Documentation
¶
Overview ¶
Package sessioncontext owns private, durable session context and immutable input pins. Source execution and Detective evaluation remain in their existing domains.
Index ¶
- Constants
- Variables
- func Collections() []string
- func ManifestCollectionsYAML() string
- func SQLiteSchemaStatements() []string
- func SessionLifecycleID(namespace NativeNamespace, sessionID string) (string, error)
- type AcceptedDetectiveOperation
- type AcceptedDetectiveStatus
- type AcceptedDetectiveWork
- type Access
- type AppliedContextSet
- type AppliedSlot
- type AuditEvent
- type Authorizer
- type Bag
- type BufferedRepository
- func (b *BufferedRepository) DatabaseID() string
- func (b *BufferedRepository) Flush(ctx context.Context) error
- func (b *BufferedRepository) PrepareFlush(ctx context.Context) error
- func (b *BufferedRepository) Transact(ctx context.Context, f func(Transaction) error) error
- func (b *BufferedRepository) View(ctx context.Context, f func(Reader) error) error
- type Command
- type CommandResult
- type ContextSource
- type CopyContextCommand
- type DALRepository
- func (r *DALRepository) BufferInTransaction(tx dal.ReadwriteTransaction) (*BufferedRepository, error)
- func (r *DALRepository) DatabaseID() string
- func (r *DALRepository) NativeNamespace() NativeNamespace
- func (r *DALRepository) ReaderInTransaction(tx dal.ReadTransaction) (Reader, error)
- func (r *DALRepository) RetainedInventoryInTransaction(ctx context.Context, tx dal.ReadTransaction, limits RetainedInventoryLimits) (RetainedInventory, error)
- func (r *DALRepository) Transact(ctx context.Context, f func(Transaction) error) error
- func (r *DALRepository) View(ctx context.Context, f func(Reader) error) error
- func (r *DALRepository) WithRetainedWriteAdmission(admit RetainedWriteAdmission) (*DALRepository, error)
- type DetectiveAcceptedQueryPin
- type DetectiveCheckDefinitionPin
- type DetectiveDispatchBinding
- type DetectiveFence
- type DetectiveIdentity
- type DetectiveInputPin
- type DetectiveObservation
- type DetectiveOwner
- func (o *DetectiveOwner) CheckFence(ctx context.Context, p Principal, token DetectiveFence) error
- func (o *DetectiveOwner) CheckFenceWithReader(ctx context.Context, p Principal, token DetectiveFence, r Reader) error
- func (o *DetectiveOwner) ClaimDispatch(ctx context.Context, p Principal, id DetectiveIdentity) (DetectiveFence, DetectiveInputPin, error)
- func (o *DetectiveOwner) ClaimDispatchOnce(ctx context.Context, p Principal, id DetectiveIdentity) (DetectiveFence, DetectiveInputPin, bool, error)
- func (o *DetectiveOwner) Fence(ctx context.Context, p Principal, id DetectiveIdentity, reason string) error
- func (o *DetectiveOwner) ReadHandoff(ctx context.Context, p Principal, id DetectiveIdentity) (EvidenceHandoff, int64, error)
- func (o *DetectiveOwner) ReadStatus(ctx context.Context, p Principal, id DetectiveIdentity) (AcceptedDetectiveStatus, error)
- func (o *DetectiveOwner) Reconcile(ctx context.Context, p Principal, id DetectiveIdentity) (AcceptedDetectiveStatus, error)
- func (o *DetectiveOwner) RedactPins(ctx context.Context, p Principal, id DetectiveIdentity, ...) (string, error)
- func (o *DetectiveOwner) ResolveOperation(ctx context.Context, p Principal, clientOpID string) (AcceptedDetectiveOperation, error)
- func (o *DetectiveOwner) SettleHandoff(ctx context.Context, p Principal, id DetectiveIdentity, expected int64, ...) error
- type DetectiveScenarioStepIdentity
- type EntityKey
- type Entry
- type EntryRef
- type EntryRevision
- type EvidenceHandoff
- type InputSnapshot
- type KeyComponent
- type LegacyChatMessage
- type LegacyEntry
- type LegacyImport
- type LegacyImportManifest
- type Message
- type MountedDatabase
- type NativeNamespace
- type Page
- type PinDetectiveInputCommand
- type PinnedDetectiveInput
- type Principal
- type Reader
- type Receipt
- type Repository
- type RetainedContextBinding
- type RetainedDetectiveExecution
- type RetainedDocument
- type RetainedInventory
- type RetainedInventoryLimits
- type RetainedOrdinaryExecution
- type RetainedScopedSubject
- type RetainedSessionProvenance
- type RetainedSessionResource
- type RetainedSessionSources
- type RetainedWrite
- type RetainedWriteAdmission
- type Run
- type Scope
- type Service
- func (s *Service) Execute(ctx context.Context, p Principal, c Command) (CommandResult, error)
- func (s *Service) GetSnapshot(ctx context.Context, p Principal, id string) (Snapshot, error)
- func (s *Service) ListEntryRevisions(ctx context.Context, p Principal, sessionID, entryID, cursor string, limit int) (Page[EntryRevision], error)
- func (s *Service) ListMessages(ctx context.Context, p Principal, sessionID, cursor string, limit int) (Page[Message], error)
- func (s *Service) ListRuns(ctx context.Context, p Principal, sessionID, cursor string, limit int) (Page[Run], error)
- func (s *Service) ListSessions(ctx context.Context, p Principal, cursor string, limit int) (Page[Session], error)
- func (s *Service) PinDetectiveInput(ctx context.Context, p Principal, c PinDetectiveInputCommand) (PinnedDetectiveInput, error)
- func (s *Service) ReadDetectiveDispatch(ctx context.Context, p Principal, sessionID, runID string) (DetectiveInputPin, error)
- func (s *Service) ReadEntryRevision(ctx context.Context, p Principal, sessionID, entryID, revisionID string) (EntryRevision, error)
- func (s *Service) ReadInput(ctx context.Context, p Principal, id string) (InputSnapshot, []EntryRevision, error)
- func (s *Service) ReadOperation(ctx context.Context, p Principal, id string) (Receipt, error)
- func (s *Service) ReadRun(ctx context.Context, p Principal, id string) (Run, error)
- type Session
- type SessionRedaction
- type Snapshot
- type Subject
- type Transaction
- type ValueEnvelope
- type WidgetOutcome
- type WorkBinding
Constants ¶
