review

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 29, 2026 License: MIT Imports: 17 Imported by: 0

Documentation

Overview

Package review coordinates one deterministic, in-memory review run.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ReduceVerifiedFindingEvidence 

func ReduceVerifiedFindingEvidence(
	findings []domain.Finding,
	groups []VerifiedFindingEvidence,
	policy EvidencePolicy,
) ([]domain.Finding, error)

ReduceVerifiedFindingEvidence proves each finding's exact unverified validation prestate has one nonempty verifier-owned receipt group with the same validation claim set, then projects receipt outcomes into immutable finding evidence states.

Types

type Assignment 

type Assignment struct {
	// contains filtered or unexported fields
}

Assignment is a trusted, immutable role selection. Required is always true for the logic required floor, independent of the supplied flag.

func NewAssignment 

func NewAssignment(role domain.Role, required bool, providerInstance string) (Assignment, error)

NewAssignment constructs a legacy trusted role assignment without fallback authority. All legacy assignments share the fixed legacy concurrency lane.

func NewScheduledAssignment 

func NewScheduledAssignment(
	role domain.Role,
	required bool,
	primary ports.ProviderRoute,
	fallback *ports.ProviderRoute,
) (Assignment, error)

NewScheduledAssignment constructs one trusted role assignment with a primary route and an optional fallback route on a distinct concurrency lane.

func (Assignment) FallbackRoute 

func (assignment Assignment) FallbackRoute() (ports.ProviderRoute, bool)

FallbackRoute returns a caller-owned fallback route when configured.

func (Assignment) HasFallback 

func (assignment Assignment) HasFallback() bool

HasFallback reports whether the assignment has a configured fallback route.

func (Assignment) PrimaryRoute 

func (assignment Assignment) PrimaryRoute() ports.ProviderRoute

PrimaryRoute returns the trusted primary provider route.

func (Assignment) ProviderInstance 

func (assignment Assignment) ProviderInstance() string

ProviderInstance returns the trusted primary provider instance selected for the role.

func (Assignment) Required 

func (assignment Assignment) Required() bool

Required reports whether the role is part of this run's required coverage.

func (Assignment) Role 

func (assignment Assignment) Role() domain.Role

Role returns the coordinator-selected role.

type AttemptCapture 

type AttemptCapture struct {
	// contains filtered or unexported fields
}

AttemptCapture binds defensive captured provider streams to one coordinator attempt and invocation sequence. Artifacts with SecurityRejected set never expose their rejected bytes.

func (AttemptCapture) Artifacts 

func (capture AttemptCapture) Artifacts() []ports.CapturedAttemptArtifact

func (AttemptCapture) AttemptID 

func (capture AttemptCapture) AttemptID() domain.AttemptID

func (AttemptCapture) Sequence 

func (capture AttemptCapture) Sequence() uint64

type AttemptCondition 

type AttemptCondition string

AttemptCondition is the closed coordinator input classification for a completed review attempt. Workers and adapters report facts; only the coordinator turns those facts into a transition decision. 

const (
	AttemptConditionValidReview                AttemptCondition = "valid_review"
	AttemptConditionInvalidProviderOutput      AttemptCondition = "invalid_provider_output"
	AttemptConditionUnrepairableProviderOutput AttemptCondition = "unrepairable_provider_output"
	AttemptConditionInvalidEvidenceClaim       AttemptCondition = "invalid_evidence_claim"
	AttemptConditionUnrepairableEvidence       AttemptCondition = "unrepairable_evidence_claim"
	AttemptConditionSemanticContradiction      AttemptCondition = "semantic_contradiction"
	AttemptConditionProviderUnavailable        AttemptCondition = "provider_unavailable"
	AttemptConditionTimeout                    AttemptCondition = "timeout"
	AttemptConditionAuthentication             AttemptCondition = "auth"
	AttemptConditionLoginRequired              AttemptCondition = "login_required"
	AttemptConditionQuota                      AttemptCondition = "quota"
	AttemptConditionRateLimit                  AttemptCondition = "rate_limit"
	AttemptConditionSecurityViolation          AttemptCondition = "security_violation"
	AttemptConditionMutationViolation          AttemptCondition = "mutation_violation"
	AttemptConditionConfigurationViolation     AttemptCondition = "configuration_violation"
	AttemptConditionArtifactFailure            AttemptCondition = "artifact_failure"
	AttemptConditionCancelled                  AttemptCondition = "cancelled"
	AttemptConditionInternalInvariant          AttemptCondition = "internal_invariant"
)

func AttemptConditions 

func AttemptConditions() []AttemptCondition

AttemptConditions returns the complete closed condition set in policy order. The returned slice is caller-owned.

func ReduceAttemptConditions 

func ReduceAttemptConditions(conditions ...AttemptCondition) (AttemptCondition, error)

ReduceAttemptConditions returns the highest-precedence condition from the closed policy set. Equal-precedence conditions retain their earliest input order so the originating reason remains stable.

func (AttemptCondition) Valid 

func (condition AttemptCondition) Valid() bool

Valid reports whether condition is part of the closed coordinator policy.

func (AttemptCondition) Validate 

func (condition AttemptCondition) Validate() error

Validate rejects any condition outside the closed coordinator policy.

type AttemptKind 

type AttemptKind string

AttemptKind identifies whether an attempt uses the role's primary or fallback provider route. 

const (
	AttemptKindPrimary  AttemptKind = "primary"
	AttemptKindFallback AttemptKind = "fallback"
)

func (AttemptKind) Valid 

func (kind AttemptKind) Valid() bool

Valid reports whether kind is a coordinator-defined attempt kind.

type AttemptOutcome 

type AttemptOutcome struct {
	// contains filtered or unexported fields
}

AttemptOutcome is one immutable provider-runtime response for one invocation job. It contains either validated role content or one closed failure condition, never both.

func NewAttemptOutcome 

func NewAttemptOutcome(
	job InvocationJob,
	output *ValidatedRoleOutput,
	condition *AttemptCondition,
) (AttemptOutcome, error)

NewAttemptOutcome constructs a success with output or a failure with a closed condition. Successful outputs must retain the exact job role, provider, and target.

func (AttemptOutcome) Condition 

func (outcome AttemptOutcome) Condition() (AttemptCondition, bool)

Condition returns the closed failure condition when this outcome failed.

func (AttemptOutcome) Job 

func (outcome AttemptOutcome) Job() InvocationJob

Job returns a defensive value copy of the invocation job this outcome answers.

func (AttemptOutcome) Output 

func (outcome AttemptOutcome) Output() (ValidatedRoleOutput, bool)

Output returns a defensive copy of the validated role output on success.

func (AttemptOutcome) Succeeded 

func (outcome AttemptOutcome) Succeeded() bool

Succeeded reports whether this outcome contains validated role output.

type BudgetReasonCode 

type BudgetReasonCode string

BudgetReasonCode is the closed, safe preflight outcome code recorded in a run budget receipt. 

const (
	BudgetReasonEligible              BudgetReasonCode = "eligible"
	BudgetReasonInvalidCeilings       BudgetReasonCode = "invalid_ceilings"
	BudgetReasonInvalidRole           BudgetReasonCode = "invalid_role"
	BudgetReasonDuplicateRole         BudgetReasonCode = "duplicate_role"
	BudgetReasonInvalidPrimaryRoute   BudgetReasonCode = "invalid_primary_route"
	BudgetReasonInvalidFallbackRoute  BudgetReasonCode = "invalid_fallback_route"
	BudgetReasonDuplicateRoleRoute    BudgetReasonCode = "duplicate_role_route"
	BudgetReasonInvocationCapExceeded BudgetReasonCode = "invocation_cap_exceeded"
	BudgetReasonRoleInvocationLimit   BudgetReasonCode = "role_invocation_limit"
	BudgetReasonRunInvocationLimit    BudgetReasonCode = "run_invocation_limit"
	BudgetReasonTotalOutputLimit      BudgetReasonCode = "total_output_limit"
	BudgetReasonLaneDeadlineLimit     BudgetReasonCode = "lane_deadline_limit"
	BudgetReasonRunDeadlineLimit      BudgetReasonCode = "run_deadline_limit"
)

func (BudgetReasonCode) Valid 

func (code BudgetReasonCode) Valid() bool

Valid reports whether code is a closed preflight reason code.

