json:"sourceScope,omitempty"`
}

type MountedDatabase

type MountedDatabase interface {
	ID() string
	DB() dal.DB
}

MountedDatabase is implemented by OVDB core.Database. The identity is captured with its mounted DALgo engine; clients cannot supply a raw storage connection.

type NativeNamespace added in v0.55.0

type NativeNamespace struct {
	StorageID   string `json:"storageId"`
	SpaceID     string `json:"spaceId,omitempty"`
	DatabaseID  string `json:"databaseId"`
	ProjectID   string `json:"projectId"`
	NamespaceID string `json:"namespaceId"`
}

NativeNamespace is the private operational authority, not the source engine.

type Page

type Page[T any] struct {
	Items      []T    `json:"items"`
	NextCursor string `json:"nextCursor,omitempty"`
	HasMore    bool   `json:"hasMore"`
}

type PinDetectiveInputCommand added in v0.55.0

type PinDetectiveInputCommand struct {
	// ClientRequestDigest is host-computed from a canonical transport request.
	// Empty retains compatibility for internal callers, not transport acceptance.
	ClientRequestDigest                     string
	OpID, SessionID, InputSnapshotID, RunID string
	ExpectedVersion                         int64
	ExpectedContextSetID                    string
	Scope                                   Scope
	Attachments                             []EntryRef
	Pin                                     DetectiveInputPin
	Case                                    *detective.Case
	NativeBinding                           detective.OperationBinding
}

PinDetectiveInputCommand is a trusted Go boundary, never a generic HTTP command. The native owner supplies its existing scope-envelope OperationBinding and authoritative Case snapshot. This method does not authorize or execute a Case.

type PinnedDetectiveInput added in v0.55.0

type PinnedDetectiveInput struct {
	Receipt Receipt
	Input   InputSnapshot
	Run     Run
}

type Principal

type Principal struct {
	// Executor is set only by the server runtime when persisting an actual outcome.
	Executor   bool
	Actor      string
	DatabaseID string
	ProjectID  string
}

Principal is supplied by the authorized server boundary, never decoded from a command.

type Reader

type Reader interface {
	Load(context.Context, string, string, any) (int64, error)
	List(context.Context, string, string, string, int) ([]json.RawMessage, string, error)
}

type Receipt

type Receipt struct {
	Scope           *Scope    `json:"scope,omitempty"`
	OpID            string    `json:"opId"`
	Actor           string    `json:"actor"`
	Action          string    `json:"action"`
	PayloadDigest   string    `json:"payloadDigest"`
	SessionID       string    `json:"sessionId"`
	SessionVersion  int64     `json:"sessionVersion"`
	ResourceID      string    `json:"resourceId,omitempty"`
	ResourceVersion int64     `json:"resourceVersion,omitempty"`
	At              time.Time `json:"at"`

	// RecoveryBindingDigest independently binds accepted native recovery metadata.
	RecoveryBindingDigest string `json:"recoveryBindingDigest,omitempty"`
}

Receipt and audit contain references and counts only, never source/input values or titles.

type Repository

type Repository interface {
	View(context.Context, func(Reader) error) error
	Transact(context.Context, func(Transaction) error) error
}

Repository implementations commit heads, immutable records, receipt and audit in one authority. List pages are bounded and owner-filtered before records reach clients.

type RetainedContextBinding added in v0.125.0

type RetainedContextBinding struct {
	Namespace                                    NativeNamespace
	LifecycleSessionID                           string
	Owner, SessionID, Collection, ID, WorkItemID string
	Active                                       bool
	Scopes                                       []Scope
	Subjects                                     []RetainedScopedSubject
	Source                                       *ContextSource
	LegacySourceID, SourceDigest                 string
}

RetainedContextBinding is private input to the owning provider's reference resolver. Subject and Scope are complete semantic descriptors, not project object IDs. Namespace identifies storage; Source may name a different owner's session in that same repository. No source values or prose are exposed.

func ProjectRetainedContextBindings added in v0.125.0

func ProjectRetainedContextBindings(ctx context.Context, inventory RetainedInventory) ([]RetainedContextBinding, error)

ProjectRetainedContextBindings validates all retained records in the five context collections, including heads removed by clearBag and old applied sets. Current references are flattened so an active session cannot hide a dependency behind a historical revision. It does not project execution pins, receipts, audits, messages, imports or redaction loss; those families require independent owning projectors. This result never certifies complete usage.