const ( Sessions = "sessionContextSessions" Bags = "sessionContextBags" Entries = "sessionContextEntries" Revisions = "sessionContextEntryRevisions" ContextSets = "sessionContextSets" Operations = "sessionContextOperations" Audit = "sessionContextAudit" Inputs = "sessionContextInputs" Runs = "sessionContextRuns" Messages = "sessionContextMessages" Outbox = "sessionContextOutbox" LegacyImports = "sessionContextLegacyImports" // MaxSnapshotBytes caps the sum of serialized session, bag, context-set, current // entry and current/applied revision records returned by GetSnapshot. MaxSnapshotBytes = 4 * 1024 * 1024 // MaxSnapshotEntries bounds current entries and applied references in one snapshot. MaxSnapshotEntries = 400 // MaxSnapshotRevisions bounds the union of current and applied revisions. MaxSnapshotRevisions = 2 * MaxSnapshotEntries )
const DetectiveOwners = "sessionContextDetectiveOwners"
const DetectiveWork = "sessionContextDetectiveWork"
const MaxDetectiveDefinitionBytes = 512 << 10
const MaxDetectiveQueryBytes = 64 << 10
const Redactions = "sessionContextRedactions"
Variables ¶
var ( ErrNotFound = errors.New("session context: not found") ErrConflict = errors.New("session context: version conflict") ErrInvalid = errors.New("session context: invalid command") ErrForbidden = errors.New("session context: access denied") ErrReadOnly = errors.New("session context: session is read-only") )
var ErrEmptyCheckSet = fmt.Errorf("%w: unsupported empty Check set", ErrInvalid)
Functions ¶
func Collections ¶
func Collections() []string
func ManifestCollectionsYAML ¶
func ManifestCollectionsYAML() string
ManifestCollectionsYAML is the collections block beneath schemas in an OVDB manifest.
func SQLiteSchemaStatements ¶
func SQLiteSchemaStatements() []string
SQLiteSchemaStatements provision the private local OVDB mount before opening it. These identifiers are compile-time constants; no user SQL is interpolated.
func SessionLifecycleID ¶ added in v0.125.0
func SessionLifecycleID(namespace NativeNamespace, sessionID string) (string, error)
SessionLifecycleID identifies a session by its operational namespace and stored session ID. The namespace must come from the owning repository: its digest binds the mount and private parent, not the native execution target. Owner is authorization/index metadata and is deliberately absent from the key. This identity establishes neither source authority nor complete project usage.
Types ¶
type AcceptedDetectiveOperation ¶ added in v0.57.0
type AcceptedDetectiveOperation struct {
Identity DetectiveIdentity `json:"identity"`
ClientRequestDigest string `json:"clientRequestDigest"`
}
AcceptedDetectiveOperation is metadata-only transport recovery. Its request digest is the host's canonical client body, not the native operation payload. Adapters compare it before reading mutable Check/Case definitions on retry.
type AcceptedDetectiveStatus ¶ added in v0.56.0
type AcceptedDetectiveStatus struct {
RunID string `json:"runId"`
State string `json:"state"`
FenceReason string `json:"fenceReason,omitempty"`
Produced bool `json:"produced"`
Done bool `json:"done"`
EvidenceState string `json:"evidenceState,omitempty"`
}
AcceptedDetectiveStatus contains no content, Case identity, labels, or input refs.
type AcceptedDetectiveWork ¶ added in v0.55.0
type AcceptedDetectiveWork struct {
ID string `json:"id"`
Owner string `json:"owner"`
Namespace NativeNamespace `json:"namespace"`
SessionID string `json:"sessionId"`
RunID string `json:"runId"`
InputSnapshotID string `json:"inputSnapshotId"`
Reference apicontract.SessionInputReference `json:"reference"`
Dispatch DetectiveDispatchBinding `json:"dispatch"`
State string `json:"state"`
Version int64 `json:"version"`
AcceptedAt time.Time `json:"acceptedAt"`
// SessionGeneration is captured atomically with acceptance, before any dispatch claim.
SessionGeneration int64 `json:"sessionGeneration"`
// OwnerProtocolVersion binds lifecycle generation; legacy unbound acceptances cannot dispatch.
OwnerProtocolVersion int64 `json:"ownerProtocolVersion"`
// ClientOperationID and AcceptanceDigest bind the durable metadata lookup.
ClientOperationID string `json:"clientOperationId,omitempty"`
AcceptanceDigest string `json:"acceptanceDigest,omitempty"`
ClientRequestDigest string `json:"clientRequestDigest,omitempty"`
}
AcceptedDetectiveWork records private acceptance, never native execution or native acceptance. Its metadata is reserved for later authenticated recovery.
type AppliedContextSet ¶
type AppliedSlot ¶
type AppliedSlot struct {
Scope Scope `json:"scope"`
BagID string `json:"bagId"`
BagVersion int64 `json:"bagVersion"`
Version int64 `json:"version"`
Entries []EntryRef `json:"entries"`
}
A slot with an empty bagId is a cleared tombstone. Its version prevents ABA reuse.
type AuditEvent ¶
type BufferedRepository ¶ added in v0.79.1
type BufferedRepository struct {
// contains filtered or unexported fields
}
BufferedRepository belongs to the caller's DALGO transaction. Commands queue their writes; Flush issues them only after the caller finishes all reads. No method may be used after Flush. The caller commits or aborts the enclosing transaction and must return every command/Flush error to that transaction.
func (*BufferedRepository) DatabaseID ¶ added in v0.79.1
func (b *BufferedRepository) DatabaseID() string
func (*BufferedRepository) Flush ¶ added in v0.79.1
func (b *BufferedRepository) Flush(ctx context.Context) error
func (*BufferedRepository) PrepareFlush ¶ added in v0.125.0
func (b *BufferedRepository) PrepareFlush(ctx context.Context) error
PrepareFlush performs reference-admission reads before a caller's first native write. It seals the pending session writes; subsequent commands are refused. Flush later writes the admitted fences and records without further reads. A repository with admission installed cannot skip this step in a coupled tx.
