reviewrun

package
v0.1.15 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 16, 2026 License: MIT Imports: 24 Imported by: 0

Documentation

Overview

Package reviewrun contains provider-independent review-run admission policy.

Index

Constants

View Source 
const ZCodeLauncher = "/Applications/ZCode.app/Contents/Resources/glm/zcode.cjs"

ZCodeLauncher is the fixed direct launcher bundled by ZCode on Darwin.

Variables

This section is empty.

Functions

func CoordinatorExecutionFailure 

func CoordinatorExecutionFailure(result review.CoordinatorResult) error

CoordinatorExecutionFailure applies the shared pre-publication terminal policy to root and child coordinator results. Operational provider failures remain publishable as incomplete coverage; authentication and closed fatal classes retain their typed execution authority instead of being flattened by a later publication validation error.

func LoadDefaultTemplateSet 

func LoadDefaultTemplateSet(ctx context.Context, catalog ports.ContractCatalog) (review.TemplateSet, error)

LoadDefaultTemplateSet loads the fixed root-review prompt contract from the supplied immutable contract catalog.

func NewAllocatedRunIdentityError added in v0.1.4 

func NewAllocatedRunIdentityError(sessionID domain.SessionID, runID domain.RunID, cause error) error

NewAllocatedRunIdentityError retains an identity even when runtime diagnostics could not be installed or finalized.

func NewProviderExecutionFailuresError 

func NewProviderExecutionFailuresError(failures []ProviderExecutionFailure) error

NewProviderExecutionFailuresError constructs a canonical safe aggregate.

func NewProviderLoginRequiredError 

func NewProviderLoginRequiredError(providers []string, cause error) error

NewProviderLoginRequiredError constructs a safe application error for the supplied configured provider instances.

func NewProviderQualificationFailuresError 

func NewProviderQualificationFailuresError(failures []ProviderQualificationFailure) error

NewProviderQualificationFailuresError constructs the canonical safe aggregate used across qualification, planning, and command projection.

func NewRuntimeDiagnosticReferenceError 

func NewRuntimeDiagnosticReferenceError(uri ports.SafeRelativePath, cause error) error

NewRuntimeDiagnosticReferenceError attaches an installed runtime diagnostic URI to a terminal error without exposing any diagnostic contents.

func NewRuntimeDiagnosticReferenceErrorWithIdentity added in v0.1.4 

func NewRuntimeDiagnosticReferenceErrorWithIdentity(
	uri ports.SafeRelativePath,
	sessionID domain.SessionID,
	runID domain.RunID,
	cause error,
) error

NewRuntimeDiagnosticReferenceErrorWithIdentity attaches an installed runtime diagnostic URI and the already allocated run identity to a terminal error. Command projections use the identity for recovery without treating the diagnostic as publication authority.

func PartialProviderRunTerminalReceiptFromError 

func PartialProviderRunTerminalReceiptFromError(err error) (ports.ProviderRunTerminalReceipt, bool)

PartialProviderRunTerminalReceiptFromError exposes the last drain observation. The returned receipt is not terminal proof unless Valid reports true.

func ProviderLoginRequiredProvidersFromError 

func ProviderLoginRequiredProvidersFromError(err error) ([]string, bool)

ProviderLoginRequiredProvidersFromError returns sorted unique provider instances without exposing native stderr or credential material.

func ProviderRunTerminalReceiptFromError 

func ProviderRunTerminalReceiptFromError(err error) (ports.ProviderRunTerminalReceipt, bool)

ProviderRunTerminalReceiptFromError exposes complete cleanup proof from a failed construction. It returns false while cleanup remains retryable.

func RuntimeDiagnosticIdentityFromError added in v0.1.4 

func RuntimeDiagnosticIdentityFromError(err error) (domain.SessionID, domain.RunID, bool)

RuntimeDiagnosticIdentityFromError returns an allocated identity retained by a failed review after diagnostics were installed.

func RuntimeDiagnosticURIFromError 

func RuntimeDiagnosticURIFromError(err error) (ports.SafeRelativePath, bool)

func SupportedProductionRoles 

func SupportedProductionRoles(family Family) []domain.Role

SupportedProductionRoles returns the closed role capability matrix for one family.

