Documentation
¶
Overview ¶
Package gateauthority carries the value types the gate decision reads: who holds which task episode, in which phase, under which session claim.
It sits at the bottom of the import graph on purpose. It imports task identifiers, the harness id and the runtime vocabulary, and nothing of pasture's task store. The task store imports THIS package and implements Reader; the edge points that way and never back, which is what keeps the decision types free of the store.
Every enum here has an Unset zero value that is INVALID, so a value nobody set cannot be mistaken for a real one.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var PhaseActionTable map[TaskPhase]map[ActionClass]Verdict
PhaseActionTable is the exhaustive phase grid: every phase, every action class.
var RoleActionTable map[AssignmentRole]map[ActionClass]Verdict
RoleActionTable is the exhaustive role grid: every role, every action class.
Functions ¶
This section is empty.
Types ¶
type ActionClass ¶
type ActionClass uint8
ActionClass is the closed set of action kinds a gate decides about. It is the harness-independent class of what the agent is about to do, so one legality rule covers every host that can express the action.
const ( // ActionUnset is the invalid zero. A gate that reads it has been handed a // value nobody set. ActionUnset ActionClass = iota ActionToolUse ActionPromptSubmit ActionStop ActionSubagent ActionWorktree ActionCompact ActionConfigChange ActionTaskLifecycle ActionPermission ActionPostHoc // ActionObservation is a pure observation: the host is telling pasture that // something happened, not asking whether it may happen. // // An observation that REPORTS A COMPLETED ACTION of a named class takes this // arm too, not the class of the action it reports. The reason is the // decision order: an observation exits on its semantic before its class is // ever read, so giving it the named class would put a value into the tables // that nothing can reach, and would read as a rule when it is not one. A // post-hoc GATE, which the host does ask, keeps ActionPostHoc. ActionObservation )
func ActionClasses ¶
func ActionClasses() []ActionClass
ActionClasses returns every valid arm in ordinal order. It is derived from the sentinel, so an arm added above appears here with no other edit.
func ClassForEvent ¶
func ClassForEvent(harness ir.HarnessID, nativeName string) (ActionClass, bool)
ClassForEvent returns the action class of one registered native event. ok is false for an event this build does not register, so a name that arrived from outside the manifests is refused rather than read as some class.
func (ActionClass) IsValid ¶
func (a ActionClass) IsValid() bool
IsValid reports whether the class is a real arm and not the unset zero.
func (ActionClass) String ¶
func (a ActionClass) String() string
String renders the class as its canonical token, or as a named invalid value.
type ActorAuthority ¶
type ActorAuthority struct {
Actor provenance.ActorID
Episodes []Episode
}
ActorAuthority is every started episode one actor holds at the snapshot instant.
type AssignmentRole ¶
type AssignmentRole uint8
AssignmentRole is the slot an episode's occupant holds. It mirrors the task store's role vocabulary through the canonical payload token, which is what the store writes into the material event, so neither package imports the other.
const ( // RoleUnset is the invalid zero. RoleUnset AssignmentRole = iota RoleOwnerResponsibility RoleGoverningSupervisor RoleAxisReviewer )
func AssignmentRoles ¶
func AssignmentRoles() []AssignmentRole
AssignmentRoles returns every valid arm in ordinal order, derived from the sentinel.
func RoleFromToken ¶
func RoleFromToken(token string) (AssignmentRole, bool)
RoleFromToken maps the canonical payload token the task store writes into an assignment-start event to this package's role. ok is false for a token this build does not know, so a role written by a newer binary is refused rather than read as the wrong slot.
This function IS the bridge between the two role enums. It exists so the mirror stays checkable without an import in either direction.
func (AssignmentRole) IsValid ¶
func (r AssignmentRole) IsValid() bool
IsValid reports whether the role is a real arm and not the unset zero.
func (AssignmentRole) String ¶
func (r AssignmentRole) String() string
String renders the role as its canonical payload token, or as a named invalid value.
type CellReachability ¶
type CellReachability struct {
Table TableName
Role AssignmentRole
Phase TaskPhase
Action ActionClass
Harnesses []HarnessReach
Reachable bool
}
CellReachability is the published reachability entry of one denied cell.
