ports

package
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 4, 2026 License: MIT Imports: 20 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	RuntimeDiagnosticLogMaxBytes            int64 = 8 << 20
	RuntimeDiagnosticTailReserveBytes       int64 = 256 << 10
	RuntimeDiagnosticStatusMaxBytes         int64 = 256 << 10
	RuntimeDiagnosticRunStatusSchema              = "mulgae-runtime-run-status.v1"
	RuntimeDiagnosticAttemptStatusSchema          = "mulgae-runtime-attempt-status.v1"
	RuntimeDiagnosticInvocationStatusSchema       = "mulgae-runtime-invocation-status.v1"
)
View Source 
const (
	// WorkspaceSnapshotMaxFiles is the maximum number of captured files in one snapshot.
	WorkspaceSnapshotMaxFiles = 10_000
	// WorkspaceSnapshotMaxBytes is the maximum total captured byte length.
	WorkspaceSnapshotMaxBytes int64 = 64 << 20
	// WorkspaceSnapshotMaxFileBytes is the maximum byte length of one captured file.
	WorkspaceSnapshotMaxFileBytes int64 = 4 << 20
)
View Source 
const ReviewTargetMaxBytes = 180000

Variables

View Source 
var ErrCorruptionObservationStale = errors.New("corruption observation is stale")

ErrCorruptionObservationStale reports that the live durable classifier facts no longer match the observation that authorized a diagnostic write.

View Source 
var ErrMutableCASConflict = errors.New("mutable publication compare-and-swap conflict")

ErrMutableCASConflict reports that a mutable publication record changed after its caller's durable observation. Callers must re-observe instead of retrying the same replacement against altered state.

View Source 
var ErrProviderLoginRequired = errors.New("provider login required")

ErrProviderLoginRequired marks an explicit native provider response that requires the installed user to authenticate outside Mulgae before retrying.

View Source 
var ErrProviderPacketSecurity = errors.New("provider packet security rejection")

ErrProviderPacketSecurity indicates that system-owned packet screening rejected a provider invocation before process execution.

View Source 
var ErrRuntimeDiagnosticEventDropped = errors.New("runtime diagnostic ordinary event dropped at cap")
View Source 
var ErrWorkspaceSnapshotDrift = errors.New("workspace snapshot drift")

ErrWorkspaceSnapshotDrift indicates that a captured workspace no longer matches the immutable snapshot that was authorized.

Functions

func ExtractProcessOutputJSONFrame 

func ExtractProcessOutputJSONFrame(framing ProcessOutputFraming, stdout []byte) ([]byte, error)

ExtractProcessOutputJSONFrame returns the JSON value bound by framing. Strict JSON permits only one conventional terminal LF. Terminal-object mode additionally permits bounded provider narration on complete preceding lines and selects exactly the final top-level JSON object.

func MarshalCapturedReviewMaterial 

func MarshalCapturedReviewMaterial(material CapturedReviewMaterial) ([]byte, error)

MarshalCapturedReviewMaterial returns deterministic JSON. All maps are projected into fixed-order slices before marshaling.

func NewConfigLocalityViolation 

func NewConfigLocalityViolation(reason ConfigLocalityReason, cause error) error

func NewIdentityObservationError 

func NewIdentityObservationError(kind IdentityObservationFailureKind, text string) error

NewIdentityObservationError constructs a redacted classified failure.

func NewRuntimeDiagnosticPersistenceError 

func NewRuntimeDiagnosticPersistenceError(operation RuntimeDiagnosticPersistenceOperation, reason RuntimeDiagnosticPersistenceReason, err error) error

func NewRuntimeDiagnosticSecurityRejectionError 

func NewRuntimeDiagnosticSecurityRejectionError(drop DropMetadata, err error) error

func SortWorkspaceSnapshotFiles 

func SortWorkspaceSnapshotFiles(files []WorkspaceSnapshotFile)

SortWorkspaceSnapshotFiles sorts a caller-owned slice by canonical path.

func ValidateProcessOutputFrame 

func ValidateProcessOutputFrame(framing ProcessOutputFraming, stdout []byte) error

ValidateProcessOutputFrame validates one complete stdout frame.

Types

type AdoptStagedFinalRequest 

type AdoptStagedFinalRequest struct {
	// contains filtered or unexported fields
}

AdoptStagedFinalRequest identifies exact persisted staged bytes that must be re-opened, validated, and fsync-adopted before recovery may install them.

func NewAdoptStagedFinalRequest 

func NewAdoptStagedFinalRequest(
	run PublicationRun,
	stagedPath SafeRelativePath,
	binding IssuedFinalBinding,
	final FinalReviewArtifact,
	maxBytes int64,
) (AdoptStagedFinalRequest, error)

NewAdoptStagedFinalRequest validates one staged durability-adoption request.

func (AdoptStagedFinalRequest) Binding 

func (request AdoptStagedFinalRequest) Binding() IssuedFinalBinding

Binding returns the explicit issuance-to-final relation.

func (AdoptStagedFinalRequest) Final 

func (request AdoptStagedFinalRequest) Final() FinalReviewArtifact

Final returns defensive exact expected final bytes.

func (AdoptStagedFinalRequest) IssuedReviewID 

func (request AdoptStagedFinalRequest) IssuedReviewID() IssuedReviewID

IssuedReviewID returns the issuance bound to the staged final.

func (AdoptStagedFinalRequest) MaxBytes 

func (request AdoptStagedFinalRequest) MaxBytes() int64

MaxBytes returns the positive adoption read cap.

func (AdoptStagedFinalRequest) Run 

func (request AdoptStagedFinalRequest) Run() PublicationRun

Run returns the exact publication scope.

func (AdoptStagedFinalRequest) StagedPath 

func (request AdoptStagedFinalRequest) StagedPath() SafeRelativePath

StagedPath returns the exact canonical staged pathname to adopt.

type AnchoredRoot 

type AnchoredRoot struct {
	// contains filtered or unexported fields
}

AnchoredRoot is a canonical absolute filesystem root approved by a caller.

func NewAnchoredRoot 

func NewAnchoredRoot(value string) (AnchoredRoot, error)

NewAnchoredRoot validates an absolute, canonical root. It deliberately rejects backslashes so the portable port contract has one separator syntax.

func (AnchoredRoot) String 

func (root AnchoredRoot) String() string

String returns the canonical absolute root.

func (AnchoredRoot) Valid 

func (root AnchoredRoot) Valid() bool

Valid reports whether root is an absolute canonical root.

type ArtistReviewInputs 

type ArtistReviewInputs struct {
	// contains filtered or unexported fields
}

ArtistReviewInputs identifies one review-scoped brief and bounded visual reference selection. Paths remain project-relative and are interpreted by the target capturer against the selected immutable snapshot.

func NewArtistReviewInputs 

func NewArtistReviewInputs(briefPath string, designSpecGlobs []string) (ArtistReviewInputs, error)

func (ArtistReviewInputs) BriefPath 

func (inputs ArtistReviewInputs) BriefPath() string

func (ArtistReviewInputs) DesignSpecGlobs 

func (inputs ArtistReviewInputs) DesignSpecGlobs() []string

func (ArtistReviewInputs) Valid 

func (inputs ArtistReviewInputs) Valid() bool

type ArtistReviewTargetCapturer 

type ArtistReviewTargetCapturer interface {
	CaptureReviewTargetWithArtistInputs(context.Context, AnchoredRoot, ReviewTargetSelector, ArtistReviewInputs) (CapturedReviewMaterial, error)
}

ArtistReviewTargetCapturer is the optional review-scoped artist extension. Ordinary captures retain the smaller ReviewTargetCapturer contract.

type AssetID 

type AssetID struct {
	// contains filtered or unexported fields
}

AssetID is the stable, opaque identifier of a built-in contract asset.

func ParseAssetID 

func ParseAssetID(value string) (AssetID, error)

ParseAssetID validates a stable contract asset identifier.

func (AssetID) String 

func (id AssetID) String() string

String returns the canonical asset identifier.

func (AssetID) Valid 

func (id AssetID) Valid() bool

Valid reports whether id is a valid stable asset identifier.

type AssetKind 

type AssetKind string

AssetKind classifies a contract asset by the consumer-facing surface it serves. 

const (
	AssetKindSOT      AssetKind = "sot"
	AssetKindSchema   AssetKind = "schema"
	AssetKindExample  AssetKind = "example"
	AssetKindHelp     AssetKind = "help"
	AssetKindDefaults AssetKind = "defaults"
)

func (AssetKind) Valid 

func (kind AssetKind) Valid() bool

Valid reports whether kind is a known contract asset kind.

type AssetMetadata 

type AssetMetadata struct {
	// contains filtered or unexported fields
}

AssetMetadata is the immutable identity, source, media type, and integrity metadata of one catalog asset.

func NewAssetMetadata 

func NewAssetMetadata(id AssetID, kind AssetKind, source SafeRelativePath, mediaType, sha256 string, byteLength int64) (AssetMetadata, error)

NewAssetMetadata validates immutable asset metadata.

func (AssetMetadata) ByteLength 

func (metadata AssetMetadata) ByteLength() int64

ByteLength returns the exact asset byte length.

func (AssetMetadata) ID 

func (metadata AssetMetadata) ID() AssetID

ID returns the stable asset identifier.

func (AssetMetadata) Kind 

func (metadata AssetMetadata) Kind() AssetKind

Kind returns the asset kind.

func (AssetMetadata) MediaType 

func (metadata AssetMetadata) MediaType() string

MediaType returns the canonical media type of the asset bytes.

func (AssetMetadata) SHA256 

func (metadata AssetMetadata) SHA256() string

SHA256 returns the canonical sha256:<lowercase-hex> integrity identifier.

func (AssetMetadata) Source 

func (metadata AssetMetadata) Source() SafeRelativePath

Source returns the canonical contract-relative asset source path.

type AttemptArtifactKind 

type AttemptArtifactKind string

FinalReviewArtifact is one immutable final review and its exact bytes. AttemptArtifactKind identifies one captured provider byte stream. 

const (
	AttemptArtifactInitialCandidate  AttemptArtifactKind = "initial_candidate"
	AttemptArtifactRepairedCandidate AttemptArtifactKind = "repaired_candidate"
	AttemptArtifactStdout            AttemptArtifactKind = "stdout"
	AttemptArtifactStderr            AttemptArtifactKind = "stderr"
)

func (AttemptArtifactKind) Valid 

func (kind AttemptArtifactKind) Valid() bool

Valid reports whether the kind is a persisted provider byte stream.

type AuxiliaryArtifactDurability 

type AuxiliaryArtifactDurability string

AuxiliaryArtifactDurability distinguishes a durable run-support artifact from one installed before its directory durability step reported an error. 

const (
	AuxiliaryArtifactDurable   AuxiliaryArtifactDurability = "durable"
	AuxiliaryArtifactUndurable AuxiliaryArtifactDurability = "installed_undurable"
)

func (AuxiliaryArtifactDurability) Valid 

func (durability AuxiliaryArtifactDurability) Valid() bool

Valid reports whether durability is explicit.

type AuxiliaryArtifactStore 

type AuxiliaryArtifactStore = RunSupportArtifactStore

AuxiliaryArtifactStore is retained for consumers that only render excerpts. New publication code uses RunSupportArtifactStore terminology.

type BoundedPostOutputLifecycle 

type BoundedPostOutputLifecycle struct {
	// contains filtered or unexported fields
}

BoundedPostOutputLifecycle configures opt-in graceful teardown after an exact frame.

func NewBoundedPostOutputLifecycle 

func NewBoundedPostOutputLifecycle(framing ProcessOutputFraming, stabilityGrace, terminationGrace time.Duration) (BoundedPostOutputLifecycle, error)

func (BoundedPostOutputLifecycle) Framing 

func (l BoundedPostOutputLifecycle) Framing() ProcessOutputFraming

func (BoundedPostOutputLifecycle) StabilityGrace 

func (l BoundedPostOutputLifecycle) StabilityGrace() time.Duration

func (BoundedPostOutputLifecycle) TerminationGrace 

func (l BoundedPostOutputLifecycle) TerminationGrace() time.Duration

func (BoundedPostOutputLifecycle) Valid 

func (l BoundedPostOutputLifecycle) Valid() bool

type CapturedAttemptArtifact 

type CapturedAttemptArtifact struct {
	// contains filtered or unexported fields
}

CapturedAttemptArtifact is a caller-owned captured provider byte stream. SecurityRejected means the bytes were rejected before persistence and must be empty; it deliberately carries no synthetic identity or receipt.

func NewCapturedAttemptArtifact 

func NewCapturedAttemptArtifact(
	kind AttemptArtifactKind,
	bytes []byte,
	securityRejected bool,
) (CapturedAttemptArtifact, error)

NewCapturedAttemptArtifact takes ownership of permitted bytes. Rejected streams retain only their rejection state and can never be serialized.

func (CapturedAttemptArtifact) Bytes 

func (artifact CapturedAttemptArtifact) Bytes() []byte

Bytes returns a caller-owned copy of permitted captured bytes.

func (CapturedAttemptArtifact) Kind 

func (artifact CapturedAttemptArtifact) Kind() AttemptArtifactKind

Kind returns the captured stream kind.

func (CapturedAttemptArtifact) SecurityRejected 

func (artifact CapturedAttemptArtifact) SecurityRejected() bool

SecurityRejected reports whether capture policy rejected the stream.

func (CapturedAttemptArtifact) Valid 

func (artifact CapturedAttemptArtifact) Valid() bool

Valid reports whether the artifact can be handled without persisting rejected bytes.

type CapturedEvidenceSide 

type CapturedEvidenceSide string

CapturedEvidenceSide identifies a captured immutable file namespace. 

const (
	CapturedEvidenceBase     CapturedEvidenceSide = "base"
	CapturedEvidenceHead     CapturedEvidenceSide = "head"
	CapturedEvidenceWorktree CapturedEvidenceSide = "worktree"
	CapturedEvidenceIndex    CapturedEvidenceSide = "index"
)

func (CapturedEvidenceSide) Valid 

func (side CapturedEvidenceSide) Valid() bool

type CapturedGitTarget 

type CapturedGitTarget struct {
	// contains filtered or unexported fields
}

CapturedGitTarget is the immutable Git target identity and its canonical captured bytes. Bytes returns a defensive copy.

func NewCapturedGitTarget 

func NewCapturedGitTarget(repositoryID string, baseObjectID, headObjectID, headTreeID GitObjectID, indexTreeID *GitObjectID, bytes []byte) (CapturedGitTarget, error)

NewCapturedGitTarget validates resolved Git identity and takes ownership of the canonical captured target bytes. indexTreeID is nil when no index tree applies to the selected target mode.

func (CapturedGitTarget) BaseObjectID 

func (target CapturedGitTarget) BaseObjectID() GitObjectID

BaseObjectID returns the resolved base object identifier.

func (CapturedGitTarget) Bytes 

func (target CapturedGitTarget) Bytes() []byte

Bytes returns a caller-owned copy of the canonical captured target bytes.

func (CapturedGitTarget) HeadObjectID 

func (target CapturedGitTarget) HeadObjectID() GitObjectID

HeadObjectID returns the resolved head object identifier.

func (CapturedGitTarget) HeadTreeID 

func (target CapturedGitTarget) HeadTreeID() GitObjectID

HeadTreeID returns the resolved head tree object identifier.

func (CapturedGitTarget) IndexTreeID 

func (target CapturedGitTarget) IndexTreeID() (GitObjectID, bool)

IndexTreeID returns the optional resolved index tree object identifier.

func (CapturedGitTarget) RepositoryID 

func (target CapturedGitTarget) RepositoryID() string

RepositoryID returns the stable repository identity recorded at capture.

func (CapturedGitTarget) SHA256 

func (target CapturedGitTarget) SHA256() string

SHA256 returns the canonical target-byte integrity identifier.

type CapturedReviewMaterial 

type CapturedReviewMaterial struct {
	// contains filtered or unexported fields
}

CapturedReviewMaterial is the complete clean, immutable capture handed to the workspace materializer. It carries no live-root authority.

func NewCapturedReviewMaterial 

func NewCapturedReviewMaterial(target CapturedReviewTarget, snapshot WorkspaceSnapshotRequest, projectContext []byte) (CapturedReviewMaterial, error)

func NewCapturedReviewMaterialWithEvidence 

func NewCapturedReviewMaterialWithEvidence(target CapturedReviewTarget, snapshot WorkspaceSnapshotRequest, projectContext []byte, evidence CapturedTargetEvidence) (CapturedReviewMaterial, error)

func NewCapturedReviewMaterialWithEvidenceAndProjectContext 

func NewCapturedReviewMaterialWithEvidenceAndProjectContext(target CapturedReviewTarget, snapshot WorkspaceSnapshotRequest, projectContext []byte, hasProjectContext bool, evidence CapturedTargetEvidence) (CapturedReviewMaterial, error)

func NewCapturedReviewMaterialWithProjectContext 

func NewCapturedReviewMaterialWithProjectContext(target CapturedReviewTarget, snapshot WorkspaceSnapshotRequest, projectContext []byte, hasProjectContext bool) (CapturedReviewMaterial, error)

func UnmarshalCapturedReviewMaterial 

func UnmarshalCapturedReviewMaterial(bytes []byte) (CapturedReviewMaterial, error)

UnmarshalCapturedReviewMaterial validates every byte and identity while rebuilding constructor-owned domain objects.

func (CapturedReviewMaterial) Evidence 

func (material CapturedReviewMaterial) Evidence() CapturedTargetEvidence

func (CapturedReviewMaterial) HasProjectContext 

func (material CapturedReviewMaterial) HasProjectContext() bool

func (CapturedReviewMaterial) ProjectContext 

func (material CapturedReviewMaterial) ProjectContext() []byte

func (CapturedReviewMaterial) Snapshot 

func (material CapturedReviewMaterial) Snapshot() WorkspaceSnapshotRequest

func (CapturedReviewMaterial) Target 

func (material CapturedReviewMaterial) Target() CapturedReviewTarget

func (CapturedReviewMaterial) Valid 

func (material CapturedReviewMaterial) Valid() bool

type CapturedReviewTarget 

type CapturedReviewTarget struct {
	// contains filtered or unexported fields
}

CapturedReviewTarget is an immutable review input with an identity bound to its exact captured bytes. Git targets additionally retain resolved Git facts.

func NewCapturedReviewGitTarget 

func NewCapturedReviewGitTarget(repositoryID string, baseObjectID, headObjectID, headTreeID GitObjectID, indexTreeID *GitObjectID, bytes []byte) (CapturedReviewTarget, error)

NewCapturedReviewGitTarget captures a Git target using the exact canonical diff bytes. Empty diffs are valid and represent a no-change Git review.

func NewCapturedReviewGitTargetWithMode 

func NewCapturedReviewGitTargetWithMode(mode domain.GitTargetMode, repositoryID string, baseObjectID, headObjectID, headTreeID GitObjectID, indexTreeID *GitObjectID, bytes []byte) (CapturedReviewTarget, error)

func NewCapturedReviewPatchTarget 

func NewCapturedReviewPatchTarget(bytes []byte) (CapturedReviewTarget, error)

NewCapturedReviewPatchTarget captures a non-empty patch input.

func NewCapturedReviewStdinTarget 

func NewCapturedReviewStdinTarget(bytes []byte) (CapturedReviewTarget, error)

NewCapturedReviewStdinTarget captures a non-empty stdin input.

func NewCapturedReviewTargetFromIdentity 

func NewCapturedReviewTargetFromIdentity(identity domain.TargetIdentity, bytes []byte) (CapturedReviewTarget, error)

NewCapturedReviewTargetFromIdentity reconstructs a trusted immutable target from P2-bound bytes and their complete persisted identity.

func NewCapturedReviewWorkspaceTarget 

func NewCapturedReviewWorkspaceTarget(bytes []byte) (CapturedReviewTarget, error)

NewCapturedReviewWorkspaceTarget binds a workspace descriptor to its exact immutable snapshot identity. Source files are carried by the accompanying WorkspaceSnapshotRequest rather than duplicated into the prompt payload.

func (CapturedReviewTarget) BaseObjectID 

func (target CapturedReviewTarget) BaseObjectID() (GitObjectID, bool)

BaseObjectID returns the Git base object ID when this is a Git target.

func (CapturedReviewTarget) Bytes 

func (target CapturedReviewTarget) Bytes() []byte

Bytes returns a caller-owned copy of the exact captured input bytes.

func (CapturedReviewTarget) HeadObjectID 

func (target CapturedReviewTarget) HeadObjectID() (GitObjectID, bool)

HeadObjectID returns the Git head object ID when this is a Git target.

func (CapturedReviewTarget) HeadTreeID 

func (target CapturedReviewTarget) HeadTreeID() (GitObjectID, bool)

HeadTreeID returns the Git head tree ID when this is a Git target.

func (CapturedReviewTarget) Identity 

func (target CapturedReviewTarget) Identity() domain.TargetIdentity

Identity returns the immutable domain identity derived from the exact bytes.

func (CapturedReviewTarget) IndexTreeID 

func (target CapturedReviewTarget) IndexTreeID() (GitObjectID, bool)

IndexTreeID returns the optional Git index tree ID.

func (CapturedReviewTarget) Kind 

func (target CapturedReviewTarget) Kind() domain.TargetKind

Kind returns the selected review target kind.

func (CapturedReviewTarget) NoChange 

func (target CapturedReviewTarget) NoChange() bool

NoChange reports only an empty Git diff; patch and stdin inputs are non-empty.

func (CapturedReviewTarget) RepositoryID 

func (target CapturedReviewTarget) RepositoryID() (string, bool)

RepositoryID returns the Git repository identity when this is a Git target.

func (CapturedReviewTarget) Valid 

func (target CapturedReviewTarget) Valid() bool

Valid reports whether the target could have been produced by its constructor.

type CapturedStdinStore 

type CapturedStdinStore interface {
	TakeCapturedStdin(context.Context, string) ([]byte, error)
}

type CapturedTargetEvidence 

type CapturedTargetEvidence struct {
	// contains filtered or unexported fields
}

CapturedTargetEvidence retains source bytes captured with a target without retaining any authority to reopen the source repository.

func NewCapturedTargetEvidence 

func NewCapturedTargetEvidence(sides map[CapturedEvidenceSide][]WorkspaceSnapshotFile) (CapturedTargetEvidence, error)

func (CapturedTargetEvidence) Files 

func (evidence CapturedTargetEvidence) Files(side CapturedEvidenceSide) ([]WorkspaceSnapshotFile, bool)

Files returns a caller-owned copy of the exact files captured for side.

func (CapturedTargetEvidence) Valid 

func (evidence CapturedTargetEvidence) Valid() bool

type Clock 

type Clock interface {
	Now() time.Time
}

Clock is the only source of wall-clock time used by application services.

type CommitCompositeRequest 

type CommitCompositeRequest struct {
	// contains filtered or unexported fields
}

CommitCompositeRequest creates, in order, immutable manifest and lineage members followed by an epoch record. The store must never replace any member.

func NewCommitCompositeRequest 

func NewCommitCompositeRequest(
	run PublicationRun,
	final FinalReviewIdentity,
	manifest ImmutablePublicationArtifact,
	lineageEdge ImmutablePublicationArtifact,
	epoch PublicationEpoch,
) (CommitCompositeRequest, error)

NewCommitCompositeRequest validates one complete immutable composite write.

func (CommitCompositeRequest) Epoch 

func (request CommitCompositeRequest) Epoch() PublicationEpoch

Epoch returns exact positive epoch identity and bytes.

func (CommitCompositeRequest) Final 

func (request CommitCompositeRequest) Final() FinalReviewIdentity

Final returns the already installed final identity bound by the composite.

func (CommitCompositeRequest) LineageEdge 

func (request CommitCompositeRequest) LineageEdge() ImmutablePublicationArtifact

LineageEdge returns exact immutable lineage-edge bytes.

func (CommitCompositeRequest) Manifest 

func (request CommitCompositeRequest) Manifest() ImmutablePublicationArtifact

Manifest returns exact immutable manifest bytes.

func (CommitCompositeRequest) Run 

func (request CommitCompositeRequest) Run() PublicationRun

Run returns the exact publication scope.

type CommittedPublicationSnapshot 

type CommittedPublicationSnapshot struct {
	// contains filtered or unexported fields
}

CommittedPublicationSnapshot is exact P2 snapshot data. It is constructed only after the store verifies composite linkage, paths, hashes, schemas, regular-file type, and no-symlink containment.

func NewCommittedPublicationSnapshot 

func NewCommittedPublicationSnapshot(
	final FinalReviewArtifact,
	manifest ImmutablePublicationArtifact,
	lineageEdge ImmutablePublicationArtifact,
	epoch PublicationEpoch,
) (CommittedPublicationSnapshot, error)

NewCommittedPublicationSnapshot validates a complete immutable P2 snapshot.

func (CommittedPublicationSnapshot) Epoch 

func (snapshot CommittedPublicationSnapshot) Epoch() PublicationEpoch

Epoch returns the positive composite epoch.

func (CommittedPublicationSnapshot) Final 

func (snapshot CommittedPublicationSnapshot) Final() FinalReviewArtifact

Final returns a defensive final artifact value whose Bytes accessor copies.

func (CommittedPublicationSnapshot) LineageEdge 

func (snapshot CommittedPublicationSnapshot) LineageEdge() ImmutablePublicationArtifact

LineageEdge returns a defensive immutable artifact value whose Bytes copies.

func (CommittedPublicationSnapshot) Manifest 

func (snapshot CommittedPublicationSnapshot) Manifest() ImmutablePublicationArtifact

Manifest returns a defensive immutable artifact value whose Bytes copies.

func (CommittedPublicationSnapshot) Valid 

func (snapshot CommittedPublicationSnapshot) Valid() bool

Valid reports whether snapshot has complete, distinct immutable members.

type CompositeCommitPhase 

type CompositeCommitPhase string

CompositeCommitPhase explicitly reports how far a no-replace composite write reached. A non-durable phase is a re-observe boundary, never a retry signal. 