type Coordinator 

type Coordinator struct {
	// contains filtered or unexported fields
}

Coordinator owns one review run's mutable domain aggregates. Provider lanes receive only immutable InvocationJobs and return immutable AttemptOutcomes.

func NewCoordinator 

func NewCoordinator(
	clock ports.Clock,
	ids CoordinatorIDIssuer,
	runtime InvocationRuntime,
	locker ports.LaneLocker,
	maxActiveLanes int,
	receipt RunBudgetReceipt,
) (*Coordinator, error)

NewCoordinator constructs a deterministic in-memory review coordinator with the default authoritative evidence policy.

func NewCoordinatorWithEvidencePolicy 

func NewCoordinatorWithEvidencePolicy(
	clock ports.Clock,
	ids CoordinatorIDIssuer,
	runtime InvocationRuntime,
	locker ports.LaneLocker,
	maxActiveLanes int,
	receipt RunBudgetReceipt,
	policy EvidencePolicy,
) (*Coordinator, error)

NewCoordinatorWithEvidencePolicy constructs a deterministic in-memory review coordinator with an immutable authoritative evidence policy.

func NewCoordinatorWithRuntimeDiagnostics 

func NewCoordinatorWithRuntimeDiagnostics(
	clock ports.Clock,
	ids CoordinatorIDIssuer,
	runtime InvocationRuntime,
	locker ports.LaneLocker,
	maxActiveLanes int,
	receipt RunBudgetReceipt,
	diagnostics ports.RuntimeDiagnosticSink,
) (*Coordinator, error)

NewCoordinatorWithRuntimeDiagnostics constructs a coordinator whose logical decisions are synchronously persisted through the already-opened run sink.

func (*Coordinator) BindRuntimeDiagnostics 

func (coordinator *Coordinator) BindRuntimeDiagnostics(sink ports.RuntimeDiagnosticSink) error

BindRuntimeDiagnostics installs an already-opened child-run sink before the coordinator starts. Root runs continue to bind through the constructor.

func (*Coordinator) Execute 

func (coordinator *Coordinator) Execute(
	ctx context.Context,
	target domain.TargetIdentity,
	assignments []Assignment,
	threshold domain.Severity,
	policy *domain.CIPolicy,
) (CoordinatorResult, error)

Execute runs every selected role. It owns all mutable Run and Attempt state in this goroutine; lane workers only execute immutable jobs. Execute runs a new root review run.

func (*Coordinator) ExecuteDeltaRun 

func (coordinator *Coordinator) ExecuteDeltaRun(
	ctx context.Context,
	run *domain.Run,
	assignments []Assignment,
	threshold domain.Severity,
	policy *domain.CIPolicy,
	material DeltaInvocationMaterial,
) (CoordinatorResult, error)

ExecuteDeltaRun executes supplied child roles with the explicit immutable A-to-B provider material. The ordinary prompt path is not available.

func (*Coordinator) ExecuteExactReplayRun 

func (coordinator *Coordinator) ExecuteExactReplayRun(
	ctx context.Context,
	run *domain.Run,
	assignment Assignment,
	threshold domain.Severity,
	policy *domain.CIPolicy,
	input ExactReplayInput,
) (CoordinatorResult, error)

ExecuteExactReplayRun executes one selected child role with its stored wire authority. It removes fallback authority and the wrapper rejects any non-initial invocation, so repair or multi-role scheduling cannot reach a provider.

func (*Coordinator) ExecuteRun 

func (coordinator *Coordinator) ExecuteRun(
	ctx context.Context,
	run *domain.Run,
	assignments []Assignment,
	threshold domain.Severity,
	policy *domain.CIPolicy,
) (CoordinatorResult, error)

ExecuteRun executes one supplied fresh pending run without replacing its run, session, or lineage identities. Root review runs have no lineage while child runs must retain both parent and source lineage.

type CoordinatorAttemptSummary 

type CoordinatorAttemptSummary struct {
	// contains filtered or unexported fields
}

CoordinatorAttemptSummary is the immutable terminal projection of one primary or fallback provider attempt.

func (CoordinatorAttemptSummary) FailureClass 

func (summary CoordinatorAttemptSummary) FailureClass() domain.FailureClass

FailureClass returns the terminal failure class, or empty on success.

func (CoordinatorAttemptSummary) ID 

func (summary CoordinatorAttemptSummary) ID() domain.AttemptID

ID returns the coordinator-issued attempt ID.

func (CoordinatorAttemptSummary) Invocations 

func (summary CoordinatorAttemptSummary) Invocations() []CoordinatorInvocationSummary

Invocations returns caller-owned immutable invocation summaries.

func (CoordinatorAttemptSummary) Kind 

func (summary CoordinatorAttemptSummary) Kind() AttemptKind

Kind returns whether this was the primary or fallback attempt.

func (CoordinatorAttemptSummary) ReasonCode 

func (summary CoordinatorAttemptSummary) ReasonCode() string

ReasonCode returns the stable terminal policy reason, or empty on success.

func (CoordinatorAttemptSummary) Route 

func (summary CoordinatorAttemptSummary) Route() ports.ProviderRoute

Route returns the selected immutable provider route.

func (CoordinatorAttemptSummary) State 

func (summary CoordinatorAttemptSummary) State() domain.AttemptState

State returns the attempt's terminal state.

type CoordinatorEventKind 

type CoordinatorEventKind string

CoordinatorEventKind is the closed, logical event vocabulary emitted by the single coordinator owner. Event order, rather than wall-clock timing, is the authoritative execution trace. 

const (
	CoordinatorEventRunStarted            CoordinatorEventKind = "run_started"
	CoordinatorEventAttemptQueued         CoordinatorEventKind = "attempt_queued"
	CoordinatorEventInvocationDispatched  CoordinatorEventKind = "invocation_dispatched"
	CoordinatorEventInvocationCommitted   CoordinatorEventKind = "invocation_committed"
	CoordinatorEventRepairQueued          CoordinatorEventKind = "repair_queued"
	CoordinatorEventFallbackQueued        CoordinatorEventKind = "fallback_queued"
	CoordinatorEventRoleTerminal          CoordinatorEventKind = "role_terminal"
	CoordinatorEventCancellationRequested CoordinatorEventKind = "cancellation_requested"
	CoordinatorEventLanesCloseAuthorized  CoordinatorEventKind = "lanes_close_authorized"
	CoordinatorEventRunTerminal           CoordinatorEventKind = "run_terminal"
)

func (CoordinatorEventKind) Valid 

func (kind CoordinatorEventKind) Valid() bool

Valid reports whether kind is a coordinator-defined logical event kind.

type CoordinatorIDIssuer 

type CoordinatorIDIssuer interface {
	NewSessionID(time.Time) (domain.SessionID, error)
	NewRunID(time.Time) (domain.RunID, error)
	NewAttemptID(time.Time) (domain.AttemptID, error)
}

CoordinatorIDIssuer is the narrow identity dependency required by a review coordinator. It intentionally excludes prompt and publication identities.

type CoordinatorIdentityIssuer 

type CoordinatorIdentityIssuer = CoordinatorIDIssuer

CoordinatorIdentityIssuer is an explicit alias for CoordinatorIDIssuer.

type CoordinatorInvocationSummary 

type CoordinatorInvocationSummary struct {
	// contains filtered or unexported fields
}

CoordinatorInvocationSummary is the immutable terminal projection of one invocation within a role attempt.

func (CoordinatorInvocationSummary) Purpose 

func (summary CoordinatorInvocationSummary) Purpose() domain.InvocationPurpose

Purpose returns whether this invocation was initial or repair work.

func (CoordinatorInvocationSummary) Sequence 

func (summary CoordinatorInvocationSummary) Sequence() uint64

Sequence returns the attempt-local invocation sequence.