type RetainedDetectiveExecution added in v0.125.0

type RetainedDetectiveExecution struct {
	Namespace          NativeNamespace
	LifecycleSessionID string
	Owner              string
	Dispatch           DetectiveDispatchBinding
	Reference          apicontract.SessionInputReference
	SessionID          string
	RunID              string
	InputSnapshotID    string
	NativeRunID        string
	Scope              Scope
	Active             bool
	HandoffActive      bool
	Definition         DetectiveCheckDefinitionPin
	// Populated by the composed source reader after exact context joins.
	Subjects []RetainedScopedSubject
}

RetainedDetectiveExecution is a validated, private source projection. Native target identity remains distinct from the operational session namespace. The host must resolve that exact native project before joining its usage graph. Query pins preserve folder-qualified identities and the immutable definitions; the owning provider must also project their typed connection/meaning refs.

func ProjectRetainedDetectiveExecutions added in v0.125.0

func ProjectRetainedDetectiveExecutions(ctx context.Context, inventory RetainedInventory) ([]RetainedDetectiveExecution, error)

ProjectRetainedDetectiveExecutions validates all retained input/run/acceptance rows in an all-owner inventory. It never reconstructs an old pin from today's Check. Ordinary client/draft execution, redacted dependency loss, unsealed legacy acceptances, unrecognized outcomes and broken joins return no partial result. An uncertain native run stays active until owner settlement proves completion.

This covers the native execution subset only: context subjects, ordinary pins, operation/audit provenance and other project sources need their own projection. The result alone MUST NOT be treated as complete project or session usage.

type RetainedDocument added in v0.125.0

type RetainedDocument struct {
	Collection string
	ID         string
	Owner      string
	SessionID  string
	Version    int64
	Payload    json.RawMessage
}

RetainedDocument is a server-internal envelope. Payload may contain private inputs and must never be returned from a user-facing inventory endpoint. Source adapters decode the collection's actual type, validate its schema and resolve its references; this envelope alone is not a complete reference graph.

type RetainedInventory added in v0.125.0

type RetainedInventory struct {
	Namespace NativeNamespace
	// Collections includes empty collections too. Consumers must reject any
	// collection they cannot project; silently skipping a new source is unsafe.
	Collections []string
	Documents   []RetainedDocument
}

type RetainedInventoryLimits added in v0.125.0

type RetainedInventoryLimits struct {
	MaxDocuments int
	MaxBytes     int
}

type RetainedOrdinaryExecution added in v0.125.0

type RetainedOrdinaryExecution struct {
	Namespace                                                    NativeNamespace
	LifecycleSessionID                                           string
	Owner, SessionID, RunID, InputSnapshotID, ContextSetID       string
	Kind, DefinitionID, DefinitionRevision                       string
	State, ExecutionAuthority, DefinitionDigest, ExecutionDigest string
	Scope                                                        Scope
	// Active conservatively includes client outcome-unknown: client settlement
	// clears operational pending bookkeeping but proves no source completion.
	Active                                bool
	DefinitionDocument, ExecutionDocument json.RawMessage
	Subjects                              []RetainedScopedSubject
	ResultRefs                            []string
	Widgets                               []WidgetOutcome
}

RetainedOrdinaryExecution is a private, immutable pin projection, including executable SQL/TugQL. It must never be returned in a lifecycle response. DefinitionID/Revision are opaque caller provenance, NOT saved project query identity. Query/widget IDs inside the documents are document-local. A host needs an owning source binding before resolving project definitions.

type RetainedScopedSubject added in v0.125.0

type RetainedScopedSubject struct {
	Scope   Scope
	Subject Subject
}

type RetainedSessionProvenance added in v0.125.0

type RetainedSessionProvenance struct {
	Namespace                                NativeNamespace
	LifecycleSessionID                       string
	Owner, SessionID, Collection, ID, Action string
	Scopes                                   []Scope
	Resources                                []RetainedSessionResource
	LegacySourceID, SourceDigest             string
}

RetainedSessionProvenance exposes reference metadata only. Every row is historical; values, message text and command payloads are not returned. Resource identities preserve provenance joins. The owning resolver must distinguish actual retained content/use from identity-only audit metadata; these identities alone do not establish lifecycle-blocking references.

type RetainedSessionResource added in v0.125.0

type RetainedSessionResource struct{ Collection, ID, SessionID string }

RetainedSessionResource names an internal session resource, never an inferred saved query or project item. SessionID preserves cross-session copy targets.

type RetainedSessionSources added in v0.125.0

type RetainedSessionSources struct {
	Contexts   []RetainedContextBinding
	Native     []RetainedDetectiveExecution
	Ordinary   []RetainedOrdinaryExecution
	Provenance []RetainedSessionProvenance
}

RetainedSessionSources joins context and execution sources across all owners. Redaction loss and unsupported legacy handoffs remain unknown. Project source identity still needs the owning provider resolver. There is no Complete bit.

