Documentation
¶
Overview ¶
Package gate is the Pasture-side normative write gate: the closed set of durable lifecycle write classes, a constructor-owned Warrant, and Legalize as the sole warrant issuer.
The gate replaces the M1 static no-write proof (a package that "neither exercises authority nor performs durable writes") with a NORMATIVE gated path: every durable lifecycle write must present a Warrant, and a Warrant can only be produced by Legalize. Threading a required Warrant through the sole durable writer (receipt.Service.Receive) and the non-delivery commit surface makes an ungated write uncompilable rather than merely absent.
The gate is PURE. It imports only model and ir; it performs no clock, store, or I/O access and holds no runtime, env, or config policy input. At M5 policy is static: every well-formed intent of an enumerated class is legal, and everything else is refused with a typed *Refusal.
Origin blindness (Stage-4 M4 seam). WriteIntent carries NOTHING but its write class: it deliberately has no capture-origin, trust, or actor field, and no constructor accepts one. The gate therefore cannot observe where a write came from, so origin discrimination is UNREPRESENTABLE by construction. The seam a future raw-ingestion milestone (M4) needs is preserved without being built: M4 can add its own origin marking upstream, and this gate will still be unable to discriminate on it. The writeIntentShape compile-time assertion below locks that guarantee — adding any field to WriteIntent fails to compile until the shape lock and this seam are consciously reconsidered.
Index ¶
- Constants
- func Legalize(intent WriteIntent) (Warrant, *Refusal)
- func NewDefinitionActivationIntent(content model.ContentIdentity) (WriteIntent, *Refusal)
- func NewDeliveryIntent(contract ir.RuntimeContractID, event model.ContractEventKind) (WriteIntent, *Refusal)
- func NewDisclosureIntent(scope model.ContentIdentity) (WriteIntent, *Refusal)
- func NewEnvelopeDefinitionActivationIntent(kind model.DefinitionKind, content model.ContentIdentity) (WriteIntent, *Refusal)
- func NewLineageIntent(harness ir.HarnessID, links int) (WriteIntent, *Refusal)
- type Refusal
- type RefusalReason
- type Warrant
- type WriteClass
- type WriteIntent
Constants ¶
const MaxLinksPerOperation = 64
MaxLinksPerOperation bounds the number of committed occurrence links a single lineage-links operation may carry. It is the closed cap the lineage write class validates against; a derivation producing more edges must narrow its scope rather than commit an unbounded operation.
Variables ¶
This section is empty.
Functions ¶
func Legalize ¶
func Legalize(intent WriteIntent) (Warrant, *Refusal)
Legalize is the SOLE issuer of Warrants. At M5 policy is pure and static: every well-formed intent of an enumerated class is legal, so Legalize refuses only the zero-value / unenumerated intent with RefusalUnknownClass. There is no env, config, or runtime policy input — a gate with a second policy source would be a different, unratified design.
func NewDefinitionActivationIntent ¶
func NewDefinitionActivationIntent(content model.ContentIdentity) (WriteIntent, *Refusal)
NewDefinitionActivationIntent constructs a definition-activation write intent. It takes the metamodel's content identity — the value that identifies WHAT is being journaled — rather than the full model.LifecycleMetamodelManifest, because the gate only needs a well-formed content identity to judge legality and because model.LifecycleMetamodelManifest is introduced by a later wave; the coordinate's version and id travel with the definition write itself, not the gate.
func NewDeliveryIntent ¶
func NewDeliveryIntent(contract ir.RuntimeContractID, event model.ContractEventKind) (WriteIntent, *Refusal)
NewDeliveryIntent constructs a delivery-receipt write intent. It validates the host coordinates (a real runtime contract and a nonzero event kind) and then retains only the write class — the gate never sees, and cannot act on, which host or delivery produced the write.
func NewDisclosureIntent ¶
func NewDisclosureIntent(scope model.ContentIdentity) (WriteIntent, *Refusal)
NewDisclosureIntent constructs a disclosure write intent. It validates the projection scope digest that fingerprints the disclosed content; the plan, attempt, and result facts travel with the disclosure write itself.
func NewEnvelopeDefinitionActivationIntent ¶ added in v0.0.21
func NewEnvelopeDefinitionActivationIntent(kind model.DefinitionKind, content model.ContentIdentity) (WriteIntent, *Refusal)
NewEnvelopeDefinitionActivationIntent admits only the five typed document owners; coordinates are validated and discarded, preserving origin blindness.
func NewLineageIntent ¶
func NewLineageIntent(harness ir.HarnessID, links int) (WriteIntent, *Refusal)
NewLineageIntent constructs a lineage-links write intent. It validates the host and the bounded edge count (1..MaxLinksPerOperation); an over-cap derivation is refused so the operator narrows the scope rather than committing an unbounded operation.