const (
	CompositeManifestInstalled       CompositeCommitPhase = "manifest_installed"
	CompositeMembersInstalled        CompositeCommitPhase = "members_installed_epoch_absent"
	CompositeEpochInstalledUndurable CompositeCommitPhase = "epoch_installed_undurable"
	CompositeCommittedDurable        CompositeCommitPhase = "committed_durable"
)

func (CompositeCommitPhase) Valid 

func (phase CompositeCommitPhase) Valid() bool

Valid reports whether phase is a closed composite outcome.

type CompositeCommitResult 

type CompositeCommitResult struct {
	// contains filtered or unexported fields
}

CompositeCommitResult records installed composite-member receipts in commit order. Receipts contains one entry after the manifest move, two when the epoch is absent, and three after epoch installation.

func NewCompositeCommitResult 

func NewCompositeCommitResult(phase CompositeCommitPhase, receipts []SecureWriteReceipt) (CompositeCommitResult, error)

NewCompositeCommitResult validates installed composite member receipts and takes ownership of receipts.

func (CompositeCommitResult) Phase 

func (result CompositeCommitResult) Phase() CompositeCommitPhase

Phase returns the explicit composite progress outcome.

func (CompositeCommitResult) Receipts 

func (result CompositeCommitResult) Receipts() []SecureWriteReceipt

Receipts returns caller-owned installed-member receipts in commit order.

func (CompositeCommitResult) Valid 

func (result CompositeCommitResult) Valid() bool

Valid reports whether result is coherent.

type CompositePreparationDurability 

type CompositePreparationDurability string

CompositePreparationDurability distinguishes a completed fsync of all staged members from an installed-but-undurable preparation outcome. 

const (
	CompositePreparationDurable   CompositePreparationDurability = "durable"
	CompositePreparationUndurable CompositePreparationDurability = "installed_undurable"
)

func (CompositePreparationDurability) Valid 

func (durability CompositePreparationDurability) Valid() bool

Valid reports whether durability is an explicit preparation outcome.

type ConcurrencyKey 

type ConcurrencyKey struct {
	// contains filtered or unexported fields
}

ConcurrencyKey is the stable, normalized identity of one serialized provider lane. It is opaque so every equal key compares equal without caller-defined spelling rules.

func ParseConcurrencyKey 

func ParseConcurrencyKey(value string) (ConcurrencyKey, error)

ParseConcurrencyKey NFC-normalizes and ASCII-lowercases value before validating the canonical lane-key grammar. It never trims or otherwise aliases input.

func (ConcurrencyKey) String 

func (key ConcurrencyKey) String() string

String returns the canonical lane-key value.

func (ConcurrencyKey) Valid 

func (key ConcurrencyKey) Valid() bool

Valid reports whether key is a canonical concurrency key.

type ConfigDestinationState 

type ConfigDestinationState string
const (
	ConfigDestinationPresent     ConfigDestinationState = "present"
	ConfigDestinationAbsent      ConfigDestinationState = "absent"
	ConfigDestinationNotObserved ConfigDestinationState = "not_observed"
)

type ConfigDirectoryIdentity 

type ConfigDirectoryIdentity struct {
	// contains filtered or unexported fields
}

func NewConfigDirectoryIdentity 

func NewConfigDirectoryIdentity(rootDevice, rootInode uint64, rootUID, rootMode uint32, privateDevice, privateInode uint64, privateUID, privateMode uint32) (ConfigDirectoryIdentity, error)

func (ConfigDirectoryIdentity) Equal 

func (identity ConfigDirectoryIdentity) Equal(other ConfigDirectoryIdentity) bool

func (ConfigDirectoryIdentity) PrivateDirectory 

func (identity ConfigDirectoryIdentity) PrivateDirectory() (uint64, uint64, uint32, uint32)

func (ConfigDirectoryIdentity) Root 

func (identity ConfigDirectoryIdentity) Root() (uint64, uint64, uint32, uint32)

func (ConfigDirectoryIdentity) Valid 

func (identity ConfigDirectoryIdentity) Valid() bool

type ConfigDirectoryReceipt 

type ConfigDirectoryReceipt struct {
	// contains filtered or unexported fields
}

func NewVerifiedConfigDirectoryReceipt 

func NewVerifiedConfigDirectoryReceipt(created bool, identity ConfigDirectoryIdentity) (ConfigDirectoryReceipt, error)

func (ConfigDirectoryReceipt) CreatedByInvocation 

func (receipt ConfigDirectoryReceipt) CreatedByInvocation() bool

func (ConfigDirectoryReceipt) Identity 

func (receipt ConfigDirectoryReceipt) Identity() (ConfigDirectoryIdentity, bool)

type ConfigFileIdentity 

type ConfigFileIdentity struct {
	// contains filtered or unexported fields
}

func NewConfigFileIdentity 

func NewConfigFileIdentity(device, inode uint64, uid, mode uint32, links uint64, byteLength int64, sha256 string) (ConfigFileIdentity, error)

func (ConfigFileIdentity) ByteLength 

func (identity ConfigFileIdentity) ByteLength() int64

func (ConfigFileIdentity) Descriptor 

func (identity ConfigFileIdentity) Descriptor() (uint64, uint64, uint32, uint32, uint64)

func (ConfigFileIdentity) Equal 

func (identity ConfigFileIdentity) Equal(other ConfigFileIdentity) bool

func (ConfigFileIdentity) SHA256 

func (identity ConfigFileIdentity) SHA256() string

func (ConfigFileIdentity) Valid 

func (identity ConfigFileIdentity) Valid() bool

type ConfigFileProof 

type ConfigFileProof struct {
	// contains filtered or unexported fields
}

func NewConfigFileProof 

func NewConfigFileProof(present bool, rootDevice, rootInode uint64, rootUID, rootMode uint32, privateDevice, privateInode uint64, privateUID, privateMode uint32, configDevice, configInode uint64, configUID, configMode uint32, configLinks uint64, configSize int64, configSHA256 string) (ConfigFileProof, error)

func (ConfigFileProof) ConfigIdentity 

func (proof ConfigFileProof) ConfigIdentity() (uint64, uint64, uint32, uint32, uint64, int64, string)

func (ConfigFileProof) Equal 

func (proof ConfigFileProof) Equal(other ConfigFileProof) bool

func (ConfigFileProof) Present 

func (proof ConfigFileProof) Present() bool

func (ConfigFileProof) PrivateDirectoryIdentity 

func (proof ConfigFileProof) PrivateDirectoryIdentity() (uint64, uint64, uint32, uint32)

func (ConfigFileProof) RootIdentity 

func (proof ConfigFileProof) RootIdentity() (uint64, uint64, uint32, uint32)

type ConfigInstallError 

type ConfigInstallError struct {
	// contains filtered or unexported fields
}

func NewConfigInstallError 

func NewConfigInstallError(stage ConfigInstallStage, destination ConfigDestinationState, cause error) *ConfigInstallError

func (*ConfigInstallError) DestinationState 

func (err *ConfigInstallError) DestinationState() ConfigDestinationState

func (*ConfigInstallError) Error 

func (err *ConfigInstallError) Error() string

func (*ConfigInstallError) Stage 

func (err *ConfigInstallError) Stage() ConfigInstallStage

func (*ConfigInstallError) Unwrap 

func (err *ConfigInstallError) Unwrap() error

type ConfigInstallReceipt 

type ConfigInstallReceipt struct {
	// contains filtered or unexported fields
}

func NewVerifiedConfigInstallReceipt 

func NewVerifiedConfigInstallReceipt(directory ConfigDirectoryIdentity, config ConfigFileIdentity) (ConfigInstallReceipt, error)

func (ConfigInstallReceipt) ByteLength 

func (receipt ConfigInstallReceipt) ByteLength() int64

func (ConfigInstallReceipt) ConfigIdentity 

func (receipt ConfigInstallReceipt) ConfigIdentity() (ConfigFileIdentity, bool)

func (ConfigInstallReceipt) DirectoryIdentity 

func (receipt ConfigInstallReceipt) DirectoryIdentity() (ConfigDirectoryIdentity, bool)

func (ConfigInstallReceipt) Installed 

func (receipt ConfigInstallReceipt) Installed() bool

func (ConfigInstallReceipt) SHA256 

func (receipt ConfigInstallReceipt) SHA256() string

type ConfigInstallStage 

type ConfigInstallStage string
const (
	ConfigInstallStagePrivateDirRace     ConfigInstallStage = "private_dir_race"
	ConfigInstallStageRootSync           ConfigInstallStage = "root_sync"
	ConfigInstallStageRootReattestation  ConfigInstallStage = "root_reattestation"
	ConfigInstallStagePreparedIdentity   ConfigInstallStage = "prepared_identity"
	ConfigInstallStagePreinstall         ConfigInstallStage = "preinstall"
	ConfigInstallStageCollision          ConfigInstallStage = "collision"
	ConfigInstallStageDirectorySync      ConfigInstallStage = "directory_sync"
	ConfigInstallStageFinalReattestation ConfigInstallStage = "final_reattestation"
)

type ConfigInstaller 

type ConfigInstaller interface {
	PrepareConfigDirectory(context.Context, AnchoredRoot) (ConfigDirectoryReceipt, error)
	InstallConfig(context.Context, AnchoredRoot, ConfigDirectoryReceipt, []byte) (ConfigInstallReceipt, error)
}

type ConfigLocalityAttestor 

type ConfigLocalityAttestor interface {
	Attest(context.Context, ConfigLocalityRequest) (ConfigLocalityContext, error)
	Revalidate(context.Context, ConfigLocalityRequest, ConfigLocalityContext) error
}

type ConfigLocalityContext 

type ConfigLocalityContext struct {
	// contains filtered or unexported fields
}

func NewConfigLocalityContext 

func NewConfigLocalityContext(repositoryID string, rootDevice, rootInode uint64, rootUID, rootMode uint32, headCommit, headTree, indexSHA256 string, indexEntryCount int, hasUnmerged bool, applicable []string, config ConfigFileProof, target ParsedTargetProof) (ConfigLocalityContext, error)

func NewFilesystemConfigLocalityContext 

func NewFilesystemConfigLocalityContext(config ConfigFileProof, target ParsedTargetProof) (ConfigLocalityContext, error)

func (ConfigLocalityContext) ApplicableCommitOIDs 

func (context ConfigLocalityContext) ApplicableCommitOIDs() []string

func (ConfigLocalityContext) Checkout 

func (context ConfigLocalityContext) Checkout() (string, string)

func (ConfigLocalityContext) Config 

func (context ConfigLocalityContext) Config() ConfigFileProof

func (ConfigLocalityContext) Equal 

func (context ConfigLocalityContext) Equal(other ConfigLocalityContext) bool

func (ConfigLocalityContext) Index 

func (context ConfigLocalityContext) Index() (string, int, bool)

func (ConfigLocalityContext) Kind 

func (context ConfigLocalityContext) Kind() string

func (ConfigLocalityContext) RepositoryID 

func (context ConfigLocalityContext) RepositoryID() string

func (ConfigLocalityContext) SameRepositoryEnvironment 

func (context ConfigLocalityContext) SameRepositoryEnvironment(other ConfigLocalityContext) bool

func (ConfigLocalityContext) Target 

func (context ConfigLocalityContext) Target() ParsedTargetProof

type ConfigLocalityReason 

type ConfigLocalityReason string
const (
	ConfigLocalityTargetPrivateConfigForbidden    ConfigLocalityReason = "target_private_config_forbidden"
	ConfigLocalityTargetPrivateNamespaceForbidden ConfigLocalityReason = "target_private_namespace_forbidden"
)

func ConfigLocalityReasonFromError 

func ConfigLocalityReasonFromError(err error) (ConfigLocalityReason, bool)

func (ConfigLocalityReason) Valid 

func (reason ConfigLocalityReason) Valid() bool

type ConfigLocalityRequest 

type ConfigLocalityRequest struct {
	// contains filtered or unexported fields
}

func NewConfigLocalityRequest 

func NewConfigLocalityRequest(root AnchoredRoot, config ConfigFileProof, applicable []GitObjectID, target []byte) (ConfigLocalityRequest, error)

func (ConfigLocalityRequest) ApplicableCommits 

func (request ConfigLocalityRequest) ApplicableCommits() []GitObjectID

func (ConfigLocalityRequest) Config 

func (request ConfigLocalityRequest) Config() ConfigFileProof

func (ConfigLocalityRequest) Root 

func (request ConfigLocalityRequest) Root() AnchoredRoot

func (ConfigLocalityRequest) TargetBytes 

func (request ConfigLocalityRequest) TargetBytes() []byte

type ConfigLocalityViolation 

type ConfigLocalityViolation struct {
	// contains filtered or unexported fields
}

func (*ConfigLocalityViolation) Error 

func (violation *ConfigLocalityViolation) Error() string

func (*ConfigLocalityViolation) Reason 

func (violation *ConfigLocalityViolation) Reason() ConfigLocalityReason

func (*ConfigLocalityViolation) Unwrap 

func (violation *ConfigLocalityViolation) Unwrap() error

type ConfigSource 

type ConfigSource interface {
	Present() bool
	Read() ([]byte, ConfigFileIdentity, error)
	Proof() (ConfigFileProof, error)
	DirectoryIdentity() (ConfigDirectoryIdentity, error)
	Revalidate() error
}

ConfigSource is a descriptor-bound view of the sole project-local config.

type ConfigSourceFactory 

type ConfigSourceFactory interface {
	OpenConfigSource(AnchoredRoot, bool) (ConfigSource, error)
}

ConfigSourceFactory opens a config source without giving application code filesystem construction authority.

type ContractCatalog 

type ContractCatalog interface {
	Read(context.Context, AssetID) (AssetMetadata, []byte, error)
	List(context.Context) ([]AssetMetadata, error)
}

ContractCatalog reads contract assets. Read must return newly allocated bytes owned by the caller. List must return every asset exactly once in ascending AssetID.String() order; callers must not infer order from map iteration. The List slice is newly allocated and caller-owned.

type CorruptionDiagnosticDurability 

type CorruptionDiagnosticDurability string

CorruptionDiagnosticDurability explicitly records whether an immutable diagnostic was installed before a post-install durability failure. 

const (
	CorruptionDiagnosticDurable   CorruptionDiagnosticDurability = "diagnostic_durable"
	CorruptionDiagnosticUndurable CorruptionDiagnosticDurability = "diagnostic_undurable"
)

func (CorruptionDiagnosticDurability) Valid 

func (durability CorruptionDiagnosticDurability) Valid() bool

Valid reports whether durability is an explicit diagnostic outcome.

type CorruptionDiagnosticRequest 

type CorruptionDiagnosticRequest struct {
	// contains filtered or unexported fields
}

CorruptionDiagnosticRequest writes one immutable, append-only corruption diagnostic. It has no mutable status or recovery-adoption capability.

func NewCorruptionDiagnosticRequest 

func NewCorruptionDiagnosticRequest(
	run PublicationRun,
	observation CorruptionObservationCAS,
	diagnostic ImmutablePublicationArtifact,
) (CorruptionDiagnosticRequest, error)

NewCorruptionDiagnosticRequest validates immutable diagnostic contents and binds them to one opaque corrupt-observation CAS snapshot.

func (CorruptionDiagnosticRequest) Diagnostic 

func (request CorruptionDiagnosticRequest) Diagnostic() ImmutablePublicationArtifact

Diagnostic returns exact immutable diagnostic bytes.

func (CorruptionDiagnosticRequest) Observation 

func (request CorruptionDiagnosticRequest) Observation() CorruptionObservationCAS

Observation returns the exact opaque corruption observation CAS.

func (CorruptionDiagnosticRequest) ObservationEpoch 

func (request CorruptionDiagnosticRequest) ObservationEpoch() uint64

ObservationEpoch returns the CAS-bound store epoch.

func (CorruptionDiagnosticRequest) ReasonCodes 

func (request CorruptionDiagnosticRequest) ReasonCodes() []string

ReasonCodes returns caller-owned stable corruption reason codes.

func (CorruptionDiagnosticRequest) Run 

func (request CorruptionDiagnosticRequest) Run() PublicationRun

Run returns the exact publication scope.

func (CorruptionDiagnosticRequest) Valid 

func (request CorruptionDiagnosticRequest) Valid() bool

Valid reports whether request is fully bound to a corrupt observation.

type CorruptionDiagnosticResult 

type CorruptionDiagnosticResult struct {
	// contains filtered or unexported fields
}

CorruptionDiagnosticResult exists only after immutable diagnostic bytes were installed. An undurable diagnostic must be re-observed, not retried blindly.

func NewCorruptionDiagnosticResult 

func NewCorruptionDiagnosticResult(diagnostic ImmutablePublicationArtifact, receipt SecureWriteReceipt, durability CorruptionDiagnosticDurability) (CorruptionDiagnosticResult, error)

NewCorruptionDiagnosticResult validates an installed diagnostic receipt.

func NewCorruptionDiagnosticResultForRequest 

func NewCorruptionDiagnosticResultForRequest(
	request CorruptionDiagnosticRequest,
	receipt SecureWriteReceipt,
	durability CorruptionDiagnosticDurability,
) (CorruptionDiagnosticResult, error)

NewCorruptionDiagnosticResultForRequest validates a diagnostic receipt against the exact immutable diagnostic carried by its write request.

func (CorruptionDiagnosticResult) Diagnostic 

func (result CorruptionDiagnosticResult) Diagnostic() ImmutablePublicationArtifact

Diagnostic returns the immutable installed diagnostic identity and bytes.

func (CorruptionDiagnosticResult) Durability 

func (result CorruptionDiagnosticResult) Durability() CorruptionDiagnosticDurability

Durability returns whether post-install durability completed.

func (CorruptionDiagnosticResult) Receipt 

func (result CorruptionDiagnosticResult) Receipt() SecureWriteReceipt

Receipt returns the accepted diagnostic-byte receipt.

func (CorruptionDiagnosticResult) Valid 

func (result CorruptionDiagnosticResult) Valid() bool

Valid reports whether result is coherent.

type CorruptionObservationCAS 

type CorruptionObservationCAS struct {
	// contains filtered or unexported fields
}

CorruptionObservationCAS is an opaque, exact snapshot of the durable classifier facts that selected immutable corruption diagnostics.

func NewCorruptionObservationCAS 

func NewCorruptionObservationCAS(observation PublicationObservation) (CorruptionObservationCAS, error)

NewCorruptionObservationCAS captures only a valid corrupt publication observation. It records both raw classifier input and the classifier-derived reason codes so every corrupt branch can be matched under the write lock.

func (CorruptionObservationCAS) Matches 

func (cas CorruptionObservationCAS) Matches(observation PublicationObservation) bool

Matches reports whether observation is exactly the same durable classifier snapshot. Stores call this only against a re-read made under their write lock.

func (CorruptionObservationCAS) ReasonCodes 

func (cas CorruptionObservationCAS) ReasonCodes() []string

ReasonCodes returns the classifier-derived corruption reason codes.

func (CorruptionObservationCAS) StoreEpoch 

func (cas CorruptionObservationCAS) StoreEpoch() uint64

StoreEpoch returns the exact observed store epoch.

func (CorruptionObservationCAS) Valid 

func (cas CorruptionObservationCAS) Valid() bool

Valid reports whether the CAS contains a complete corrupt classifier snapshot.

type CredentialProjectionDestination 

type CredentialProjectionDestination string

CredentialProjectionDestination is the closed set of provider-owned files that may be seeded into an isolated namespace. 

const (
	CredentialProjectionKimiConfig      CredentialProjectionDestination = "kimi_config"
	CredentialProjectionKimiCredentials CredentialProjectionDestination = "kimi_credentials"
	CredentialProjectionZCodeConfig     CredentialProjectionDestination = "zcode_config"
)

func (CredentialProjectionDestination) Valid 

func (destination CredentialProjectionDestination) Valid() bool

type CredentialProjectionReceipt 

type CredentialProjectionReceipt struct {
	// contains filtered or unexported fields
}

CredentialProjectionReceipt reports a completed seed without exposing its source, destination path, bytes, or content identity.

func NewCredentialProjectionReceipt 

func NewCredentialProjectionReceipt(destination CredentialProjectionDestination) (CredentialProjectionReceipt, error)

func (CredentialProjectionReceipt) Destination 

func (receipt CredentialProjectionReceipt) Destination() CredentialProjectionDestination

type CredentialProjectionRequest 

type CredentialProjectionRequest struct {
	// contains filtered or unexported fields
}

func NewCredentialProjectionRequest 

func NewCredentialProjectionRequest(providerInstance, generation, sourcePath string, source *os.File, sha256 string, size int64, mode os.FileMode, destination CredentialProjectionDestination) (CredentialProjectionRequest, error)

func NewCredentialProjectionRequestWithAuthority 

func NewCredentialProjectionRequestWithAuthority(providerInstance, generation, sourcePath string, source *os.File, sha256 string, size int64, mode os.FileMode, destination CredentialProjectionDestination, authority CredentialSourceAuthority) (CredentialProjectionRequest, error)

NewCredentialProjectionRequestWithAuthority creates a request whose source can be revalidated through a retained descriptor-anchored authority.

func (CredentialProjectionRequest) Destination 

func (request CredentialProjectionRequest) Destination() CredentialProjectionDestination

func (CredentialProjectionRequest) Generation 

func (request CredentialProjectionRequest) Generation() string

func (CredentialProjectionRequest) Mode 

func (request CredentialProjectionRequest) Mode() os.FileMode

func (CredentialProjectionRequest) ProviderInstance 

func (request CredentialProjectionRequest) ProviderInstance() string

func (CredentialProjectionRequest) SHA256 

func (request CredentialProjectionRequest) SHA256() string

func (CredentialProjectionRequest) Size 

func (request CredentialProjectionRequest) Size() int64

func (CredentialProjectionRequest) Source 

func (request CredentialProjectionRequest) Source() *os.File

func (CredentialProjectionRequest) SourceAuthority 

func (request CredentialProjectionRequest) SourceAuthority() CredentialSourceAuthority

func (CredentialProjectionRequest) SourcePath 

func (request CredentialProjectionRequest) SourcePath() string

type CredentialSourceAuthority 

type CredentialSourceAuthority interface {
	ValidateCredentialSource(size int64, mode os.FileMode, sha256 string) error
}

CredentialProjectionRequest declares exactly one already-opened credential or settings source. Source is transferred to ProjectCredential, which closes it on every return path. The source path is canonical and absolute; destination is a closed provider-owned name rather than a caller-selected path. CredentialSourceAuthority revalidates a credential source without trusting its ambient path resolution. Implementations retain their own source anchor.

type DropMetadata 

type DropMetadata struct {
	// contains filtered or unexported fields
}

DropMetadata is the redacted record of a rejected untrusted-byte channel. It intentionally cannot hold source bytes, excerpts, or hashes of blocked bytes.

func NewDropMetadata 

func NewDropMetadata(channel, detector string, count int, sourceIDs []string) (DropMetadata, error)

NewDropMetadata validates redacted metadata for a rejected write.

func (DropMetadata) Channel 

func (metadata DropMetadata) Channel() string

Channel returns the rejected byte channel.

func (DropMetadata) Count 

func (metadata DropMetadata) Count() int

Count returns the number of detections recorded by the detector.

func (DropMetadata) Detector 

func (metadata DropMetadata) Detector() string

Detector returns the detector name, never detector input or matched bytes.

func (DropMetadata) SourceIDs 

func (metadata DropMetadata) SourceIDs() []string

SourceIDs returns a caller-owned copy of redacted source identifiers.

type EnvironmentInspector 

type EnvironmentInspector interface {
	ObservePlatform(context.Context) (PlatformObservation, error)
	ObserveExecutable(context.Context, string) (ExecutableObservation, error)
	ObserveExecutableIdentity(context.Context, string) (ExecutableObservation, error)
	ObserveReadableFileIdentity(context.Context, string) (FileIdentityObservation, error)
	ObserveNativeHomeIdentity(context.Context, string) (NativeHomeLaunchAuthority, error)
	ObservePermission(context.Context, AnchoredRoot, SafeRelativePath) (PermissionObservation, error)
}

EnvironmentInspector observes platform, executable, and permission readiness without importing operating-system or process implementations into the application.

type EnvironmentVariable 

type EnvironmentVariable struct {
	// contains filtered or unexported fields
}

EnvironmentVariable is one explicit, portable process-environment entry.

func NewEnvironmentVariable 

func NewEnvironmentVariable(name, value string) (EnvironmentVariable, error)

NewEnvironmentVariable validates a portable environment name and NUL-free value. The value is otherwise opaque to this provider-neutral port.

func (EnvironmentVariable) Name 

func (variable EnvironmentVariable) Name() string

Name returns the portable environment name.

func (EnvironmentVariable) Valid 

func (variable EnvironmentVariable) Valid() bool

Valid reports whether variable has a portable name and NUL-free value.

func (EnvironmentVariable) Value 

func (variable EnvironmentVariable) Value() string

Value returns the NUL-free environment value.

type ExecutableObservation 

type ExecutableObservation struct {
	// contains filtered or unexported fields
}

ExecutableObservation describes one readiness executable lookup. An absent executable is represented by Found false rather than an invented substitute.

func NewExecutableObservation 

func NewExecutableObservation(name string, found bool, resolvedPath, version, sha256 string) (ExecutableObservation, error)

NewExecutableObservation validates one executable observation. A found executable must have an absolute canonical resolved path; an absent one must not claim path, version, or hash provenance.

func (ExecutableObservation) Found 

func (observation ExecutableObservation) Found() bool

Found reports whether an executable was resolved without substitution.

func (ExecutableObservation) Name 

func (observation ExecutableObservation) Name() string

Name returns the executable lookup name.

func (ExecutableObservation) ResolvedPath 

func (observation ExecutableObservation) ResolvedPath() string

ResolvedPath returns the canonical resolved executable path, if Found.

func (ExecutableObservation) SHA256 

func (observation ExecutableObservation) SHA256() string

SHA256 returns the optional executable provenance hash.

func (ExecutableObservation) Version 

func (observation ExecutableObservation) Version() string

Version returns the observed version string, if recorded.

type FileIdentityObservation 

type FileIdentityObservation struct {
	// contains filtered or unexported fields
}

FileIdentityObservation describes one identity-only readable file lookup. A found file has a canonical absolute path and optional content hash, but no executable or version semantics.