func (*BufferedRepository) Transact ¶ added in v0.79.1
func (b *BufferedRepository) Transact(ctx context.Context, f func(Transaction) error) error
type Command ¶
type Command struct {
OpID string `json:"opId"`
Action string `json:"action"`
SessionID string `json:"sessionId"`
ExpectedVersion int64 `json:"expectedVersion,omitempty"`
DatabaseID string `json:"databaseId,omitempty"`
ProjectID string `json:"projectId,omitempty"`
BagID string `json:"bagId,omitempty"`
ExpectedBagVersion int64 `json:"expectedBagVersion,omitempty"`
ExpectedSlotVersion int64 `json:"expectedSlotVersion,omitempty"`
ExpectedContextSetID string `json:"expectedContextSetId,omitempty"`
EntryID string `json:"entryId,omitempty"`
ExpectedEntryVersion int64 `json:"expectedEntryVersion,omitempty"`
RevisionID string `json:"revisionId,omitempty"`
Title string `json:"title,omitempty"`
Alias string `json:"alias,omitempty"`
Scope *Scope `json:"scope,omitempty"`
Subject *Subject `json:"subject,omitempty"`
Value *ValueEnvelope `json:"value,omitempty"`
Selection []EntryRef `json:"selection,omitempty"`
Enabled *bool `json:"enabled,omitempty"`
Transition string `json:"transition,omitempty"`
// M3 input pins and durable run routing. Result rows remain in the existing result store.
InputSnapshotID string `json:"inputSnapshotId,omitempty"`
RunID string `json:"runId,omitempty"`
Kind string `json:"kind,omitempty"`
DefinitionID string `json:"definitionId,omitempty"`
DefinitionRevision string `json:"definitionRevision,omitempty"`
DefinitionDocument json.RawMessage `json:"definitionDocument,omitempty"`
ExecutionDocument json.RawMessage `json:"executionDocument,omitempty"`
Attachments []EntryRef `json:"attachments,omitempty"`
Text string `json:"text,omitempty"`
ExpectedRunVersion int64 `json:"expectedRunVersion,omitempty"`
// reportClientRun accepts outcome-unknown only with the fixed
// CLIENT_OUTCOME_UNKNOWN code and no result payload. It records uncertainty
// after client interruption; it does not assert source failure or cancellation.
RunState string `json:"runState,omitempty"`
Widgets []WidgetOutcome `json:"widgets,omitempty"`
ResultRefs []string `json:"resultRefs,omitempty"`
ErrorCode string `json:"errorCode,omitempty"`
CaseID string `json:"caseId,omitempty"`
DetectiveRunID string `json:"detectiveRunId,omitempty"`
ResolvedParameters map[string]apicontract.TypedValue `json:"resolvedParameters,omitempty"`
LegacyImport *LegacyImport `json:"legacyImport,omitempty"`
}
Command is shared by HTTP/terminal adapters. IDs are opaque, path-safe and stable. expectedVersion is the session version. expectedEntryVersion=0 creates an entry.
type CommandResult ¶
type CommandResult struct {
Receipt Receipt `json:"receipt"`
}
func CopyContext ¶ added in v0.79.1
func CopyContext(ctx context.Context, p Principal, source, destination *Service, c CopyContextCommand) (CommandResult, error)
CopyContext copies typed values and named bags within one transaction and project. source and destination must use the same Repository instance. A private destination must belong to the real actor; this is the execution snapshot path, not delegation of native execution ownership.
type ContextSource ¶ added in v0.79.1
type CopyContextCommand ¶ added in v0.79.1
type CopyContextCommand struct {
OpID, SourceSessionID, DestinationSessionID string
ExpectedSourceVersion, ExpectedDestinationVersion int64
Selection []EntryRef
}
CopyContextCommand selects exact current revisions. Both session heads are compared; refresh never replaces an entry subsequently edited in the child. Selection must be nonempty. Copied entries remain unapplied until applyContext.
type DALRepository ¶
type DALRepository struct {
// contains filtered or unexported fields
}
func NewDALRepository ¶
func NewDALRepository(mounted MountedDatabase, parent *record.Key) (*DALRepository, error)
func NewNativePinRepository ¶ added in v0.55.0
func NewNativePinRepository(mounted MountedDatabase, parent *record.Key, storage, space, project string) (*DALRepository, error)
NewNativePinRepository explicitly binds pinning to the real mount and an owned repository parent. Ordinary NewDALRepository does not enable native pinning.
func (*DALRepository) BufferInTransaction ¶ added in v0.79.1
func (r *DALRepository) BufferInTransaction(tx dal.ReadwriteTransaction) (*BufferedRepository, error)
func (*DALRepository) DatabaseID ¶
func (r *DALRepository) DatabaseID() string
func (*DALRepository) NativeNamespace ¶ added in v0.55.0
func (r *DALRepository) NativeNamespace() NativeNamespace
func (*DALRepository) ReaderInTransaction ¶ added in v0.56.0
func (r *DALRepository) ReaderInTransaction(tx dal.ReadTransaction) (Reader, error)
ReaderInTransaction binds the caller's existing transaction to this repository's operational parent. It never starts, commits, or writes a transaction. Its lifetime is the caller's transaction; do not retain it. On Firestore, use this before native writes so session fence reads participate in the same optimistic transaction conflict boundary as native finalization.
func (*DALRepository) RetainedInventoryInTransaction ¶ added in v0.125.0
func (r *DALRepository) RetainedInventoryInTransaction(ctx context.Context, tx dal.ReadTransaction, limits RetainedInventoryLimits) (RetainedInventory, error)
RetainedInventoryInTransaction scans all owners and all retained rows under this repository's explicitly bound native project parent. It does not filter by current session state, expiration, redaction or execution outcome. Retained tombstones and expired-but-unpurged snapshots still carry references.
The owning server must authorize this internal operation and prove that tx is on the SAME mounted database as this repository. Like ReaderInTransaction, this method cannot prove a transaction's database identity from DAL's interface. It starts no transaction and performs no writes. Call before the first write; the provider must share admission with every concurrent reference writer.