func (CoordinatorInvocationSummary) State 

func (summary CoordinatorInvocationSummary) State() domain.InvocationState

State returns the invocation's terminal state.

type CoordinatorResult 

type CoordinatorResult struct {
	// contains filtered or unexported fields
}

CoordinatorResult is the immutable terminal snapshot of one coordinator run. It contains neither domain aggregates nor publication authority.

func (CoordinatorResult) Evidence 

func (result CoordinatorResult) Evidence() []VerifiedFindingEvidence

Evidence returns defensive verifier receipt-group copies in final finding order.

func (CoordinatorResult) FallbackScheduled 

func (result CoordinatorResult) FallbackScheduled() bool

FallbackScheduled reports whether any role entered its configured fallback.

func (CoordinatorResult) Findings 

func (result CoordinatorResult) Findings() []domain.Finding

Findings returns caller-owned deterministically ordered findings.

func (CoordinatorResult) OutcomeAxes 

func (result CoordinatorResult) OutcomeAxes() domain.OutcomeAxes

OutcomeAxes is an explicit alias for Outcomes.

func (CoordinatorResult) Outcomes 

func (result CoordinatorResult) Outcomes() domain.OutcomeAxes

Outcomes returns the four system-owned outcome axes.

func (CoordinatorResult) RoleSummaries 

func (result CoordinatorResult) RoleSummaries() []CoordinatorRoleSummary

RoleSummaries returns caller-owned immutable role projections in fixed role order.

func (CoordinatorResult) Roles 

func (result CoordinatorResult) Roles() []CoordinatorRoleSummary

Roles is an explicit alias for RoleSummaries.

func (CoordinatorResult) RunID 

func (result CoordinatorResult) RunID() domain.RunID

RunID returns the immutable review-run identity.

func (CoordinatorResult) RunState 

func (result CoordinatorResult) RunState() domain.RunState

RunState returns the terminal review-run state.

func (CoordinatorResult) SessionID 

func (result CoordinatorResult) SessionID() domain.SessionID

SessionID returns the immutable review-session identity.

func (CoordinatorResult) Trace 

func (result CoordinatorResult) Trace() []CoordinatorTraceEvent

Trace returns caller-owned logical trace events in canonical ordinal order.

func (CoordinatorResult) TraceEvents 

func (result CoordinatorResult) TraceEvents() []CoordinatorTraceEvent

TraceEvents is an explicit alias for Trace.

type CoordinatorRoleSummary 

type CoordinatorRoleSummary struct {
	// contains filtered or unexported fields
}

CoordinatorRoleSummary is the immutable terminal projection of one selected role. ReasonCode retains security and mutation terminal reasons even though those roles end in the cancelled state.

func (CoordinatorRoleSummary) Attempts 

func (summary CoordinatorRoleSummary) Attempts() []CoordinatorAttemptSummary

Attempts returns caller-owned attempt summaries in creation order.

func (CoordinatorRoleSummary) Degraded 

func (summary CoordinatorRoleSummary) Degraded() bool

Degraded reports whether accepted role output declared incomplete coverage.

func (CoordinatorRoleSummary) FailureClass 

func (summary CoordinatorRoleSummary) FailureClass() domain.FailureClass

FailureClass returns the terminal failure class, or empty on success.

func (CoordinatorRoleSummary) FallbackScheduled 

func (summary CoordinatorRoleSummary) FallbackScheduled() bool

FallbackScheduled reports whether this role used its configured fallback.

func (CoordinatorRoleSummary) ReasonCode 

func (summary CoordinatorRoleSummary) ReasonCode() string

ReasonCode returns the stable terminal policy reason, or empty on success.

func (CoordinatorRoleSummary) Repaired 

func (summary CoordinatorRoleSummary) Repaired() bool

Repaired reports whether a repair invocation produced accepted output.

func (CoordinatorRoleSummary) Required 

func (summary CoordinatorRoleSummary) Required() bool

Required reports whether the selected role was required for this run.

func (CoordinatorRoleSummary) Role 

func (summary CoordinatorRoleSummary) Role() domain.Role

Role returns the selected role.

func (CoordinatorRoleSummary) State 

func (summary CoordinatorRoleSummary) State() domain.RoleTaskState

State returns the role's terminal domain state.

func (CoordinatorRoleSummary) Valid 

func (summary CoordinatorRoleSummary) Valid() bool

Valid reports whether validated provider output was accepted for this role.

type CoordinatorTraceEvent 

type CoordinatorTraceEvent struct {
	// contains filtered or unexported fields
}

CoordinatorTraceEvent is one immutable, canonical coordinator decision. It intentionally excludes observed timestamps because timing has no transition authority.

func (CoordinatorTraceEvent) AttemptID 

func (event CoordinatorTraceEvent) AttemptID() (domain.AttemptID, bool)

AttemptID returns the coordinator-issued attempt identity when present.

func (CoordinatorTraceEvent) AttemptKind 

func (event CoordinatorTraceEvent) AttemptKind() (AttemptKind, bool)

AttemptKind returns the primary/fallback kind when an attempt is present.

func (CoordinatorTraceEvent) Condition 

func (event CoordinatorTraceEvent) Condition() (AttemptCondition, bool)

Condition returns the committed closed attempt condition when present.

func (CoordinatorTraceEvent) Kind 

func (event CoordinatorTraceEvent) Kind() CoordinatorEventKind

Kind returns the closed logical event kind.

func (CoordinatorTraceEvent) Lane 

func (event CoordinatorTraceEvent) Lane() (ports.ConcurrencyKey, bool)

Lane returns the normalized concurrency lane when an invocation is present.

func (CoordinatorTraceEvent) Ordinal 

func (event CoordinatorTraceEvent) Ordinal() uint64

Ordinal returns the canonical event order.

func (CoordinatorTraceEvent) Purpose 

func (event CoordinatorTraceEvent) Purpose() (domain.InvocationPurpose, bool)

Purpose returns the initial/repair purpose when an invocation is present.

func (CoordinatorTraceEvent) Reason 

func (event CoordinatorTraceEvent) Reason() string

Reason returns the stable policy reason when one applies.

func (CoordinatorTraceEvent) Role 

func (event CoordinatorTraceEvent) Role() (domain.Role, bool)

Role returns the event role when the event is role-specific.

func (CoordinatorTraceEvent) RunState 

func (event CoordinatorTraceEvent) RunState() (domain.RunState, bool)

RunState returns the terminal run state for run-terminal events.

type DeltaInvocationMaterial 

type DeltaInvocationMaterial struct {
	SourceRunID           domain.RunID
	SourceTarget          []byte
	SourceTargetIdentity  domain.TargetIdentity
	CurrentTarget         []byte
	CurrentTargetIdentity domain.TargetIdentity
	Delta                 []byte
}

DeltaInvocationMaterial is the immutable A-to-B input for one delta invocation. Source and current bytes are independently bound to their identities; Delta is comparator-owned material and is never recomputed here.

type DeltaInvocationPromptSource 

type DeltaInvocationPromptSource interface {
	DeltaPrompt(context.Context, InvocationJob, DeltaInvocationMaterial, *InvocationRepairInput) (RuntimePrompt, error)
}

DeltaInvocationPromptSource composes a canonical delta-aware prompt. It is intentionally separate from Prompt so delta execution cannot fall back to a current-target-only prompt.

type EvidencePolicy 

type EvidencePolicy struct {
	// contains filtered or unexported fields
}

EvidencePolicy is an immutable minimum receipt-verification policy.

func DefaultEvidencePolicy 

func DefaultEvidencePolicy() EvidencePolicy

DefaultEvidencePolicy requires verified receipts for exactly high, critical, and blocker findings.

func NewEvidencePolicy 

func NewEvidencePolicy(required []domain.Severity) (EvidencePolicy, error)

NewEvidencePolicy canonicalizes required severities. Every policy must retain the high, critical, and blocker verification minimum.

func (EvidencePolicy) RequiredSeverities 

func (policy EvidencePolicy) RequiredSeverities() []domain.Severity

RequiredSeverities returns the canonical required severity set.

func (EvidencePolicy) Requires 

func (policy EvidencePolicy) Requires(severity domain.Severity) bool

Requires reports whether severity must have all receipts verified.

type EvidencePolicyError 

type EvidencePolicyError struct {
	// contains filtered or unexported fields
}

EvidencePolicyError rejects output whose policy-required finding lacks fully verified evidence. It identifies the finding without exposing receipt data.

func AsEvidencePolicyError 

func AsEvidencePolicyError(err error) (*EvidencePolicyError, bool)

AsEvidencePolicyError returns the typed policy error, including when wrapped.

func (*EvidencePolicyError) Error 

func (err *EvidencePolicyError) Error() string

Error implements error.

func (*EvidencePolicyError) EvidenceState 

func (err *EvidencePolicyError) EvidenceState() domain.EvidenceState

EvidenceState returns the reduced state that violated the policy.

func (*EvidencePolicyError) FindingID 

func (err *EvidencePolicyError) FindingID() string

FindingID returns the policy-rejected finding ID.

func (*EvidencePolicyError) Severity 

func (err *EvidencePolicyError) Severity() domain.Severity

Severity returns the policy-rejected finding severity.

type ExactReplayInput 

type ExactReplayInput struct {
	SourceRunID                 domain.RunID
	SourceAttemptID             domain.AttemptID
	SourceProviderInstance      string
	Stdin                       []byte
	CompleteStdinSHA256         string
	SourceInvocationID          string
	SourceExecutionInvocationID string
	TemplateID                  string
	TemplateVersion             string
	TemplateSHA256              string
	Role                        domain.Role
	AdapterProfile              string
	AdapterParameters           map[string]string
}

ExactReplayInput is the stored provider-wire authority for one selected attempt. Only ExecutionInvocationID is minted afresh by the prompt source.

type ExactReplayPromptSource 

type ExactReplayPromptSource interface {
	ExactReplayPrompt(context.Context, InvocationJob, ExactReplayInput) (RuntimePrompt, error)
}

ExactReplayPromptSource replays stored wire authority into a fresh execution identity. Implementations must preserve every ExactReplayInput field.

type HarnessCeilings 

type HarnessCeilings struct {
	// contains filtered or unexported fields
}

HarnessCeilings are trusted preflight ceilings. They can only strengthen the fixed SOT resource limits; they never authorize a larger budget.

func DefaultHarnessCeilings 

func DefaultHarnessCeilings() HarnessCeilings

DefaultHarnessCeilings returns the immutable SOT default envelope. Callers must pass it explicitly to PreflightRunBudget when these defaults are wanted.

func NewHarnessCeilings 

func NewHarnessCeilings(
	maxTimeout time.Duration,
	maxStdout, maxStderr, maxTotalOutput int64,
	maxLaneDeadline, maxRunDeadline time.Duration,
	maxInvocationsPerRole, maxInvocationsPerRun int,
) (HarnessCeilings, error)

NewHarnessCeilings validates trusted execution ceilings. The fixed SOT maxima are closed: four invocations per role, 28 per run, 64 MiB output, and a 50 minute run deadline.

func (HarnessCeilings) MaxInvocationsPerRole 

func (ceilings HarnessCeilings) MaxInvocationsPerRole() int

MaxInvocationsPerRole returns the trusted role invocation ceiling.

func (HarnessCeilings) MaxInvocationsPerRun 

func (ceilings HarnessCeilings) MaxInvocationsPerRun() int

MaxInvocationsPerRun returns the trusted run invocation ceiling.

func (HarnessCeilings) MaxLaneDeadline 

func (ceilings HarnessCeilings) MaxLaneDeadline() time.Duration

MaxLaneDeadline returns the trusted per-lane deadline ceiling.

func (HarnessCeilings) MaxRunDeadline 

func (ceilings HarnessCeilings) MaxRunDeadline() time.Duration

MaxRunDeadline returns the trusted full-run deadline ceiling.

func (HarnessCeilings) MaxStderrBytes 

func (ceilings HarnessCeilings) MaxStderrBytes() int64

MaxStderrBytes returns the trusted per-invocation stderr ceiling.

func (HarnessCeilings) MaxStdoutBytes 

func (ceilings HarnessCeilings) MaxStdoutBytes() int64

MaxStdoutBytes returns the trusted per-invocation stdout ceiling.

func (HarnessCeilings) MaxTimeout 

func (ceilings HarnessCeilings) MaxTimeout() time.Duration

MaxTimeout returns the trusted per-invocation timeout ceiling.

func (HarnessCeilings) MaxTotalOutput 

func (ceilings HarnessCeilings) MaxTotalOutput() int64

MaxTotalOutput returns the trusted aggregate stdout-plus-stderr ceiling.

func (HarnessCeilings) Valid 

func (ceilings HarnessCeilings) Valid() bool

Valid reports whether ceilings are positive and no weaker than the fixed SOT resource bounds.

type IdentityGenerator 

type IdentityGenerator interface {
	NewSessionID(time.Time) (domain.SessionID, error)
	NewRunID(time.Time) (domain.RunID, error)
	NewAttemptID(time.Time) (domain.AttemptID, error)
	NewRoleTaskID(time.Time) (string, error)
	NewSourceInvocationID(time.Time) (string, error)
	NewExecutionInvocationID(time.Time) (string, error)
}

IdentityGenerator is the consumer-owned composition used by the review coordinator. It deliberately has no sequencing, scheduling, or publication authority.

type InvocationJob 

type InvocationJob struct {
	// contains filtered or unexported fields
}

InvocationJob is the immutable, value-only work item sent from the coordinator to a provider runtime. It carries no mutable run or attempt aggregate.

func NewInvocationJob 

func NewInvocationJob(
	role domain.Role,
	attemptKind AttemptKind,
	route ports.ProviderRoute,
	target domain.TargetIdentity,
	limits InvocationLimits,
	attemptID domain.AttemptID,
	purpose domain.InvocationPurpose,
	ordinal uint64,
) (InvocationJob, error)

NewInvocationJob validates and canonicalizes a legacy direct provider invocation job. Coordinator-issued jobs must use newCoordinatorInvocationJob and always carry run coordinates.

func (InvocationJob) AttemptID 

func (job InvocationJob) AttemptID() domain.AttemptID

AttemptID returns the coordinator-issued attempt identity.

func (InvocationJob) AttemptKind 

func (job InvocationJob) AttemptKind() AttemptKind

AttemptKind returns whether this job uses the primary or fallback route.

func (InvocationJob) Limits 

func (job InvocationJob) Limits() InvocationLimits

Limits returns the exact validated runtime authority for this invocation.

func (InvocationJob) Ordinal 

func (job InvocationJob) Ordinal() uint64

Ordinal returns the stable positive coordinator dispatch ordinal.

func (InvocationJob) Purpose 

func (job InvocationJob) Purpose() domain.InvocationPurpose

Purpose returns the initial or repair invocation purpose.

func (InvocationJob) Role 

func (job InvocationJob) Role() domain.Role

Role returns the canonical coordinator-selected role.

func (InvocationJob) Route 

func (job InvocationJob) Route() ports.ProviderRoute

Route returns a reconstructed canonical provider route.

func (InvocationJob) RunID 

func (job InvocationJob) RunID() domain.RunID

RunID returns the coordinator-authorized review run identity, or zero for a legacy direct job.

func (InvocationJob) SessionID 

func (job InvocationJob) SessionID() domain.SessionID

SessionID returns the coordinator-authorized review session identity, or zero for a legacy direct job.

func (InvocationJob) Target 

func (job InvocationJob) Target() domain.TargetIdentity

Target returns a reconstructed canonical immutable target identity.

type InvocationLimits 

type InvocationLimits struct {
	// contains filtered or unexported fields
}

InvocationLimits are the immutable resource caps for every possible invocation through one provider route.

func NewInvocationLimits 

func NewInvocationLimits(timeout time.Duration, stdoutCap, stderrCap int64) (InvocationLimits, error)

NewInvocationLimits validates positive, independent invocation caps.

func (InvocationLimits) MaxStderrBytes 

func (limits InvocationLimits) MaxStderrBytes() int64

MaxStderrBytes returns the positive stderr capture cap.

func (InvocationLimits) MaxStdoutBytes 

func (limits InvocationLimits) MaxStdoutBytes() int64

MaxStdoutBytes returns the positive stdout capture cap.

func (InvocationLimits) Timeout 

func (limits InvocationLimits) Timeout() time.Duration

Timeout returns the positive invocation deadline.

func (InvocationLimits) Valid 

func (limits InvocationLimits) Valid() bool

Valid reports whether limits contain only positive invocation caps.

type InvocationPromptSource 

type InvocationPromptSource interface {
	Prompt(context.Context, InvocationJob, *InvocationRepairInput) (RuntimePrompt, error)
}

InvocationPromptSource supplies trusted prompt material keyed by the immutable coordinator job. repair is nil for initial jobs and is present only for the one coordinator-authorized repair invocation of the same attempt.

type InvocationRepairInput 

type InvocationRepairInput struct {
	// contains filtered or unexported fields
}

InvocationRepairInput is trusted state retained from a repair-eligible initial invocation. Its accessors return defensive copies.

func (InvocationRepairInput) InitialCandidate 

func (input InvocationRepairInput) InitialCandidate() []byte

func (InvocationRepairInput) Plan 

func (input InvocationRepairInput) Plan() validation.RepairPlan

type InvocationRuntime 

type InvocationRuntime interface {
	Invoke(context.Context, InvocationJob) AttemptOutcome
}

InvocationRuntime executes immutable jobs. Calls for jobs in distinct provider concurrency lanes may occur concurrently. The runtime MUST enforce job.Limits() timeout, stdout, and stderr capture caps. Both the job and outcome are value-only boundaries and must not carry mutable coordinator state.

type LaneDeadline 

type LaneDeadline struct {
	// contains filtered or unexported fields
}

LaneDeadline records the fully accumulated worst-case deadline for one normalized concurrency lane.

func (LaneDeadline) ConcurrencyKey 

func (lane LaneDeadline) ConcurrencyKey() ports.ConcurrencyKey

ConcurrencyKey returns the immutable normalized lane key.

func (LaneDeadline) Deadline 

func (lane LaneDeadline) Deadline() time.Duration

Deadline returns invocation timeouts plus two seconds per transition.

func (LaneDeadline) InvocationCount 

func (lane LaneDeadline) InvocationCount() int

InvocationCount returns the number of possible invocations assigned to lane.

func (LaneDeadline) InvocationTimeouts 

func (lane LaneDeadline) InvocationTimeouts() time.Duration

InvocationTimeouts returns the sum of all possible invocation timeouts.

func (LaneDeadline) TransitionCount 

func (lane LaneDeadline) TransitionCount() int

TransitionCount returns the number of possible repair or fallback transitions charged to lane.

type PromptWireIdentity 

type PromptWireIdentity struct {
	// contains filtered or unexported fields
}

PromptWireIdentity records the exact source and execution identities of one compiled provider packet. It contains no provider output.

func (PromptWireIdentity) CompleteStdinSHA256 

func (identity PromptWireIdentity) CompleteStdinSHA256() string

CompleteStdinSHA256 returns the exact complete-stdin wire identity.

func (PromptWireIdentity) ExecutionInvocationID 

func (identity PromptWireIdentity) ExecutionInvocationID() string

ExecutionInvocationID returns the process execution identity for the packet.

func (PromptWireIdentity) Purpose 

func (identity PromptWireIdentity) Purpose() ports.ProviderInvocationPurpose

Purpose returns whether this was an initial or repair invocation.

func (PromptWireIdentity) SourceInvocationID 

func (identity PromptWireIdentity) SourceInvocationID() string

SourceInvocationID returns the source identity framed in the packet.

func (PromptWireIdentity) StdinByteLength 

func (identity PromptWireIdentity) StdinByteLength() int

StdinByteLength returns the exact number of bytes in the provider packet.

type ProviderInvocationRuntime 

type ProviderInvocationRuntime struct {
	// contains filtered or unexported fields
}

ProviderInvocationRuntime is the real bridge from coordinator jobs to prompt, provider, validation, repair, and evidence verification. It has no scheduler, transition, fallback, or publication authority.

func NewObservedProviderInvocationRuntime 

func NewObservedProviderInvocationRuntime(provider ports.ObservedReviewProvider, source InvocationPromptSource, validator *validation.ReviewValidator, verifier *evidence.Verifier) (*ProviderInvocationRuntime, error)

NewObservedProviderInvocationRuntime constructs a runtime directly from the observation boundary. It preserves process streams as artifacts while using only the provider result's isolated stdout as the validation candidate.

func NewObservedProviderInvocationRuntimeWithDiagnostics 

func NewObservedProviderInvocationRuntimeWithDiagnostics(
	provider ports.ObservedReviewProvider,
	source InvocationPromptSource,
	validator *validation.ReviewValidator,
	verifier *evidence.Verifier,
	diagnostics RuntimeDiagnosticSinkResolver,
) (*ProviderInvocationRuntime, error)

NewObservedProviderInvocationRuntimeWithDiagnostics constructs an observed runtime that may persist separated raw streams through an already-open sink.

func NewObservedProviderInvocationRuntimeWithWorkspace 

func NewObservedProviderInvocationRuntimeWithWorkspace(provider ports.ObservedReviewProvider, source InvocationPromptSource, workspace ports.WorkspaceExecutionAuthority, validator *validation.ReviewValidator, verifier *evidence.Verifier) (*ProviderInvocationRuntime, error)

NewObservedProviderInvocationRuntimeWithWorkspace constructs an observed runtime bound to one capture-owned workspace authority for every invocation.

func NewObservedProviderInvocationRuntimeWithWorkspaceAndDiagnostics 

func NewObservedProviderInvocationRuntimeWithWorkspaceAndDiagnostics(
	provider ports.ObservedReviewProvider,
	source InvocationPromptSource,
	workspace ports.WorkspaceExecutionAuthority,
	validator *validation.ReviewValidator,
	verifier *evidence.Verifier,
	diagnostics RuntimeDiagnosticSinkResolver,
) (*ProviderInvocationRuntime, error)

NewObservedProviderInvocationRuntimeWithWorkspaceAndDiagnostics combines a capture-owned workspace with an already-opened per-run diagnostic sink.

func NewProviderInvocationRuntime 

func NewProviderInvocationRuntime(provider ports.ReviewProvider, source InvocationPromptSource, validator *validation.ReviewValidator, verifier *evidence.Verifier) (*ProviderInvocationRuntime, error)

NewProviderInvocationRuntime constructs a coordinator InvocationRuntime using the existing authoritative review validator and evidence reducer.

func (*ProviderInvocationRuntime) BindRuntimeDiagnostics 

func (runtime *ProviderInvocationRuntime) BindRuntimeDiagnostics(resolver RuntimeDiagnosticSinkResolver) error

BindRuntimeDiagnostics installs the child-run sink resolver before the runtime executes its first invocation. It is intentionally one-shot.

func (*ProviderInvocationRuntime) Capture 

func (runtime *ProviderInvocationRuntime) Capture(attemptID domain.AttemptID, sequence uint64) (AttemptCapture, bool)

Capture returns one defensive receipt by coordinator attempt and invocation sequence.

func (*ProviderInvocationRuntime) Captures 

func (runtime *ProviderInvocationRuntime) Captures() []AttemptCapture

Captures returns defensive captured artifacts in attempt then invocation order.

func (*ProviderInvocationRuntime) DrainCaptures 

func (runtime *ProviderInvocationRuntime) DrainCaptures() []AttemptCapture

DrainCaptures returns all captured artifacts and removes them from this runtime. Callers that share a runtime across runs must drain receipts after durable publication.

func (*ProviderInvocationRuntime) DrainRuntimeArtifacts 

func (runtime *ProviderInvocationRuntime) DrainRuntimeArtifacts() []RuntimeArtifactInventory

DrainRuntimeArtifacts returns source snapshots and removes them from this runtime. The snapshot is keyed by run, attempt, and invocation sequence.

func (*ProviderInvocationRuntime) DrainRuntimeArtifactsForRun 

func (runtime *ProviderInvocationRuntime) DrainRuntimeArtifactsForRun(runID domain.RunID) []RuntimeArtifactInventory

DrainRuntimeArtifactsForRun returns and removes only source snapshots owned by runID. It is safe to use when one runtime serves concurrent child runs.

func (*ProviderInvocationRuntime) Invoke 

func (runtime *ProviderInvocationRuntime) Invoke(ctx context.Context, job InvocationJob) (outcome AttemptOutcome)

Invoke executes exactly one coordinator-authorized invocation. A repair job is accepted only after this runtime retained a repair plan for its initial job.

func (*ProviderInvocationRuntime) InvokeDelta 

func (runtime *ProviderInvocationRuntime) InvokeDelta(ctx context.Context, job InvocationJob, input DeltaInvocationMaterial) AttemptOutcome

InvokeDelta executes a delta-aware invocation through the explicit delta prompt source. Initial and its one coordinator-authorized repair both retain the same immutable A-to-B material; no ordinary prompt fallback is available.

func (*ProviderInvocationRuntime) InvokeExactReplay 

func (runtime *ProviderInvocationRuntime) InvokeExactReplay(ctx context.Context, job InvocationJob, input ExactReplayInput) AttemptOutcome

InvokeExactReplay executes exactly one stored provider wire invocation using a fresh execution identity supplied by the explicit replay prompt source.

func (*ProviderInvocationRuntime) RuntimeArtifacts 

func (runtime *ProviderInvocationRuntime) RuntimeArtifacts() []RuntimeArtifactInventory

RuntimeArtifacts returns defensive source snapshots in attempt then invocation order. Provider output remains limited to the captured attempt streams.

type Request 

type Request struct {
	Target         ports.CapturedGitTarget
	Assignments    []Assignment
	Templates      TemplateSet
	ProjectContext *prompt.Payload
	Objective      string
}

Request is the complete trusted and untrusted input to one in-memory review run. Target is already captured and therefore requires no Git access here.

func NewRequest 

func NewRequest(target ports.CapturedGitTarget, assignments []Assignment, templates TemplateSet, projectContext *prompt.Payload, objective string) Request

NewRequest defensively copies the selected assignments and optional payload value. It performs semantic validation in Execute so constructor use remains convenient for callers building a request incrementally.

type Result 

type Result struct {
	// contains filtered or unexported fields
}

Result is an immutable review-service snapshot. It intentionally exposes no mutable domain.Run, provider output, publication authority, or filesystem receipt.

func (Result) Evidence 

func (result Result) Evidence() []ResultFindingEvidence

Evidence returns defensive verifier receipt-group copies in final finding order.

func (Result) FallbackScheduled 

func (Result) FallbackScheduled() bool

FallbackScheduled is always false for this sequential vertical slice.

func (Result) Findings 

func (result Result) Findings() []domain.Finding

Findings returns a caller-owned ordered finding slice.

func (Result) OutcomeAxes 

func (result Result) OutcomeAxes() domain.OutcomeAxes

OutcomeAxes is an explicit alias for Outcomes.

func (Result) Outcomes 

func (result Result) Outcomes() domain.OutcomeAxes

Outcomes returns the four system-owned outcome axes.

func (Result) RoleExecutions 

func (result Result) RoleExecutions() []RoleExecution

RoleExecutions returns caller-owned terminal role execution records.

func (Result) RunID 

func (result Result) RunID() domain.RunID

RunID returns the immutable review run ID.

func (Result) RunState 

func (result Result) RunState() domain.RunState

RunState returns the terminal state of the in-memory run.

func (Result) SessionID 

func (result Result) SessionID() domain.SessionID

SessionID returns the immutable review session ID.

type ResultFindingEvidence 

type ResultFindingEvidence struct {
	// contains filtered or unexported fields
}

ResultFindingEvidence binds one final global finding ID to its exact verifier-owned receipt group. The validation proof remains private so callers cannot substitute a different finding for the receipts.

func (ResultFindingEvidence) Finding 

func (group ResultFindingEvidence) Finding() domain.Finding

Finding returns the final global finding associated with the receipts.

func (ResultFindingEvidence) FindingID 

func (group ResultFindingEvidence) FindingID() string

FindingID returns the final global finding ID.

func (ResultFindingEvidence) MatchesFinding 

func (group ResultFindingEvidence) MatchesFinding(finding domain.Finding) bool

MatchesFinding reports whether finding is the exact final finding associated with this verifier-owned receipt group.

func (ResultFindingEvidence) Receipts 

func (group ResultFindingEvidence) Receipts() []evidence.CurrentReceipt

Receipts returns caller-owned verifier receipt values in validation claim order.

type RoleBudget 

type RoleBudget struct {
	// contains filtered or unexported fields
}

RoleBudget contains the primary route and optional fallback route for one selected review role.

func NewRoleBudget 

func NewRoleBudget(role domain.Role, primary RouteBudget, fallback *RouteBudget) (RoleBudget, error)

NewRoleBudget constructs one role's primary and optional fallback operands. A fallback must select a different provider instance from the primary, while retaining the option to share its normalized concurrency lane.

func (RoleBudget) Fallback 

func (budget RoleBudget) Fallback() (RouteBudget, bool)

Fallback returns a caller-owned fallback route budget when one is configured.

func (RoleBudget) Primary 

func (budget RoleBudget) Primary() RouteBudget

Primary returns the immutable primary route budget.

func (RoleBudget) Role 

func (budget RoleBudget) Role() domain.Role

Role returns the selected review role.

func (RoleBudget) Valid 

func (budget RoleBudget) Valid() bool

Valid reports whether budget is a complete role selection.

type RoleExecution 

type RoleExecution struct {
	// contains filtered or unexported fields
}

RoleExecution is an immutable record of one selected role. An unstarted role has no attempt identity or prompt identities.

func (RoleExecution) AttemptID 

func (execution RoleExecution) AttemptID() (domain.AttemptID, bool)

AttemptID returns the coordinator-issued attempt ID when the role started.

func (RoleExecution) AttemptState 

func (execution RoleExecution) AttemptState() (domain.AttemptState, bool)

AttemptState returns the terminal attempt state when the role started.

func (RoleExecution) PromptWireIdentities 

func (execution RoleExecution) PromptWireIdentities() []PromptWireIdentity

PromptWireIdentities returns caller-owned identity records in invocation order. The values contain no mutable bytes.

func (RoleExecution) Repaired 

func (execution RoleExecution) Repaired() bool

Repaired reports whether a repair response was accepted for this role.

func (RoleExecution) Role 

func (execution RoleExecution) Role() domain.Role

Role returns the selected role.

func (RoleExecution) State 

func (execution RoleExecution) State() domain.RoleTaskState

State returns the terminal role-task state.

type RouteBudget 

type RouteBudget struct {
	// contains filtered or unexported fields
}

RouteBudget binds immutable invocation limits to one normalized provider route. The limits apply to both the route's initial and repair invocations.

func NewRouteBudget 

func NewRouteBudget(route ports.ProviderRoute, limits InvocationLimits) (RouteBudget, error)

NewRouteBudget constructs a valid route-and-limits operand.

func (RouteBudget) Limits 

func (budget RouteBudget) Limits() InvocationLimits

Limits returns the immutable invocation limits for the route.

func (RouteBudget) Route 

func (budget RouteBudget) Route() ports.ProviderRoute

Route returns the immutable provider route.

func (RouteBudget) Valid 

func (budget RouteBudget) Valid() bool

Valid reports whether budget has a valid route and positive invocation caps.