func ProjectRetainedSessionSources added in v0.125.0

func ProjectRetainedSessionSources(ctx context.Context, inventory RetainedInventory) (RetainedSessionSources, error)

type RetainedWrite added in v0.125.0

type RetainedWrite struct {
	Before *RetainedDocument
	After  RetainedDocument
}

type RetainedWriteAdmission added in v0.125.0

type RetainedWriteAdmission func(context.Context, dal.ReadwriteTransaction, NativeNamespace, []RetainedWrite) (func() error, error)

RetainedWriteAdmission belongs to the trusted project host. It projects typed before/after records and reads shared reference fences in the supplied SAME transaction. It returns a write-only closure for those fences. No source or fence write may happen during preparation. Both errors must abort the outer transaction. Admission is not source authorization; existing command gates still authorize owner/collaborator access and native accepted work.

type Run

type Run struct {
	ID                 string `json:"id"`
	SessionID          string `json:"sessionId"`
	InputSnapshotID    string `json:"inputSnapshotId"`
	Kind               string `json:"kind"`
	DefinitionID       string `json:"definitionId"`
	DefinitionRevision string `json:"definitionRevision"`
	// State is accepted/completed/failed/canceled; client reportClientRun may
	// also settle uncertainty as outcome-unknown.
	State                string                             `json:"state"`
	OutcomeOrigin        string                             `json:"outcomeOrigin,omitempty"`
	ExecutionAuthority   string                             `json:"executionAuthority"`
	ExecutionDigest      string                             `json:"executionDigest,omitempty"`
	ExecutionDocument    json.RawMessage                    `json:"executionDocument,omitempty"`
	ResolvedParameters   map[string]apicontract.TypedValue  `json:"resolvedParameters,omitempty"`
	Version              int64                              `json:"version"`
	Widgets              []WidgetOutcome                    `json:"widgets,omitempty"`
	ResultRefs           []string                           `json:"resultRefs,omitempty"`
	ErrorCode            string                             `json:"errorCode,omitempty"`
	CreatedAt            time.Time                          `json:"createdAt"`
	CompletedAt          *time.Time                         `json:"completedAt,omitempty"`
	InputReference       *apicontract.SessionInputReference `json:"inputReference,omitempty"`
	DetectiveOperationID string                             `json:"detectiveOperationId,omitempty"`
}

type Scope

type Scope struct {
	EnvironmentID  string `json:"environmentId"`
	IdentityDomain string `json:"identityDomain"`
}

type Service

type Service struct {
	// contains filtered or unexported fields
}

Service requires a live authorization boundary. It never executes source queries on reads.

func NewNativePinService added in v0.55.0

func NewNativePinService(repo Repository, authorize Authorizer) (*Service, error)

NewNativePinService is explicitly opt-in and remains unrouted/dormant.

func NewService

func NewService(repo Repository, authorize Authorizer) (*Service, error)

func NewWorkService added in v0.79.1

func NewWorkService(repo Repository, binding WorkBinding, authorize Authorizer) (*Service, error)

NewWorkService reuses context commands under one explicit Work association. A caller-owned BufferedRepository allows authorization, Work activity and context writes to commit together. Authorize must fail closed on revocation.

func (*Service) Execute

func (s *Service) Execute(ctx context.Context, p Principal, c Command) (CommandResult, error)

func (*Service) GetSnapshot

func (s *Service) GetSnapshot(ctx context.Context, p Principal, id string) (Snapshot, error)

func (*Service) ListEntryRevisions

func (s *Service) ListEntryRevisions(ctx context.Context, p Principal, sessionID, entryID, cursor string, limit int) (Page[EntryRevision], error)

ListEntryRevisions exposes a stable, authorized history for one session entry.

func (*Service) ListMessages

func (s *Service) ListMessages(ctx context.Context, p Principal, sessionID, cursor string, limit int) (Page[Message], error)

ListMessages returns durable chat history in stable ID order, rechecking the source scope pinned when each message was sent.

func (*Service) ListRuns

func (s *Service) ListRuns(ctx context.Context, p Principal, sessionID, cursor string, limit int) (Page[Run], error)

ListRuns returns durable run receipts in stable ID order. Each page is scoped to the authorized session and reauthorizes every pinned source scope.

func (*Service) ListSessions

func (s *Service) ListSessions(ctx context.Context, p Principal, cursor string, limit int) (Page[Session], error)

func (*Service) PinDetectiveInput added in v0.55.0

PinDetectiveInput atomically accepts private inputs only. It deliberately dispatches nothing and cannot settle native work without later attestation.