func NewFileIdentityObservation 

func NewFileIdentityObservation(name string, found bool, resolvedPath, sha256 string) (FileIdentityObservation, error)

NewFileIdentityObservation validates one readable file identity observation.

func (FileIdentityObservation) Found 

func (observation FileIdentityObservation) Found() bool

func (FileIdentityObservation) Name 

func (observation FileIdentityObservation) Name() string

func (FileIdentityObservation) ResolvedPath 

func (observation FileIdentityObservation) ResolvedPath() string

func (FileIdentityObservation) SHA256 

func (observation FileIdentityObservation) SHA256() string

type FinalReviewArtifact 

type FinalReviewArtifact struct {
	// contains filtered or unexported fields
}

func NewFinalReviewArtifact 

func NewFinalReviewArtifact(identity FinalReviewIdentity, bytes []byte) (FinalReviewArtifact, error)

NewFinalReviewArtifact validates a final identity against exact bytes and takes ownership of bytes.

func (FinalReviewArtifact) Bytes 

func (artifact FinalReviewArtifact) Bytes() []byte

Bytes returns a caller-owned copy of exact final review bytes.

func (FinalReviewArtifact) Identity 

func (artifact FinalReviewArtifact) Identity() FinalReviewIdentity

Identity returns the final review identity.

func (FinalReviewArtifact) Valid 

func (artifact FinalReviewArtifact) Valid() bool

Valid reports whether final identity and bytes are coherent.

type FinalReviewIdentity 

type FinalReviewIdentity struct {
	// contains filtered or unexported fields
}

FinalReviewIdentity identifies the one immutable final review to be published. Its ReviewID is issued by PublicationStore only after final validation has succeeded.

func NewFinalReviewIdentity 

func NewFinalReviewIdentity(reviewID domain.ReviewID, path SafeRelativePath, sha256 string) (FinalReviewIdentity, error)

NewFinalReviewIdentity validates immutable final-review identity.

func (FinalReviewIdentity) Path 

func (identity FinalReviewIdentity) Path() SafeRelativePath

Path returns the canonical final path beneath the run root.

func (FinalReviewIdentity) ReviewID 

func (identity FinalReviewIdentity) ReviewID() domain.ReviewID

ReviewID returns the publisher-issued review identity.

func (FinalReviewIdentity) SHA256 

func (identity FinalReviewIdentity) SHA256() string

SHA256 returns the canonical final-byte integrity identifier.

func (FinalReviewIdentity) Valid 

func (identity FinalReviewIdentity) Valid() bool

Valid reports whether identity is complete and canonical.

type GitCaptureRequest 

type GitCaptureRequest struct {
	// contains filtered or unexported fields
}

GitCaptureRequest selects a Git target before symbolic references are resolved. The resulting CapturedGitTarget, not these references, is the immutable target identity.

func NewGitCaptureRequest 

func NewGitCaptureRequest(projectRoot AnchoredRoot, baseReference, headReference string, includeUntracked bool) (GitCaptureRequest, error)

NewGitCaptureRequest validates a Git target selection. Both references are required so a capture request has an explicit comparison basis.

func (GitCaptureRequest) BaseReference 

func (request GitCaptureRequest) BaseReference() string

BaseReference returns the requested base revision before resolution.

func (GitCaptureRequest) HeadReference 

func (request GitCaptureRequest) HeadReference() string

HeadReference returns the requested head revision before resolution.

func (GitCaptureRequest) IncludeUntracked 

func (request GitCaptureRequest) IncludeUntracked() bool

IncludeUntracked reports whether the capture must include an untracked manifest.

func (GitCaptureRequest) ProjectRoot 

func (request GitCaptureRequest) ProjectRoot() AnchoredRoot

ProjectRoot returns the approved project root.

type GitObjectID 

type GitObjectID struct {
	// contains filtered or unexported fields
}

GitObjectID is a canonical SHA-1 or SHA-256 Git object identifier.

func ParseGitObjectID 

func ParseGitObjectID(value string) (GitObjectID, error)

ParseGitObjectID validates a lowercase 40- or 64-hex Git object identifier.

func (GitObjectID) String 

func (id GitObjectID) String() string

String returns the canonical Git object identifier.

func (GitObjectID) Valid 

func (id GitObjectID) Valid() bool

Valid reports whether id is a canonical Git object identifier.

type GitTargetCapture 

type GitTargetCapture interface {
	Capture(context.Context, GitCaptureRequest) (CapturedGitTarget, error)
}

GitTargetCapture resolves revisions and captures immutable Git target bytes.

type IDGenerator 

type IDGenerator interface {
	NewSessionID(now time.Time) (domain.SessionID, error)
	NewRunID(now time.Time) (domain.RunID, error)
	NewAttemptID(now time.Time) (domain.AttemptID, error)
	NewReviewID(now time.Time) (domain.ReviewID, error)
}

IDGenerator creates canonical UUIDv7 identifiers from an injected timestamp. Implementations must surface clock regression rather than silently hiding it.

type IdentityObservationError 

type IdentityObservationError struct {
	// contains filtered or unexported fields
}

IdentityObservationError is a redacted, typed identity-observation failure.

func (*IdentityObservationError) Error 

func (failure *IdentityObservationError) Error() string

type IdentityObservationFailureKind 

type IdentityObservationFailureKind string

IdentityObservationFailureKind classifies failures that are safe for provider-family scoped admission handling. Unknown failures remain ordinary errors and must not be downgraded by callers. 

const (
	IdentityObservationUnavailable IdentityObservationFailureKind = "unavailable"
	IdentityObservationSecurity    IdentityObservationFailureKind = "security"
)

func IdentityObservationFailure 

func IdentityObservationFailure(err error) (IdentityObservationFailureKind, bool)

IdentityObservationFailure returns the classified failure kind when err is safe for family-scoped admission handling.

type ImmutablePublicationArtifact 

type ImmutablePublicationArtifact struct {
	// contains filtered or unexported fields
}

ImmutablePublicationArtifact is validated immutable artifact bytes. Bytes always returns a caller-owned copy.

func NewImmutablePublicationArtifact 

func NewImmutablePublicationArtifact(path SafeRelativePath, sha256 string, bytes []byte) (ImmutablePublicationArtifact, error)

NewImmutablePublicationArtifact validates identity against exact immutable bytes and takes ownership of bytes.

func (ImmutablePublicationArtifact) Bytes 

func (artifact ImmutablePublicationArtifact) Bytes() []byte

Bytes returns a caller-owned copy of the immutable artifact bytes.

func (ImmutablePublicationArtifact) Path 

func (artifact ImmutablePublicationArtifact) Path() SafeRelativePath

Path returns the canonical artifact path beneath the run root.

func (ImmutablePublicationArtifact) SHA256 

func (artifact ImmutablePublicationArtifact) SHA256() string

SHA256 returns the canonical exact-byte integrity identifier.

func (ImmutablePublicationArtifact) Valid 

func (artifact ImmutablePublicationArtifact) Valid() bool

Valid reports whether identity and bytes are coherent.

type InstallFinalDurability 

type InstallFinalDurability string

InstallFinalDurability explicitly records whether a final was installed but its containing-directory durability step failed. 

const (
	InstallFinalDurable   InstallFinalDurability = "final_installed_durable"
	InstallFinalUndurable InstallFinalDurability = "final_installed_undurable"
)

func (InstallFinalDurability) Valid 

func (durability InstallFinalDurability) Valid() bool

Valid reports whether durability is an explicit final-install outcome.

type InstallFinalRequest 

type InstallFinalRequest struct {
	// contains filtered or unexported fields
}

InstallFinalRequest atomically moves a previously staged final to its final no-replace path. It can only be built from a validated staged result.

func NewInstallFinalRequest 

func NewInstallFinalRequest(run PublicationRun, staged StageFinalResult) (InstallFinalRequest, error)

NewInstallFinalRequest validates an install request from exact staged facts.

func (InstallFinalRequest) Run 

func (request InstallFinalRequest) Run() PublicationRun

Run returns the exact publication scope.

func (InstallFinalRequest) Staged 

func (request InstallFinalRequest) Staged() StageFinalResult

Staged returns the exact staged final to install.

func (InstallFinalRequest) Valid 

func (request InstallFinalRequest) Valid() bool

Valid reports whether request is a canonical final-install request.

type InstallFinalResult 

type InstallFinalResult struct {
	// contains filtered or unexported fields
}

InstallFinalResult exists only after the immutable final path was installed. InstallFinalUndurable must be followed by ObserveRun, never blind retry.

func NewInstallFinalResult 

func NewInstallFinalResult(final FinalReviewIdentity, receipt SecureWriteReceipt, durability InstallFinalDurability) (InstallFinalResult, error)

NewInstallFinalResult validates an installed final-file receipt.

func NewInstallFinalResultForRequest 

func NewInstallFinalResultForRequest(
	request InstallFinalRequest,
	receipt SecureWriteReceipt,
	durability InstallFinalDurability,
) (InstallFinalResult, error)

NewInstallFinalResultForRequest validates an install receipt against the exact staged result carried by the install request.

func (InstallFinalResult) Durability 

func (result InstallFinalResult) Durability() InstallFinalDurability

Durability returns whether post-install durability completed.

func (InstallFinalResult) Final 

func (result InstallFinalResult) Final() FinalReviewIdentity

Final returns the installed final identity.

func (InstallFinalResult) Receipt 

func (result InstallFinalResult) Receipt() SecureWriteReceipt

Receipt returns the accepted final-byte receipt.

func (InstallFinalResult) Valid 

func (result InstallFinalResult) Valid() bool

Valid reports whether result is coherent.

type InvocationIdentityGenerator 

type InvocationIdentityGenerator interface {
	NewRoleTaskID(now time.Time) (string, error)
	NewSourceInvocationID(now time.Time) (string, error)
	NewExecutionInvocationID(now time.Time) (string, error)
}

InvocationIdentityGenerator creates provider invocation identity through the same monotonic UUIDv7 issuance path as other runtime identifiers.

type IssueReviewIDRequest 

type IssueReviewIDRequest struct {
	// contains filtered or unexported fields
}

IssueReviewIDRequest proves which final validated candidate is about to enter publication. PublicationStore issues its ReviewID after validation, rather than accepting a provider or caller-generated identifier.

func NewIssueReviewIDRequest 

func NewIssueReviewIDRequest(run PublicationRun, validatedCandidateSHA256 string) (IssueReviewIDRequest, error)

NewIssueReviewIDRequest validates post-validation ReviewID issuance input.

func (IssueReviewIDRequest) Run 

func (request IssueReviewIDRequest) Run() PublicationRun

Run returns the exact publication scope.

func (IssueReviewIDRequest) ValidatedCandidateSHA256 

func (request IssueReviewIDRequest) ValidatedCandidateSHA256() string

ValidatedCandidateSHA256 returns the validation-bound candidate identity.

type IssuedFinalBinding 

type IssuedFinalBinding struct {
	// contains filtered or unexported fields
}

IssuedFinalBinding is the explicit relation between the semantic candidate identity bound at ReviewID issuance and the final artifact's raw-byte identity. The two SHA-256 values deliberately cover different representations and are never compared directly; the shared issued ReviewID is the validated join.

func NewIssuedFinalBinding 

func NewIssuedFinalBinding(issued IssuedReviewID, final FinalReviewIdentity) (IssuedFinalBinding, error)

NewIssuedFinalBinding validates the only permitted semantic-candidate to final-artifact relation.

func (IssuedFinalBinding) Final 

func (binding IssuedFinalBinding) Final() FinalReviewIdentity

Final returns the exact immutable final identity joined to issuance.

func (IssuedFinalBinding) FinalSHA256 

func (binding IssuedFinalBinding) FinalSHA256() string

FinalSHA256 returns the raw final-artifact identity.

func (IssuedFinalBinding) IssuedReviewID 

func (binding IssuedFinalBinding) IssuedReviewID() IssuedReviewID

IssuedReviewID returns the post-validation issuance fact.

func (IssuedFinalBinding) Valid 

func (binding IssuedFinalBinding) Valid() bool

Valid reports whether the semantic candidate and final identities have an explicit, non-forgeable-in-ports ReviewID join.

func (IssuedFinalBinding) ValidatedCandidateSHA256 

func (binding IssuedFinalBinding) ValidatedCandidateSHA256() string

ValidatedCandidateSHA256 returns the semantic candidate identity.

type IssuedReviewID 

type IssuedReviewID struct {
	// contains filtered or unexported fields
}

IssuedReviewID binds a publisher-issued ReviewID to the semantic candidate identity that passed validation before final serialization.

func NewIssuedReviewID 

func NewIssuedReviewID(reviewID domain.ReviewID, validatedCandidateSHA256 string) (IssuedReviewID, error)

NewIssuedReviewID validates a publisher-issued post-validation ReviewID.

func (IssuedReviewID) ReviewID 

func (issued IssuedReviewID) ReviewID() domain.ReviewID

ReviewID returns the publisher-issued domain identifier.

func (IssuedReviewID) Valid 

func (issued IssuedReviewID) Valid() bool

Valid reports whether issuance is bound to a valid ReviewID and candidate hash.

func (IssuedReviewID) ValidatedCandidateSHA256 

func (issued IssuedReviewID) ValidatedCandidateSHA256() string

ValidatedCandidateSHA256 returns the semantic candidate identity bound at issuance.

type LaneAcquisitionFailure 

type LaneAcquisitionFailure interface {
	error
	LaneAcquisitionFailureClass() LaneAcquisitionFailureClass
}

LaneAcquisitionFailure is implemented by adapter errors that carry a safe, policy-relevant acquisition class without exposing raw filesystem text.

type LaneAcquisitionFailureClass 

type LaneAcquisitionFailureClass string

LaneAcquisitionFailureClass is the closed policy-relevant cause of a failed cross-process lane acquisition. 

const (
	LaneAcquisitionUnavailable   LaneAcquisitionFailureClass = "unavailable"
	LaneAcquisitionConfiguration LaneAcquisitionFailureClass = "configuration"
	LaneAcquisitionSecurity      LaneAcquisitionFailureClass = "security"
	LaneAcquisitionInternal      LaneAcquisitionFailureClass = "internal"
)

func ClassifyLaneAcquisitionFailure 

func ClassifyLaneAcquisitionFailure(err error) LaneAcquisitionFailureClass

ClassifyLaneAcquisitionFailure returns the closed class carried by err. Unknown adapter errors fail closed as internal rather than becoming fallback-eligible provider unavailability.

func (LaneAcquisitionFailureClass) Valid 

func (class LaneAcquisitionFailureClass) Valid() bool

Valid reports whether the class is a closed lane-acquisition cause.

type LaneLease 

type LaneLease interface {
	Key() ConcurrencyKey
	Release() error
}

LaneLease is an acquired authoritative lane lock. The key identifies exactly the lane held by the lease; Release relinquishes that authority.

type LaneLocker 

type LaneLocker interface {
	Acquire(context.Context, ConcurrencyKey) (LaneLease, error)
}

LaneLocker acquires authoritative cross-process serialization for one normalized lane key. Implementations must reject a nil context and must use the operating-system lock primitive as authority; stale lock metadata is diagnostic only and cannot block acquisition by itself.

type MutableCASExpectation 

type MutableCASExpectation struct {
	// contains filtered or unexported fields
}

MutableCASExpectation states exactly whether a mutable record must be absent or match one expected prior SHA-256. It cannot represent both.

func ExpectMutableAbsent 

func ExpectMutableAbsent() MutableCASExpectation

ExpectMutableAbsent creates an absence-only compare-and-swap expectation.

func ExpectMutableSHA256 

func ExpectMutableSHA256(sha256 string) (MutableCASExpectation, error)

ExpectMutableSHA256 creates a hash-only compare-and-swap expectation.

func (MutableCASExpectation) ExpectedSHA256 

func (expectation MutableCASExpectation) ExpectedSHA256() (string, bool)

ExpectedSHA256 returns the expected prior hash when the prior must exist.

func (MutableCASExpectation) MustBeAbsent 

func (expectation MutableCASExpectation) MustBeAbsent() bool

MustBeAbsent reports whether the expected prior state is exact absence.

func (MutableCASExpectation) Valid 

func (expectation MutableCASExpectation) Valid() bool

Valid reports whether expectation is one non-contradictory CAS state.

type MutablePublicationDocument 

type MutablePublicationDocument string

MutablePublicationDocument is the closed mutable publication record set. 

const (
	MutablePublicationStatus  MutablePublicationDocument = "status"
	MutablePublicationJournal MutablePublicationDocument = "journal"
)

func (MutablePublicationDocument) Valid 

func (document MutablePublicationDocument) Valid() bool

Valid reports whether document is an allowed mutable publication record.

type MutableReplaceDurability 

type MutableReplaceDurability string

MutableReplaceDurability explicitly records whether replacement occurred before a post-replacement durability failure. 

const (
	MutableReplaceDurable   MutableReplaceDurability = "replaced_durable"
	MutableReplaceUndurable MutableReplaceDurability = "replaced_undurable"
)

func (MutableReplaceDurability) Valid 

func (durability MutableReplaceDurability) Valid() bool

Valid reports whether durability is an explicit mutable replacement outcome.

type MutableReplaceRequest 

type MutableReplaceRequest struct {
	// contains filtered or unexported fields
}

MutableReplaceRequest atomically replaces one mutable status or journal record only when ExpectedPrior still matches. Replacement returns copied exact bytes so the adapter cannot retain caller-owned memory.

func NewMutableReplaceRequest 

func NewMutableReplaceRequest(
	run PublicationRun,
	document MutablePublicationDocument,
	path SafeRelativePath,
	expectedPrior MutableCASExpectation,
	replacement []byte,
	sha256 string,
) (MutableReplaceRequest, error)

NewMutableReplaceRequest validates exact mutable replacement bytes and CAS.

func (MutableReplaceRequest) Document 

func (request MutableReplaceRequest) Document() MutablePublicationDocument

Document returns the closed mutable record kind.

func (MutableReplaceRequest) ExpectedPrior 

func (request MutableReplaceRequest) ExpectedPrior() MutableCASExpectation

ExpectedPrior returns the exact compare-and-swap expectation.

func (MutableReplaceRequest) Path 

func (request MutableReplaceRequest) Path() SafeRelativePath

Path returns the exact mutable record path.

func (MutableReplaceRequest) Replacement 

func (request MutableReplaceRequest) Replacement() []byte

Replacement returns a caller-owned copy of replacement bytes.

func (MutableReplaceRequest) Run 

func (request MutableReplaceRequest) Run() PublicationRun

Run returns the exact publication scope.

func (MutableReplaceRequest) SHA256 

func (request MutableReplaceRequest) SHA256() string

SHA256 returns the canonical replacement-byte integrity identifier.

func (MutableReplaceRequest) Valid 

func (request MutableReplaceRequest) Valid() bool

Valid reports whether the request is a canonical, byte-bound CAS replacement.

type MutableReplaceResult 

type MutableReplaceResult struct {
	// contains filtered or unexported fields
}

MutableReplaceResult exists only when the exact request replacement occurred. An undurable result requires ObserveRun before another CAS attempt.

func NewMutableReplaceResult 

func NewMutableReplaceResult(
	request MutableReplaceRequest,
	receipt SecureWriteReceipt,
	durability MutableReplaceDurability,
) (MutableReplaceResult, error)

NewMutableReplaceResult validates a receipt against the exact replacement request, including destination, SHA-256, and byte length.

func (MutableReplaceResult) Document 

func (result MutableReplaceResult) Document() MutablePublicationDocument

Document returns the replaced mutable document kind.

func (MutableReplaceResult) Durability 

func (result MutableReplaceResult) Durability() MutableReplaceDurability

Durability returns whether post-replacement durability completed.

func (MutableReplaceResult) Path 

func (result MutableReplaceResult) Path() SafeRelativePath

Path returns the replaced mutable record path.

func (MutableReplaceResult) Receipt 

func (result MutableReplaceResult) Receipt() SecureWriteReceipt

Receipt returns the accepted replacement-byte receipt.

func (MutableReplaceResult) Valid 

func (result MutableReplaceResult) Valid() bool

Valid reports whether result is coherent.

type NativeHomeLaunchAuthority 

type NativeHomeLaunchAuthority struct {
	// contains filtered or unexported fields
}

NativeHomeLaunchAuthority is the immutable installed-user HOME identity required by a descriptor-bound provider launch. It is intentionally absent from process observations and receipts.

func NewNativeHomeLaunchAuthority 

func NewNativeHomeLaunchAuthority(path string, device, inode uint64, effectiveUID uint32) (NativeHomeLaunchAuthority, error)

NewNativeHomeLaunchAuthority constructs an exact, canonical native-home identity captured by the composition root.

func (NativeHomeLaunchAuthority) Device 

func (authority NativeHomeLaunchAuthority) Device() uint64

Device returns the captured filesystem device.

func (NativeHomeLaunchAuthority) EffectiveUID 

func (authority NativeHomeLaunchAuthority) EffectiveUID() uint32

EffectiveUID returns the captured installed-user effective UID.

func (NativeHomeLaunchAuthority) Inode 

func (authority NativeHomeLaunchAuthority) Inode() uint64

Inode returns the captured filesystem inode.

func (NativeHomeLaunchAuthority) Path 

func (authority NativeHomeLaunchAuthority) Path() string

Path returns the canonical native-home path for the protected launch only.

func (NativeHomeLaunchAuthority) Valid 

func (authority NativeHomeLaunchAuthority) Valid() bool

Valid reports whether authority has a complete canonical identity.

type ObserveRunRequest 

type ObserveRunRequest struct {
	// contains filtered or unexported fields
}

ObserveRunRequest bounds one durable publication observation.

func NewObserveRunRequest 

func NewObserveRunRequest(run PublicationRun, maxReadBytes int64) (ObserveRunRequest, error)

NewObserveRunRequest validates an observation scope and positive per-file observation limit.

func (ObserveRunRequest) MaxReadBytes 

func (request ObserveRunRequest) MaxReadBytes() int64

MaxReadBytes returns the positive per-file observation cap.

func (ObserveRunRequest) Run 

func (request ObserveRunRequest) Run() PublicationRun

Run returns the exact publication scope.

type ObservedMutablePublicationDocument 

type ObservedMutablePublicationDocument struct {
	// contains filtered or unexported fields
}

ObservedMutablePublicationDocument is one exact mutable publication record observed during one atomic ObserveRun operation. Bytes always returns a caller-owned copy.

func NewMissingMutablePublicationDocument 

func NewMissingMutablePublicationDocument(
	document MutablePublicationDocument,
	path SafeRelativePath,
) (ObservedMutablePublicationDocument, error)

NewMissingMutablePublicationDocument records that a canonical mutable path was absent during the same atomic observation as immutable P2 authority.

func NewObservedMutablePublicationDocument 

func NewObservedMutablePublicationDocument(
	document MutablePublicationDocument,
	path SafeRelativePath,
	sha256 string,
	bytes []byte,
) (ObservedMutablePublicationDocument, error)

NewObservedMutablePublicationDocument validates one closed mutable document kind against exact observed bytes and takes ownership of bytes.

func (ObservedMutablePublicationDocument) Bytes 

func (observed ObservedMutablePublicationDocument) Bytes() []byte

Bytes returns a caller-owned copy of exact observed bytes.

func (ObservedMutablePublicationDocument) Document 

func (observed ObservedMutablePublicationDocument) Document() MutablePublicationDocument

Document returns the closed mutable publication document kind.

func (ObservedMutablePublicationDocument) Path 

func (observed ObservedMutablePublicationDocument) Path() SafeRelativePath

Path returns the canonical observed mutable-record path.

func (ObservedMutablePublicationDocument) Present 

func (observed ObservedMutablePublicationDocument) Present() bool

Present reports whether bytes existed at the canonical mutable path.

func (ObservedMutablePublicationDocument) SHA256 

func (observed ObservedMutablePublicationDocument) SHA256() string

SHA256 returns the canonical exact-byte integrity identifier.

func (ObservedMutablePublicationDocument) Valid 

func (observed ObservedMutablePublicationDocument) Valid() bool

Valid reports whether the closed document identity and bytes are coherent.

type ObservedReviewProvider 

type ObservedReviewProvider interface {
	Observe(context.Context, ProviderInvocation) (ProviderExecutionObservation, error)
}

ObservedReviewProvider is the provider execution boundary that returns immutable provider-neutral execution facts. An ordinary provider or process failure must be returned as a failed observation with a nil error; error is reserved for a boundary or internal inability to produce a coherent observation. Calls for distinct coordinator concurrency lanes may occur concurrently, so implementations must be concurrency-safe or serialize internally.

type ParsedTargetProof 

type ParsedTargetProof struct {
	SHA256          string
	Parsed          bool
	PrivatePathFree bool
}

type PermissionObservation 

type PermissionObservation struct {
	// contains filtered or unexported fields
}

PermissionObservation records access bits for one approved relative path.

func NewPermissionObservation 

func NewPermissionObservation(path SafeRelativePath, readable, writable, executable bool) (PermissionObservation, error)

NewPermissionObservation validates one permission observation.

func (PermissionObservation) Executable 

func (observation PermissionObservation) Executable() bool

Executable reports whether the path is executable by the inspected process.

func (PermissionObservation) Path 

func (observation PermissionObservation) Path() SafeRelativePath

Path returns the observed project-relative path.

func (PermissionObservation) Readable 

func (observation PermissionObservation) Readable() bool

Readable reports whether the path is readable by the inspected process.

func (PermissionObservation) Writable 

func (observation PermissionObservation) Writable() bool

Writable reports whether the path is writable by the inspected process.

type PersistAuxiliaryArtifactRequest 

type PersistAuxiliaryArtifactRequest struct {
	// contains filtered or unexported fields
}

PersistAuxiliaryArtifactRequest binds one exact immutable run-support artifact to a run. Its kind is derived from the canonical path, never caller supplied.

func NewPersistAuxiliaryArtifactRequest 

func NewPersistAuxiliaryArtifactRequest(
	run PublicationRun,
	artifact ImmutablePublicationArtifact,
) (PersistAuxiliaryArtifactRequest, error)

NewPersistAuxiliaryArtifactRequest validates a no-replace run-support write.

func NewPersistRunSupportArtifactRequest 

func NewPersistRunSupportArtifactRequest(
	run PublicationRun,
	artifact ImmutablePublicationArtifact,
) (PersistAuxiliaryArtifactRequest, error)

NewPersistRunSupportArtifactRequest is the canonical run-support constructor.

func (PersistAuxiliaryArtifactRequest) Artifact 

func (request PersistAuxiliaryArtifactRequest) Artifact() ImmutablePublicationArtifact

Artifact returns the exact immutable run-support artifact.

func (PersistAuxiliaryArtifactRequest) Kind 

func (request PersistAuxiliaryArtifactRequest) Kind() RunSupportArtifactKind

Kind returns the path-derived closed run-support artifact kind.

func (PersistAuxiliaryArtifactRequest) Run 

func (request PersistAuxiliaryArtifactRequest) Run() PublicationRun

Run returns the exact publication scope.

type PersistAuxiliaryArtifactResult 

type PersistAuxiliaryArtifactResult struct {
	// contains filtered or unexported fields
}

PersistAuxiliaryArtifactResult exists only after exact run-support bytes were installed. An undurable result must be followed by ObserveRun, not retried.

func NewPersistAuxiliaryArtifactResult 

func NewPersistAuxiliaryArtifactResult(
	artifact ImmutablePublicationArtifact,
	receipt SecureWriteReceipt,
	durability AuxiliaryArtifactDurability,
) (PersistAuxiliaryArtifactResult, error)

NewPersistAuxiliaryArtifactResult validates an installed run-support receipt.

func (PersistAuxiliaryArtifactResult) Artifact 

func (result PersistAuxiliaryArtifactResult) Artifact() ImmutablePublicationArtifact

Artifact returns the installed immutable run-support artifact.

func (PersistAuxiliaryArtifactResult) Durability 

func (result PersistAuxiliaryArtifactResult) Durability() AuxiliaryArtifactDurability

Durability returns the explicit post-install durability outcome.

func (PersistAuxiliaryArtifactResult) Receipt 

func (result PersistAuxiliaryArtifactResult) Receipt() SecureWriteReceipt

Receipt returns the exact no-replace receipt.

func (PersistAuxiliaryArtifactResult) Valid 

func (result PersistAuxiliaryArtifactResult) Valid() bool

Valid reports whether result facts are coherent.

type PersistValidatedCandidateRequest 

type PersistValidatedCandidateRequest struct {
	// contains filtered or unexported fields
}

PersistValidatedCandidateRequest persists the exact schema-validated final candidate before any recoverable publication journal hint is written.

func NewPersistValidatedCandidateRequest 

func NewPersistValidatedCandidateRequest(
	run PublicationRun,
	candidate FinalReviewArtifact,
) (PersistValidatedCandidateRequest, error)

NewPersistValidatedCandidateRequest validates a no-replace candidate write.

func (PersistValidatedCandidateRequest) Candidate 

func (request PersistValidatedCandidateRequest) Candidate() FinalReviewArtifact

Candidate returns exact final candidate bytes with defensive byte accessors.

func (PersistValidatedCandidateRequest) Path 

func (request PersistValidatedCandidateRequest) Path() SafeRelativePath

Path returns the canonical no-replace candidate destination.

func (PersistValidatedCandidateRequest) Run 

func (request PersistValidatedCandidateRequest) Run() PublicationRun

Run returns the exact publication scope.

type PersistValidatedCandidateResult 

type PersistValidatedCandidateResult struct {
	// contains filtered or unexported fields
}

PersistValidatedCandidateResult exists only after exact candidate bytes were installed at Path. An undurable result must be re-observed, never retried.

func NewPersistValidatedCandidateResult 

func NewPersistValidatedCandidateResult(
	candidate FinalReviewArtifact,
	path SafeRelativePath,
	receipt SecureWriteReceipt,
	durability ValidatedCandidateDurability,
) (PersistValidatedCandidateResult, error)

NewPersistValidatedCandidateResult validates an installed candidate receipt.

func (PersistValidatedCandidateResult) Candidate 

func (result PersistValidatedCandidateResult) Candidate() FinalReviewArtifact

Candidate returns exact installed candidate bytes with defensive accessors.

func (PersistValidatedCandidateResult) Durability 

func (result PersistValidatedCandidateResult) Durability() ValidatedCandidateDurability

Durability returns the explicit post-install durability outcome.

func (PersistValidatedCandidateResult) Path 

func (result PersistValidatedCandidateResult) Path() SafeRelativePath

Path returns the installed canonical candidate destination.

func (PersistValidatedCandidateResult) Receipt 

func (result PersistValidatedCandidateResult) Receipt() SecureWriteReceipt

Receipt returns the exact accepted no-replace receipt.

func (PersistValidatedCandidateResult) Valid 

func (result PersistValidatedCandidateResult) Valid() bool

Valid reports whether result facts are coherent.

type PlatformObservation 

type PlatformObservation struct {
	// contains filtered or unexported fields
}

PlatformObservation describes the platform observed by a readiness check.

func NewPlatformObservation 

func NewPlatformObservation(operatingSystem, architecture string) (PlatformObservation, error)

NewPlatformObservation validates one observed operating system and architecture.

func (PlatformObservation) Architecture 

func (observation PlatformObservation) Architecture() string

Architecture returns the observed architecture name.

func (PlatformObservation) OperatingSystem 

func (observation PlatformObservation) OperatingSystem() string

OperatingSystem returns the observed operating system name.

type PrepareCompositeRequest 

type PrepareCompositeRequest struct {
	// contains filtered or unexported fields
}

PrepareCompositeRequest binds one complete immutable composite to its three canonical durable staging sources. The final commit may only consume a PreparedComposite returned for this exact request.

func NewPrepareCompositeRequest 

func NewPrepareCompositeRequest(composite CommitCompositeRequest) (PrepareCompositeRequest, error)

NewPrepareCompositeRequest derives and validates the only permitted temporary-source paths for an immutable composite.

func (PrepareCompositeRequest) Composite 

func (request PrepareCompositeRequest) Composite() CommitCompositeRequest

Composite returns the exact immutable composite whose members are staged.

func (PrepareCompositeRequest) StagedEpochPath 

func (request PrepareCompositeRequest) StagedEpochPath() SafeRelativePath

StagedEpochPath returns the canonical epoch temporary source.

func (PrepareCompositeRequest) StagedLineageEdgePath 

func (request PrepareCompositeRequest) StagedLineageEdgePath() SafeRelativePath

StagedLineageEdgePath returns the canonical lineage-edge temporary source.

func (PrepareCompositeRequest) StagedManifestPath 

func (request PrepareCompositeRequest) StagedManifestPath() SafeRelativePath

StagedManifestPath returns the canonical manifest temporary source.

type PreparedComposite 

type PreparedComposite struct {
	// contains filtered or unexported fields
}

PreparedComposite is the exact, fsync-attempted temporary composite consumed by CommitPreparedComposite. It includes no authority or recovery policy.

func NewPreparedComposite 

func NewPreparedComposite(
	request PrepareCompositeRequest,
	stagedManifest ImmutablePublicationArtifact,
	stagedLineage ImmutablePublicationArtifact,
	stagedEpoch ImmutablePublicationArtifact,
	receipts []SecureWriteReceipt,
	durability CompositePreparationDurability,
) (PreparedComposite, error)

NewPreparedComposite validates staged exact-byte artifacts and receipts.

func (PreparedComposite) Composite 

func (prepared PreparedComposite) Composite() CommitCompositeRequest

Composite returns the immutable composite that may be committed.

func (PreparedComposite) Durability 

func (prepared PreparedComposite) Durability() CompositePreparationDurability

Durability returns the explicit preparation durability outcome.

func (PreparedComposite) Receipts 

func (prepared PreparedComposite) Receipts() []SecureWriteReceipt

Receipts returns caller-owned preparation receipts in canonical source order.

func (PreparedComposite) Request 

func (prepared PreparedComposite) Request() PrepareCompositeRequest

Request returns the bound staged composite request.

func (PreparedComposite) StagedEpoch 

func (prepared PreparedComposite) StagedEpoch() ImmutablePublicationArtifact

StagedEpoch returns exact staged epoch material.

func (PreparedComposite) StagedLineageEdge 

func (prepared PreparedComposite) StagedLineageEdge() ImmutablePublicationArtifact

StagedLineageEdge returns exact staged lineage-edge material.

func (PreparedComposite) StagedManifest 

func (prepared PreparedComposite) StagedManifest() ImmutablePublicationArtifact

StagedManifest returns exact staged manifest material.

func (PreparedComposite) Valid 

func (prepared PreparedComposite) Valid() bool

Valid reports whether the exact staged material is coherent.

type ProcessExecutionError 

type ProcessExecutionError struct {
	// contains filtered or unexported fields
}

ProcessExecutionError preserves the closed primary cause and any captured streams when a runner cannot return a coherent ProcessObservation. Cleanup failure is supplemental: it never replaces the initiating cause. The wrapped error is retained only for local causal inspection; Error itself is a closed safe projection and never includes adapter text.

func NewProcessExecutionError 

func NewProcessExecutionError(
	primaryCause domain.RuntimeDiagnosticCause,
	cleanupCause domain.RuntimeDiagnosticCause,
	stdout, stderr []byte,
	err error,
) (*ProcessExecutionError, error)

NewProcessExecutionError constructs a safe typed process failure. Primary cause is mandatory. Cleanup cause, when present, must be the dedicated process-group cleanup cause.

func (*ProcessExecutionError) CleanupCause 

func (failure *ProcessExecutionError) CleanupCause() (domain.RuntimeDiagnosticCause, bool)

func (*ProcessExecutionError) Error 

func (failure *ProcessExecutionError) Error() string

func (*ProcessExecutionError) PrimaryCause 

func (failure *ProcessExecutionError) PrimaryCause() domain.RuntimeDiagnosticCause

func (*ProcessExecutionError) Stderr 

func (failure *ProcessExecutionError) Stderr() []byte

func (*ProcessExecutionError) Stdout 

func (failure *ProcessExecutionError) Stdout() []byte

func (*ProcessExecutionError) Unwrap 

func (failure *ProcessExecutionError) Unwrap() error

type ProcessFinalTermination 

type ProcessFinalTermination struct {
	// contains filtered or unexported fields
}

func NewExitedProcessFinalTermination 

func NewExitedProcessFinalTermination(exitCode int) (ProcessFinalTermination, error)

func NewSignaledProcessFinalTermination 

func NewSignaledProcessFinalTermination(signal ProcessSignal) (ProcessFinalTermination, error)

func (ProcessFinalTermination) ExitCode 

func (f ProcessFinalTermination) ExitCode() (int, bool)

func (ProcessFinalTermination) Kind 

func (f ProcessFinalTermination) Kind() ProcessFinalTerminationKind

func (ProcessFinalTermination) Signal 

func (f ProcessFinalTermination) Signal() (ProcessSignal, bool)

func (ProcessFinalTermination) Valid 

func (f ProcessFinalTermination) Valid() bool

type ProcessFinalTerminationKind 

type ProcessFinalTerminationKind string
const (
	ProcessFinalTerminationExited   ProcessFinalTerminationKind = "exited"
	ProcessFinalTerminationSignaled ProcessFinalTerminationKind = "signaled"
)

type ProcessGroupSignalRequestReason 

type ProcessGroupSignalRequestReason string
const (
	ProcessGroupSignalRequestPostOutput           ProcessGroupSignalRequestReason = "post_output"
	ProcessGroupSignalRequestPostOutputEscalation ProcessGroupSignalRequestReason = "post_output_escalation"
	ProcessGroupSignalRequestCancellation         ProcessGroupSignalRequestReason = "cancellation"
	ProcessGroupSignalRequestTimeout              ProcessGroupSignalRequestReason = "timeout"
	ProcessGroupSignalRequestStdoutLimit          ProcessGroupSignalRequestReason = "stdout_limit"
	ProcessGroupSignalRequestStderrLimit          ProcessGroupSignalRequestReason = "stderr_limit"
	ProcessGroupSignalRequestStdinIncomplete      ProcessGroupSignalRequestReason = "stdin_incomplete"
	ProcessGroupSignalRequestResidualGroup        ProcessGroupSignalRequestReason = "residual_process_group"
	ProcessGroupSignalRequestInternalTeardown     ProcessGroupSignalRequestReason = "internal_teardown"
)

type ProcessGroupSignalRequestReceipt 

type ProcessGroupSignalRequestReceipt struct {
	// contains filtered or unexported fields
}

func NewAcceptedPostOutputEscalationProcessGroupSignalRequestReceipt 

func NewAcceptedPostOutputEscalationProcessGroupSignalRequestReceipt(signal ProcessSignal, packet ProviderPacketIdentity, frame ProcessOutputFrameReceipt) (ProcessGroupSignalRequestReceipt, error)

func NewAcceptedPostOutputProcessGroupSignalRequestReceipt 

func NewAcceptedPostOutputProcessGroupSignalRequestReceipt(signal ProcessSignal, packet ProviderPacketIdentity, frame ProcessOutputFrameReceipt) (ProcessGroupSignalRequestReceipt, error)

func NewAcceptedProcessGroupSignalRequestReceipt 

func NewAcceptedProcessGroupSignalRequestReceipt(reason ProcessGroupSignalRequestReason, signal ProcessSignal) (ProcessGroupSignalRequestReceipt, error)

func (ProcessGroupSignalRequestReceipt) FrameSHA256 

func (r ProcessGroupSignalRequestReceipt) FrameSHA256() (string, bool)

func (ProcessGroupSignalRequestReceipt) PacketIdentity 

func (r ProcessGroupSignalRequestReceipt) PacketIdentity() (ProviderPacketIdentity, bool)

func (ProcessGroupSignalRequestReceipt) Reason 

func (r ProcessGroupSignalRequestReceipt) Reason() ProcessGroupSignalRequestReason

func (ProcessGroupSignalRequestReceipt) Signal 

func (r ProcessGroupSignalRequestReceipt) Signal() ProcessSignal

func (ProcessGroupSignalRequestReceipt) Valid 

func (r ProcessGroupSignalRequestReceipt) Valid() bool

type ProcessLifecycleReceipt 

type ProcessLifecycleReceipt struct {
	// contains filtered or unexported fields
}

func NewProcessLifecycleReceipt 

func NewProcessLifecycleReceipt(final ProcessFinalTermination, absent bool, requests []ProcessGroupSignalRequestReceipt, frames ...ProcessOutputFrameReceipt) (ProcessLifecycleReceipt, error)

func (ProcessLifecycleReceipt) FinalTermination 

func (r ProcessLifecycleReceipt) FinalTermination() ProcessFinalTermination

func (ProcessLifecycleReceipt) OutputFrame 

func (r ProcessLifecycleReceipt) OutputFrame() (ProcessOutputFrameReceipt, bool)

func (ProcessLifecycleReceipt) ProcessGroupAbsent 

func (r ProcessLifecycleReceipt) ProcessGroupAbsent() bool

func (ProcessLifecycleReceipt) SignalRequests 

func (r ProcessLifecycleReceipt) SignalRequests() []ProcessGroupSignalRequestReceipt

func (ProcessLifecycleReceipt) Valid 

func (r ProcessLifecycleReceipt) Valid() bool

type ProcessObservation 

type ProcessObservation struct {
	// contains filtered or unexported fields
}

ProcessObservation is the immutable, provider-neutral fact record from one direct process attempt. It intentionally contains no repair, fallback, finding, validation, or outcome authority.

func NewProcessObservation 

func NewProcessObservation(
	stdout, stderr []byte,
	exitCode *int,
	termination ProcessTermination,
	stdinWriteReceipt StdinWriteReceipt,
	startedAt, endedAt time.Time,
	signals ...ProcessSignal,
) (ProcessObservation, error)

NewProcessObservation validates neutral process facts and retains defensive copies of stdout and stderr. An exited process has a nonnegative exit code and no signal; a signaled process has one valid signal and no exit code.

func NewProviderProcessObservation 

func NewProviderProcessObservation(
	stdout, stderr []byte, exitCode *int, termination ProcessTermination,
	stdinWriteReceipt StdinWriteReceipt, transportReceipt ProviderPacketTransportReceipt,
	startedAt, endedAt time.Time, signals ...ProcessSignal,
) (ProcessObservation, error)

NewProviderProcessObservation records process facts with truthful packet transport.

func NewStartedProcessObservation 

func NewStartedProcessObservation(
	stdout, stderr []byte, disposition ProcessTermination, stdin StdinWriteReceipt,
	lifecycle ProcessLifecycleReceipt, startedAt, endedAt time.Time,
) (ProcessObservation, error)

NewStartedProcessObservation records a reaped process with exact final wait and full process-group absence evidence.

func NewStartedProviderProcessObservation 

func NewStartedProviderProcessObservation(
	stdout, stderr []byte, disposition ProcessTermination, stdin StdinWriteReceipt,
	transport ProviderPacketTransportReceipt, lifecycle ProcessLifecycleReceipt,
	startedAt, endedAt time.Time,
) (ProcessObservation, error)

NewStartedProviderProcessObservation records started provider evidence.

func (ProcessObservation) EndedAt 

func (observation ProcessObservation) EndedAt() time.Time

EndedAt returns the observed UTC process-end time.

func (ProcessObservation) ExitCode 

func (observation ProcessObservation) ExitCode() (int, bool)

ExitCode returns the process exit code when the process terminated by exit.

func (ProcessObservation) FinalTermination 

func (observation ProcessObservation) FinalTermination() (ProcessFinalTermination, bool)

func (ProcessObservation) LifecycleReceipt 

func (observation ProcessObservation) LifecycleReceipt() (ProcessLifecycleReceipt, bool)

LifecycleReceipt returns final wait and full group-absence evidence.

func (ProcessObservation) ProcessGroupAbsent 

func (observation ProcessObservation) ProcessGroupAbsent() bool

func (ProcessObservation) ProviderPacketTransportReceipt 

func (observation ProcessObservation) ProviderPacketTransportReceipt() (ProviderPacketTransportReceipt, bool)

ProviderPacketTransportReceipt returns truthful provider packet delivery evidence.

func (ProcessObservation) Signal 

func (observation ProcessObservation) Signal() (number int, name string, ok bool)

Signal returns the exact operating-system signal fact when the process terminated because it received a signal.

func (ProcessObservation) SignalRequests 

func (observation ProcessObservation) SignalRequests() []ProcessGroupSignalRequestReceipt

func (ProcessObservation) StartedAt 

func (observation ProcessObservation) StartedAt() time.Time

StartedAt returns the observed UTC process-start time.

func (ProcessObservation) Stderr 

func (observation ProcessObservation) Stderr() []byte

Stderr returns a caller-owned copy of captured stderr bytes.

func (ProcessObservation) StdinWriteReceipt 

func (observation ProcessObservation) StdinWriteReceipt() StdinWriteReceipt

StdinWriteReceipt returns the immutable exact-write fact for child stdin.

func (ProcessObservation) Stdout 

func (observation ProcessObservation) Stdout() []byte

Stdout returns a caller-owned copy of captured stdout bytes.

func (ProcessObservation) Succeeded 

func (observation ProcessObservation) Succeeded() bool

Succeeded reports either a normal zero exit or an intentional bounded post-output termination after an exact stable frame. Both paths require complete stdin delivery and terminal process-group absence when lifecycle evidence is present.

func (ProcessObservation) Termination 

func (observation ProcessObservation) Termination() ProcessTermination

Termination returns the closed neutral termination fact.

func (ProcessObservation) Valid 

func (observation ProcessObservation) Valid() bool

Valid reports whether observation remains a coherent neutral process fact record.

type ProcessOutputFrameReceipt 

type ProcessOutputFrameReceipt struct {
	// contains filtered or unexported fields
}

func NewProcessOutputFrameReceipt 

func NewProcessOutputFrameReceipt(framing ProcessOutputFraming, stdout []byte, stabilityGrace time.Duration) (ProcessOutputFrameReceipt, error)

func (ProcessOutputFrameReceipt) ByteLength 

func (r ProcessOutputFrameReceipt) ByteLength() int64

func (ProcessOutputFrameReceipt) Framing 

func (r ProcessOutputFrameReceipt) Framing() ProcessOutputFraming

func (ProcessOutputFrameReceipt) SHA256 

func (r ProcessOutputFrameReceipt) SHA256() string

func (ProcessOutputFrameReceipt) StabilityGrace 

func (r ProcessOutputFrameReceipt) StabilityGrace() time.Duration

func (ProcessOutputFrameReceipt) Valid 

func (r ProcessOutputFrameReceipt) Valid() bool

type ProcessOutputFraming 

type ProcessOutputFraming string

ProcessOutputFraming is the closed output framing policy. 

const (
	ProcessOutputFramingStrictJSON         ProcessOutputFraming = "strict_json"
	ProcessOutputFramingTerminalJSONObject ProcessOutputFraming = "terminal_json_object"
)

func (ProcessOutputFraming) Valid 

func (framing ProcessOutputFraming) Valid() bool

type ProcessRequest 

type ProcessRequest struct {
	// contains filtered or unexported fields
}

ProcessRequest is the complete direct-execution request for one child process. Its fields deliberately exclude shell commands, TTY settings, and inherited environment state. Environment is the complete environment actually supplied through exec.Cmd.Env. Slice accessors return caller-owned copies.

func NewBoundProcessRequest 

func NewBoundProcessRequest(request ProcessRequest, root ValidatedWorkspaceRoot, launchDirectory *os.File) (ProcessRequest, error)

NewBoundProcessRequest transfers a caller-owned launch-directory descriptor into an immutable request. The descriptor is consumed and closed by the process runner; callers must not use it after this constructor succeeds.

func NewBoundProcessRequestWithNativeHomeAuthority 

func NewBoundProcessRequestWithNativeHomeAuthority(request ProcessRequest, root ValidatedWorkspaceRoot, launchDirectory *os.File, authority NativeHomeLaunchAuthority) (ProcessRequest, error)

NewBoundProcessRequestWithNativeHomeAuthority binds an exact installed-user HOME identity to a descriptor-bound launch. The authority is launch-only and never becomes part of the child environment or process evidence.

func NewProcessRequest 

func NewProcessRequest(
	executable string,
	argv []string,
	environment []EnvironmentVariable,
	workingDirectory string,
	stdin []byte,
	timeout time.Duration,
	maxStdoutBytes, maxStderrBytes int64,
	concurrencyKey ConcurrencyKey,
) (ProcessRequest, error)

NewProcessRequest validates a direct child-process request and retains defensive copies of argv, environment, and stdin. Environment entries are completed with the exact working-directory PWD, sorted by portable name, and must be unique.

func NewProviderProcessRequest 

func NewProviderProcessRequest(
	executable string, argv []string, environment []EnvironmentVariable, workingDirectory string,
	binding ProviderPacketBinding, timeout time.Duration, maxStdoutBytes, maxStderrBytes int64,
	concurrencyKey ConcurrencyKey,
) (ProcessRequest, error)

NewProviderProcessRequest builds a generic request from one fail-closed packet binding.

func NewProviderProcessRequestWithPostOutputLifecycle 

func NewProviderProcessRequestWithPostOutputLifecycle(
	executable string, argv []string, environment []EnvironmentVariable, workingDirectory string,
	binding ProviderPacketBinding, lifecycle BoundedPostOutputLifecycle, timeout time.Duration,
	maxStdoutBytes, maxStderrBytes int64, concurrencyKey ConcurrencyKey,
) (ProcessRequest, error)

NewProviderProcessRequestWithPostOutputLifecycle enables the opt-in strict output lifecycle for one provider packet request.

func (ProcessRequest) Argv 

func (request ProcessRequest) Argv() []string

Argv returns a caller-owned copy of the exact direct-execution argv.

func (ProcessRequest) BoundLaunchDirectory 

func (request ProcessRequest) BoundLaunchDirectory() (*os.File, ValidatedWorkspaceRoot, bool)

BoundLaunchDirectory returns the descriptor and root transferred through the strict bound-request constructor. The runner owns closing the descriptor.

func (ProcessRequest) ConcurrencyKey 

func (request ProcessRequest) ConcurrencyKey() ConcurrencyKey

ConcurrencyKey returns the validated lane key for this process request.

func (ProcessRequest) Environment 

func (request ProcessRequest) Environment() []EnvironmentVariable

Environment returns a caller-owned copy of the sorted complete environment actually supplied through exec.Cmd.Env.

func (ProcessRequest) Executable 

func (request ProcessRequest) Executable() string

Executable returns the absolute, canonical resolved executable path.

func (ProcessRequest) MaxStderrBytes 

func (request ProcessRequest) MaxStderrBytes() int64

MaxStderrBytes returns the independent positive stderr capture cap.

func (ProcessRequest) MaxStdoutBytes 

func (request ProcessRequest) MaxStdoutBytes() int64

MaxStdoutBytes returns the independent positive stdout capture cap.

func (ProcessRequest) NativeHomeLaunchAuthority 

func (request ProcessRequest) NativeHomeLaunchAuthority() (NativeHomeLaunchAuthority, bool)

NativeHomeLaunchAuthority returns the optional exact HOME identity required by the descriptor-bound trampoline.

func (ProcessRequest) PostOutputLifecycle 

func (request ProcessRequest) PostOutputLifecycle() (BoundedPostOutputLifecycle, bool)

PostOutputLifecycle returns the optional bounded strict-output policy.

func (ProcessRequest) ProviderPacketBinding 

func (request ProcessRequest) ProviderPacketBinding() (ProviderPacketBinding, bool)

ProviderPacketBinding returns the optional provider packet binding.

func (ProcessRequest) Stdin 

func (request ProcessRequest) Stdin() []byte

Stdin returns a caller-owned copy of the exact process stdin bytes.

func (ProcessRequest) Timeout 

func (request ProcessRequest) Timeout() time.Duration

Timeout returns the exact positive process deadline.

func (ProcessRequest) Valid 

func (request ProcessRequest) Valid() bool

Valid reports whether request remains a complete canonical direct-execution request.

func (ProcessRequest) WorkingDirectory 

func (request ProcessRequest) WorkingDirectory() string

WorkingDirectory returns the absolute process working directory.

type ProcessRunner 

type ProcessRunner interface {
	Run(context.Context, ProcessRequest) (ProcessObservation, error)
}

ProcessRunner executes one direct process request. Implementations must reject a nil context and must never introduce shell or TTY behavior.

type ProcessSignal 

type ProcessSignal struct {
	// contains filtered or unexported fields
}

ProcessSignal is an immutable numeric and symbolic signal fact observed for a process that terminated because it received a signal.

func NewProcessSignal 

func NewProcessSignal(number int, name string) (ProcessSignal, error)

NewProcessSignal validates one exact signal fact.

func (ProcessSignal) Name 

func (signal ProcessSignal) Name() string

Name returns the canonical operating-system signal name.

func (ProcessSignal) Number 

func (signal ProcessSignal) Number() int

Number returns the positive operating-system signal number.

func (ProcessSignal) Valid 

func (signal ProcessSignal) Valid() bool

Valid reports whether signal remains a valid immutable signal fact.

type ProcessTermination 

type ProcessTermination string

ProcessTermination is the closed set of neutral child-process termination facts. 

const (
	ProcessTerminationExited               ProcessTermination = "exited"
	ProcessTerminationSignaled             ProcessTermination = "signaled"
	ProcessTerminationStartFailed          ProcessTermination = "start_failed"
	ProcessTerminationStartUnavailable     ProcessTermination = "start_unavailable"
	ProcessTerminationStartConfiguration   ProcessTermination = "start_configuration"
	ProcessTerminationStartSecurity        ProcessTermination = "start_security"
	ProcessTerminationTimedOut             ProcessTermination = "timed_out"
	ProcessTerminationCancelled            ProcessTermination = "cancelled"
	ProcessTerminationStdoutLimit          ProcessTermination = "stdout_limit"
	ProcessTerminationStderrLimit          ProcessTermination = "stderr_limit"
	ProcessTerminationStdinIncomplete      ProcessTermination = "stdin_incomplete"
	ProcessTerminationResidualProcessGroup ProcessTermination = "residual_process_group"
	ProcessTerminationLockFailed           ProcessTermination = "lock_failed"
	ProcessTerminationLockUnavailable      ProcessTermination = "lock_unavailable"
	ProcessTerminationLockConfiguration    ProcessTermination = "lock_configuration"
	ProcessTerminationLockSecurity         ProcessTermination = "lock_security"
)

func (ProcessTermination) Valid 

func (termination ProcessTermination) Valid() bool

Valid reports whether termination is one of the closed process facts.

type ProviderCurrentProbe 

type ProviderCurrentProbe interface {
	QualifyProviderCurrent(context.Context, ProviderCurrentProbeRequest) (ProviderCurrentProbeResult, error)
}

ProviderCurrentProbe executes the adapter-owned current qualification probe.

type ProviderCurrentProbeReceipt 

type ProviderCurrentProbeReceipt struct {
	Kind                     string
	EvidenceID               string
	ExpiresAt                time.Time
	DirectExecutionAuthority ProviderDirectExecutionAuthority
}

ProviderCurrentProbeReceipt is one adapter observation translated into a provider-independent receipt boundary.

type ProviderCurrentProbeRequest 

type ProviderCurrentProbeRequest struct {
	Definition   ProviderRuntimeDefinition
	Namespace    ProviderQualificationNamespace
	Fixture      ProviderQualificationFixtureLease
	RoleFixtures []ProviderQualificationFixtureLease
	Now          time.Time
	TTL          time.Duration
}

ProviderCurrentProbeRequest binds one runtime, namespace, and independent fixture set to a single current observation.

type ProviderCurrentProbeResult 

type ProviderCurrentProbeResult struct {
	VersionArgv []string
	Version     string
	Receipts    []ProviderCurrentProbeReceipt
}

ProviderCurrentProbeResult is current version and capability evidence after adapter-specific validation.

type ProviderDirectExecutionAuthority 

type ProviderDirectExecutionAuthority interface {
	AuthorityID() string
	ExpiresAt() time.Time
	Valid() bool
	Matches(ProviderRuntimeDefinition, string, string, []domain.Role) bool
	AGYControlAuthorityID() (string, bool)
}

ProviderDirectExecutionAuthority is current, descriptor-bound authority for the complete qualified role set.

type ProviderExecutionObservation 

type ProviderExecutionObservation struct {
	// contains filtered or unexported fields
}

ProviderExecutionObservation is immutable provider-neutral execution evidence. It binds a validated invocation identity to exactly one validated process observation and either a successful provider result or a classified failure. It intentionally grants no repair, fallback, finding, validation, or publication authority.

func NewFailedProviderExecutionObservation 

func NewFailedProviderExecutionObservation(
	status ProviderExecutionStatus,
	invocation ProviderInvocation,
	processObservation ProcessObservation,
	diagnosticCode string,
	stdoutLimit, stderrLimit int64,
) (ProviderExecutionObservation, error)

NewFailedProviderExecutionObservation records one classified process failure. It deliberately accepts no ProviderResult: process stdout and stderr remain neutral bounded evidence rather than a successful provider result.

func NewFailedProviderExecutionObservationWithCause 

func NewFailedProviderExecutionObservationWithCause(
	status ProviderExecutionStatus,
	invocation ProviderInvocation,
	processObservation ProcessObservation,
	diagnosticCode string,
	cause, cleanupCause domain.RuntimeDiagnosticCause,
	stdoutLimit, stderrLimit int64,
) (ProviderExecutionObservation, error)

NewFailedProviderExecutionObservationWithCause records a failed provider observation with the exact detailed cause selected at the adapter boundary. cleanupCause is optional and can only supplement, never replace, cause.

func NewIsolatedSuccessfulProviderExecutionObservation 

func NewIsolatedSuccessfulProviderExecutionObservation(
	invocation ProviderInvocation,
	result ProviderResult,
	processObservation ProcessObservation,
	stdoutLimit, stderrLimit int64,
) (ProviderExecutionObservation, error)

NewIsolatedSuccessfulProviderExecutionObservation records a successful provider result deliberately derived from a structured process stdout stream. The raw stdout remains available through ProcessObservation and Stdout.

func NewPartialFailedProviderExecutionObservation 

func NewPartialFailedProviderExecutionObservation(
	status ProviderExecutionStatus,
	invocation ProviderInvocation,
	stdout, stderr []byte,
	diagnosticCode string,
	cause, cleanupCause domain.RuntimeDiagnosticCause,
	stdoutLimit, stderrLimit int64,
) (ProviderExecutionObservation, error)

NewPartialFailedProviderExecutionObservation retains bounded streams and a typed cause when process execution failed before a coherent neutral process observation could be assembled.

func NewSuccessfulProviderExecutionObservation 

func NewSuccessfulProviderExecutionObservation(
	invocation ProviderInvocation,
	result ProviderResult,
	processObservation ProcessObservation,
	stdoutLimit, stderrLimit int64,
) (ProviderExecutionObservation, error)

NewSuccessfulProviderExecutionObservation records a successful provider result bound to an exactly matching successful process observation.

func (ProviderExecutionObservation) AvailableProcessObservation 

func (observation ProviderExecutionObservation) AvailableProcessObservation() (ProcessObservation, bool)

AvailableProcessObservation returns coherent process evidence when one was available. Partial failures may retain streams and causes without one.

func (ProviderExecutionObservation) CleanupCause 

func (observation ProviderExecutionObservation) CleanupCause() (domain.RuntimeDiagnosticCause, bool)

CleanupCause returns the supplemental process-group cleanup cause, if any.

func (ProviderExecutionObservation) CompleteStdinSHA256 

func (observation ProviderExecutionObservation) CompleteStdinSHA256() string

CompleteStdinSHA256 returns the write-receipt digest. It equals the invocation digest whenever the receipt is complete.

func (ProviderExecutionObservation) DiagnosticCode 

func (observation ProviderExecutionObservation) DiagnosticCode() string

DiagnosticCode returns the safe, non-empty failure code. It is empty for a successful observation and never contains an underlying error string.

func (ProviderExecutionObservation) EndedAt 

func (observation ProviderExecutionObservation) EndedAt() time.Time

EndedAt returns the exact UTC process-end time.

func (ProviderExecutionObservation) ExitCode 

func (observation ProviderExecutionObservation) ExitCode() (int, bool)

ExitCode returns the exact process exit code when the process exited.

func (ProviderExecutionObservation) FailureClass 

func (observation ProviderExecutionObservation) FailureClass() domain.FailureClass

FailureClass returns the exact domain failure class for a failed execution. It is empty for a successful observation.

func (ProviderExecutionObservation) FinalTermination 

func (observation ProviderExecutionObservation) FinalTermination() (ProcessFinalTermination, bool)

func (ProviderExecutionObservation) Invocation 

func (observation ProviderExecutionObservation) Invocation() ProviderInvocation

Invocation returns a defensive copy of the invocation bound to this execution observation.

func (ProviderExecutionObservation) OutputFrameReceipt 

func (observation ProviderExecutionObservation) OutputFrameReceipt() (ProcessOutputFrameReceipt, bool)

func (ProviderExecutionObservation) PrimaryCause 

func (observation ProviderExecutionObservation) PrimaryCause() domain.RuntimeDiagnosticCause

PrimaryCause returns the detailed closed diagnostic cause for a failed observation. Successful observations have no cause.

func (ProviderExecutionObservation) ProcessGroupAbsent 

func (observation ProviderExecutionObservation) ProcessGroupAbsent() bool

func (ProviderExecutionObservation) ProcessObservation 

func (observation ProviderExecutionObservation) ProcessObservation() ProcessObservation

ProcessObservation returns a validated defensive copy of the exact neutral process evidence bound to this provider execution observation.

func (ProviderExecutionObservation) Result 

func (observation ProviderExecutionObservation) Result() (ProviderResult, bool)

Result returns a defensive copy of the successful provider result. Failed observations never return a result.

func (ProviderExecutionObservation) SignalRequests 

func (observation ProviderExecutionObservation) SignalRequests() []ProcessGroupSignalRequestReceipt

func (ProviderExecutionObservation) StartedAt 

func (observation ProviderExecutionObservation) StartedAt() time.Time

StartedAt returns the exact UTC process-start time.

func (ProviderExecutionObservation) Status 

func (observation ProviderExecutionObservation) Status() ProviderExecutionStatus

Status returns the closed provider execution outcome.

func (ProviderExecutionObservation) Stderr 

func (observation ProviderExecutionObservation) Stderr() []byte

Stderr returns a caller-owned copy of the stderr captured by the bound process observation.

func (ProviderExecutionObservation) StderrLimit 

func (observation ProviderExecutionObservation) StderrLimit() int64

StderrLimit returns the positive stderr capture limit bound to the observation.

func (ProviderExecutionObservation) StdinByteLength 

func (observation ProviderExecutionObservation) StdinByteLength() int64

StdinByteLength returns the exact intended provider stdin length from the bound process write receipt.

func (ProviderExecutionObservation) StdinWriteReceipt 

func (observation ProviderExecutionObservation) StdinWriteReceipt() StdinWriteReceipt

StdinWriteReceipt returns the exact immutable child-stdin write fact.

func (ProviderExecutionObservation) Stdout 

func (observation ProviderExecutionObservation) Stdout() []byte

Stdout returns a caller-owned copy of the stdout captured by the bound process observation.

func (ProviderExecutionObservation) StdoutLimit 

func (observation ProviderExecutionObservation) StdoutLimit() int64

StdoutLimit returns the positive stdout capture limit bound to the observation.

func (ProviderExecutionObservation) Succeeded 

func (observation ProviderExecutionObservation) Succeeded() bool

Succeeded reports whether the observation records a successful execution.

func (ProviderExecutionObservation) Termination 

func (observation ProviderExecutionObservation) Termination() ProcessTermination

Termination returns the exact neutral process termination fact.

func (ProviderExecutionObservation) Validate 

func (observation ProviderExecutionObservation) Validate() error

Validate reports whether the observation is coherent immutable execution evidence. Constructors always return an observation that validates.

type ProviderExecutionStatus 

type ProviderExecutionStatus string

ProviderExecutionStatus is the closed, provider-neutral execution outcome. It records execution facts only; it does not authorize repair, fallback, validation, or publication decisions. 

const (
	ProviderExecutionStatusSucceeded              ProviderExecutionStatus = "succeeded"
	ProviderExecutionStatusUnavailable            ProviderExecutionStatus = "unavailable"
	ProviderExecutionStatusTimedOut               ProviderExecutionStatus = "timeout"
	ProviderExecutionStatusAuthentication         ProviderExecutionStatus = "auth"
	ProviderExecutionStatusQuota                  ProviderExecutionStatus = "quota"
	ProviderExecutionStatusRateLimit              ProviderExecutionStatus = "rate_limit"
	ProviderExecutionStatusSecurityViolation      ProviderExecutionStatus = "security_violation"
	ProviderExecutionStatusMutationViolation      ProviderExecutionStatus = "mutation_violation"
	ProviderExecutionStatusConfigurationViolation ProviderExecutionStatus = "configuration_violation"
	ProviderExecutionStatusArtifactFailure        ProviderExecutionStatus = "artifact_failure"
	ProviderExecutionStatusCancelled              ProviderExecutionStatus = "cancelled"
	ProviderExecutionStatusInternalFailure        ProviderExecutionStatus = "internal_failure"
)

func (ProviderExecutionStatus) FailureClass 

func (status ProviderExecutionStatus) FailureClass() domain.FailureClass

FailureClass maps a failed execution status to its domain failure class. It returns an empty class for a successful or invalid status.

func (ProviderExecutionStatus) Valid 

func (status ProviderExecutionStatus) Valid() bool

Valid reports whether status is a closed provider execution outcome.

type ProviderInvocation 

type ProviderInvocation struct {
	// contains filtered or unexported fields
}

ProviderInvocation is immutable trusted input to a review provider.

func NewProviderInvocation 

func NewProviderInvocation(role domain.Role, providerInstance string, attemptID domain.AttemptID, purpose ProviderInvocationPurpose, stdin []byte, sourceInvocationID, executionInvocationID, completeStdinSHA256 string) (ProviderInvocation, error)

NewProviderInvocation is the source-compatible stdin-named packet wrapper.

func NewProviderInvocationWithPacket 

func NewProviderInvocationWithPacket(
	role domain.Role, providerInstance string, attemptID domain.AttemptID,
	purpose ProviderInvocationPurpose, packet ProviderPacket,
	sourceInvocationID, executionInvocationID string,
) (ProviderInvocation, error)

NewProviderInvocationWithPacket validates trusted provider invocation identity.

func NewProviderInvocationWithPacketInWorkspace 

func NewProviderInvocationWithPacketInWorkspace(
	role domain.Role, providerInstance string, attemptID domain.AttemptID,
	purpose ProviderInvocationPurpose, packet ProviderPacket,
	sourceInvocationID, executionInvocationID string, workspace WorkspaceExecutionAuthority,
) (ProviderInvocation, error)

NewProviderInvocationWithPacketInWorkspace binds a provider invocation to the capture-owned workspace authority. The authority's immutable identity is captured once; execution consumers must not infer authority from prompt paths.

func (ProviderInvocation) AttemptID 

func (invocation ProviderInvocation) AttemptID() domain.AttemptID

func (ProviderInvocation) CompleteStdinSHA256 

func (invocation ProviderInvocation) CompleteStdinSHA256() string

CompleteStdinSHA256 is a deprecated packet identity alias.

func (ProviderInvocation) ExecutionInvocationID 

func (invocation ProviderInvocation) ExecutionInvocationID() string

func (ProviderInvocation) ExecutionWorkspace 

func (invocation ProviderInvocation) ExecutionWorkspace() (WorkspaceExecutionAuthority, bool)

ExecutionWorkspace returns the capture-owned execution authority when this invocation was created for a production workspace.

func (ProviderInvocation) InputIdentity 

func (invocation ProviderInvocation) InputIdentity() ProviderPacketIdentity

func (ProviderInvocation) Packet 

func (invocation ProviderInvocation) Packet() ProviderPacket

func (ProviderInvocation) PacketBytes 

func (invocation ProviderInvocation) PacketBytes() []byte

func (ProviderInvocation) ProviderInstance 

func (invocation ProviderInvocation) ProviderInstance() string

func (ProviderInvocation) Purpose 

func (invocation ProviderInvocation) Purpose() ProviderInvocationPurpose

func (ProviderInvocation) Role 

func (invocation ProviderInvocation) Role() domain.Role

func (ProviderInvocation) SourceInvocationID 

func (invocation ProviderInvocation) SourceInvocationID() string

func (ProviderInvocation) Stdin 

func (invocation ProviderInvocation) Stdin() []byte

Stdin is a deprecated packet alias retained for source compatibility.

func (ProviderInvocation) WorkspaceSnapshotIdentity 

func (invocation ProviderInvocation) WorkspaceSnapshotIdentity() (WorkspaceSnapshotIdentity, bool)

WorkspaceSnapshotIdentity returns the immutable identity captured with the execution authority, without exposing execution authority through prompt data.

type ProviderInvocationPurpose 

type ProviderInvocationPurpose string

ProviderInvocationPurpose identifies the bounded stage of an attempt sent to a review provider. 

const (
	ProviderInvocationInitial ProviderInvocationPurpose = "initial"
	ProviderInvocationRepair  ProviderInvocationPurpose = "repair"
)

func (ProviderInvocationPurpose) Valid 

func (purpose ProviderInvocationPurpose) Valid() bool

Valid reports whether purpose is a supported provider invocation purpose.

type ProviderLoginAuthenticator 

type ProviderLoginAuthenticator interface {
	LoginProvider(context.Context, ProviderRuntimeDefinition) error
}

ProviderLoginAuthenticator performs an explicit operator-facing login flow for one exact discovered runtime. Implementations must not inherit ambient process environment or retain native provider output.

type ProviderNamespaceAcquisition 

type ProviderNamespaceAcquisition func(context.Context, string, ProviderNamespaceTerminalBinding) (ProviderNamespaceLease, error)

ProviderNamespaceAcquisition creates one concrete namespace lease and binds its terminal effects before returning it.

type ProviderNamespaceFactory 

type ProviderNamespaceFactory interface {
	AcquireProviderNamespace(context.Context, string) (ProviderNamespaceLease, error)
}

ProviderNamespaceFactory allocates one isolated, run-scoped namespace for each configured provider instance. Its environment must not inherit ambient host state. A family-specific factory may inject a startup-frozen, identity-revalidated authentication HOME, but the resulting lease must not receive cleanup authority over that external HOME.

type ProviderNamespaceLease 

type ProviderNamespaceLease interface {
	ProviderInstance() string
	Generation() string
	Environment() []EnvironmentVariable
	ProjectCredential(context.Context, CredentialProjectionRequest) (CredentialProjectionReceipt, error)
	ValidateForSpawn() error
	DrainTerminal(context.Context) (ProviderNamespaceTerminalReceipt, error)
}

ProviderNamespaceLease is the authority for all provider process launches in one namespace generation. It owns cleanup only for that namespace; an injected startup-frozen, identity-revalidated authentication HOME remains external and outside its cleanup authority. ValidateForSpawn must fail closed when the lease is expired, closed, or its namespace has drifted. DrainTerminal is idempotent: every caller receives the same terminal receipt and the adapter performs terminal cleanup at most once.

func AcquireProviderNamespaceLease 

func AcquireProviderNamespaceLease(ctx context.Context, providerInstance string, acquire ProviderNamespaceAcquisition) (ProviderNamespaceLease, error)

AcquireProviderNamespaceLease binds terminal receipt authority to a single successful namespace acquisition without wrapping the concrete lease.

type ProviderNamespaceTerminalBinding 

type ProviderNamespaceTerminalBinding struct {
	// contains filtered or unexported fields
}

ProviderNamespaceTerminalBinding is supplied only while an acquisition is in progress. Its zero value cannot bind terminal authority.

func (ProviderNamespaceTerminalBinding) Bind 

func (binding ProviderNamespaceTerminalBinding) Bind(generation string, drainAndVerify func(context.Context) error) (ProviderNamespaceTerminalDrain, error)

Bind associates terminal effects with this acquisition's exact generation. The returned drain issues a receipt only after effects complete successfully.

type ProviderNamespaceTerminalDrain 

type ProviderNamespaceTerminalDrain func(context.Context) (ProviderNamespaceTerminalReceipt, error)

ProviderNamespaceTerminalDrain completes one acquired namespace's terminal effects and returns its acquisition-bound receipt.

type ProviderNamespaceTerminalReceipt 

type ProviderNamespaceTerminalReceipt struct {
	// contains filtered or unexported fields
}

ProviderNamespaceTerminalReceipt records complete terminal cleanup for one namespace generation. It intentionally contains no credentials or paths.

func (ProviderNamespaceTerminalReceipt) CredentialsZeroed 

func (receipt ProviderNamespaceTerminalReceipt) CredentialsZeroed() bool

func (ProviderNamespaceTerminalReceipt) Drained 

func (receipt ProviderNamespaceTerminalReceipt) Drained() bool

func (ProviderNamespaceTerminalReceipt) Generation 

func (receipt ProviderNamespaceTerminalReceipt) Generation() string

func (ProviderNamespaceTerminalReceipt) ProviderInstance 

func (receipt ProviderNamespaceTerminalReceipt) ProviderInstance() string

func (ProviderNamespaceTerminalReceipt) ReceiptID 

func (receipt ProviderNamespaceTerminalReceipt) ReceiptID() string

ReceiptID returns the canonical domain-separated identity of this exact namespace cleanup receipt.

func (ProviderNamespaceTerminalReceipt) TornDown 

func (receipt ProviderNamespaceTerminalReceipt) TornDown() bool

func (ProviderNamespaceTerminalReceipt) Unlinked 

func (receipt ProviderNamespaceTerminalReceipt) Unlinked() bool

func (ProviderNamespaceTerminalReceipt) Valid 

func (receipt ProviderNamespaceTerminalReceipt) Valid() bool

Valid reports whether receipt proves the complete terminal cleanup sequence.

type ProviderPacket 

type ProviderPacket struct {
	// contains filtered or unexported fields
}

ProviderPacket is immutable complete provider input.

func NewProviderPacket 

func NewProviderPacket(bytes []byte, completeSHA256 string) (ProviderPacket, error)

NewProviderPacket retains a defensive copy and validates its v1 identity.

func NewProviderPacketFromBytes 

func NewProviderPacketFromBytes(bytes []byte) (ProviderPacket, error)

NewProviderPacketFromBytes constructs the canonical v1 packet identity from the complete bytes. Callers that do not already possess a trusted v1 digest should use this constructor rather than reproducing the domain separator.

func (ProviderPacket) Bytes 

func (packet ProviderPacket) Bytes() []byte

func (ProviderPacket) Identity 

func (packet ProviderPacket) Identity() ProviderPacketIdentity

func (ProviderPacket) Valid 

func (packet ProviderPacket) Valid() bool

type ProviderPacketBinding 

type ProviderPacketBinding struct {
	// contains filtered or unexported fields
}

ProviderPacketBinding binds one packet to exactly one child-process channel.

func NewArgvLiteralProviderPacketBinding 

func NewArgvLiteralProviderPacketBinding(packet ProviderPacket, argvIndex int) (ProviderPacketBinding, error)

func NewPromptFileProviderPacketBinding 

func NewPromptFileProviderPacketBinding(packet ProviderPacket, argvIndex int, reference, snapshotCWD string) (ProviderPacketBinding, error)

func NewStdinProviderPacketBinding 

func NewStdinProviderPacketBinding(packet ProviderPacket) (ProviderPacketBinding, error)

func (ProviderPacketBinding) ArgvIndex 

func (binding ProviderPacketBinding) ArgvIndex() int

func (ProviderPacketBinding) Channel 

func (binding ProviderPacketBinding) Channel() ProviderPacketChannel

func (ProviderPacketBinding) Packet 

func (binding ProviderPacketBinding) Packet() ProviderPacket

func (ProviderPacketBinding) PacketIdentity 

func (binding ProviderPacketBinding) PacketIdentity() ProviderPacketIdentity

func (ProviderPacketBinding) PromptFileReference 

func (binding ProviderPacketBinding) PromptFileReference() string

func (ProviderPacketBinding) SnapshotCWD 

func (binding ProviderPacketBinding) SnapshotCWD() string

func (ProviderPacketBinding) Valid 

func (binding ProviderPacketBinding) Valid() bool

type ProviderPacketChannel 

type ProviderPacketChannel string

ProviderPacketChannel is the sole transport selected for a provider packet. 

const (
	ProviderPacketChannelArgvLiteral ProviderPacketChannel = "argv_literal"
	ProviderPacketChannelStdin       ProviderPacketChannel = "stdin"
	ProviderPacketChannelPromptFile  ProviderPacketChannel = "prompt_file"
)

func (ProviderPacketChannel) Valid 

func (channel ProviderPacketChannel) Valid() bool

type ProviderPacketIdentity 

type ProviderPacketIdentity struct {
	// contains filtered or unexported fields
}

ProviderPacketIdentity is the immutable v1 identity of the complete provider packet. Its digest algorithm is retained for continuity, not transport claims.

func NewProviderPacketIdentity 

func NewProviderPacketIdentity(byteLength int, completeSHA256 string) (ProviderPacketIdentity, error)

NewProviderPacketIdentity validates a non-empty complete packet identity.

func (ProviderPacketIdentity) ByteLength 

func (identity ProviderPacketIdentity) ByteLength() int

func (ProviderPacketIdentity) CompleteSHA256 

func (identity ProviderPacketIdentity) CompleteSHA256() string

func (ProviderPacketIdentity) Valid 

func (identity ProviderPacketIdentity) Valid() bool

type ProviderPacketTransportReceipt 

type ProviderPacketTransportReceipt struct {
	// contains filtered or unexported fields
}

ProviderPacketTransportReceipt is immutable evidence of the channel that delivered a complete provider packet. Stdin facts remain in StdinWriteReceipt.

func NewProviderPacketTransportReceipt 

func NewProviderPacketTransportReceipt(
	channel ProviderPacketChannel, packetIdentity ProviderPacketIdentity,
	promptFileReference, snapshotCWD string,
	preStartIdentity, postTerminationIdentity ProviderPacketIdentity,
) (ProviderPacketTransportReceipt, error)

func (ProviderPacketTransportReceipt) Channel 

func (receipt ProviderPacketTransportReceipt) Channel() ProviderPacketChannel

func (ProviderPacketTransportReceipt) PacketIdentity 

func (receipt ProviderPacketTransportReceipt) PacketIdentity() ProviderPacketIdentity

func (ProviderPacketTransportReceipt) PostTerminationIdentity 

func (receipt ProviderPacketTransportReceipt) PostTerminationIdentity() ProviderPacketIdentity

func (ProviderPacketTransportReceipt) PreStartIdentity 

func (receipt ProviderPacketTransportReceipt) PreStartIdentity() ProviderPacketIdentity

func (ProviderPacketTransportReceipt) PromptFileReference 

func (receipt ProviderPacketTransportReceipt) PromptFileReference() string

func (ProviderPacketTransportReceipt) SnapshotCWD 

func (receipt ProviderPacketTransportReceipt) SnapshotCWD() string

func (ProviderPacketTransportReceipt) Valid 

func (receipt ProviderPacketTransportReceipt) Valid() bool

type ProviderQualificationFixtureFactory 

type ProviderQualificationFixtureFactory interface {
	Acquire(context.Context, domain.Role) (ProviderQualificationFixtureLease, error)
}

ProviderQualificationFixtureFactory acquires independently materialized qualification fixtures for requested roles.

type ProviderQualificationFixtureLease 

type ProviderQualificationFixtureLease interface {
	Role() domain.Role
	WorkspaceSnapshotIdentity() WorkspaceSnapshotIdentity
	Validate() error
	DrainTerminal(context.Context) (QualificationWorkspaceTerminalReceipt, error)
}

ProviderQualificationFixtureLease is the application-visible portion of an adapter probe fixture. The adapter retains packet and workspace operations.

type ProviderQualificationNamespace 

type ProviderQualificationNamespace interface {
	ProviderInstance() string
	Generation() string
	Environment() []EnvironmentVariable
	RuntimeSafetyPolicyIdentity() string
	ValidateForSpawn() error
	NativeHomeLaunchAuthority() (NativeHomeLaunchAuthority, bool)
}

ProviderQualificationNamespace is retained namespace authority for one provider instance. Probe workspaces remain independently leased.

type ProviderQualificationRegistry 

type ProviderQualificationRegistry interface {
	ObservedReviewProvider
	QualificationNamespace(string) (ProviderQualificationNamespace, bool)
	Close(context.Context) (ProviderRunTerminalReceipt, error)
}

ProviderQualificationRegistry is the retained admitted execution authority.

type ProviderQualificationRegistryFactory 

type ProviderQualificationRegistryFactory interface {
	NewProviderQualificationRegistry(context.Context, []ProviderRuntimeDefinition) (ProviderQualificationRegistry, error)
	RegistryFromConstructionError(error) (ProviderQualificationRegistry, bool)
}

ProviderQualificationRegistryFactory constructs retained registries and exposes cleanup authority when construction fails after acquisition.

type ProviderResult 

type ProviderResult struct {
	// contains filtered or unexported fields
}

ProviderResult is immutable raw provider output bound to a complete packet identity.

func NewProviderResult 

func NewProviderResult(stdout []byte, stdinByteLength int, completeStdinSHA256 string) (ProviderResult, error)

NewProviderResult is the source-compatible stdin-named identity wrapper.

func NewProviderResultForInput 

func NewProviderResultForInput(stdout []byte, identity ProviderPacketIdentity) (ProviderResult, error)

func (ProviderResult) CompleteInputSHA256 

func (result ProviderResult) CompleteInputSHA256() string

func (ProviderResult) CompleteStdinSHA256 

func (result ProviderResult) CompleteStdinSHA256() string

CompleteStdinSHA256 is a deprecated packet identity alias.

func (ProviderResult) InputByteLength 

func (result ProviderResult) InputByteLength() int

func (ProviderResult) InputIdentity 

func (result ProviderResult) InputIdentity() ProviderPacketIdentity

func (ProviderResult) StdinByteLength 

func (result ProviderResult) StdinByteLength() int

StdinByteLength is a deprecated packet identity alias.

func (ProviderResult) Stdout 

func (result ProviderResult) Stdout() []byte

type ProviderRoute 

type ProviderRoute struct {
	// contains filtered or unexported fields
}

ProviderRoute binds one safe provider instance to its normalized concurrency lane. It contains no provider-family or live-runtime authority.

func NewProviderRoute 

func NewProviderRoute(providerInstance string, concurrencyKey ConcurrencyKey) (ProviderRoute, error)

NewProviderRoute validates an immutable provider-instance-to-lane binding.

func (ProviderRoute) ConcurrencyKey 

func (route ProviderRoute) ConcurrencyKey() ConcurrencyKey

ConcurrencyKey returns the normalized lane key selected for the provider.

func (ProviderRoute) ProviderInstance 

func (route ProviderRoute) ProviderInstance() string

ProviderInstance returns the safe provider instance identifier.

func (ProviderRoute) Valid 

func (route ProviderRoute) Valid() bool

Valid reports whether route is a valid provider-instance-to-lane binding.

type ProviderRunTerminalReceipt 

type ProviderRunTerminalReceipt struct {
	// contains filtered or unexported fields
}

ProviderRunTerminalReceipt proves complete terminal cleanup for every namespace owned by one run. Receipts are ordered canonically by provider instance and contain no credentials or paths.

func NewEmptyProviderRunTerminalReceipt 

func NewEmptyProviderRunTerminalReceipt() ProviderRunTerminalReceipt

NewEmptyProviderRunTerminalReceipt proves that a failed run acquired no provider namespace. It is distinct from an incomplete drain.

func NewProviderRunTerminalReceipt 

func NewProviderRunTerminalReceipt(receipts []ProviderNamespaceTerminalReceipt) (ProviderRunTerminalReceipt, error)

NewProviderRunTerminalReceipt constructs aggregate terminal cleanup evidence. Every receipt must be valid and represent a distinct provider instance.

func (ProviderRunTerminalReceipt) Equal 

func (receipt ProviderRunTerminalReceipt) Equal(other ProviderRunTerminalReceipt) bool

Equal reports whether two aggregate receipts prove the same canonical cleanup.

func (ProviderRunTerminalReceipt) NamespaceReceipts 

func (receipt ProviderRunTerminalReceipt) NamespaceReceipts() []ProviderNamespaceTerminalReceipt

NamespaceReceipts returns a caller-owned copy in canonical instance order.

func (ProviderRunTerminalReceipt) NoNamespaces 

func (receipt ProviderRunTerminalReceipt) NoNamespaces() bool

NoNamespaces reports explicit proof that no provider namespace was acquired.

func (ProviderRunTerminalReceipt) Valid 

func (receipt ProviderRunTerminalReceipt) Valid() bool

Valid reports whether receipt proves either that no namespace was acquired or complete cleanup of a duplicate-free canonical namespace set.

type ProviderRuntimeBuilder 

type ProviderRuntimeBuilder interface {
	RuntimeSafetyPolicyIdentity(string) (string, error)
	BuildProductionRuntime(ProviderRuntimeSpec) (ProviderRuntimeDefinition, error)
}

ProviderRuntimeBuilder owns adapter-specific runtime-policy lookup and construction. Application packages supply neutral specs only.

type ProviderRuntimeDefinition 

type ProviderRuntimeDefinition interface {
	Family() string
	Instance() string
	Version() string
	Executable() string
	ExecutableSHA256() string
	Launcher() string
	LauncherSHA256() string
	ProfileGeneration() string
	RuntimeSafetyPolicyIdentity() string
	ConcurrencyKey() ConcurrencyKey
	ProfileID() string
	KimiModel() string
	BaseArgv() []string
	Environment() []EnvironmentVariable
	WorkingDirectory() string
	Timeout() time.Duration
	MaxStdoutBytes() int64
	MaxStderrBytes() int64
	PostOutputLifecycle() (BoundedPostOutputLifecycle, bool)
	TransportChannel() ProviderPacketChannel
	TransportArgvIndex() int
	TransportReference() string
}

ProviderRuntimeDefinition is the provider-independent identity and execution surface consumed by application-layer qualification. Adapter-owned runtime definitions implement this contract without exposing their concrete type.

type ProviderRuntimeError 

type ProviderRuntimeError struct {
	// contains filtered or unexported fields
}

ProviderRuntimeError carries a closed detailed cause when the provider boundary itself fails. A caller may still receive a valid observation with this error and must preserve that evidence before applying policy.

func NewProviderRuntimeError 

func NewProviderRuntimeError(cause domain.RuntimeDiagnosticCause, err error) (*ProviderRuntimeError, error)

func (*ProviderRuntimeError) Cause 

func (failure *ProviderRuntimeError) Cause() domain.RuntimeDiagnosticCause

func (*ProviderRuntimeError) Error 

func (failure *ProviderRuntimeError) Error() string

func (*ProviderRuntimeError) Unwrap 

func (failure *ProviderRuntimeError) Unwrap() error

type ProviderRuntimeSpec 

type ProviderRuntimeSpec struct {
	Family                      string
	Instance                    string
	Version                     string
	Executable                  string
	ExecutableSHA256            string
	Launcher                    string
	LauncherSHA256              string
	ConcurrencyKey              ConcurrencyKey
	ProfileID                   string
	ProfileGeneration           string
	RuntimeSafetyPolicyIdentity string
	KimiModel                   string
	BaseArgv                    []string
	TransportChannel            ProviderPacketChannel
	TransportArgvIndex          int
	TransportReference          string
	Environment                 []EnvironmentVariable
	WorkingDirectory            string
	Timeout                     time.Duration
	MaxStdoutBytes              int64
	MaxStderrBytes              int64
	PostOutputLifecycle         BoundedPostOutputLifecycle
	HasPostOutputLifecycle      bool
}

ProviderRuntimeSpec is the neutral construction request passed from the application layer to a provider adapter. The adapter validates all family-specific argv, transport, lifecycle, and safety-policy constraints.

type PublicationEpoch 

type PublicationEpoch struct {
	// contains filtered or unexported fields
}

PublicationEpoch binds a positive store epoch to its immutable epoch record.

func NewPublicationEpoch 

func NewPublicationEpoch(value uint64, record ImmutablePublicationArtifact) (PublicationEpoch, error)

NewPublicationEpoch validates a positive composite epoch and its record.

func (PublicationEpoch) Record 

func (epoch PublicationEpoch) Record() ImmutablePublicationArtifact

Record returns the immutable epoch record.

func (PublicationEpoch) Valid 

func (epoch PublicationEpoch) Valid() bool

Valid reports whether epoch is coherent.

func (PublicationEpoch) Value 

func (epoch PublicationEpoch) Value() uint64

Value returns the positive composite epoch value.

type PublicationEpochCommitStore 

type PublicationEpochCommitStore interface {
	WithNextPublicationEpoch(context.Context, AnchoredRoot, func(context.Context, uint64) error) error
}

PublicationEpochCommitStore holds one root-scoped durable publication transaction from epoch selection through the callback. It must select an epoch greater than every epoch previously committed beneath root and must not release its cross-process authority until callback returns. The callback may use the same store's PublicationStore methods to complete the publication.

type PublicationObservation 

type PublicationObservation struct {
	// contains filtered or unexported fields
}

PublicationObservation is raw durable evidence normalized into the domain's observation class. Application policy passes ClassifierInput to the domain; this port never chooses a recovery action.

func NewPublicationObservation 

func NewPublicationObservation(
	journalState domain.PersistedJournalState,
	observation domain.DurableObservationClass,
	storedNormalExit *domain.OperationalExitCode,
	ambiguityReasons []string,
	storeEpoch uint64,
) (PublicationObservation, error)

NewPublicationObservation validates one immutable durable observation that does not expose recovery material.

func NewPublicationObservationWithRecovery 

func NewPublicationObservationWithRecovery(
	journalState domain.PersistedJournalState,
	observation domain.DurableObservationClass,
	storedNormalExit *domain.OperationalExitCode,
	ambiguityReasons []string,
	storeEpoch uint64,
	recoveryMaterial PublicationRecoveryMaterial,
) (PublicationObservation, error)

NewPublicationObservationWithRecovery validates one immutable durable observation together with the exact material needed for P0/P1 recovery or P2 mutable-status reconstruction.

func (PublicationObservation) ClassifierInput 

func (observation PublicationObservation) ClassifierInput() domain.PublicationClassifierInput

ClassifierInput returns a validated immutable domain classifier input.

func (PublicationObservation) RecoveryMaterial 

func (observation PublicationObservation) RecoveryMaterial() (PublicationRecoveryMaterial, bool)

RecoveryMaterial returns the atomically observed exact recovery material when the durable class and journal hint require it.

func (PublicationObservation) StoreEpoch 

func (observation PublicationObservation) StoreEpoch() uint64

StoreEpoch returns the positive store epoch observed with the durable facts.

func (PublicationObservation) Valid 

func (observation PublicationObservation) Valid() bool

Valid reports whether observation is coherent.

type PublicationRecoveryMaterial 

type PublicationRecoveryMaterial struct {
	// contains filtered or unexported fields
}

PublicationRecoveryMaterial is exact durable material used to recover P0/P1 effects or reconstruct P2 mutable status after restart. Its accessors return defensive values whose byte accessors copy.

func NewPublicationRecoveryMaterialWithCommittedSnapshot 

func NewPublicationRecoveryMaterialWithCommittedSnapshot(
	final FinalReviewArtifact,
	journal ObservedMutablePublicationDocument,
	status ObservedMutablePublicationDocument,
	snapshot CommittedPublicationSnapshot,
) (PublicationRecoveryMaterial, error)

NewPublicationRecoveryMaterialWithCommittedSnapshot binds exact P2 immutable member identities and bytes to the same atomic observation as mutable hints.

func NewPublicationRecoveryMaterialWithPrepared 

func NewPublicationRecoveryMaterialWithPrepared(
	final FinalReviewArtifact,
	stagedPath *SafeRelativePath,
	journal ObservedMutablePublicationDocument,
	status *ObservedMutablePublicationDocument,
	validatedCandidate FinalReviewArtifact,
	preparedComposite PreparedComposite,
) (PublicationRecoveryMaterial, error)

NewPublicationRecoveryMaterialWithPrepared validates recovery material that carries the exact persisted candidate and prepared composite required by the recoverable P0/P1 paths.

func (PublicationRecoveryMaterial) CommittedSnapshot 

func (material PublicationRecoveryMaterial) CommittedSnapshot() (CommittedPublicationSnapshot, bool)

CommittedSnapshot returns the exact atomically observed P2 immutable members.

func (PublicationRecoveryMaterial) Final 

func (material PublicationRecoveryMaterial) Final() FinalReviewArtifact

Final returns the exact immutable final candidate and defensive bytes.

func (PublicationRecoveryMaterial) Journal 

func (material PublicationRecoveryMaterial) Journal() ObservedMutablePublicationDocument

Journal returns the required observed publication journal and defensive bytes.

func (PublicationRecoveryMaterial) PreparedComposite 

func (material PublicationRecoveryMaterial) PreparedComposite() (PreparedComposite, bool)

PreparedComposite returns exact prepared staged members when recovery material was captured from a recovery-aware observation.

func (PublicationRecoveryMaterial) StagedPath 

func (material PublicationRecoveryMaterial) StagedPath() (SafeRelativePath, bool)

StagedPath returns the observed staged path when one exists.

func (PublicationRecoveryMaterial) Status 

func (material PublicationRecoveryMaterial) Status() (ObservedMutablePublicationDocument, bool)

Status returns the observed publication status and defensive bytes when one exists.

func (PublicationRecoveryMaterial) Valid 

func (material PublicationRecoveryMaterial) Valid() bool

Valid reports whether material is complete and exact.

func (PublicationRecoveryMaterial) ValidatedCandidate 

func (material PublicationRecoveryMaterial) ValidatedCandidate() (FinalReviewArtifact, bool)

ValidatedCandidate returns exact persisted candidate bytes when recovery material was captured from a recovery-aware observation.

type PublicationRun 

type PublicationRun struct {
	// contains filtered or unexported fields
}

PublicationRun identifies one run beneath an approved artifact root.

func NewPublicationRun 

func NewPublicationRun(root AnchoredRoot, sessionID domain.SessionID, runID domain.RunID) (PublicationRun, error)

NewPublicationRun validates immutable publication scope.

func (PublicationRun) Root 

func (run PublicationRun) Root() AnchoredRoot

Root returns the approved artifact root.

func (PublicationRun) RunID 

func (run PublicationRun) RunID() domain.RunID

RunID returns the exact run scope.

func (PublicationRun) SessionID 

func (run PublicationRun) SessionID() domain.SessionID

SessionID returns the exact session scope.

func (PublicationRun) Valid 

func (run PublicationRun) Valid() bool

Valid reports whether run is a valid publication scope.

type PublicationStore 

type PublicationStore interface {
	IssueReviewID(context.Context, IssueReviewIDRequest) (IssuedReviewID, error)
	ResolveRun(context.Context, ResolvePublicationRunRequest) (PublicationRun, error)
	// ObserveRun returns classifier input and any permitted recovery material from
	// one atomic durable observation; adapters must not split that observation
	// across a second racing read.
	ObserveRun(context.Context, ObserveRunRequest) (PublicationObservation, error)
	PersistValidatedCandidate(context.Context, PersistValidatedCandidateRequest) (PersistValidatedCandidateResult, error)
	PersistAuxiliaryArtifact(context.Context, PersistAuxiliaryArtifactRequest) (PersistAuxiliaryArtifactResult, error)
	ReadAuxiliaryArtifact(context.Context, ReadAuxiliaryArtifactRequest) (ImmutablePublicationArtifact, error)
	PrepareComposite(context.Context, PrepareCompositeRequest) (PreparedComposite, error)
	StageFinal(context.Context, StageFinalRequest) (StageFinalResult, error)
	AdoptStagedFinal(context.Context, AdoptStagedFinalRequest) (StageFinalResult, error)
	InstallFinal(context.Context, InstallFinalRequest) (InstallFinalResult, error)
	ReplaceMutable(context.Context, MutableReplaceRequest) (MutableReplaceResult, error)
	CommitPreparedComposite(context.Context, PreparedComposite) (CompositeCommitResult, error)
	ReadCommittedSnapshot(context.Context, ReadCommittedSnapshotRequest) (CommittedPublicationSnapshot, error)
	WriteCorruptionDiagnostic(context.Context, CorruptionDiagnosticRequest) (CorruptionDiagnosticResult, error)
}

type QualificationWorkspaceAcquisition 

type QualificationWorkspaceAcquisition func(context.Context, QualificationWorkspaceTerminalBinding) (QualificationWorkspaceLease, error)

QualificationWorkspaceAcquisition materializes one lease while its terminal binding is open.

type QualificationWorkspaceLease 

type QualificationWorkspaceLease interface {
	WorkspaceExecutionAuthority
	DrainTerminal(context.Context) (QualificationWorkspaceTerminalReceipt, error)
}

QualificationWorkspaceLease is an ephemeral execution authority. Its terminal cleanup is independent of the captured user-workspace lifecycle.

func AcquireQualificationWorkspaceLease 

func AcquireQualificationWorkspaceLease(ctx context.Context, acquire QualificationWorkspaceAcquisition) (QualificationWorkspaceLease, error)

AcquireQualificationWorkspaceLease binds terminal proof to lease acquisition.

type QualificationWorkspaceLeaseFactory 

type QualificationWorkspaceLeaseFactory interface {
	MaterializeQualificationLease(context.Context, WorkspaceSnapshotRequest) (QualificationWorkspaceLease, error)
}

QualificationWorkspaceLeaseFactory materializes an ephemeral immutable workspace for qualification inputs. It has no publication or abort authority.

type QualificationWorkspaceTerminalBinding 

type QualificationWorkspaceTerminalBinding struct {
	// contains filtered or unexported fields
}

QualificationWorkspaceTerminalBinding is minted only for one acquisition callback.

func (QualificationWorkspaceTerminalBinding) Bind 

func (binding QualificationWorkspaceTerminalBinding) Bind(workspace WorkspaceSnapshotIdentity, drainAndVerify func(context.Context) error) (QualificationWorkspaceTerminalDrain, error)

Bind retains a verified terminal operation and makes its receipt unavailable until that operation succeeds.

type QualificationWorkspaceTerminalDrain 

type QualificationWorkspaceTerminalDrain func(context.Context) (QualificationWorkspaceTerminalReceipt, error)

type QualificationWorkspaceTerminalReceipt 

type QualificationWorkspaceTerminalReceipt struct {
	// contains filtered or unexported fields
}

QualificationWorkspaceTerminalReceipt proves successful removal of one qualification workspace.

func (QualificationWorkspaceTerminalReceipt) Valid 

func (receipt QualificationWorkspaceTerminalReceipt) Valid() bool

func (QualificationWorkspaceTerminalReceipt) WorkspaceSnapshotIdentity 

func (receipt QualificationWorkspaceTerminalReceipt) WorkspaceSnapshotIdentity() WorkspaceSnapshotIdentity

type ReadAuxiliaryArtifactRequest 

type ReadAuxiliaryArtifactRequest struct {
	// contains filtered or unexported fields
}

ReadAuxiliaryArtifactRequest identifies one immutable run-support artifact by its canonical path, with an optional exact raw SHA-256. Adapters must always reject a different path and must reject a different artifact when a hash is supplied.

func NewReadAuxiliaryArtifactRequest 

func NewReadAuxiliaryArtifactRequest(
	run PublicationRun,
	path SafeRelativePath,
	sha256 string,
	maxReadBytes int64,
) (ReadAuxiliaryArtifactRequest, error)

NewReadAuxiliaryArtifactRequest validates one bounded run-support read. An empty SHA-256 requests a bounded canonical-path read; a non-empty SHA-256 remains an exact raw-byte identity requirement.

func NewReadRunSupportArtifactRequest 

func NewReadRunSupportArtifactRequest(
	run PublicationRun,
	path SafeRelativePath,
	sha256 string,
	maxReadBytes int64,
) (ReadAuxiliaryArtifactRequest, error)

NewReadRunSupportArtifactRequest is the canonical run-support constructor.

func (ReadAuxiliaryArtifactRequest) ExpectedSHA256 

func (request ReadAuxiliaryArtifactRequest) ExpectedSHA256() (string, bool)

ExpectedSHA256 returns the optional expected exact raw artifact hash.

func (ReadAuxiliaryArtifactRequest) Kind 

func (request ReadAuxiliaryArtifactRequest) Kind() RunSupportArtifactKind

Kind returns the path-derived closed run-support artifact kind.

func (ReadAuxiliaryArtifactRequest) MaxReadBytes 

func (request ReadAuxiliaryArtifactRequest) MaxReadBytes() int64

MaxReadBytes returns the positive exact-read cap.

func (ReadAuxiliaryArtifactRequest) Path 

func (request ReadAuxiliaryArtifactRequest) Path() SafeRelativePath

Path returns the exact expected run-support path.

func (ReadAuxiliaryArtifactRequest) Run 

func (request ReadAuxiliaryArtifactRequest) Run() PublicationRun

Run returns the exact publication scope.

type ReadCommittedSnapshotRequest 

type ReadCommittedSnapshotRequest struct {
	// contains filtered or unexported fields
}

ReadCommittedSnapshotRequest reads only one P2-authoritative committed snapshot, bounded by a positive per-member byte cap.

func NewReadCommittedSnapshotRequest 

func NewReadCommittedSnapshotRequest(run PublicationRun, maxReadBytes int64) (ReadCommittedSnapshotRequest, error)

NewReadCommittedSnapshotRequest validates a P2 snapshot read request.

func (ReadCommittedSnapshotRequest) MaxReadBytes 

func (request ReadCommittedSnapshotRequest) MaxReadBytes() int64

MaxReadBytes returns the positive per-member read cap.

func (ReadCommittedSnapshotRequest) Run 

func (request ReadCommittedSnapshotRequest) Run() PublicationRun

Run returns the exact publication scope.

type ResolvePublicationRunRequest 

type ResolvePublicationRunRequest struct {
	// contains filtered or unexported fields
}

ResolvePublicationRunRequest locates one canonical run ID beneath an approved artifact root without trusting directory modification times or caller-supplied session identity.

func NewResolvePublicationRunRequest 

func NewResolvePublicationRunRequest(
	root AnchoredRoot,
	runID domain.RunID,
	maxReadBytes int64,
) (ResolvePublicationRunRequest, error)

NewResolvePublicationRunRequest validates a bounded run-resolution request.

func (ResolvePublicationRunRequest) MaxReadBytes 

func (request ResolvePublicationRunRequest) MaxReadBytes() int64

MaxReadBytes returns the positive per-manifest resolution cap.

func (ResolvePublicationRunRequest) Root 

func (request ResolvePublicationRunRequest) Root() AnchoredRoot

Root returns the approved artifact root.

func (ResolvePublicationRunRequest) RunID 

func (request ResolvePublicationRunRequest) RunID() domain.RunID

RunID returns the canonical run ID to resolve.

type ReviewInputChannel 

type ReviewInputChannel string
const (
	ReviewInputTarget    ReviewInputChannel = "review_target"
	ReviewInputReference ReviewInputChannel = "reference_snapshot"
	ReviewInputObjective ReviewInputChannel = "objective"
	ReviewInputPacket    ReviewInputChannel = "provider_packet"
)

func (ReviewInputChannel) Valid 

func (channel ReviewInputChannel) Valid() bool

type ReviewInputContentDetector 

type ReviewInputContentDetector interface {
	DetectReviewInput(context.Context, ReviewInputChannel, string, []byte) (ReviewInputDetection, error)
}

type ReviewInputContentDetectorIdentity 

type ReviewInputContentDetectorIdentity interface {
	ReviewInputDetectorIdentity() string
}

ReviewInputContentDetectorIdentity identifies the fixed detector policy that admitted captured review bytes. Production capture rejects detectors that do not provide this immutable identity.

type ReviewInputDetection 

type ReviewInputDetection struct {
	// contains filtered or unexported fields
}

func NewReviewInputDetection 

func NewReviewInputDetection(verdict ReviewInputVerdict, detectorCode string, count int) (ReviewInputDetection, error)

func (ReviewInputDetection) Count 

func (detection ReviewInputDetection) Count() int

func (ReviewInputDetection) DetectorCode 

func (detection ReviewInputDetection) DetectorCode() string

func (ReviewInputDetection) Valid 

func (detection ReviewInputDetection) Valid() bool

func (ReviewInputDetection) Verdict 

func (detection ReviewInputDetection) Verdict() ReviewInputVerdict

type ReviewInputVerdict 

type ReviewInputVerdict string
const (
	ReviewInputClean   ReviewInputVerdict = "clean"
	ReviewInputBlocked ReviewInputVerdict = "blocked"
)

type ReviewProvider 

type ReviewProvider interface {
	Invoke(context.Context, ProviderInvocation) (ProviderResult, error)
}

ReviewProvider is the only boundary used to invoke a review provider.

type ReviewTargetCapturer 

type ReviewTargetCapturer interface {
	CaptureReviewTarget(context.Context, AnchoredRoot, ReviewTargetSelector) (CapturedReviewMaterial, error)
}

type ReviewTargetSelector 

type ReviewTargetSelector struct {
	// contains filtered or unexported fields
}

func NewReviewTargetSelector 

func NewReviewTargetSelector(kind ReviewTargetSelectorKind, value string) (ReviewTargetSelector, error)

func (ReviewTargetSelector) Kind 

func (selector ReviewTargetSelector) Kind() ReviewTargetSelectorKind

func (ReviewTargetSelector) Valid 

func (selector ReviewTargetSelector) Valid() bool

func (ReviewTargetSelector) Value 

func (selector ReviewTargetSelector) Value() string

type ReviewTargetSelectorKind 

type ReviewTargetSelectorKind string
const (
	ReviewTargetWorkspace ReviewTargetSelectorKind = "workspace"
	ReviewTargetStage     ReviewTargetSelectorKind = "stage"
	ReviewTargetDirty     ReviewTargetSelectorKind = "dirty"
	ReviewTargetDiff      ReviewTargetSelectorKind = "diff"
	ReviewTargetPatch     ReviewTargetSelectorKind = "patch"
	ReviewTargetStdin     ReviewTargetSelectorKind = "stdin"
)

type RunSupportArtifactKind 

type RunSupportArtifactKind string

RunSupportArtifactKind identifies the closed support-artifact path grammar. 

const (
	RunSupportArtifactExcerpt           RunSupportArtifactKind = "excerpt"
	RunSupportArtifactAttemptStatus     RunSupportArtifactKind = "attempt_status"
	RunSupportArtifactInitialCandidate  RunSupportArtifactKind = "initial_candidate"
	RunSupportArtifactRepairedCandidate RunSupportArtifactKind = "repaired_candidate"
	RunSupportArtifactInvocationStdout  RunSupportArtifactKind = "invocation_stdout"
	RunSupportArtifactInvocationStderr  RunSupportArtifactKind = "invocation_stderr"
	RunSupportArtifactTargetBytes       RunSupportArtifactKind = "target_bytes"
	RunSupportArtifactTargetManifest    RunSupportArtifactKind = "target_manifest"
	RunSupportArtifactCapturedArchive   RunSupportArtifactKind = "captured_archive"
	RunSupportArtifactArtistBrief       RunSupportArtifactKind = "artist_brief"
	RunSupportArtifactArtistVisuals     RunSupportArtifactKind = "artist_visual_assets"
	RunSupportArtifactPromptStdin       RunSupportArtifactKind = "prompt_stdin"
	RunSupportArtifactPromptManifest    RunSupportArtifactKind = "prompt_manifest"
	RunSupportArtifactSupportIndex      RunSupportArtifactKind = "support_index"
)

func ClassifyRunSupportArtifactPath 

func ClassifyRunSupportArtifactPath(sessionID domain.SessionID, runID domain.RunID, path SafeRelativePath) (RunSupportArtifactKind, error)

ClassifyRunSupportArtifactPath validates a canonical support-artifact path against its immutable session and run scope.

func (RunSupportArtifactKind) Valid 

func (kind RunSupportArtifactKind) Valid() bool

Valid reports whether kind is a closed run-support artifact kind.

type RunSupportArtifactStore 

type RunSupportArtifactStore interface {
	PersistAuxiliaryArtifact(context.Context, PersistAuxiliaryArtifactRequest) (PersistAuxiliaryArtifactResult, error)
	ReadAuxiliaryArtifact(context.Context, ReadAuxiliaryArtifactRequest) (ImmutablePublicationArtifact, error)
}

RunSupportArtifactStore persists and reads immutable, non-authoritative run support artifacts. It accepts only canonical excerpt and provider-attempt paths for its exact run and never replaces an existing artifact.

type RuntimeDiagnosticAttemptStatus 

type RuntimeDiagnosticAttemptStatus struct {
	// contains filtered or unexported fields
}

func NewRuntimeDiagnosticAttemptStatus 

func NewRuntimeDiagnosticAttemptStatus(input RuntimeDiagnosticAttemptStatusInput) (RuntimeDiagnosticAttemptStatus, error)

func (RuntimeDiagnosticAttemptStatus) AttemptID 

func (status RuntimeDiagnosticAttemptStatus) AttemptID() domain.AttemptID

func (RuntimeDiagnosticAttemptStatus) CompletedAt 

func (status RuntimeDiagnosticAttemptStatus) CompletedAt() (time.Time, bool)

func (RuntimeDiagnosticAttemptStatus) InvocationCount 

func (status RuntimeDiagnosticAttemptStatus) InvocationCount() int

func (RuntimeDiagnosticAttemptStatus) LastSequence 

func (status RuntimeDiagnosticAttemptStatus) LastSequence() uint64

func (RuntimeDiagnosticAttemptStatus) Provider 

func (status RuntimeDiagnosticAttemptStatus) Provider() string

func (RuntimeDiagnosticAttemptStatus) Role 

func (status RuntimeDiagnosticAttemptStatus) Role() domain.Role

func (RuntimeDiagnosticAttemptStatus) RunID 

func (status RuntimeDiagnosticAttemptStatus) RunID() domain.RunID

func (RuntimeDiagnosticAttemptStatus) SchemaVersion 

func (status RuntimeDiagnosticAttemptStatus) SchemaVersion() string

func (RuntimeDiagnosticAttemptStatus) Selection 

func (status RuntimeDiagnosticAttemptStatus) Selection() RuntimeDiagnosticSelection

func (RuntimeDiagnosticAttemptStatus) SessionID 

func (status RuntimeDiagnosticAttemptStatus) SessionID() domain.SessionID

func (RuntimeDiagnosticAttemptStatus) StartedAt 

func (status RuntimeDiagnosticAttemptStatus) StartedAt() time.Time

func (RuntimeDiagnosticAttemptStatus) State 

func (status RuntimeDiagnosticAttemptStatus) State() domain.AttemptState

func (RuntimeDiagnosticAttemptStatus) TerminalCause 

func (status RuntimeDiagnosticAttemptStatus) TerminalCause() domain.RuntimeDiagnosticCause

func (RuntimeDiagnosticAttemptStatus) UpdatedAt 

func (status RuntimeDiagnosticAttemptStatus) UpdatedAt() time.Time

type RuntimeDiagnosticAttemptStatusInput 

type RuntimeDiagnosticAttemptStatusInput struct {
	SessionID                         domain.SessionID
	RunID                             domain.RunID
	AttemptID                         domain.AttemptID
	Role                              domain.Role
	Provider                          string
	Selection                         RuntimeDiagnosticSelection
	State                             domain.AttemptState
	StartedAt, UpdatedAt, CompletedAt time.Time
	HasCompletedAt                    bool
	InvocationCount                   int
	LastSequence                      uint64
	TerminalCause                     domain.RuntimeDiagnosticCause
}

type RuntimeDiagnosticFinalizeRequest 

type RuntimeDiagnosticFinalizeRequest struct {
	// contains filtered or unexported fields
}

func NewRuntimeDiagnosticFinalizeRequest 

func NewRuntimeDiagnosticFinalizeRequest(state domain.RunState, cause domain.RuntimeDiagnosticCause, status RuntimeDiagnosticRunStatus) (RuntimeDiagnosticFinalizeRequest, error)

func (RuntimeDiagnosticFinalizeRequest) Cause 

func (request RuntimeDiagnosticFinalizeRequest) Cause() domain.RuntimeDiagnosticCause

func (RuntimeDiagnosticFinalizeRequest) State 

func (request RuntimeDiagnosticFinalizeRequest) State() domain.RunState

func (RuntimeDiagnosticFinalizeRequest) Status 

func (request RuntimeDiagnosticFinalizeRequest) Status() RuntimeDiagnosticRunStatus

type RuntimeDiagnosticFinalizeResult 

type RuntimeDiagnosticFinalizeResult struct {
	// contains filtered or unexported fields
}

func NewRuntimeDiagnosticFinalizeResult 

func NewRuntimeDiagnosticFinalizeResult(uri SafeRelativePath, lastSequence uint64) (RuntimeDiagnosticFinalizeResult, error)

func (RuntimeDiagnosticFinalizeResult) LastSequence 

func (result RuntimeDiagnosticFinalizeResult) LastSequence() uint64

func (RuntimeDiagnosticFinalizeResult) URI 

func (result RuntimeDiagnosticFinalizeResult) URI() SafeRelativePath

type RuntimeDiagnosticInvocationStatus 

type RuntimeDiagnosticInvocationStatus struct {
	// contains filtered or unexported fields
}

func NewRuntimeDiagnosticInvocationStatus 

func NewRuntimeDiagnosticInvocationStatus(input RuntimeDiagnosticInvocationStatusInput) (RuntimeDiagnosticInvocationStatus, error)

func (RuntimeDiagnosticInvocationStatus) AttemptID 

func (status RuntimeDiagnosticInvocationStatus) AttemptID() domain.AttemptID

func (RuntimeDiagnosticInvocationStatus) CompletedAt 

func (status RuntimeDiagnosticInvocationStatus) CompletedAt() (time.Time, bool)

func (RuntimeDiagnosticInvocationStatus) ExitCode 

func (status RuntimeDiagnosticInvocationStatus) ExitCode() (int, bool)

func (RuntimeDiagnosticInvocationStatus) InvocationID 

func (status RuntimeDiagnosticInvocationStatus) InvocationID() string

func (RuntimeDiagnosticInvocationStatus) LastSequence 

func (status RuntimeDiagnosticInvocationStatus) LastSequence() uint64

func (RuntimeDiagnosticInvocationStatus) Ordinal 

func (status RuntimeDiagnosticInvocationStatus) Ordinal() uint64

func (RuntimeDiagnosticInvocationStatus) Purpose 

func (status RuntimeDiagnosticInvocationStatus) Purpose() ProviderInvocationPurpose

func (RuntimeDiagnosticInvocationStatus) RunID 

func (status RuntimeDiagnosticInvocationStatus) RunID() domain.RunID

func (RuntimeDiagnosticInvocationStatus) SchemaVersion 

func (status RuntimeDiagnosticInvocationStatus) SchemaVersion() string

func (RuntimeDiagnosticInvocationStatus) SessionID 

func (status RuntimeDiagnosticInvocationStatus) SessionID() domain.SessionID

func (RuntimeDiagnosticInvocationStatus) StartedAt 

func (status RuntimeDiagnosticInvocationStatus) StartedAt() time.Time

func (RuntimeDiagnosticInvocationStatus) States 

func (status RuntimeDiagnosticInvocationStatus) States() (domain.InvocationState, domain.ParseState, domain.ValidationState)

func (RuntimeDiagnosticInvocationStatus) Stderr 

func (status RuntimeDiagnosticInvocationStatus) Stderr() (RuntimeDiagnosticRawResult, bool)

func (RuntimeDiagnosticInvocationStatus) Stdout 

func (status RuntimeDiagnosticInvocationStatus) Stdout() (RuntimeDiagnosticRawResult, bool)

func (RuntimeDiagnosticInvocationStatus) Termination 

func (status RuntimeDiagnosticInvocationStatus) Termination() string

func (RuntimeDiagnosticInvocationStatus) UpdatedAt 

func (status RuntimeDiagnosticInvocationStatus) UpdatedAt() time.Time

type RuntimeDiagnosticInvocationStatusInput 

type RuntimeDiagnosticInvocationStatusInput struct {
	SessionID                         domain.SessionID
	RunID                             domain.RunID
	AttemptID                         domain.AttemptID
	InvocationID                      string
	Ordinal                           uint64
	Purpose                           ProviderInvocationPurpose
	ProcessState                      domain.InvocationState
	ParseState                        domain.ParseState
	ValidationState                   domain.ValidationState
	StartedAt, UpdatedAt, CompletedAt time.Time
	HasCompletedAt                    bool
	Termination                       string
	ExitCode                          int
	HasExitCode                       bool
	LastSequence                      uint64
	Stdout, Stderr                    RuntimeDiagnosticRawResult
	HasStdout, HasStderr              bool
}

type RuntimeDiagnosticOpenRequest 

type RuntimeDiagnosticOpenRequest struct {
	// contains filtered or unexported fields
}

func NewRuntimeDiagnosticOpenRequest 

func NewRuntimeDiagnosticOpenRequest(root AnchoredRoot, sessionID domain.SessionID, runID domain.RunID, startedAt time.Time) (RuntimeDiagnosticOpenRequest, error)

func (RuntimeDiagnosticOpenRequest) Root 

func (request RuntimeDiagnosticOpenRequest) Root() AnchoredRoot

func (RuntimeDiagnosticOpenRequest) RunID 

func (request RuntimeDiagnosticOpenRequest) RunID() domain.RunID

func (RuntimeDiagnosticOpenRequest) RunPath 

func (request RuntimeDiagnosticOpenRequest) RunPath() SafeRelativePath

func (RuntimeDiagnosticOpenRequest) SessionID 

func (request RuntimeDiagnosticOpenRequest) SessionID() domain.SessionID

func (RuntimeDiagnosticOpenRequest) StartedAt 

func (request RuntimeDiagnosticOpenRequest) StartedAt() time.Time

type RuntimeDiagnosticPersistenceError 

type RuntimeDiagnosticPersistenceError struct {
	// contains filtered or unexported fields
}

func (*RuntimeDiagnosticPersistenceError) Error 

func (err *RuntimeDiagnosticPersistenceError) Error() string

func (*RuntimeDiagnosticPersistenceError) Operation 

func (err *RuntimeDiagnosticPersistenceError) Operation() RuntimeDiagnosticPersistenceOperation

func (*RuntimeDiagnosticPersistenceError) Reason 

func (err *RuntimeDiagnosticPersistenceError) Reason() RuntimeDiagnosticPersistenceReason

func (*RuntimeDiagnosticPersistenceError) Unwrap 

func (err *RuntimeDiagnosticPersistenceError) Unwrap() error

type RuntimeDiagnosticPersistenceOperation 

type RuntimeDiagnosticPersistenceOperation string
const (
	DiagnosticPersistenceOpen     RuntimeDiagnosticPersistenceOperation = "open"
	DiagnosticPersistenceEmit     RuntimeDiagnosticPersistenceOperation = "emit"
	DiagnosticPersistenceRaw      RuntimeDiagnosticPersistenceOperation = "raw"
	DiagnosticPersistenceStatus   RuntimeDiagnosticPersistenceOperation = "status"
	DiagnosticPersistenceFinalize RuntimeDiagnosticPersistenceOperation = "finalize"
)

func (RuntimeDiagnosticPersistenceOperation) Valid 

func (operation RuntimeDiagnosticPersistenceOperation) Valid() bool

type RuntimeDiagnosticPersistenceReason 

type RuntimeDiagnosticPersistenceReason string
const (
	DiagnosticPersistenceInvalidInput       RuntimeDiagnosticPersistenceReason = "invalid_input"
	DiagnosticPersistenceClosed             RuntimeDiagnosticPersistenceReason = "closed"
	DiagnosticPersistenceIdentityMismatch   RuntimeDiagnosticPersistenceReason = "identity_mismatch"
	DiagnosticPersistenceClockFailure       RuntimeDiagnosticPersistenceReason = "clock_failure"
	DiagnosticPersistenceEncodingFailure    RuntimeDiagnosticPersistenceReason = "encoding_failure"
	DiagnosticPersistenceCapacityExhausted  RuntimeDiagnosticPersistenceReason = "capacity_exhausted"
	DiagnosticPersistenceNamespaceChanged   RuntimeDiagnosticPersistenceReason = "namespace_changed"
	DiagnosticPersistenceWriteFailure       RuntimeDiagnosticPersistenceReason = "write_failure"
	DiagnosticPersistenceSyncFailure        RuntimeDiagnosticPersistenceReason = "sync_failure"
	DiagnosticPersistenceVerificationFailed RuntimeDiagnosticPersistenceReason = "verification_failed"
	DiagnosticPersistenceRecoveryFailed     RuntimeDiagnosticPersistenceReason = "recovery_failed"
	DiagnosticPersistenceResultInvalid      RuntimeDiagnosticPersistenceReason = "result_invalid"
)

func (RuntimeDiagnosticPersistenceReason) Valid 

func (reason RuntimeDiagnosticPersistenceReason) Valid() bool

type RuntimeDiagnosticRawRequest 

type RuntimeDiagnosticRawRequest struct {
	// contains filtered or unexported fields
}

func NewRuntimeDiagnosticRawRequest 

func NewRuntimeDiagnosticRawRequest(attemptID domain.AttemptID, invocationID string, ordinal uint64, purpose ProviderInvocationPurpose, stream domain.RuntimeDiagnosticStream, source io.Reader, maxBytes int64, sourceIDs []string, abort func(error)) (RuntimeDiagnosticRawRequest, error)

func (RuntimeDiagnosticRawRequest) Abort 

func (request RuntimeDiagnosticRawRequest) Abort() func(error)

func (RuntimeDiagnosticRawRequest) AttemptID 

func (request RuntimeDiagnosticRawRequest) AttemptID() domain.AttemptID

func (RuntimeDiagnosticRawRequest) InvocationID 

func (request RuntimeDiagnosticRawRequest) InvocationID() string

func (RuntimeDiagnosticRawRequest) MaxBytes 

func (request RuntimeDiagnosticRawRequest) MaxBytes() int64

func (RuntimeDiagnosticRawRequest) Ordinal 

func (request RuntimeDiagnosticRawRequest) Ordinal() uint64

func (RuntimeDiagnosticRawRequest) Purpose 

func (request RuntimeDiagnosticRawRequest) Purpose() ProviderInvocationPurpose

func (RuntimeDiagnosticRawRequest) Source 

func (request RuntimeDiagnosticRawRequest) Source() io.Reader

func (RuntimeDiagnosticRawRequest) SourceIDs 

func (request RuntimeDiagnosticRawRequest) SourceIDs() []string

func (RuntimeDiagnosticRawRequest) Stream 

func (request RuntimeDiagnosticRawRequest) Stream() domain.RuntimeDiagnosticStream

type RuntimeDiagnosticRawResult 

type RuntimeDiagnosticRawResult struct {
	// contains filtered or unexported fields
}

func NewRuntimeDiagnosticRawResult 

func NewRuntimeDiagnosticRawResult(stream domain.RuntimeDiagnosticStream, uri SafeRelativePath, drop *DropMetadata, byteLength int64) (RuntimeDiagnosticRawResult, error)

func (RuntimeDiagnosticRawResult) ByteLength 

func (result RuntimeDiagnosticRawResult) ByteLength() int64

func (RuntimeDiagnosticRawResult) Drop 

func (result RuntimeDiagnosticRawResult) Drop() (*DropMetadata, bool)

func (RuntimeDiagnosticRawResult) Stream 

func (result RuntimeDiagnosticRawResult) Stream() domain.RuntimeDiagnosticStream

func (RuntimeDiagnosticRawResult) URI 

func (result RuntimeDiagnosticRawResult) URI() (SafeRelativePath, bool)

func (RuntimeDiagnosticRawResult) ValidFor 

func (result RuntimeDiagnosticRawResult) ValidFor(stream domain.RuntimeDiagnosticStream) bool

type RuntimeDiagnosticRunStatus 

type RuntimeDiagnosticRunStatus struct {
	// contains filtered or unexported fields
}

func NewRuntimeDiagnosticRunStatus 

func NewRuntimeDiagnosticRunStatus(input RuntimeDiagnosticRunStatusInput) (RuntimeDiagnosticRunStatus, error)

func (RuntimeDiagnosticRunStatus) CompletedAt 

func (status RuntimeDiagnosticRunStatus) CompletedAt() (time.Time, bool)

func (RuntimeDiagnosticRunStatus) DroppedEvents 

func (status RuntimeDiagnosticRunStatus) DroppedEvents() uint64

func (RuntimeDiagnosticRunStatus) LaneCounts 

func (status RuntimeDiagnosticRunStatus) LaneCounts() (int, int, int)

func (RuntimeDiagnosticRunStatus) LastSequence 

func (status RuntimeDiagnosticRunStatus) LastSequence() uint64

func (RuntimeDiagnosticRunStatus) P2URI 

func (status RuntimeDiagnosticRunStatus) P2URI() (SafeRelativePath, bool)

func (RuntimeDiagnosticRunStatus) RunID 

func (status RuntimeDiagnosticRunStatus) RunID() domain.RunID

func (RuntimeDiagnosticRunStatus) SchemaVersion 

func (status RuntimeDiagnosticRunStatus) SchemaVersion() string

func (RuntimeDiagnosticRunStatus) SelectedRoles 

func (status RuntimeDiagnosticRunStatus) SelectedRoles() []domain.Role

func (RuntimeDiagnosticRunStatus) SessionID 

func (status RuntimeDiagnosticRunStatus) SessionID() domain.SessionID

func (RuntimeDiagnosticRunStatus) StartedAt 

func (status RuntimeDiagnosticRunStatus) StartedAt() time.Time

func (RuntimeDiagnosticRunStatus) State 

func (status RuntimeDiagnosticRunStatus) State() domain.RunState

func (RuntimeDiagnosticRunStatus) TerminalCause 

func (status RuntimeDiagnosticRunStatus) TerminalCause() domain.RuntimeDiagnosticCause

func (RuntimeDiagnosticRunStatus) UpdatedAt 

func (status RuntimeDiagnosticRunStatus) UpdatedAt() time.Time

type RuntimeDiagnosticRunStatusInput 

type RuntimeDiagnosticRunStatusInput struct {
	SessionID                            domain.SessionID
	RunID                                domain.RunID
	State                                domain.RunState
	StartedAt, UpdatedAt, CompletedAt    time.Time
	HasCompletedAt                       bool
	SelectedRoles                        []domain.Role
	LaneTotal, LaneCompleted, LaneFailed int
	LastSequence                         uint64
	TerminalCause                        domain.RuntimeDiagnosticCause
	P2URI                                SafeRelativePath
	HasP2URI                             bool
	DroppedEvents                        uint64
}

type RuntimeDiagnosticSecurityRejectionError 

type RuntimeDiagnosticSecurityRejectionError struct {
	// contains filtered or unexported fields
}

func (*RuntimeDiagnosticSecurityRejectionError) Drop 

func (err *RuntimeDiagnosticSecurityRejectionError) Drop() DropMetadata

func (*RuntimeDiagnosticSecurityRejectionError) Error 

func (err *RuntimeDiagnosticSecurityRejectionError) Error() string

func (*RuntimeDiagnosticSecurityRejectionError) Unwrap 

func (err *RuntimeDiagnosticSecurityRejectionError) Unwrap() error

type RuntimeDiagnosticSelection 

type RuntimeDiagnosticSelection string
const (
	RuntimeDiagnosticPrimary  RuntimeDiagnosticSelection = "primary"
	RuntimeDiagnosticFallback RuntimeDiagnosticSelection = "fallback"
)

func (RuntimeDiagnosticSelection) Valid 

func (selection RuntimeDiagnosticSelection) Valid() bool

type RuntimeDiagnosticSink 

type RuntimeDiagnosticSink interface {
	Emit(context.Context, domain.RuntimeDiagnosticEventDraft) (domain.RuntimeDiagnosticEvent, error)
	PersistRaw(context.Context, RuntimeDiagnosticRawRequest) (RuntimeDiagnosticRawResult, error)
	ReplaceRunStatus(context.Context, RuntimeDiagnosticRunStatus) error
	ReplaceAttemptStatus(context.Context, RuntimeDiagnosticAttemptStatus) error
	ReplaceInvocationStatus(context.Context, RuntimeDiagnosticInvocationStatus) error
	Finalize(context.Context, RuntimeDiagnosticFinalizeRequest) (RuntimeDiagnosticFinalizeResult, error)
	URI() (SafeRelativePath, bool)
}

func NewInMemoryRuntimeDiagnosticSink 

func NewInMemoryRuntimeDiagnosticSink(request RuntimeDiagnosticOpenRequest) (RuntimeDiagnosticSink, error)

func NewNoopRuntimeDiagnosticSink 

func NewNoopRuntimeDiagnosticSink(request RuntimeDiagnosticOpenRequest) (RuntimeDiagnosticSink, error)

type RuntimeDiagnosticSinkFactory 

type RuntimeDiagnosticSinkFactory interface {
	Open(context.Context, RuntimeDiagnosticOpenRequest) (RuntimeDiagnosticSink, error)
}

func NewInMemoryRuntimeDiagnosticSinkFactory 

func NewInMemoryRuntimeDiagnosticSinkFactory() RuntimeDiagnosticSinkFactory

func NewNoopRuntimeDiagnosticSinkFactory 

func NewNoopRuntimeDiagnosticSinkFactory() RuntimeDiagnosticSinkFactory

type SafeRelativePath 

type SafeRelativePath struct {
	// contains filtered or unexported fields
}

SafeRelativePath is a canonical, non-empty path beneath an AnchoredRoot.

func NewSafeRelativePath 

func NewSafeRelativePath(value string) (SafeRelativePath, error)

NewSafeRelativePath validates a portable relative path that cannot traverse or use an alternate separator.

func ValidatedCandidatePath 

func ValidatedCandidatePath(run PublicationRun) (SafeRelativePath, error)

ValidatedCandidatePath returns the canonical durable location for the exact post-validation final candidate. It is intentionally distinct from the final publication path so recovery never has to reconstruct candidate bytes.

func (SafeRelativePath) String 

func (relative SafeRelativePath) String() string

String returns the canonical relative path.

func (SafeRelativePath) Valid 

func (relative SafeRelativePath) Valid() bool

Valid reports whether relative is a canonical, traversal-free relative path.

type SecureFileWriter 

type SecureFileWriter interface {
	EnsurePrivateDir(AnchoredRoot, SafeRelativePath) error
	Write(context.Context, SecureWriteRequest) (SecureWriteReceipt, *DropMetadata, error)
}

SecureFileWriter is the mandatory scan-before-write boundary for untrusted bytes. EnsurePrivateDir creates only canonical directories beneath root and fails when a newly created parent directory cannot be synced before descent. Write fsyncs accepted bytes before atomically creating a destination once and never replaces an existing destination. It fsyncs the containing directory after installation; a post-install sync failure returns the installed receipt with a non-nil error. Receipts bind only accepted bytes to the request root, destination, channel, and source IDs. On a scan rejection or cap overflow it returns no receipt, redacted drop metadata, and a non-nil error.

type SecureWriteReceipt 

type SecureWriteReceipt struct {
	// contains filtered or unexported fields
}

SecureWriteReceipt records a completed accepted write, its exact approved root, and its exact input lineage. A writer must not return a receipt for bytes it dropped or rejected.

func NewSecureWriteReceipt 

func NewSecureWriteReceipt(root AnchoredRoot, destination SafeRelativePath, sha256 string, byteLength int64, channel string, sourceIDs []string) (SecureWriteReceipt, error)

NewSecureWriteReceipt validates a completed accepted write receipt bound to an exact approved root and retains a defensive copy of its non-empty source IDs.

func (SecureWriteReceipt) ByteLength 

func (receipt SecureWriteReceipt) ByteLength() int64

ByteLength returns the number of accepted bytes.

func (SecureWriteReceipt) Channel 

func (receipt SecureWriteReceipt) Channel() string

Channel returns the exact audited channel that supplied the accepted bytes.

func (SecureWriteReceipt) Destination 

func (receipt SecureWriteReceipt) Destination() SafeRelativePath

Destination returns the accepted destination beneath the request root.

func (SecureWriteReceipt) Root 

func (receipt SecureWriteReceipt) Root() AnchoredRoot

Root returns the exact approved root for the accepted destination.

func (SecureWriteReceipt) SHA256 

func (receipt SecureWriteReceipt) SHA256() string

SHA256 returns the accepted byte integrity identifier.

func (SecureWriteReceipt) SourceIDs 

func (receipt SecureWriteReceipt) SourceIDs() []string

SourceIDs returns a caller-owned copy of the accepted bytes' source IDs.

type SecureWriteRequest 

type SecureWriteRequest struct {
	// contains filtered or unexported fields
}

SecureWriteRequest streams untrusted bytes through the mandatory scan-before-write boundary. SourceIDs returns a defensive copy.

func NewSecureWriteRequest 

func NewSecureWriteRequest(
	root AnchoredRoot,
	destination SafeRelativePath,
	channel string,
	source io.Reader,
	maxBytes int64,
	sourceIDs []string,
	abort func(error),
) (SecureWriteRequest, error)

NewSecureWriteRequest validates a streaming secure write request. Source is consumed by SecureFileWriter, MaxBytes is an exact positive cap, and Abort must terminate the producer when scanning rejects or overflows the stream.

func (SecureWriteRequest) Abort 

func (request SecureWriteRequest) Abort() func(error)

Abort returns the producer-cancellation function used on scan rejection.

func (SecureWriteRequest) Channel 

func (request SecureWriteRequest) Channel() string

Channel returns the audited untrusted-byte channel name.

func (SecureWriteRequest) Destination 

func (request SecureWriteRequest) Destination() SafeRelativePath

Destination returns the canonical destination beneath Root.

func (SecureWriteRequest) MaxBytes 

func (request SecureWriteRequest) MaxBytes() int64

MaxBytes returns the exact positive scan and persistence cap.

func (SecureWriteRequest) Root 

func (request SecureWriteRequest) Root() AnchoredRoot

Root returns the approved destination root.

func (SecureWriteRequest) Source 

func (request SecureWriteRequest) Source() io.Reader

Source returns the one-shot untrusted input stream owned by SecureFileWriter.

func (SecureWriteRequest) SourceIDs 

func (request SecureWriteRequest) SourceIDs() []string

SourceIDs returns a caller-owned copy of redacted source identifiers.

type SequenceGenerator 

type SequenceGenerator interface {
	Next() (uint64, error)
}

SequenceGenerator supplies exact coordinator program order independently of approximate UUID or wall-clock ordering.

type StageFinalDurability 

type StageFinalDurability string

StageFinalDurability explicitly distinguishes a staged artifact whose directory sync completed from one installed before its durability error. 

const (
	StageFinalDurable   StageFinalDurability = "staged_durable"
	StageFinalUndurable StageFinalDurability = "staged_undurable"
)

func (StageFinalDurability) Valid 

func (durability StageFinalDurability) Valid() bool

Valid reports whether durability is an explicit staging outcome.

type StageFinalRequest 

type StageFinalRequest struct {
	// contains filtered or unexported fields
}

StageFinalRequest streams a validated final candidate to a distinct staged path. Source is one-shot and owned by the store; Abort must stop the source producer when the store rejects, overflows, or cannot persist the stream.

func NewStageFinalRequest 

func NewStageFinalRequest(
	run PublicationRun,
	stagedPath SafeRelativePath,
	binding IssuedFinalBinding,
	source io.Reader,
	maxBytes int64,
	sourceIDs []string,
	abort func(error),
) (StageFinalRequest, error)

NewStageFinalRequest validates a no-replace staging request and takes ownership of sourceIDs. It deliberately accepts no final bytes, so the store must validate the streamed bytes against Binding's final identity before exposing a receipt.

func NewStageFinalRequestWithExpectedByteLength 

func NewStageFinalRequestWithExpectedByteLength(
	run PublicationRun,
	stagedPath SafeRelativePath,
	binding IssuedFinalBinding,
	source io.Reader,
	maxBytes int64,
	expectedByteLength int64,
	sourceIDs []string,
	abort func(error),
) (StageFinalRequest, error)

NewStageFinalRequestWithExpectedByteLength additionally binds a stage receipt to the exact source byte length. It is additive so streaming callers that cannot know a length retain the original request contract.

func (StageFinalRequest) Abort 

func (request StageFinalRequest) Abort() func(error)

Abort returns the required producer-cancellation callback.

func (StageFinalRequest) Binding 

func (request StageFinalRequest) Binding() IssuedFinalBinding

Binding returns the explicit issuance-to-final relation.

func (StageFinalRequest) ExpectedByteLength 

func (request StageFinalRequest) ExpectedByteLength() (int64, bool)

ExpectedByteLength returns the exact streamed byte length when the caller supplied one. Legacy streaming requests deliberately have no length binding.

func (StageFinalRequest) Final 

func (request StageFinalRequest) Final() FinalReviewIdentity

Final returns the final review identity that staged bytes must match.

func (StageFinalRequest) IssuedReviewID 

func (request StageFinalRequest) IssuedReviewID() IssuedReviewID

IssuedReviewID returns the post-validation issuance bound to Final.

func (StageFinalRequest) MaxBytes 

func (request StageFinalRequest) MaxBytes() int64

MaxBytes returns the positive staging cap.

func (StageFinalRequest) Run 

func (request StageFinalRequest) Run() PublicationRun

Run returns the exact publication scope.

func (StageFinalRequest) Source 

func (request StageFinalRequest) Source() io.Reader

Source returns the one-shot validated candidate stream owned by the store.

func (StageFinalRequest) SourceIDs 

func (request StageFinalRequest) SourceIDs() []string

SourceIDs returns a caller-owned copy of staged input lineage identifiers.

func (StageFinalRequest) StagedPath 

func (request StageFinalRequest) StagedPath() SafeRelativePath

StagedPath returns the required distinct staged temporary path.

func (StageFinalRequest) Valid 

func (request StageFinalRequest) Valid() bool

Valid reports whether request is a canonical stage request.

type StageFinalResult 

type StageFinalResult struct {
	// contains filtered or unexported fields
}

StageFinalResult exists only after bytes were installed at the staged path. A StageFinalUndurable result must be re-observed; it is never retry-safe.

func NewStageFinalResult 

func NewStageFinalResult(stagedPath SafeRelativePath, final FinalReviewIdentity, receipt SecureWriteReceipt, durability StageFinalDurability) (StageFinalResult, error)

NewStageFinalResult validates an installed staged-file receipt.

func NewStageFinalResultForRequest 

func NewStageFinalResultForRequest(
	request StageFinalRequest,
	receipt SecureWriteReceipt,
	durability StageFinalDurability,
) (StageFinalResult, error)

NewStageFinalResultForRequest validates a stage receipt against the exact request, including the optional source byte-length binding.

func (StageFinalResult) Durability 

func (result StageFinalResult) Durability() StageFinalDurability

Durability returns whether post-install durability completed.

func (StageFinalResult) Final 

func (result StageFinalResult) Final() FinalReviewIdentity

Final returns the final identity matched by staged bytes.

func (StageFinalResult) Receipt 

func (result StageFinalResult) Receipt() SecureWriteReceipt

Receipt returns the accepted staged-byte receipt.

func (StageFinalResult) StagedPath 

func (result StageFinalResult) StagedPath() SafeRelativePath

StagedPath returns the installed staged temporary path.

func (StageFinalResult) Valid 

func (result StageFinalResult) Valid() bool

Valid reports whether result is coherent.

type StdinWriteReceipt 

type StdinWriteReceipt struct {
	// contains filtered or unexported fields
}

StdinWriteReceipt is the immutable record of bytes successfully written to one child stdin pipe. SHA256 is the raw lower-case hexadecimal digest of "Mulgae-PROVIDER-STDIN/1" || 0x00 || those exact successful bytes.

func NewStdinWriteReceipt 

func NewStdinWriteReceipt(
	intendedByteLength, writtenByteCount int64,
	sha256 string,
	complete bool,
) (StdinWriteReceipt, error)

NewStdinWriteReceipt validates one stdin write fact. Complete must agree exactly with the intended and successfully written byte counts.

func (StdinWriteReceipt) Complete 

func (receipt StdinWriteReceipt) Complete() bool

Complete reports whether every intended stdin byte was successfully written.

func (StdinWriteReceipt) IntendedByteLength 

func (receipt StdinWriteReceipt) IntendedByteLength() int64

IntendedByteLength returns the exact requested stdin byte length.

func (StdinWriteReceipt) SHA256 

func (receipt StdinWriteReceipt) SHA256() string

SHA256 returns the raw domain-separated digest of exactly the successfully written stdin bytes.

func (StdinWriteReceipt) Valid 

func (receipt StdinWriteReceipt) Valid() bool

Valid reports whether receipt is a coherent immutable stdin write fact.

func (StdinWriteReceipt) WrittenByteCount 

func (receipt StdinWriteReceipt) WrittenByteCount() int64

WrittenByteCount returns the exact number of bytes accepted by the child stdin pipe before it closed or the request completed.

type TrustedProjectReader 

type TrustedProjectReader interface {
	ResolveCommit(context.Context, AnchoredRoot, string) (GitObjectID, error)
	ReadFileAtCommit(context.Context, AnchoredRoot, GitObjectID, SafeRelativePath) ([]byte, error)
}

TrustedProjectReader binds project configuration reads to a resolved immutable commit. ReadFileAtCommit must return newly allocated bytes owned by the caller.

type ValidatedCandidateDurability 

type ValidatedCandidateDurability string

ValidatedCandidateDurability distinguishes a completed candidate directory sync from an installed candidate whose durability outcome is unknown. 

const (
	ValidatedCandidateDurable   ValidatedCandidateDurability = "durable"
	ValidatedCandidateUndurable ValidatedCandidateDurability = "installed_undurable"
)

func (ValidatedCandidateDurability) Valid 

func (durability ValidatedCandidateDurability) Valid() bool

Valid reports whether durability is an explicit candidate outcome.

type ValidatedWorkspaceRoot 

type ValidatedWorkspaceRoot struct {
	// contains filtered or unexported fields
}

ValidatedWorkspaceRoot is a read-only root validated with a v2 identity.

func NewValidatedWorkspaceRoot 

func NewValidatedWorkspaceRoot(path string, identity WorkspaceSnapshotIdentity) (ValidatedWorkspaceRoot, error)

func (ValidatedWorkspaceRoot) Path 

func (root ValidatedWorkspaceRoot) Path() string

func (ValidatedWorkspaceRoot) SnapshotIdentity 

func (root ValidatedWorkspaceRoot) SnapshotIdentity() WorkspaceSnapshotIdentity

func (ValidatedWorkspaceRoot) Valid 

func (root ValidatedWorkspaceRoot) Valid() bool

type WorkspaceAbortEvidence 

type WorkspaceAbortEvidence struct {
	// contains filtered or unexported fields
}

WorkspaceAbortEvidence authorizes cleanup without fabricating P2 publication. It binds complete aggregate terminal cleanup evidence to the workspace.

func NewWorkspaceAbortEvidence 

func NewWorkspaceAbortEvidence(workspace WorkspaceSnapshotIdentity, reason WorkspaceAbortReason, terminal ProviderRunTerminalReceipt) (WorkspaceAbortEvidence, error)

func (WorkspaceAbortEvidence) Equal 

func (evidence WorkspaceAbortEvidence) Equal(other WorkspaceAbortEvidence) bool

Equal reports whether two abort authorities bind the same workspace, reason, and complete provider-run cleanup.

func (WorkspaceAbortEvidence) Reason 

func (evidence WorkspaceAbortEvidence) Reason() WorkspaceAbortReason

func (WorkspaceAbortEvidence) TerminalReceipt 

func (evidence WorkspaceAbortEvidence) TerminalReceipt() ProviderRunTerminalReceipt

func (WorkspaceAbortEvidence) Valid 

func (evidence WorkspaceAbortEvidence) Valid() bool

func (WorkspaceAbortEvidence) WorkspaceSnapshotIdentity 

func (evidence WorkspaceAbortEvidence) WorkspaceSnapshotIdentity() WorkspaceSnapshotIdentity

type WorkspaceAbortReason 

type WorkspaceAbortReason string

WorkspaceAbortReason is the closed reason set for deleting a snapshot before publication authority exists. 

const (
	WorkspaceAbortCaptureFailure     WorkspaceAbortReason = "capture_failure"
	WorkspaceAbortPlanningFailure    WorkspaceAbortReason = "planning_failure"
	WorkspaceAbortExecutionFailure   WorkspaceAbortReason = "execution_failure"
	WorkspaceAbortPublicationFailure WorkspaceAbortReason = "publication_failure"
	WorkspaceAbortCancellation       WorkspaceAbortReason = "cancellation"
	WorkspaceAbortSecurityViolation  WorkspaceAbortReason = "security_violation"
	WorkspaceAbortInternalFailure    WorkspaceAbortReason = "internal_failure"
)

func (WorkspaceAbortReason) Valid 

func (reason WorkspaceAbortReason) Valid() bool

type WorkspaceCompletionEvidence 

type WorkspaceCompletionEvidence struct {
	// contains filtered or unexported fields
}

WorkspaceCompletionEvidence binds successful workspace cleanup to one coordinator run and its complete provider terminal aggregate.

func NewWorkspaceCompletionEvidence 

func NewWorkspaceCompletionEvidence(workspace WorkspaceSnapshotIdentity, runID string, terminal ProviderRunTerminalReceipt) (WorkspaceCompletionEvidence, error)

func (WorkspaceCompletionEvidence) ProviderRunTerminalReceipt 

func (evidence WorkspaceCompletionEvidence) ProviderRunTerminalReceipt() ProviderRunTerminalReceipt

func (WorkspaceCompletionEvidence) RunID 

func (evidence WorkspaceCompletionEvidence) RunID() string

func (WorkspaceCompletionEvidence) Valid 

func (evidence WorkspaceCompletionEvidence) Valid() bool

func (WorkspaceCompletionEvidence) WorkspaceSnapshotIdentity 

func (evidence WorkspaceCompletionEvidence) WorkspaceSnapshotIdentity() WorkspaceSnapshotIdentity

type WorkspaceContentDetector 

type WorkspaceContentDetector interface {
	DetectWorkspaceContent(context.Context, SafeRelativePath, []byte) (WorkspaceContentVerdict, error)
}

WorkspaceContentDetector examines every captured file before any destination exists.

type WorkspaceContentVerdict 

type WorkspaceContentVerdict string

WorkspaceContentVerdict is the mandatory pre-write detector result. 

const (
	WorkspaceContentClean                        WorkspaceContentVerdict = "clean"
	WorkspaceContentSecret                       WorkspaceContentVerdict = "secret"
	WorkspaceContentDangerousProviderInstruction WorkspaceContentVerdict = "dangerous_provider_instruction"
)

type WorkspaceExecutionAuthority 

type WorkspaceExecutionAuthority interface {
	WorkspaceSnapshotIdentity() WorkspaceSnapshotIdentity
	RevalidateForExecution() (WorkspaceExecutionGuard, error)
}

WorkspaceExecutionAuthority can mint one validated guard per process attempt. It deliberately has no release or cleanup method.

type WorkspaceExecutionGuard 

type WorkspaceExecutionGuard interface {
	WorkspaceRoot() ValidatedWorkspaceRoot
	WorkspaceSnapshotIdentity() WorkspaceSnapshotIdentity
	// DuplicateLaunchDirectory returns a caller-owned descriptor for the exact
	// validated workspace root. It rejects closed guards.
	DuplicateLaunchDirectory() (*os.File, error)
	RevalidateAfterExecution() error
	Close() error
}

WorkspaceExecutionGuard is the narrowed per-spawn root capability.

type WorkspaceSnapshotAcquisition 

type WorkspaceSnapshotAcquisition func(context.Context, WorkspaceTerminalBinding) (WorkspaceSnapshotLease, error)

WorkspaceSnapshotAcquisition materializes one lease while its terminal binding is open.

type WorkspaceSnapshotFile 

type WorkspaceSnapshotFile struct {
	// contains filtered or unexported fields
}

WorkspaceSnapshotFile is a captured regular UTF-8 file. Its bytes are copied at construction and when returned so callers cannot alter the request later.

func NewWorkspaceSnapshotFile 

func NewWorkspaceSnapshotFile(path SafeRelativePath, bytes []byte, expectedSHA256 string) (WorkspaceSnapshotFile, error)

NewWorkspaceSnapshotFile validates a captured file and its expected identity.

func NewWorkspaceVisualAsset 

func NewWorkspaceVisualAsset(path SafeRelativePath, bytes []byte, expectedSHA256, mediaType string) (WorkspaceSnapshotFile, error)

NewWorkspaceVisualAsset validates a bounded raster design reference. Visual assets are materialized for UI review but are never passed through text or line-evidence readers.

func (WorkspaceSnapshotFile) Bytes 

func (file WorkspaceSnapshotFile) Bytes() []byte

func (WorkspaceSnapshotFile) IsText 

func (file WorkspaceSnapshotFile) IsText() bool

func (WorkspaceSnapshotFile) MediaType 

func (file WorkspaceSnapshotFile) MediaType() string

func (WorkspaceSnapshotFile) Path 

func (file WorkspaceSnapshotFile) Path() SafeRelativePath

func (WorkspaceSnapshotFile) SHA256 

func (file WorkspaceSnapshotFile) SHA256() string

type WorkspaceSnapshotIdentity 

type WorkspaceSnapshotIdentity struct {
	// contains filtered or unexported fields
}

WorkspaceSnapshotIdentity is the immutable filesystem and manifest identity of one v2 workspace snapshot.

func NewWorkspaceSnapshotIdentity 

func NewWorkspaceSnapshotIdentity(snapshotPath, snapshotName, manifestSHA256, policyIdentity string, rootDevice, rootInode, snapshotDevice, snapshotInode uint64) (WorkspaceSnapshotIdentity, error)

func (WorkspaceSnapshotIdentity) ManifestSHA256 

func (identity WorkspaceSnapshotIdentity) ManifestSHA256() string

func (WorkspaceSnapshotIdentity) PolicyIdentity 

func (identity WorkspaceSnapshotIdentity) PolicyIdentity() string

func (WorkspaceSnapshotIdentity) RootIdentity 

func (identity WorkspaceSnapshotIdentity) RootIdentity() (uint64, uint64)

func (WorkspaceSnapshotIdentity) SnapshotFSIdentity 

func (identity WorkspaceSnapshotIdentity) SnapshotFSIdentity() (uint64, uint64)

func (WorkspaceSnapshotIdentity) SnapshotName 

func (identity WorkspaceSnapshotIdentity) SnapshotName() string

func (WorkspaceSnapshotIdentity) SnapshotPath 

func (identity WorkspaceSnapshotIdentity) SnapshotPath() string

func (WorkspaceSnapshotIdentity) Valid 

func (identity WorkspaceSnapshotIdentity) Valid() bool

type WorkspaceSnapshotLease 

type WorkspaceSnapshotLease interface {
	WorkspaceExecutionAuthority
	Receipt() WorkspaceSnapshotReceipt
	Release(WorkspaceCompletionEvidence) (WorkspaceTerminalReceipt, error)
	Abort(WorkspaceAbortEvidence) error
}

WorkspaceSnapshotLease is capture-owned authority retained through terminal cleanup or an explicitly evidenced abort. Execution consumers receive only WorkspaceExecutionAuthority.

func AcquireWorkspaceSnapshotLease 

func AcquireWorkspaceSnapshotLease(ctx context.Context, acquire WorkspaceSnapshotAcquisition) (WorkspaceSnapshotLease, error)

AcquireWorkspaceSnapshotLease binds terminal proof to lease acquisition.

type WorkspaceSnapshotLeaseFactory 

type WorkspaceSnapshotLeaseFactory interface {
	MaterializeLease(context.Context, WorkspaceSnapshotRequest) (WorkspaceSnapshotLease, error)
}

WorkspaceSnapshotLeaseFactory materializes captured bytes without receiving authority to read the live project root.

type WorkspaceSnapshotReceipt 

type WorkspaceSnapshotReceipt struct {
	// contains filtered or unexported fields
}

WorkspaceSnapshotReceipt identifies exactly one materialized snapshot.

func NewWorkspaceSnapshotReceipt 

func NewWorkspaceSnapshotReceipt(snapshotPath, snapshotName, manifestSHA256, policyIdentity string, rootDevice, rootInode, snapshotDevice, snapshotInode uint64, files []WorkspaceSnapshotFile) (WorkspaceSnapshotReceipt, error)

NewWorkspaceSnapshotReceipt constructs an immutable receipt for an adapter-owned snapshot.

func (WorkspaceSnapshotReceipt) Files 

func (receipt WorkspaceSnapshotReceipt) Files() []WorkspaceSnapshotFile

func (WorkspaceSnapshotReceipt) ManifestSHA256 

func (receipt WorkspaceSnapshotReceipt) ManifestSHA256() string

func (WorkspaceSnapshotReceipt) PolicyIdentity 

func (receipt WorkspaceSnapshotReceipt) PolicyIdentity() string

func (WorkspaceSnapshotReceipt) SnapshotIdentity 

func (receipt WorkspaceSnapshotReceipt) SnapshotIdentity() (string, uint64, uint64, uint64, uint64)

func (WorkspaceSnapshotReceipt) SnapshotPath 

func (receipt WorkspaceSnapshotReceipt) SnapshotPath() string

func (WorkspaceSnapshotReceipt) Valid 

func (receipt WorkspaceSnapshotReceipt) Valid() bool

type WorkspaceSnapshotRequest 

type WorkspaceSnapshotRequest struct {
	// contains filtered or unexported fields
}

WorkspaceSnapshotRequest contains only already-captured source bytes. It has no live-project-root field by design.

func NewWorkspaceSnapshotRequest 

func NewWorkspaceSnapshotRequest(files []WorkspaceSnapshotFile, policyIdentity string) (WorkspaceSnapshotRequest, error)

NewWorkspaceSnapshotRequest validates stable lexicographic, unique captured files.

func (WorkspaceSnapshotRequest) Files 

func (request WorkspaceSnapshotRequest) Files() []WorkspaceSnapshotFile

func (WorkspaceSnapshotRequest) PolicyIdentity 

func (request WorkspaceSnapshotRequest) PolicyIdentity() string

func (WorkspaceSnapshotRequest) Valid 

func (request WorkspaceSnapshotRequest) Valid() bool

type WorkspaceTerminalBinding 

type WorkspaceTerminalBinding struct {
	// contains filtered or unexported fields
}

WorkspaceTerminalBinding is minted only for one acquisition callback.

func (WorkspaceTerminalBinding) Bind 

func (binding WorkspaceTerminalBinding) Bind(workspace WorkspaceSnapshotIdentity, releaseAndVerify func(WorkspaceCompletionEvidence) error) (WorkspaceTerminalRelease, error)

Bind retains a verified terminal operation and makes its receipt unavailable until that operation succeeds.

type WorkspaceTerminalReceipt 

type WorkspaceTerminalReceipt struct {
	// contains filtered or unexported fields
}

WorkspaceTerminalReceipt proves successful revalidation and deletion of the exact workspace bound by completion evidence. Its identity is canonical and domain-separated from all other SHA-256 identifiers.

func (WorkspaceTerminalReceipt) ProviderRunTerminalReceipt 

func (receipt WorkspaceTerminalReceipt) ProviderRunTerminalReceipt() ProviderRunTerminalReceipt

func (WorkspaceTerminalReceipt) ReceiptID 

func (receipt WorkspaceTerminalReceipt) ReceiptID() string

func (WorkspaceTerminalReceipt) RunID 

func (receipt WorkspaceTerminalReceipt) RunID() string

func (WorkspaceTerminalReceipt) Valid 

func (receipt WorkspaceTerminalReceipt) Valid() bool

func (WorkspaceTerminalReceipt) WorkspaceSnapshotIdentity 

func (receipt WorkspaceTerminalReceipt) WorkspaceSnapshotIdentity() WorkspaceSnapshotIdentity

type WorkspaceTerminalRelease 

type WorkspaceTerminalRelease func(WorkspaceCompletionEvidence) (WorkspaceTerminalReceipt, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.