Types

type AllocatedRunIdentityError added in v0.1.4 

type AllocatedRunIdentityError struct {
	// contains filtered or unexported fields
}

AllocatedRunIdentityError retains recovery identity without claiming that a diagnostic or publication artifact was installed.

func (*AllocatedRunIdentityError) Error added in v0.1.4 

func (err *AllocatedRunIdentityError) Error() string

func (*AllocatedRunIdentityError) Unwrap added in v0.1.4 

func (err *AllocatedRunIdentityError) Unwrap() error

type AuthorityScope 

type AuthorityScope string

AuthorityScope is the closed execution authority scope carried by a receipt. 

const (
	AuthorityScopeDirectExecution          AuthorityScope = "direct-execution"
	AuthorityScopeAGYCanonicalPlanControls AuthorityScope = "agy-canonical-plan-controls"
)

type BuildIdentity 

type BuildIdentity struct {
	Product     string
	Version     string
	Module      string
	ModuleSum   string
	VCSRevision string
}

BuildIdentity is immutable provenance attached to a qualified production run.

func (BuildIdentity) ImmutableReference 

func (identity BuildIdentity) ImmutableReference() string

func (BuildIdentity) Valid 

func (identity BuildIdentity) Valid() bool

type CapturedRunInput 

type CapturedRunInput struct {
	// contains filtered or unexported fields
}

CapturedRunInput transfers the immutable input, immutable evidence reader, and sole workspace lease from capture into the review service.

func NewCapturedRunInput 

func NewCapturedRunInput(input ImmutableReviewInput, lease ports.WorkspaceSnapshotLease, reader evidence.ImmutableTargetReader, packetDetectors ...ports.ReviewInputContentDetector) (CapturedRunInput, error)

func (CapturedRunInput) ImmutableTargetReader 

func (captured CapturedRunInput) ImmutableTargetReader() evidence.ImmutableTargetReader

func (CapturedRunInput) Input 

func (captured CapturedRunInput) Input() ImmutableReviewInput

func (CapturedRunInput) PacketDetector 

func (captured CapturedRunInput) PacketDetector() ports.ReviewInputContentDetector

func (CapturedRunInput) WorkspaceLease 

func (captured CapturedRunInput) WorkspaceLease() ports.WorkspaceSnapshotLease

type CurrentQualificationRequest 

type CurrentQualificationRequest struct {
	Profile        DiscoveredProviderProfile
	Definition     ports.ProviderRuntimeDefinition
	Identity       Identity
	Namespace      ports.ProviderQualificationNamespace
	RequestedRoles []domain.Role
	BaseRole       domain.Role
	Now            time.Time
}

CurrentQualificationRequest is the complete immutable probe boundary. The definition is production-only and the identity is shared by every receipt.

type CurrentQualificationResult 

type CurrentQualificationResult struct {
	VersionArgv       []string
	Version           string
	KnownIncompatible bool
	Receipts          []Receipt
	SupportedRoles    []domain.Role
	RoleReceipts      []CurrentRoleReceipt
	BaseRole          domain.Role
	Observations      []ProviderQualificationObservation
	// contains filtered or unexported fields
}

CurrentQualificationResult is immutable current evidence bound to exactly the supplied request identity. SupportedRoles must exactly match the canonical receipt-backed role authority. familyAuthority is the adapter-minted exact direct-execution authority for the probed definition and is never remapped by rewriting app-layer identity fields.

type CurrentQualifier 

type CurrentQualifier interface {
	QualifyCurrent(context.Context, CurrentQualificationRequest) (CurrentQualificationResult, error)
}

CurrentQualifier performs the isolated current checks for one discovered provider. It must never use the host HOME or working directory: the supplied identity names the namespace retained by the run-owned registry. VersionArgv must be the exact discovered invocation plus "--version".

type CurrentQualifierFunc 

type CurrentQualifierFunc func(context.Context, CurrentQualificationRequest) (CurrentQualificationResult, error)

CurrentQualifierFunc adapts a function for injection in tests and composition.

func (CurrentQualifierFunc) QualifyCurrent 

func (function CurrentQualifierFunc) QualifyCurrent(ctx context.Context, request CurrentQualificationRequest) (CurrentQualificationResult, error)

type CurrentRoleReceipt 

type CurrentRoleReceipt struct {
	Role     domain.Role
	State    ReceiptState
	Identity Identity
}

CurrentRoleReceipt is explicit current evidence for one role.

type Dependencies 

type Dependencies struct {
	Clock               ports.Clock
	IDs                 review.IdentityGenerator
	Build               BuildIdentity
	RunAuthorityFactory RunAuthorityFactory
	Validator           *validation.ReviewValidator
	Publication         publication.PublicationCommitter
	Templates           review.TemplateSet
	Diagnostics         ports.RuntimeDiagnosticSinkFactory
}