Every known source collection is scanned with a budget+1 limit. Any overflow, malformed envelope, query/read/close failure discards the entire result. This is a storage inventory, not a completeness certificate for other authorities.
func (*DALRepository) Transact ¶
func (r *DALRepository) Transact(ctx context.Context, f func(Transaction) error) error
Transact queues every write until the worker has completed all reads. Firestore transactions prohibit reads after writes, so this ordering is part of the contract.
func (*DALRepository) WithRetainedWriteAdmission ¶ added in v0.125.0
func (r *DALRepository) WithRetainedWriteAdmission(admit RetainedWriteAdmission) (*DALRepository, error)
WithRetainedWriteAdmission creates an independently configured repository. It never mutates another service's repository or enables native pin commands. Only an explicitly bound native project repository may install this port.
type DetectiveAcceptedQueryPin ¶ added in v0.55.0
type DetectiveAcceptedQueryPin struct {
QueryID string `json:"queryId"`
Revision string `json:"revision"`
DefinitionJSON json.RawMessage `json:"definitionJson"`
}
type DetectiveCheckDefinitionPin ¶ added in v0.55.0
type DetectiveCheckDefinitionPin struct {
SchemaVersion int `json:"schemaVersion"`
Check detective.Check `json:"check"`
Dependencies []detective.Check `json:"dependencies"`
PublishedValidators []detective.PublishedValidator `json:"publishedValidators"`
QueryValidators []detective.QueryValidators `json:"queryValidators"`
Queries []DetectiveAcceptedQueryPin `json:"queries"`
Scenario *DetectiveScenarioStepIdentity `json:"scenario,omitempty"`
}
func CanonicalDetectiveDefinition ¶ added in v0.55.0
func CanonicalDetectiveDefinition(ctx context.Context, definition DetectiveCheckDefinitionPin) (DetectiveCheckDefinitionPin, string, error)
CanonicalDetectiveDefinition validates a complete private executable snapshot. It uses existing saved-query and catalog contracts, not source admission. Errors never include query text or validator/provider diagnostics.
type DetectiveDispatchBinding ¶ added in v0.55.0
type DetectiveDispatchBinding struct {
NativeOperationID string `json:"nativeOperationId"`
NativeStoreID string `json:"nativeStoreId"`
NativeSpaceID string `json:"nativeSpaceId,omitempty"`
NativeProjectID string `json:"nativeProjectId"`
Action string `json:"action"`
CheckID string `json:"checkId"`
CheckVersion int64 `json:"checkVersion"`
DefinitionDigest string `json:"definitionDigest"`
NativeRequestDigest string `json:"nativeRequestDigest"`
CaseID string `json:"caseId,omitempty"`
CaseVersion int64 `json:"caseVersion,omitempty"`
CaseContextDigest string `json:"caseContextDigest,omitempty"`
}
type DetectiveFence ¶ added in v0.56.0
type DetectiveFence struct {
SessionGeneration int64 `json:"sessionGeneration"`
Identity DetectiveIdentity `json:"identity"`
Generation int64 `json:"generation"`
}
type DetectiveIdentity ¶ added in v0.56.0
type DetectiveIdentity struct {
Namespace NativeNamespace `json:"namespace"`
Actor string `json:"actor"`
SessionID string `json:"sessionId"`
RunID string `json:"runId"`
NativeStoreID string `json:"nativeStoreId"`
NativeSpaceID string `json:"nativeSpaceId,omitempty"`
NativeProjectID string `json:"nativeProjectId"`
NativeOperationID string `json:"nativeOperationId"`
Digest string `json:"digest"`
}
DetectiveIdentity binds both operational authorities. It is not a bearer grant. NativeOperationID and Digest must come from the native owner's accepted request.
type DetectiveInputPin ¶ added in v0.55.0
type DetectiveInputPin struct {
Reference apicontract.SessionInputReference `json:"reference"`
Definition DetectiveCheckDefinitionPin `json:"definition"`
EffectiveInputs map[string]detective.InputValue `json:"effectiveInputs"`
Dispatch DetectiveDispatchBinding `json:"dispatch"`
}
type DetectiveObservation ¶ added in v0.56.0
type DetectiveObservation struct {
// FenceGeneration copies DetectiveFence.Generation (initially 1).
// SessionGeneration copies DetectiveFence.SessionGeneration (initially 0).
// The native owner persists both with its acceptance and checks them at finalization.
FenceGeneration int64 `json:"fenceGeneration"`
SessionGeneration int64 `json:"sessionGeneration"`
Identity DetectiveIdentity `json:"identity"`
Produced bool `json:"produced"`
Done bool `json:"done"`
NativeRunID string `json:"nativeRunId,omitempty"`
NativeReceiptID string `json:"nativeReceiptId,omitempty"`
State string `json:"state,omitempty"` // completed, failed, canceled
CaseLinkStatus string `json:"caseLinkStatus,omitempty"`
}
DetectiveObservation is supplied only by an authenticated native owner lookup, never by command JSON or a browser. Produced means the result is durable, Done means native finalization has completed. A fence must never discard Produced.
type DetectiveOwner ¶ added in v0.56.0
type DetectiveOwner struct {
// contains filtered or unexported fields
}
DetectiveOwner is deliberately separate from Service.Command. Its host must authenticate an active account for every gate call, even after content access is revoked, and supply a native lookup bound to the exact operation identity. Native execution must call CheckFence before source execution AND native finalization. A claim is recoverable ownership, never permission to reexecute. Cross-store adapters must serialize/check these fences at their native owner; Core cannot turn a remote check followed by a write into an atomic transaction.
func NewDetectiveOwner ¶ added in v0.56.0
func NewDetectiveOwner(s *Service, gate func(context.Context, Principal, DetectiveIdentity) error, lookup func(context.Context, DetectiveIdentity) (DetectiveObservation, error)) (*DetectiveOwner, error)
func (*DetectiveOwner) CheckFence ¶ added in v0.56.0
func (o *DetectiveOwner) CheckFence(ctx context.Context, p Principal, token DetectiveFence) error
CheckFence observes the fence in a fresh session repository read. Native owners sharing the authority should use CheckFenceWithReader inside their existing transaction so concurrent fences cause a transaction conflict.