Types ¶
type Refusal ¶
type Refusal struct {
// contains filtered or unexported fields
}
Refusal is the distinct typed disposition of a refused Pasture-side durable lifecycle write. It is the gate's analogue of the activation gate's withheld diagnostic: a first-class, actionable value rather than a bare error string.
Refusal implements error, so it flows on the existing (native []byte, err error) lifecycle path where the CLI prints it to stderr, emits no stdout, and exits 0. It is deliberately NOT a *pasterrors.StructuredError: it never carries a Category and so can never be mapped to exit code 2 (which pasterrors.ExitCode reserves for CategoryConnection). Callers discriminate a refusal with errors.As(&*gate.Refusal), never by string or exit-code matching.
func Authorize ¶
func Authorize(warrant Warrant, expected WriteClass) *Refusal
Authorize is the commit-surface check every durable lifecycle write performs before touching the store. It returns nil when warrant admits a write of the expected class; otherwise a typed *Refusal — RefusalInvalidIntent for a zero/unissued warrant (an ungated write) and RefusalClassMismatch for a warrant issued for a different class (a misrouted write). Because it runs before any I/O, a refused write never writes a blob or appends an operation.
func (*Refusal) Class ¶
func (r *Refusal) Class() WriteClass
Class returns the write class the refusal concerns.
func (*Refusal) Error ¶
Error implements error with a single actionable line describing what went wrong, why, where, its impact, and how to fix it.
func (*Refusal) Reason ¶
func (r *Refusal) Reason() RefusalReason
Reason returns the closed-set reason the write was refused.
type RefusalReason ¶
type RefusalReason uint8
RefusalReason is the closed set of reasons a durable lifecycle write is refused by the gate.
const ( // RefusalUnknownClass: the intent or expected class is not one of the // enumerated WriteClass values (typically the zero value). RefusalUnknownClass RefusalReason = iota + 1 // RefusalInvalidIntent: an intent's per-class coordinates are not // well-formed, or a commit surface received a zero/unissued warrant. RefusalInvalidIntent // RefusalClassMismatch: a warrant's class does not match the write class // at the commit surface that received it. RefusalClassMismatch )
func (RefusalReason) String ¶
func (r RefusalReason) String() string
String returns the stable spelling of the refusal reason.
type Warrant ¶
type Warrant struct {
// contains filtered or unexported fields
}
Warrant is the constructor-owned proof that a durable lifecycle write of a given class has been legalized. Only Legalize produces a valid Warrant; the zero value is invalid and every commit surface refuses it, so a write cannot present a warrant it did not obtain from the gate.
func (Warrant) Class ¶
func (w Warrant) Class() WriteClass
Class returns the write class this warrant admits.
type WriteClass ¶
type WriteClass uint8
WriteClass is the closed set of Pasture-side durable lifecycle write classes.
Adding a class is a reviewed enum extension — the deliberate chokepoint that replaced the M1 static no-write proof with a normative gated path. Every durable lifecycle write is exactly one of these classes.
const ( // WriteDeliveryReceipt is the existing host-evidence delivery write: one // occurrence receipt (plus its interpreted and optional consultation // evidence) per host delivery, produced by receipt.Service.Receive. WriteDeliveryReceipt WriteClass = iota + 1 // WriteDefinitionActivation is the lazy, idempotent metamodel definition // journal write (definition snapshot + activation state). WriteDefinitionActivation // WriteLineageLinks is the read-side materialization of committed // occurrence predecessor links (1..MaxLinksPerOperation edges). WriteLineageLinks // WriteDisclosure is the context-disclosure write (plan + attempt + result // facts) committed as one operation before the projection is printed. WriteDisclosure )
func ParseWriteClass ¶ added in v0.0.21
func ParseWriteClass(token string) (WriteClass, bool)
ParseWriteClass converts the stable lowercase spelling back to its write class. It reports false for anything String never emits, so a descriptor that names a non-admitted class fails against the live gate set rather than against a copied literal.
func (WriteClass) IsValid ¶
func (c WriteClass) IsValid() bool
IsValid reports whether c is one of the enumerated write classes. The zero value is deliberately invalid so an unset class can never be legalized.
func (WriteClass) String ¶
func (c WriteClass) String() string
String returns the stable lowercase spelling of the write class, used in actionable refusal messages. Unknown classes render their numeric form so a diagnostic never silently drops an out-of-range value.
type WriteIntent ¶
type WriteIntent struct {
// contains filtered or unexported fields
}
WriteIntent is the constructor-validated description of a pending durable lifecycle write. It carries ONLY its write class: each constructor enforces per-class well-formedness at construction and then discards the coordinates, so the intent that reaches Legalize is an opaque class token that retains nothing capable of encoding capture origin (see the package doc's M4-seam note and the writeIntentShape lock below).
The zero value has an invalid class and cannot be legalized.
func (WriteIntent) Class ¶
func (i WriteIntent) Class() WriteClass
Class returns the write class this intent describes.
Source Files