Dependencies are injected application services and ports. They intentionally exclude filesystem, process construction, and provider discovery.

type DiscoveredProviderProfile 

type DiscoveredProviderProfile struct {
	// contains filtered or unexported fields
}

DiscoveredProviderProfile is an immutable identity-only executable discovery result. Discovery never launches a provider and is therefore not routable until a qualified version result is bound to this exact invocation shape.

func DiscoverConfiguredProviderProfiles 

func DiscoverConfiguredProviderProfiles(ctx context.Context, inspector ports.EnvironmentInspector, configured map[Family][]string) ([]DiscoveredProviderProfile, error)

DiscoverConfiguredProviderProfiles observes only the exact executable and launcher paths admitted from the project-local configuration.

func DiscoverProviderProfile 

func DiscoverProviderProfile(ctx context.Context, inspector ports.EnvironmentInspector, family Family) (DiscoveredProviderProfile, error)

DiscoverProviderProfile discovers one allowlisted family without observing any other provider. Discovery never executes the provider. ZCode has distinct Node and CJS launcher identities.

func DiscoverProviderProfileWithOverrides 

func DiscoverProviderProfileWithOverrides(ctx context.Context, inspector ports.EnvironmentInspector, family Family, executableOverride, launcherOverride string) (DiscoveredProviderProfile, error)

DiscoverProviderProfileWithOverrides observes one effective provider tuple. Empty executable and ZCode launcher overrides select startup PATH and the bundled launcher respectively; supplied components suppress those lookups.

func DiscoverProviderProfiles 

func DiscoverProviderProfiles(ctx context.Context, inspector ports.EnvironmentInspector) ([]DiscoveredProviderProfile, error)

DiscoverProviderProfiles discovers every allowlisted family in canonical order. Callers that select a subset must use DiscoverProviderProfile so an unselected provider cannot influence discovery.

func (DiscoveredProviderProfile) Argv 

func (profile DiscoveredProviderProfile) Argv() []string

Argv returns a caller-owned direct invocation shape.

func (DiscoveredProviderProfile) Available 

func (profile DiscoveredProviderProfile) Available() bool

Available reports whether executable discovery and version-floor eligibility passed.

func (DiscoveredProviderProfile) Classification 

func (profile DiscoveredProviderProfile) Classification() VersionClassification

Classification returns the version guidance classification.

func (DiscoveredProviderProfile) Executable 

func (profile DiscoveredProviderProfile) Executable() string

Executable returns the canonical executable provenance, when discovered.

func (DiscoveredProviderProfile) Family 

func (profile DiscoveredProviderProfile) Family() Family

Family returns the allowlisted family discovered by this profile.

func (DiscoveredProviderProfile) Launcher 

func (profile DiscoveredProviderProfile) Launcher() string

Launcher returns ZCode's fixed canonical launcher, or empty for direct binaries.

func (DiscoveredProviderProfile) LauncherSHA256 

func (profile DiscoveredProviderProfile) LauncherSHA256() string

LauncherSHA256 returns the current launcher identity hash.

func (DiscoveredProviderProfile) Reason 

func (profile DiscoveredProviderProfile) Reason() string

Reason returns the stable discovery reason.

func (DiscoveredProviderProfile) SHA256 

func (profile DiscoveredProviderProfile) SHA256() string

SHA256 returns diagnostic executable provenance.

func (DiscoveredProviderProfile) Version 

func (profile DiscoveredProviderProfile) Version() string

Version returns the observed version text.

func (DiscoveredProviderProfile) WithQualifiedVersion 

func (profile DiscoveredProviderProfile) WithQualifiedVersion(argv []string, version string) DiscoveredProviderProfile

WithQualifiedVersion binds a version returned by the isolated exact [executable, launcher, "--version"] invocation. Direct families use the executable as their launcher.

type ExecutionPlan 

type ExecutionPlan struct {
	Assignments []review.Assignment
	Budgets     []review.RoleBudget
	Ceilings    review.HarnessCeilings
	Threshold   domain.Severity
	Policy      *domain.CIPolicy
	MaxWorkers  int
}

ExecutionPlan contains only already-qualified routing and trusted execution limits. Planning has no provider invocation or publication authority.

func PreflightConfiguredPlan added in v0.1.2 

func PreflightConfiguredPlan(
	policy PlannerPolicy,
	providerTimeouts map[Family]time.Duration,
	selectedRoles []domain.Role,
) (ExecutionPlan, review.RunBudgetReceipt, error)

PreflightConfiguredPlan projects the production route topology and its enclosing budgets without discovering, qualifying, or invoking providers. It deliberately shares the production instance, output-cap, timeout, assignment, and budget authorities used by qualified execution planning.

type ExecutionPlanner 

type ExecutionPlanner interface {
	Plan(context.Context, PlanningRequest) (ExecutionPlan, error)
}

ExecutionPlanner supplies already-qualified assignments and matching budgets.

func NewQualifiedPlanner 

func NewQualifiedPlanner(routes []QualifiedRoute, policy PlannerPolicy) (ExecutionPlanner, error)

NewQualifiedPlanner freezes current qualified routes for pure deterministic assignment planning. Discovery availability alone is never accepted.

type Family 

type Family string

Family identifies an allowlisted provider family. 

const (
	FamilyKimi  Family = "kimi"
	FamilyZCode Family = "zcode"
	FamilyAGY   Family = "agy"
	FamilyCodex Family = "codex"
)

func ConfiguredProviderSecurityFamilies 

func ConfiguredProviderSecurityFamilies(err error) []Family

ConfiguredProviderSecurityFamilies returns the configured families whose identity observation failed security admission. The returned slice is caller-owned and contains no local path material.

func Families 

func Families() []Family

Families returns the allowlisted families in canonical order. The returned slice is caller-owned.

func (Family) Valid 

func (family Family) Valid() bool

Valid reports whether family is allowlisted.

type FamilyRouteDerivationRequest added in v0.1.4 

type FamilyRouteDerivationRequest struct {
	Source               CurrentQualificationResult
	SourceDefinition     ports.ProviderRuntimeDefinition
	SourceNamespaceGen   string
	Destination          QualifiedRunCandidate
	DestinationIdentity  Identity
	DestinationNamespace ports.ProviderQualificationNamespace
	Now                  time.Time
}

FamilyRouteDerivationRequest binds one live family result to a sibling route.

type FamilyRouteDeriver added in v0.1.4 

type FamilyRouteDeriver interface {
	DeriveEquivalentFamilyRoute(context.Context, FamilyRouteDerivationRequest) (CurrentQualificationResult, error)
}

FamilyRouteDeriver derives exact sibling-route admission from one live family qualification without copying the representative authority identity.

type Identity 

type Identity struct {
	Family              Family
	Instance            string
	ProfileGeneration   string
	AdapterProfile      string
	Version             string
	Executable          string
	ExecutableSHA256    string
	Launcher            string
	LauncherSHA256      string
	SnapshotManifest    string
	NamespaceLease      string
	NamespaceGeneration string
}

Identity is the full current binding that every qualification receipt must share.

type ImmutableInputSource 

type ImmutableInputSource interface {
	Capture(context.Context, Request) (CapturedRunInput, error)
}

ImmutableInputSource captures all user-controlled material and its sole workspace lease exactly once.

type ImmutableInputSourceFactory 

type ImmutableInputSourceFactory interface {
	NewImmutableInputSource(context.Context, InputCaptureRequest) (ImmutableInputSource, error)
}

type ImmutableReviewInput 

type ImmutableReviewInput struct {
	// contains filtered or unexported fields
}

ImmutableReviewInput is the single captured snapshot used throughout a run.

func NewImmutableReviewInput 

func NewImmutableReviewInput(target ports.CapturedReviewTarget, objective []byte, hasObjective bool, projectContext []byte) (ImmutableReviewInput, error)

NewImmutableReviewInput is the compatibility constructor for callers without explicit project-context presence. A nil context is absent; a non-nil context is present, including an empty slice.

func NewImmutableReviewInputWithCapturedArchive 

func NewImmutableReviewInputWithCapturedArchive(target ports.CapturedReviewTarget, objective []byte, hasObjective bool, projectContext []byte, hasProjectContext bool, capturedArchive []byte) (ImmutableReviewInput, error)

NewImmutableReviewInputWithCapturedArchive additionally retains the exact authority-free capture needed to reproduce this input after publication.

func NewImmutableReviewInputWithProjectContext 

func NewImmutableReviewInputWithProjectContext(target ports.CapturedReviewTarget, objective []byte, hasObjective bool, projectContext []byte, hasProjectContext bool) (ImmutableReviewInput, error)

NewImmutableReviewInputWithProjectContext validates a captured target and takes defensive ownership of the exact objective and project-context bytes.