func (*DetectiveOwner) CheckFenceWithReader ¶ added in v0.56.0
func (o *DetectiveOwner) CheckFenceWithReader(ctx context.Context, p Principal, token DetectiveFence, r Reader) error
CheckFenceWithReader performs the same fence and authorization validation using the caller's transaction snapshot. It starts or commits no transaction. The trusted native owner must supply a namespace-bound Reader and perform all reads before writes where its storage engine requires that ordering.
func (*DetectiveOwner) ClaimDispatch ¶ added in v0.56.0
func (o *DetectiveOwner) ClaimDispatch(ctx context.Context, p Principal, id DetectiveIdentity) (DetectiveFence, DetectiveInputPin, error)
ClaimDispatch returns the SAME generation on retry. It has no clock or lease. Recovery must reconcile the native operation identity before any execution.
func (*DetectiveOwner) ClaimDispatchOnce ¶ added in v0.57.0
func (o *DetectiveOwner) ClaimDispatchOnce(ctx context.Context, p Principal, id DetectiveIdentity) (DetectiveFence, DetectiveInputPin, bool, error)
ClaimDispatchOnce distinguishes the successful first ownership claim from replay. Only first=true may begin original native acceptance; it is still subject to native admission/fencing and durable journaling before dispatch. first=false never authorizes execution merely because native work is absent. A native accepted-but-not-started continuation needs its own durable proof.
func (*DetectiveOwner) Fence ¶ added in v0.56.0
func (o *DetectiveOwner) Fence(ctx context.Context, p Principal, id DetectiveIdentity, reason string) error
Fence durably invalidates all prior dispatch tokens. Repeating a reason does not advance generation. No method clears fences or recreates private pins.
func (*DetectiveOwner) ReadHandoff ¶ added in v0.56.0
func (o *DetectiveOwner) ReadHandoff(ctx context.Context, p Principal, id DetectiveIdentity) (EvidenceHandoff, int64, error)
ReadHandoff is a trusted worker read, with ordinary content authorization. Reauthorization of the destination Case remains the native adapter's duty.
func (*DetectiveOwner) ReadStatus ¶ added in v0.56.0
func (o *DetectiveOwner) ReadStatus(ctx context.Context, p Principal, id DetectiveIdentity) (AcceptedDetectiveStatus, error)
func (*DetectiveOwner) Reconcile ¶ added in v0.56.0
func (o *DetectiveOwner) Reconcile(ctx context.Context, p Principal, id DetectiveIdentity) (AcceptedDetectiveStatus, error)
Reconcile reads the native owner's authoritative operation. It cannot run a query or create a native Case link. Produced-but-unfinished results survive fences; only native Done observations can settle an accepted session run.
func (*DetectiveOwner) RedactPins ¶ added in v0.56.0
func (o *DetectiveOwner) RedactPins(ctx context.Context, p Principal, id DetectiveIdentity, deleteOpID, cursor string, limit int) (string, error)
RedactPins installs an irreversible content marker before bounded scrubbing. Cursor advances across owner-filtered input records, including other sessions; a caller resumes until NextCursor is empty. Repeating pages is safe. This removes session-side executable pins only; separately owned Case evidence, operational records, legacy stores, backups and source data are untouched.
func (*DetectiveOwner) ResolveOperation ¶ added in v0.57.0
func (o *DetectiveOwner) ResolveOperation(ctx context.Context, p Principal, clientOpID string) (AcceptedDetectiveOperation, error)
ResolveOperation uses the operation receipt and accepted work committed with the private pin as one durable mapping. It performs no content authorization, private input read, source execution or new native identity generation. The configured full-identity gate still runs for the accepted actor after metadata is found. A transport MUST authenticate its active caller before invoking this resolver, including missing/corrupt operation paths. Legacy acceptances without a client request binding cannot enter this transport path.
func (*DetectiveOwner) SettleHandoff ¶ added in v0.56.0
func (o *DetectiveOwner) SettleHandoff(ctx context.Context, p Principal, id DetectiveIdentity, expected int64, delivered bool, receiptID string) error
SettleHandoff records only an external receipt, after the adapter reauthorizes both resources and delivers selected input evidence idempotently. It never changes native CaseRunLink. The version is the outbox storage version.
type DetectiveScenarioStepIdentity ¶ added in v0.55.0
type EntityKey ¶
type EntityKey struct {
Components []KeyComponent `json:"components"`
}
type EntryRevision ¶
type EntryRevision struct {
Source *ContextSource `json:"source,omitempty"`
ID string `json:"id"`
EntryID string `json:"entryId"`
BagID string `json:"bagId"`
ParentRevisionID string `json:"parentRevisionId,omitempty"`
Subject Subject `json:"subject"`
Value ValueEnvelope `json:"value"`
CreatedAt time.Time `json:"createdAt"`
Provenance string `json:"provenance,omitempty"`
LegacySourceID string `json:"legacySourceId,omitempty"`
SourceDigest string `json:"sourceDigest,omitempty"`
}
type EvidenceHandoff ¶
type EvidenceHandoff struct {
ID string `json:"id"`
SessionID string `json:"sessionId"`
RunID string `json:"runId"`
InputSnapshotID string `json:"inputSnapshotId"`
CaseID string `json:"caseId"`
DetectiveRunID string `json:"detectiveRunId"`
State string `json:"state"`
ErrorCode string `json:"errorCode,omitempty"`
}
EvidenceHandoff cannot replace Detective's native CaseRunLink transaction. A worker finalizes the native Detective operation, then marks this handoff delivered.