type RunBudgetReceipt 

type RunBudgetReceipt struct {
	// contains filtered or unexported fields
}

RunBudgetReceipt is the immutable result of a pure assignment preflight. All slice getters return caller-owned copies in canonical order.

func PreflightRunBudget 

func PreflightRunBudget(roles []RoleBudget, ceilings HarnessCeilings) (RunBudgetReceipt, error)

PreflightRunBudget evaluates every possible primary, repair, and configured fallback invocation without starting providers, scheduling work, or changing runtime state. Rejected inputs still return a receipt containing copied canonical operands and every safely computable result.

func (RunBudgetReceipt) Ceilings 

func (receipt RunBudgetReceipt) Ceilings() HarnessCeilings

Ceilings returns the trusted ceilings used for this preflight.

func (RunBudgetReceipt) Eligible 

func (receipt RunBudgetReceipt) Eligible() bool

Eligible reports whether every closed resource constraint passed.

func (RunBudgetReceipt) LaneDeadlines 

func (receipt RunBudgetReceipt) LaneDeadlines() []LaneDeadline

LaneDeadlines returns copied per-lane results in normalized key order.

func (RunBudgetReceipt) ReasonCode 

func (receipt RunBudgetReceipt) ReasonCode() BudgetReasonCode

ReasonCode returns the safe, closed preflight result code.

func (RunBudgetReceipt) RoleBudgets 

func (receipt RunBudgetReceipt) RoleBudgets() []RoleBudget

RoleBudgets returns copied role operands in fixed role order.

func (RunBudgetReceipt) RunDeadline 

func (receipt RunBudgetReceipt) RunDeadline() time.Duration

RunDeadline returns max(lane deadlines) plus the fixed five-second run grace.

func (RunBudgetReceipt) TotalInvocations 

func (receipt RunBudgetReceipt) TotalInvocations() int

TotalInvocations returns the count of every possible initial and repair invocation across primary and fallback routes.

func (RunBudgetReceipt) TotalOutputCap 

func (receipt RunBudgetReceipt) TotalOutputCap() int64

TotalOutputCap returns the worst-case stdout-plus-stderr capture total.

type RuntimeArtifactInventory 

type RuntimeArtifactInventory struct {
	// contains filtered or unexported fields
}

RuntimePrompt is the trusted prompt and target material supplied for one job. Source implementations own template, objective, target-byte, and identity selection; provider output never participates in their construction. RuntimeArtifactInventory is the immutable source material retained for one provider invocation. It has no provider-output or publication authority.

func (RuntimeArtifactInventory) AdapterParameters 

func (inventory RuntimeArtifactInventory) AdapterParameters() map[string]string

func (RuntimeArtifactInventory) AdapterProfile 

func (inventory RuntimeArtifactInventory) AdapterProfile() string

func (RuntimeArtifactInventory) AttemptID 

func (inventory RuntimeArtifactInventory) AttemptID() domain.AttemptID

func (RuntimeArtifactInventory) CapturedArchive 

func (inventory RuntimeArtifactInventory) CapturedArchive() []byte

func (RuntimeArtifactInventory) Captures 

func (inventory RuntimeArtifactInventory) Captures() []ports.CapturedAttemptArtifact

func (RuntimeArtifactInventory) DiagnosticStderr 

func (inventory RuntimeArtifactInventory) DiagnosticStderr() (ports.RuntimeDiagnosticRawResult, bool)

func (RuntimeArtifactInventory) DiagnosticStdout 

func (inventory RuntimeArtifactInventory) DiagnosticStdout() (ports.RuntimeDiagnosticRawResult, bool)

func (RuntimeArtifactInventory) ExecutionInvocationID 

func (inventory RuntimeArtifactInventory) ExecutionInvocationID() string

func (RuntimeArtifactInventory) Purpose 

func (inventory RuntimeArtifactInventory) Purpose() domain.InvocationPurpose

func (RuntimeArtifactInventory) Role 

func (inventory RuntimeArtifactInventory) Role() domain.Role

func (RuntimeArtifactInventory) RunID 

func (inventory RuntimeArtifactInventory) RunID() domain.RunID

func (RuntimeArtifactInventory) Scope 

func (inventory RuntimeArtifactInventory) Scope() string

func (RuntimeArtifactInventory) Sequence 

func (inventory RuntimeArtifactInventory) Sequence() uint64

func (RuntimeArtifactInventory) SourceInvocationID 

func (inventory RuntimeArtifactInventory) SourceInvocationID() string

func (RuntimeArtifactInventory) Stdin 

func (inventory RuntimeArtifactInventory) Stdin() []byte

func (RuntimeArtifactInventory) StdinSHA256 

func (inventory RuntimeArtifactInventory) StdinSHA256() string

func (RuntimeArtifactInventory) Target 

func (inventory RuntimeArtifactInventory) Target() []byte

func (RuntimeArtifactInventory) TargetIdentity 

func (inventory RuntimeArtifactInventory) TargetIdentity() domain.TargetIdentity

func (RuntimeArtifactInventory) TemplateID 

func (inventory RuntimeArtifactInventory) TemplateID() string

func (RuntimeArtifactInventory) TemplateSHA256 

func (inventory RuntimeArtifactInventory) TemplateSHA256() string

func (RuntimeArtifactInventory) TemplateVersion 

func (inventory RuntimeArtifactInventory) TemplateVersion() string

type RuntimeDiagnosticSinkResolver 

type RuntimeDiagnosticSinkResolver interface {
	RuntimeDiagnosticSink(domain.RunID) (ports.RuntimeDiagnosticSink, bool)
}

RuntimeDiagnosticSinkResolver supplies an already-opened run sink. The provider runtime may persist per-invocation raw streams but never opens or finalizes the sink; reviewrun owns that lifecycle in D-E03.

type RuntimePrompt 

type RuntimePrompt struct {
	Prompt            prompt.CompiledPrompt
	Target            []byte
	CapturedArchive   []byte
	AdapterProfile    string
	AdapterParameters map[string]string
}

AdapterProfile and AdapterParameters identify the trusted execution adapter. They are source material, never provider output.

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service is the G004 compatibility path for deterministic, sequential, in-memory fake-provider runs. Coordinator owns fallback scheduling and live provider lanes.

func NewService 

func NewService(
	clock ports.Clock,
	ids IdentityGenerator,
	provider ports.ReviewProvider,
	reviewValidator *validation.ReviewValidator,
	verifier *evidence.Verifier,
) (*Service, error)

NewService constructs a sequential compatibility service with the default immutable evidence policy.

func NewServiceWithEvidencePolicy 

func NewServiceWithEvidencePolicy(
	clock ports.Clock,
	ids IdentityGenerator,
	provider ports.ReviewProvider,
	reviewValidator *validation.ReviewValidator,
	verifier *evidence.Verifier,
	policy EvidencePolicy,
) (*Service, error)

NewServiceWithEvidencePolicy constructs a sequential compatibility service with verifier-owned current-evidence authority.

func (*Service) Execute 

func (service *Service) Execute(ctx context.Context, request Request) (Result, error)

Execute performs every selected role in canonical order. It neither queues a fallback nor writes, publishes, or returns an artifact.

type TemplateSet 

type TemplateSet struct {
	// contains filtered or unexported fields
}

TemplateSet holds the trusted prompt layers required to compose a role packet. It owns defensive copies of all layer bytes and exposes copies.

func NewTemplateSet 

func NewTemplateSet(common, reviewRun, jsonOutput, repair prompt.TrustedLayer, roleSpecific map[domain.Role]prompt.TrustedLayer) (TemplateSet, error)

NewTemplateSet validates and defensively copies the common, review-run, JSON-output, repair, and role-specific trusted layers.

func (TemplateSet) Common 

func (templates TemplateSet) Common() prompt.TrustedLayer

Common returns a caller-owned copy of the common trusted layer.

func (TemplateSet) ComposeRootReview 

func (templates TemplateSet) ComposeRootReview(role domain.Role, objective *prompt.Objective) (prompt.TrustedTemplate, error)