func (ImmutableReviewInput) CapturedArchive 

func (input ImmutableReviewInput) CapturedArchive() []byte

func (ImmutableReviewInput) HasObjective 

func (input ImmutableReviewInput) HasObjective() bool

func (ImmutableReviewInput) HasProjectContext 

func (input ImmutableReviewInput) HasProjectContext() bool

func (ImmutableReviewInput) Objective 

func (input ImmutableReviewInput) Objective() []byte

func (ImmutableReviewInput) ProjectContext 

func (input ImmutableReviewInput) ProjectContext() []byte

func (ImmutableReviewInput) Target 

func (input ImmutableReviewInput) Target() ports.CapturedReviewTarget

type InputCaptureRequest 

type InputCaptureRequest struct {
	// contains filtered or unexported fields
}

func NewInputCaptureRequest 

func NewInputCaptureRequest(root ports.AnchoredRoot, target ports.ReviewTargetSelector, objective []byte, hasObjective bool) (InputCaptureRequest, error)

func NewInputCaptureRequestWithArtistInputs 

func NewInputCaptureRequestWithArtistInputs(root ports.AnchoredRoot, target ports.ReviewTargetSelector, objective []byte, hasObjective bool, artistInputs ports.ArtistReviewInputs) (InputCaptureRequest, error)

func NewInputCaptureRequestWithAutomaticArtistInputs added in v0.1.11 

func NewInputCaptureRequestWithAutomaticArtistInputs(root ports.AnchoredRoot, target ports.ReviewTargetSelector, objective []byte, hasObjective bool, artistInputs ports.ArtistReviewInputs) (InputCaptureRequest, error)

func (InputCaptureRequest) ArtistInputs 

func (request InputCaptureRequest) ArtistInputs() (ports.ArtistReviewInputs, bool)

func (InputCaptureRequest) Objective 

func (request InputCaptureRequest) Objective() ([]byte, bool)

func (InputCaptureRequest) Root 

func (request InputCaptureRequest) Root() ports.AnchoredRoot

func (InputCaptureRequest) Target 

func (request InputCaptureRequest) Target() ports.ReviewTargetSelector

func (InputCaptureRequest) Valid 

func (request InputCaptureRequest) Valid() bool

type PlannerPolicy 

type PlannerPolicy struct {
	Ceilings      review.HarnessCeilings
	Threshold     domain.Severity
	Policy        *domain.CIPolicy
	MaxWorkers    int
	Assignments   []RoleProviderAssignment
	RequiredRoles []domain.Role
}

PlannerPolicy supplies trusted execution limits, explicit Config v1 provider assignments, outcome policy, and active-worker capacity. Zero threshold, ceilings, and capacity select the closed defaults; assignments never default.

func DefaultPlannerPolicy 

func DefaultPlannerPolicy() PlannerPolicy

DefaultPlannerPolicy returns the closed planner policy used when no narrower trusted policy is supplied.

type PlanningRequest 

type PlanningRequest struct {
	// contains filtered or unexported fields
}

PlanningRequest binds immutable input to the exact ordered role selection that a planner is authorized to assign.

func NewPlanningRequest 

func NewPlanningRequest(input ImmutableReviewInput, requestedRoles []domain.Role) (PlanningRequest, error)

NewPlanningRequest validates and defensively retains requested role order.

func (PlanningRequest) Input 

func (request PlanningRequest) Input() ImmutableReviewInput

Input returns the immutable captured input.

func (PlanningRequest) RequestedRoles 

func (request PlanningRequest) RequestedRoles() []domain.Role

RequestedRoles returns a caller-owned copy in requested order.

type ProductionPromptSource 

type ProductionPromptSource = promptSource

ProductionPromptSource is the shared current-template prompt authority for root, delta, recomposed rerun, and exact replay execution.

func NewProductionPromptSource 

func NewProductionPromptSource(input ImmutableReviewInput, templates review.TemplateSet, ids prompt.InvocationIDIssuer, roleTask func() (prompt.RoleTaskID, error)) (*ProductionPromptSource, error)

NewProductionPromptSource constructs a child-workflow prompt authority from one P2- or capture-bound immutable target. It grants no staging authority, so every launch it composes keeps the stdout transport.

func NewProductionPromptSourceWithStaging added in v0.1.4 

func NewProductionPromptSourceWithStaging(input ImmutableReviewInput, templates review.TemplateSet, ids prompt.InvocationIDIssuer, roleTask func() (prompt.RoleTaskID, error), staging ports.ProviderOutputStagingLocator) (*ProductionPromptSource, error)