type InputSnapshot ¶
type InputSnapshot struct {
ID string `json:"id"`
SessionID string `json:"sessionId"`
ContextSetID string `json:"contextSetId"`
Scope Scope `json:"scope"`
Entries []EntryRef `json:"entries"`
DefinitionDigest string `json:"definitionDigest"`
DefinitionDocument json.RawMessage `json:"definitionDocument"`
ResolvedParameters map[string]apicontract.TypedValue `json:"resolvedParameters,omitempty"`
ParametersOrigin string `json:"parametersOrigin,omitempty"`
CreatedAt time.Time `json:"createdAt"`
Detective *DetectiveInputPin `json:"detective,omitempty"`
}
type KeyComponent ¶
type KeyComponent struct {
Field string `json:"field"`
Value apicontract.TypedValue `json:"value"`
}
type LegacyChatMessage ¶
type LegacyEntry ¶
type LegacyImport ¶
type LegacyImport struct {
SourceID string `json:"sourceId"`
Title string `json:"title,omitempty"`
Scope Scope `json:"scope"`
Entries []LegacyEntry `json:"entries,omitempty"`
Messages []LegacyChatMessage `json:"messages,omitempty"`
}
LegacyImport is a bounded, read-only migration payload. It imports saved context values and historical chat turns; it never creates executable runs.
type LegacyImportManifest ¶
type LegacyImportManifest struct {
ID string `json:"id"`
SessionID string `json:"sessionId"`
BagID string `json:"bagId"`
SourceID string `json:"sourceId"`
SourceDigest string `json:"sourceDigest"`
Scope Scope `json:"scope"`
CreatedAt time.Time `json:"createdAt"`
}
LegacyImportManifest is private idempotency state keyed by a digest of the source identity, actor, project, and execution scope.
type Message ¶
type Message struct {
ID string `json:"id"`
SessionID string `json:"sessionId"`
InputSnapshotID string `json:"inputSnapshotId"`
Role string `json:"role"`
Text string `json:"text"`
CreatedAt time.Time `json:"createdAt"`
Provenance string `json:"provenance,omitempty"`
LegacySourceID string `json:"legacySourceId,omitempty"`
SourceDigest string `json:"sourceDigest,omitempty"`
HistoricalAt time.Time `json:"historicalAt,omitempty"`
SourceScope Scope `json:"sourceScope,omitempty"`
}
type MountedDatabase ¶
MountedDatabase is implemented by OVDB core.Database. The identity is captured with its mounted DALgo engine; clients cannot supply a raw storage connection.
type NativeNamespace ¶ added in v0.55.0
type NativeNamespace struct {
StorageID string `json:"storageId"`
SpaceID string `json:"spaceId,omitempty"`
DatabaseID string `json:"databaseId"`
ProjectID string `json:"projectId"`
NamespaceID string `json:"namespaceId"`
}
NativeNamespace is the private operational authority, not the source engine.
type PinDetectiveInputCommand ¶ added in v0.55.0
type PinDetectiveInputCommand struct {
// ClientRequestDigest is host-computed from a canonical transport request.
// Empty retains compatibility for internal callers, not transport acceptance.
ClientRequestDigest string
OpID, SessionID, InputSnapshotID, RunID string
ExpectedVersion int64
ExpectedContextSetID string
Scope Scope
Attachments []EntryRef
Pin DetectiveInputPin
Case *detective.Case
NativeBinding detective.OperationBinding
}
PinDetectiveInputCommand is a trusted Go boundary, never a generic HTTP command. The native owner supplies its existing scope-envelope OperationBinding and authoritative Case snapshot. This method does not authorize or execute a Case.
type PinnedDetectiveInput ¶ added in v0.55.0
type PinnedDetectiveInput struct {
Receipt Receipt
Input InputSnapshot
Run Run
}
type Principal ¶
type Principal struct {
// Executor is set only by the server runtime when persisting an actual outcome.
Executor bool
Actor string
DatabaseID string
ProjectID string
}
Principal is supplied by the authorized server boundary, never decoded from a command.
type Receipt ¶
type Receipt struct {
Scope *Scope `json:"scope,omitempty"`
OpID string `json:"opId"`
Actor string `json:"actor"`
Action string `json:"action"`
PayloadDigest string `json:"payloadDigest"`
SessionID string `json:"sessionId"`
SessionVersion int64 `json:"sessionVersion"`
ResourceID string `json:"resourceId,omitempty"`
ResourceVersion int64 `json:"resourceVersion,omitempty"`
At time.Time `json:"at"`
// RecoveryBindingDigest independently binds accepted native recovery metadata.
RecoveryBindingDigest string `json:"recoveryBindingDigest,omitempty"`
}
Receipt and audit contain references and counts only, never source/input values or titles.
type Repository ¶
type Repository interface {
View(context.Context, func(Reader) error) error
Transact(context.Context, func(Transaction) error) error
}
Repository implementations commit heads, immutable records, receipt and audit in one authority. List pages are bounded and owner-filtered before records reach clients.
type RetainedContextBinding ¶ added in v0.125.0
type RetainedContextBinding struct {
Namespace NativeNamespace
LifecycleSessionID string
Owner, SessionID, Collection, ID, WorkItemID string
Active bool
Scopes []Scope
Subjects []RetainedScopedSubject
Source *ContextSource
LegacySourceID, SourceDigest string
}
RetainedContextBinding is private input to the owning provider's reference resolver. Subject and Scope are complete semantic descriptors, not project object IDs. Namespace identifies storage; Source may name a different owner's session in that same repository. No source values or prose are exposed.
func ProjectRetainedContextBindings ¶ added in v0.125.0
func ProjectRetainedContextBindings(ctx context.Context, inventory RetainedInventory) ([]RetainedContextBinding, error)
ProjectRetainedContextBindings validates all retained records in the five context collections, including heads removed by clearBag and old applied sets. Current references are flattened so an active session cannot hide a dependency behind a historical revision. It does not project execution pins, receipts, audits, messages, imports or redaction loss; those families require independent owning projectors. This result never certifies complete usage.
type RetainedDetectiveExecution ¶ added in v0.125.0
type RetainedDetectiveExecution struct {
Namespace NativeNamespace
LifecycleSessionID string
Owner string
Dispatch DetectiveDispatchBinding
Reference apicontract.SessionInputReference
SessionID string
RunID string
InputSnapshotID string
NativeRunID string
Scope Scope
Active bool
HandoffActive bool
Definition DetectiveCheckDefinitionPin
// Populated by the composed source reader after exact context joins.