func (*Service) ReadDetectiveDispatch added in v0.55.0

func (s *Service) ReadDetectiveDispatch(ctx context.Context, p Principal, sessionID, runID string) (DetectiveInputPin, error)

func (*Service) ReadEntryRevision

func (s *Service) ReadEntryRevision(ctx context.Context, p Principal, sessionID, entryID, revisionID string) (EntryRevision, error)

ReadEntryRevision returns one retained revision after checking its owning session and the bag's current authorization boundary.

func (*Service) ReadInput

func (s *Service) ReadInput(ctx context.Context, p Principal, id string) (InputSnapshot, []EntryRevision, error)

ReadInput resolves exact historical revisions after fresh source-scope authorization.

func (*Service) ReadOperation

func (s *Service) ReadOperation(ctx context.Context, p Principal, id string) (Receipt, error)

func (*Service) ReadRun

func (s *Service) ReadRun(ctx context.Context, p Principal, id string) (Run, error)

type Session

type Session struct {
	// WorkItemID is immutable and can only be set by a trusted Work-bound service.
	WorkItemID      string    `json:"workItemId,omitempty"`
	SchemaVersion   int       `json:"schemaVersion"`
	ID              string    `json:"id"`
	DatabaseID      string    `json:"databaseId"`
	ProjectID       string    `json:"projectId"`
	Owner           string    `json:"owner"`
	Title           string    `json:"title"`
	State           string    `json:"state"`
	Version         int64     `json:"version"`
	DefaultBagID    string    `json:"defaultBagId"`
	ContextSetID    string    `json:"contextSetId"`
	PendingRunCount int       `json:"pendingRunCount,omitempty"`
	BagIDs          []string  `json:"bagIds"`
	CreatedAt       time.Time `json:"createdAt"`
	UpdatedAt       time.Time `json:"updatedAt"`

	// NativeFenceGeneration monotonically invalidates native claims on Stop/archive/delete.
	NativeFenceGeneration int64 `json:"nativeFenceGeneration,omitempty"`
}

type SessionRedaction added in v0.55.0

type SessionRedaction struct {
	SessionID  string          `json:"sessionId"`
	Owner      string          `json:"owner"`
	Namespace  NativeNamespace `json:"namespace"`
	DeleteOpID string          `json:"deleteOpId"`
	Version    int64           `json:"version"`
	RedactedAt time.Time       `json:"redactedAt"`
}

SessionRedaction is a private authority marker, not an erasure claim or a grant. Creation/scrubbing belongs to the later accepted owner-deletion command.

type Snapshot

type Snapshot struct {
	Session    Session           `json:"session"`
	Bags       []Bag             `json:"bags"`
	Entries    []Entry           `json:"entries"`
	Revisions  []EntryRevision   `json:"revisions"`
	ContextSet AppliedContextSet `json:"contextSet"`
}

type Subject

type Subject struct {
	ConceptID       string   `json:"conceptId"`
	FieldID         string   `json:"fieldId"`
	FieldMappingRef string   `json:"fieldMappingRef"`
	GraphResource   string   `json:"graphResource,omitempty"`
	GraphRevision   string   `json:"graphRevision,omitempty"`
	ModelRef        string   `json:"modelRef,omitempty"`
	ModelRevision   string   `json:"modelRevision,omitempty"`
	Record          string   `json:"record,omitempty"`
	Fields          []string `json:"fields,omitempty"`
}

type Transaction

type Transaction interface {
	Reader
	Save(context.Context, string, string, any, int64, string, string) error
}

type ValueEnvelope

type ValueEnvelope struct {
	SchemaVersion int                      `json:"schemaVersion"`
	Kind          string                   `json:"kind"`
	Scalar        *apicontract.TypedValue  `json:"scalar,omitempty"`
	Values        []apicontract.TypedValue `json:"values,omitempty"`
	KeyFields     []string                 `json:"keyFields,omitempty"`
	Keys          []EntityKey              `json:"keys,omitempty"`
}

ValueEnvelope keeps integers/decimals lossless and composite keys structurally typed. Sets may be empty; an empty set is never interpreted as an unfiltered source.

type WidgetOutcome

type WidgetOutcome struct {
	ID        string `json:"id"`
	State     string `json:"state"`
	ResultRef string `json:"resultRef,omitempty"`
	ErrorCode string `json:"errorCode,omitempty"`
}

type WorkBinding added in v0.79.1

type WorkBinding struct {
	WorkItemID, SessionID, IndexOwner, DatabaseID, ProjectID string
}

WorkBinding is trusted server configuration, never a transport payload. The caller must validate reciprocal WorkItem/session identity and current project, item and source permissions in the same transaction used by the repository. IndexOwner is the immutable creator/index partition, not the acting user.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL