taskoutcome

type Outcome string

type Record struct {
	V            int     `json:"v"`
	Outcome      Outcome `json:"outcome"`
	ExitCode     *int32  `json:"exit_code,omitempty"`
	RescheduleAt string  `json:"reschedule_at,omitempty"`
	// Reason is a short, human-readable classification of a failure the agent
	// observed before it could report anything — the pre-registration blind spot
	// where the control plane sees only a dead pod. It is optional and additive:
	// a reader that does not know the field still decodes the record as a plain
	// failure, and a writer that never sets it produces today's bytes exactly.
	//
	// It carries a CLASSIFICATION, never a raw error. The agent maps the failure
	// either to one of a closed set of operator-facing constants (the bootstrap
	// and environment-build classifiers in internal/agent) or to a fixed template
	// whose only variable is the timeout the task itself declared; a failure its
	// classifiers recognize nothing in records NO reason at all rather than
	// falling back to the error's text. So nothing derived from a credential or an
	// internal error path can reach this durable, end-user-visible field. A reader
	// still bounds it: the record can also arrive from a task that wrote its own
	// termination message.
	//
	// A reader serves it as the platform's own failure reason only when Author
	// says the agent wrote it (see AgentAuthored, #948).
	Reason string `json:"reason,omitempty"`
	// Author marks a record whose Reason the agent classified. The agent's
	// reason constructors (FailedBecause, FailedBecauseWith) stamp AuthorAgent;
	// a record without it (a task that wrote its own termination message, or an
	// agent that predates the field) still settles its outcome, but a reader
	// does not present its Reason as platform-authored.
	//
	// It is a declaration of authorship, NOT an authentication: the task runs as
	// a child of the agent in the same container and uid, so it can write this
	// field too, and no key the agent holds is out of the task's reach (ADR 0052,
	// "The trust caveat"). What it does is make authorship explicit, so a reason
	// that does not claim the agent as its author is never vouched for, and so a
	// later authenticated marker has a slot to replace. It is optional and
	// additive like AttemptEpoch: v stays 1, and only a record that carries a
	// reason carries it, so every other record keeps today's bytes.
	Author string `json:"author,omitempty"`
	// AttemptEpoch names the execution of the try that wrote the record (ADR
	// 0052 amendment), as the task spec gave it to the agent. It is optional
	// and additive like Reason: v stays 1, an old reader ignores it, and a
	// record without it (an older agent, or epoch 0) is read against the pod's
	// label alone. A reader that finds an epoch different from the pod's label
	// treats the record as absent.
	AttemptEpoch *int64 `json:"attempt_epoch,omitempty"`
	// Infra marks a failure the agent saw before the task's code ran because
	// the control plane did not answer: ADR 0051's Unexecutable, the substrate
	// could not run the task (#1594). Only UnexecutableBecause sets it, always
	// with an agent-authored reason and never with an exit code. It is optional
	// and additive like AttemptEpoch: v stays 1, every other record keeps
	// today's bytes, and a reader that does not know the field settles the
	// record as a plain failure.
	//
	// Like Author it is a declaration, not an authentication: the task can write
	// this file too. What a forged marker buys is a re-place on the bounded
	// infra budget, which the task can already get by killing its agent, so the
	// reader honors it only with the bounds the reconciler checks (an
	// agent-authored reason and no exit code).
	Infra bool `json:"infra,omitempty"`
}