Subjects []RetainedScopedSubject
}
RetainedDetectiveExecution is a validated, private source projection. Native target identity remains distinct from the operational session namespace. The host must resolve that exact native project before joining its usage graph. Query pins preserve folder-qualified identities and the immutable definitions; the owning provider must also project their typed connection/meaning refs.
func ProjectRetainedDetectiveExecutions ¶ added in v0.125.0
func ProjectRetainedDetectiveExecutions(ctx context.Context, inventory RetainedInventory) ([]RetainedDetectiveExecution, error)
ProjectRetainedDetectiveExecutions validates all retained input/run/acceptance rows in an all-owner inventory. It never reconstructs an old pin from today's Check. Ordinary client/draft execution, redacted dependency loss, unsealed legacy acceptances, unrecognized outcomes and broken joins return no partial result. An uncertain native run stays active until owner settlement proves completion.
This covers the native execution subset only: context subjects, ordinary pins, operation/audit provenance and other project sources need their own projection. The result alone MUST NOT be treated as complete project or session usage.
type RetainedDocument ¶ added in v0.125.0
type RetainedDocument struct {
Collection string
ID string
Owner string
SessionID string
Version int64
Payload json.RawMessage
}
RetainedDocument is a server-internal envelope. Payload may contain private inputs and must never be returned from a user-facing inventory endpoint. Source adapters decode the collection's actual type, validate its schema and resolve its references; this envelope alone is not a complete reference graph.
type RetainedInventory ¶ added in v0.125.0
type RetainedInventory struct {
Namespace NativeNamespace
// Collections includes empty collections too. Consumers must reject any
// collection they cannot project; silently skipping a new source is unsafe.
Collections []string
Documents []RetainedDocument
}
type RetainedInventoryLimits ¶ added in v0.125.0
type RetainedOrdinaryExecution ¶ added in v0.125.0
type RetainedOrdinaryExecution struct {
Namespace NativeNamespace
LifecycleSessionID string
Owner, SessionID, RunID, InputSnapshotID, ContextSetID string
Kind, DefinitionID, DefinitionRevision string
State, ExecutionAuthority, DefinitionDigest, ExecutionDigest string
Scope Scope
// Active conservatively includes client outcome-unknown: client settlement
// clears operational pending bookkeeping but proves no source completion.
Active bool
DefinitionDocument, ExecutionDocument json.RawMessage
Subjects []RetainedScopedSubject
ResultRefs []string
Widgets []WidgetOutcome
}
RetainedOrdinaryExecution is a private, immutable pin projection, including executable SQL/TugQL. It must never be returned in a lifecycle response. DefinitionID/Revision are opaque caller provenance, NOT saved project query identity. Query/widget IDs inside the documents are document-local. A host needs an owning source binding before resolving project definitions.
type RetainedScopedSubject ¶ added in v0.125.0
type RetainedSessionProvenance ¶ added in v0.125.0
type RetainedSessionProvenance struct {
Namespace NativeNamespace
LifecycleSessionID string
Owner, SessionID, Collection, ID, Action string
Scopes []Scope
Resources []RetainedSessionResource
LegacySourceID, SourceDigest string
}
RetainedSessionProvenance exposes reference metadata only. Every row is historical; values, message text and command payloads are not returned. Resource identities preserve provenance joins. The owning resolver must distinguish actual retained content/use from identity-only audit metadata; these identities alone do not establish lifecycle-blocking references.
type RetainedSessionResource ¶ added in v0.125.0
type RetainedSessionResource struct{ Collection, ID, SessionID string }
RetainedSessionResource names an internal session resource, never an inferred saved query or project item. SessionID preserves cross-session copy targets.
type RetainedSessionSources ¶ added in v0.125.0
type RetainedSessionSources struct {
Contexts []RetainedContextBinding
Native []RetainedDetectiveExecution
Ordinary []RetainedOrdinaryExecution
Provenance []RetainedSessionProvenance
}
RetainedSessionSources joins context and execution sources across all owners. Redaction loss and unsupported legacy handoffs remain unknown. Project source identity still needs the owning provider resolver. There is no Complete bit.
func ProjectRetainedSessionSources ¶ added in v0.125.0
func ProjectRetainedSessionSources(ctx context.Context, inventory RetainedInventory) (RetainedSessionSources, error)
type RetainedWrite ¶ added in v0.125.0
type RetainedWrite struct {
Before *RetainedDocument
After RetainedDocument
}
type RetainedWriteAdmission ¶ added in v0.125.0
type RetainedWriteAdmission func(context.Context, dal.ReadwriteTransaction, NativeNamespace, []RetainedWrite) (func() error, error)
RetainedWriteAdmission belongs to the trusted project host. It projects typed before/after records and reads shared reference fences in the supplied SAME transaction. It returns a write-only closure for those fences. No source or fence write may happen during preparation. Both errors must abort the outer transaction. Admission is not source authorization; existing command gates still authorize owner/collaborator access and native accepted work.
type Run ¶
type Run struct {
ID string `json:"id"`
SessionID string `json:"sessionId"`
InputSnapshotID string `json:"inputSnapshotId"`
Kind string `json:"kind"`
DefinitionID string `json:"definitionId"`
DefinitionRevision string `json:"definitionRevision"`
// State is accepted/completed/failed/canceled; client reportClientRun may
// also settle uncertainty as outcome-unknown.
State string `json:"state"`
OutcomeOrigin string `json:"outcomeOrigin,omitempty"`
ExecutionAuthority string `json:"executionAuthority"`
ExecutionDigest string `json:"executionDigest,omitempty"`
ExecutionDocument json.RawMessage `json:"executionDocument,omitempty"`
ResolvedParameters map[string]apicontract.TypedValue `json:"resolvedParameters,omitempty"`
Version int64 `json:"version"`
Widgets []WidgetOutcome `json:"widgets,omitempty"`
ResultRefs []string `json:"resultRefs,omitempty"`
ErrorCode string `json:"errorCode,omitempty"`
CreatedAt time.Time `json:"createdAt"`
CompletedAt *time.Time `json:"completedAt,omitempty"`
InputReference *apicontract.SessionInputReference `json:"inputReference,omitempty"`
DetectiveOperationID string `json:"detectiveOperationId,omitempty"`
}
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service requires a live authorization boundary. It never executes source queries on reads.