ComposeRootReview composes the fixed-order trusted template for role.

func (TemplateSet) ComposeRootReviewRepair 

func (templates TemplateSet) ComposeRootReviewRepair(original prompt.TrustedTemplate, plan validation.RepairPlan) (prompt.TrustedTemplate, error)

ComposeRootReviewRepair appends the frozen repair contract and canonical plan to the original trusted template without promoting prior provider output.

func (TemplateSet) JSONOutput 

func (templates TemplateSet) JSONOutput() prompt.TrustedLayer

JSONOutput returns a caller-owned copy of the JSON-output trusted layer.

func (TemplateSet) Repair 

func (templates TemplateSet) Repair() prompt.TrustedLayer

Repair returns a caller-owned copy of the repair trusted layer.

func (TemplateSet) ReviewRun 

func (templates TemplateSet) ReviewRun() prompt.TrustedLayer

ReviewRun returns a caller-owned copy of the review-run trusted layer.

func (TemplateSet) RoleTemplate 

func (templates TemplateSet) RoleTemplate(role domain.Role) (prompt.TrustedLayer, bool)

RoleTemplate returns a caller-owned copy of a role-specific trusted layer.

func (TemplateSet) RoleTemplates 

func (templates TemplateSet) RoleTemplates() map[domain.Role]prompt.TrustedLayer

RoleTemplates returns a caller-owned map and caller-owned layer values.

type TerminalProjection 

type TerminalProjection string

TerminalProjection is the terminal role projection selected when this decision does not schedule more work. None means that repair or fallback was selected and the coordinator must await that result. 

const (
	TerminalProjectionNone      TerminalProjection = ""
	TerminalProjectionSucceeded TerminalProjection = "succeeded"
	TerminalProjectionFailed    TerminalProjection = "failed"
	TerminalProjectionCancelled TerminalProjection = "cancelled"
)

func (TerminalProjection) Valid 

func (projection TerminalProjection) Valid() bool

Valid reports whether projection is a policy-defined terminal projection.

type TransitionDecision 

type TransitionDecision struct {
	// contains filtered or unexported fields
}

TransitionDecision is an immutable coordinator-owned result. It contains no references and exposes its facts only through value-returning accessors.

func DecideTransition 

func DecideTransition(input TransitionInput) (TransitionDecision, error)

DecideTransition applies the closed coordinator policy to immutable attempt facts. It has no scheduling, provider, publication, or other side effects.

func (TransitionDecision) CancelRun 

func (decision TransitionDecision) CancelRun() bool

CancelRun reports whether the coordinator must cancel the run and prevent further work.

func (TransitionDecision) Condition 

func (decision TransitionDecision) Condition() AttemptCondition

Condition returns the effective condition selected by closed precedence reduction, including an observed cancellation when it takes precedence.

func (TransitionDecision) ReasonCode 

func (decision TransitionDecision) ReasonCode() string

ReasonCode returns the stable condition-specific reason code. In particular, invalid evidence claims retain invalid_evidence_claim even though their terminal class is invalid_provider_output.

func (TransitionDecision) ScheduleFallback 

func (decision TransitionDecision) ScheduleFallback() bool

ScheduleFallback reports whether the coordinator may schedule a configured, eligible fallback attempt.

func (TransitionDecision) ScheduleRepair 

func (decision TransitionDecision) ScheduleRepair() bool

ScheduleRepair reports whether the coordinator must schedule the one allowed repair invocation.

func (TransitionDecision) Terminal 

func (decision TransitionDecision) Terminal() bool

Terminal reports whether the decision closes this role rather than scheduling repair or fallback work.

func (TransitionDecision) TerminalClass 

func (decision TransitionDecision) TerminalClass() domain.FailureClass

TerminalClass returns the domain failure class for the effective condition. It is empty only for a valid review.

func (TransitionDecision) TerminalProjection 

func (decision TransitionDecision) TerminalProjection() TerminalProjection

TerminalProjection returns the selected terminal role projection. It is None while the decision schedules repair or fallback work.

type TransitionInput 

type TransitionInput struct {
	Condition            AttemptCondition
	RepairUsed           bool
	FallbackConfigured   bool
	FallbackEligible     bool
	CancellationObserved bool
}

TransitionInput contains the facts the coordinator needs to make one policy decision. Fallback is usable only when it is both configured and eligible.

type ValidatedRoleOutput 

type ValidatedRoleOutput struct {
	// contains filtered or unexported fields
}

ValidatedRoleOutput is immutable validated provider content for one role, provider instance, and immutable target. It has no transition, policy, outcome-axis, or publication authority.

func NewEvidenceValidatedRoleOutput 

func NewEvidenceValidatedRoleOutput(
	role domain.Role,
	providerInstance string,
	target domain.TargetIdentity,
	findings []domain.Finding,
	completeness string,
	limitations []string,
	evidenceGroups []VerifiedFindingEvidence,
) (ValidatedRoleOutput, error)

NewEvidenceValidatedRoleOutput records finding output only after receipt groups prove one nonempty verifier-owned group for every assigned finding. It projects receipt states with a structural policy; the coordinator applies its authoritative policy separately.

func NewValidatedRoleOutput 

func NewValidatedRoleOutput(
	role domain.Role,
	providerInstance string,
	target domain.TargetIdentity,
	findings []domain.Finding,
	completeness string,
	limitations []string,
) (ValidatedRoleOutput, error)

NewValidatedRoleOutput records a zero-finding validated role output. Finding output requires verifier-owned receipts and must use NewEvidenceValidatedRoleOutput.

func (ValidatedRoleOutput) Completeness 

func (output ValidatedRoleOutput) Completeness() string

Completeness returns the validated provider-declared review completeness.

func (ValidatedRoleOutput) Evidence 

func (output ValidatedRoleOutput) Evidence() []VerifiedFindingEvidence

Evidence returns defensive receipt-group copies in deterministic finding-ID order.

func (ValidatedRoleOutput) Findings 

func (output ValidatedRoleOutput) Findings() []domain.Finding

Findings returns caller-owned copies in deterministic assigned-ID order.

func (ValidatedRoleOutput) Limitations 

func (output ValidatedRoleOutput) Limitations() []string

Limitations returns a caller-owned copy of the validated limitations.

func (ValidatedRoleOutput) ProviderInstance 

func (output ValidatedRoleOutput) ProviderInstance() string

ProviderInstance returns the exact selected provider instance.

func (ValidatedRoleOutput) Role 

func (output ValidatedRoleOutput) Role() domain.Role

Role returns the selected review role.

func (ValidatedRoleOutput) Target 

func (output ValidatedRoleOutput) Target() domain.TargetIdentity

Target returns a reconstructed canonical immutable target identity.

type VerifiedFindingEvidence 

type VerifiedFindingEvidence struct {
	// contains filtered or unexported fields
}

VerifiedFindingEvidence binds an exact final finding proof to the immutable receipts produced by the coordinator-owned current-evidence verifier.

func VerifyValidatedEvidence 

func VerifyValidatedEvidence(
	ctx context.Context,
	verifier *evidence.Verifier,
	groups []validation.FindingEvidenceClaims,
) ([]VerifiedFindingEvidence, error)

VerifyValidatedEvidence converts validated current-evidence claims into verifier-owned claims and verifies them in their deterministic input order. Any invalid bridge input, cancellation, or verifier failure rejects the whole result so no partial evidence can escape.

func (VerifiedFindingEvidence) FindingID 

func (verified VerifiedFindingEvidence) FindingID() string

FindingID returns the final system-assigned finding ID.

func (VerifiedFindingEvidence) Receipts 

func (verified VerifiedFindingEvidence) Receipts() []evidence.CurrentReceipt

Receipts returns caller-owned receipt values in the supplied claim order.

func (VerifiedFindingEvidence) VisualReferences 

func (verified VerifiedFindingEvidence) VisualReferences() []validation.VerifiedVisualReference

VisualReferences returns verified visual references aligned with Receipts. Zero values identify current claims without visual evidence.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.