Reachable is REGISTERED reachability: some harness registers an event of the cell's action class, that event can block, and it is not short-circuited by the observation rule or by the stop-loop guard. It does NOT say the event is enabled today; that is stated beside it in the report, and is checked by the test rather than read here.
func DeniedCellReachability ¶
func DeniedCellReachability() []CellReachability
DeniedCellReachability returns the published reachability entry of every denied cell of both tables, in a stable order. It is derived from the registration manifests and the tables themselves, so a new denial or a new host event changes it with no edit here.
type Episode ¶
type Episode struct {
Assignment provenance.AssignmentID
Task provenance.TaskID
Role AssignmentRole
Phase TaskPhase
}
Episode is one started assignment episode: who holds what, in which slot, on a task in which phase.
type HarnessReach ¶
HarnessReach is the registered reachability of one denied cell on one harness: the native events that can carry that class of action to a gate. An empty Events list means the harness cannot reach the cell.
type SessionClaim ¶
type SessionClaim struct {
Bound bool
Actor provenance.ActorID
Session string
Known bool
}
SessionClaim is what a harness session is bound to. Bound false means the session was never claimed, which is not an error: the gate proceeds and records that the session was unbound. Known reports whether the harness session id itself was recognised.
type Snapshot ¶
type Snapshot interface {
ResolveSession(harness ir.HarnessID, session string) (SessionClaim, error)
Authority(actor provenance.ActorID) (ActorAuthority, error)
Close() error
}
Snapshot is one consistent view of the gate facts.
type TableName ¶
type TableName uint8
TableName says which of the two legality tables a cell belongs to.
type TaskPhase ¶
type TaskPhase uint8
TaskPhase is the phase of the task an episode governs. It mirrors the task store's phase vocabulary, offset by one so the zero value can be invalid: the store's own phase enum starts its first arm at zero.
func PhaseFromProvenance ¶
func PhaseFromProvenance(p provenance.Phase) (TaskPhase, bool)
PhaseFromProvenance maps one task-store phase to its gate phase. ok is false for a value outside the store's own valid range, so a phase read from a record written by a newer binary is refused instead of silently renamed.
The mapping is the ordinal plus one, because the store's first arm is zero and this enum keeps zero for Unset. It is written as arithmetic, not as a table, so a phase added to the store needs one arm here and nothing else.
func TaskPhases ¶
func TaskPhases() []TaskPhase
TaskPhases returns every valid arm in ordinal order, derived from the sentinel.
type Verdict ¶
type Verdict uint8
Verdict is what a table says about one (role or phase, action) pair.
const ( // VerdictUnset is the invalid zero. A caller that reads it has a value // nobody set, which is not the same as a missing cell. VerdictUnset Verdict = iota // VerdictAllow lets the action through. VerdictAllow // VerdictDeny stops the action. It is a policy answer and it fails closed. VerdictDeny // VerdictRefuse means the tables could not answer. It is a FAULT answer and // it fails open: the action is not judged and it is not stopped. VerdictRefuse )
func PhaseVerdict ¶
func PhaseVerdict(phase TaskPhase, action ActionClass) Verdict
PhaseVerdict answers what the phase table says, with the same refusal rule.
func RoleVerdict ¶
func RoleVerdict(role AssignmentRole, action ActionClass) Verdict
RoleVerdict answers what the role table says. A pair with no cell REFUSES: a gap between the tables and the enums is a fault in pasture, and a fault never denies the user's action.
func Verdicts ¶
func Verdicts() []Verdict
Verdicts returns every valid arm in ordinal order, derived from the sentinel.
Source Files