func NewNativePinService ¶ added in v0.55.0
func NewNativePinService(repo Repository, authorize Authorizer) (*Service, error)
NewNativePinService is explicitly opt-in and remains unrouted/dormant.
func NewService ¶
func NewService(repo Repository, authorize Authorizer) (*Service, error)
func NewWorkService ¶ added in v0.79.1
func NewWorkService(repo Repository, binding WorkBinding, authorize Authorizer) (*Service, error)
NewWorkService reuses context commands under one explicit Work association. A caller-owned BufferedRepository allows authorization, Work activity and context writes to commit together. Authorize must fail closed on revocation.
func (*Service) GetSnapshot ¶
func (*Service) ListEntryRevisions ¶
func (s *Service) ListEntryRevisions(ctx context.Context, p Principal, sessionID, entryID, cursor string, limit int) (Page[EntryRevision], error)
ListEntryRevisions exposes a stable, authorized history for one session entry.
func (*Service) ListMessages ¶
func (s *Service) ListMessages(ctx context.Context, p Principal, sessionID, cursor string, limit int) (Page[Message], error)
ListMessages returns durable chat history in stable ID order, rechecking the source scope pinned when each message was sent.
func (*Service) ListRuns ¶
func (s *Service) ListRuns(ctx context.Context, p Principal, sessionID, cursor string, limit int) (Page[Run], error)
ListRuns returns durable run receipts in stable ID order. Each page is scoped to the authorized session and reauthorizes every pinned source scope.
func (*Service) ListSessions ¶
func (*Service) PinDetectiveInput ¶ added in v0.55.0
func (s *Service) PinDetectiveInput(ctx context.Context, p Principal, c PinDetectiveInputCommand) (PinnedDetectiveInput, error)
PinDetectiveInput atomically accepts private inputs only. It deliberately dispatches nothing and cannot settle native work without later attestation.
func (*Service) ReadDetectiveDispatch ¶ added in v0.55.0
func (*Service) ReadEntryRevision ¶
func (s *Service) ReadEntryRevision(ctx context.Context, p Principal, sessionID, entryID, revisionID string) (EntryRevision, error)
ReadEntryRevision returns one retained revision after checking its owning session and the bag's current authorization boundary.
func (*Service) ReadInput ¶
func (s *Service) ReadInput(ctx context.Context, p Principal, id string) (InputSnapshot, []EntryRevision, error)
ReadInput resolves exact historical revisions after fresh source-scope authorization.
func (*Service) ReadOperation ¶
type Session ¶
type Session struct {
// WorkItemID is immutable and can only be set by a trusted Work-bound service.
WorkItemID string `json:"workItemId,omitempty"`
SchemaVersion int `json:"schemaVersion"`
ID string `json:"id"`
DatabaseID string `json:"databaseId"`
ProjectID string `json:"projectId"`
Owner string `json:"owner"`
Title string `json:"title"`
State string `json:"state"`
Version int64 `json:"version"`
DefaultBagID string `json:"defaultBagId"`
ContextSetID string `json:"contextSetId"`
PendingRunCount int `json:"pendingRunCount,omitempty"`
BagIDs []string `json:"bagIds"`
CreatedAt time.Time `json:"createdAt"`
UpdatedAt time.Time `json:"updatedAt"`
// NativeFenceGeneration monotonically invalidates native claims on Stop/archive/delete.
NativeFenceGeneration int64 `json:"nativeFenceGeneration,omitempty"`
}
type SessionRedaction ¶ added in v0.55.0
type SessionRedaction struct {
SessionID string `json:"sessionId"`
Owner string `json:"owner"`
Namespace NativeNamespace `json:"namespace"`
DeleteOpID string `json:"deleteOpId"`
Version int64 `json:"version"`
RedactedAt time.Time `json:"redactedAt"`
}
SessionRedaction is a private authority marker, not an erasure claim or a grant. Creation/scrubbing belongs to the later accepted owner-deletion command.
type Snapshot ¶
type Snapshot struct {
Session Session `json:"session"`
Bags []Bag `json:"bags"`
Entries []Entry `json:"entries"`
Revisions []EntryRevision `json:"revisions"`
ContextSet AppliedContextSet `json:"contextSet"`
}
type Subject ¶
type Subject struct {
ConceptID string `json:"conceptId"`
FieldID string `json:"fieldId"`
FieldMappingRef string `json:"fieldMappingRef"`
GraphResource string `json:"graphResource,omitempty"`
GraphRevision string `json:"graphRevision,omitempty"`
ModelRef string `json:"modelRef,omitempty"`
ModelRevision string `json:"modelRevision,omitempty"`
Record string `json:"record,omitempty"`
Fields []string `json:"fields,omitempty"`
}
type Transaction ¶
type ValueEnvelope ¶
type ValueEnvelope struct {
SchemaVersion int `json:"schemaVersion"`
Kind string `json:"kind"`
Scalar *apicontract.TypedValue `json:"scalar,omitempty"`
Values []apicontract.TypedValue `json:"values,omitempty"`
KeyFields []string `json:"keyFields,omitempty"`
Keys []EntityKey `json:"keys,omitempty"`
}
ValueEnvelope keeps integers/decimals lossless and composite keys structurally typed. Sets may be empty; an empty set is never interpreted as an unfiltered source.
type WidgetOutcome ¶
type WorkBinding ¶ added in v0.79.1
type WorkBinding struct {
WorkItemID, SessionID, IndexOwner, DatabaseID, ProjectID string
}
WorkBinding is trusted server configuration, never a transport payload. The caller must validate reciprocal WorkItem/session identity and current project, item and source permissions in the same transaction used by the repository. IndexOwner is the immutable creator/index partition, not the acting user.
Source Files
¶
- contracts.go
- dalgo.go
- dalgo_buffer.go
- detective.go
- detective_definition.go
- detective_namespace.go
- detective_operation.go
- detective_owner.go
- lifecycle_identity.go
- redaction_guard.go
- retained_admission.go
- retained_context.go
- retained_detective.go
- retained_executions.go
- retained_inventory.go
- retained_provenance.go
- service.go
- work.go
- work_copy.go