Documentation
¶
Index ¶
- Constants
- Variables
- func Activate(ctx context.Context, queries dbstore.Queries, fence Fence) error
- func ActivateWithOptions(ctx context.Context, queries dbstore.Queries, fence Fence, ...) error
- func InResetTransaction(ctx context.Context, queries dbstore.Queries, botID string, sessionID string, ...) error
- func InTransaction(ctx context.Context, queries dbstore.Queries, botID string, sessionID string, ...) error
- func Lock(ctx context.Context, queries dbstore.Queries, botID, sessionID string) error
- func LockBotForSessionWrite(ctx context.Context, queries dbstore.Queries, botID string) error
- func NormalizeResetError(ctx context.Context, err error) error
- func PublishBotRuntimeConfig(ctx context.Context, queries dbstore.Queries, botID string, ...) (publishErr error, guardErr error)
- func ResetLeaseFailure(ctx context.Context, err error) error
- func ValidateResetLocked(ctx context.Context, queries dbstore.Queries, botID, sessionID string) error
- func ValidateScope(ctx context.Context, botID, sessionID string) error
- func WithContext(ctx context.Context, fence Fence) context.Context
- func WithResetContext(ctx context.Context, fence ResetFence) context.Context
- type ActivationOptions
- type Activator
- type Fence
- type PreservedDecision
- type ResetFence
- type WaitingDecisionReclaim
Constants ¶
const ( DecisionToolApproval = "tool_approval" DecisionUserInput = "user_input" )
Variables ¶
Functions ¶
func Activate ¶
Activate is the persistence ownership cutover. Redis may already reserve the successor as admitting, but a writer holding the previous token still linearizes before this transaction if it acquired the session lock first. Once activation commits, the previous token can never write again. Cleanup uses later statements in the same transaction so it sees rows committed by a writer that activation had to wait for.
func ActivateWithOptions ¶
func InResetTransaction ¶
func InResetTransaction( ctx context.Context, queries dbstore.Queries, botID string, sessionID string, fn func(dbstore.Queries) error, ) error
InResetTransaction validates a tokenized reset lease under the bot parent lock and runs fn in that same real PostgreSQL transaction. Contexts without a reset fence retain the ordinary direct path for non-reset callers.
func InTransaction ¶
func InTransaction( ctx context.Context, queries dbstore.Queries, botID string, sessionID string, fn func(dbstore.Queries) error, ) error
InTransaction locks and validates the durable token in the same real PostgreSQL transaction as fn. Redis admission reserves control ownership; token activation is the linearization point for persistence ownership.
func Lock ¶
Lock validates the current fence and serializes writers on the session row until the caller's transaction ends. A successor cannot activate its token until that write commits, and an older token cannot write after activation.
func LockBotForSessionWrite ¶
LockBotForSessionWrite establishes parent-before-child lock ordering before a transaction locks a session and writes rows that reference its bot.
func NormalizeResetError ¶
NormalizeResetError preserves the stable lease-loss identity when context cancellation wins a race with a database call and the driver reports only context.Canceled or context.DeadlineExceeded.
func PublishBotRuntimeConfig ¶
func PublishBotRuntimeConfig( ctx context.Context, queries dbstore.Queries, botID string, publishTimeout time.Duration, publish func(context.Context) error, ) (publishErr error, guardErr error)
PublishBotRuntimeConfig serializes a bot-scoped external runtime-config write against reset successors and stale ACP processes.
The epoch invalidation is intentionally committed in a short first transaction before any external side effect. A second transaction then holds the bot parent lock while publish runs. This two-phase order makes a partial workspace write safe even if the process crashes or the long transaction later rolls back: every process bound to the old epoch was already made permanently stale. The second transaction refreshes the exact reset token before committing, even when publish reports an error.
publishErr is the external callback result. guardErr means the reset/epoch boundary itself did not complete and must not be downgraded to a warning.
func ResetLeaseFailure ¶
ResetLeaseFailure reports whether a fenced mutation failed because its reset lease was lost, folding in the cause carried by the owner context (the renewer cancels the context, so the direct error may only say "context canceled"). It returns the error to surface, or nil when the failure is unrelated to the lease. Handlers use this instead of repeating the context.Cause / errors.Is dance at every call site.
func ValidateResetLocked ¶
func ValidateResetLocked(ctx context.Context, queries dbstore.Queries, botID, sessionID string) error
ValidateResetLocked checks the reset token using a fresh statement while the caller's transaction already holds the bot parent lock.
func ValidateScope ¶
ValidateScope rejects a durable write that does not belong to the session represented by the context fence. Unfenced contexts remain unchanged.
func WithResetContext ¶
func WithResetContext(ctx context.Context, fence ResetFence) context.Context
Types ¶
type ActivationOptions ¶
type ActivationOptions struct {
// PreserveDecisions carries every decision the reclaiming owner keeps
// alive; a turn can park on several approvals and user inputs at once,
// and any pending decision not listed here is superseded.
PreserveDecisions []PreservedDecision
ReclaimWaitingDecision *WaitingDecisionReclaim
}
type Activator ¶
type Activator struct {
// contains filtered or unexported fields
}
Activator binds Activate to one persistence store so a caller can hand persistence ownership to a run without holding a database handle itself.
The session runtime owns the decision of when a token takes over; it must not also own a connection to the store that records it. Keeping the binding here is what lets the runtime declare the capability as an interface over (bot, session, token) and stay free of dbstore.
func NewActivator ¶
func (*Activator) Activate ¶
Activate promotes token to the session's persistence fence. Callers must have won the durable ownership claim first: activating a token whose run does not own the session would fence out the owner that legitimately holds an older one.
func (*Activator) ReclaimWaitingDecision ¶
type Fence ¶
Fence identifies the PostgreSQL generation allowed to persist one runtime run. A newer run increments Token and permanently invalidates older fences.
type PreservedDecision ¶
type ResetFence ¶
type ResetFence struct {
Scope string
BotID string
SessionID string
Token string
LeaseTTL time.Duration
}
func ResetFromContext ¶
func ResetFromContext(ctx context.Context) (ResetFence, bool)
func (ResetFence) Valid ¶
func (f ResetFence) Valid() bool
Source Files