NewProductionPromptSourceWithStaging constructs the same child-workflow prompt authority bound to the adapter-owned staging locator. Delta and recomposed rerun then state their own resolved destination exactly as root review does; exact replay reproduces stored wire bytes and is unaffected.

type ProductionQualifiedRunCandidateSource 

type ProductionQualifiedRunCandidateSource struct {
	// contains filtered or unexported fields
}

ProductionQualifiedRunCandidateSource binds startup-frozen identity-only discovery to the fixed production runtime templates. It has no process, credential, environment, or configuration authority.

func NewProductionQualifiedRunCandidateSource 

func NewProductionQualifiedRunCandidateSource(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSource constructs the production candidate source from the identity-only profiles captured at startup. Profiles are retained by value; their caller-owned argv slices are cloned.

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentities 

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentities(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile, identities map[Family]string) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSourceWithPolicyIdentities constructs the production candidate source using the exact policies installed into provider credential namespaces for this composition.

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndAGYPermissionMode 

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndAGYPermissionMode(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile, identities map[Family]string, agyPermissionMode string) (*ProductionQualifiedRunCandidateSource, error)

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettings 

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettings(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile, identities map[Family]string, agyPermissionMode, kimiModel string) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettings binds operator-admitted family settings to every probe and production invocation. Kimi's model is explicit here; callers pass the canonical default only when the configuration omitted the field.

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettingsAndCodexAndTimeouts added in v0.1.14 

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettingsAndCodexAndTimeouts(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile, identities map[Family]string, agyPermissionMode, kimiModel, codexModel, codexReasoningEffort string, providerTimeouts map[Family]time.Duration) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettingsAndCodexAndTimeouts binds optional Codex model settings without replacing the provider's defaults when either value is omitted.

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettingsAndCodexCredentialProfilesAndTimeouts added in v0.1.14 

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettingsAndCodexCredentialProfilesAndTimeouts(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile, identities map[Family]string, agyPermissionMode, kimiModel, codexModel, codexReasoningEffort string, codexCredentialProfiles map[domain.Role]string, providerTimeouts map[Family]time.Duration) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettingsAndCodexCredentialProfilesAndTimeouts binds role-specific Codex credential profiles into provider instance and adapter-profile identity without changing shared Codex model policy.

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettingsAndTimeouts added in v0.1.2 

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettingsAndTimeouts(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile, identities map[Family]string, agyPermissionMode, kimiModel string, providerTimeouts map[Family]time.Duration) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndRuntimeSettingsAndTimeouts binds a complete family timeout policy to every role-specific production candidate and its adapter-built runtime definition.

func (*ProductionQualifiedRunCandidateSource) NewQualifiedRunCandidates 

func (source *ProductionQualifiedRunCandidateSource) NewQualifiedRunCandidates(_ context.Context, captured CapturedRunInput, selection RunSelection) ([]QualifiedRunCandidate, error)

NewQualifiedRunCandidates creates candidate descriptions only. Current version, capability, security, and role authorization remain admission work.

func (*ProductionQualifiedRunCandidateSource) NewSyntheticQualifiedRunCandidates added in v0.1.15 

func (source *ProductionQualifiedRunCandidateSource) NewSyntheticQualifiedRunCandidates(workspace ports.WorkspaceSnapshotIdentity, selection RunSelection) ([]QualifiedRunCandidate, error)

NewSyntheticQualifiedRunCandidates creates candidates bound only to a Mulgae-owned synthetic workspace. It is used by explicitly authorized live diagnostics and carries no review input or publication authority.

type Provenance 

type Provenance struct {
	Version string
	Path    string
	SHA256  string
	Profile string
}

Provenance is diagnostic-only receipt metadata. Its values deliberately do not participate in admission identity comparisons.

type ProviderCurrentQualifier 

type ProviderCurrentQualifier struct {
	// contains filtered or unexported fields
}

ProviderCurrentQualifier adapts descriptor-bound provider probes into provider-independent current admission evidence.

func NewProviderCurrentQualifier 

func NewProviderCurrentQualifier(probe ports.ProviderCurrentProbe, fixtures ports.ProviderQualificationFixtureFactory) (*ProviderCurrentQualifier, error)

NewProviderCurrentQualifier constructs the production current qualifier.

func (*ProviderCurrentQualifier) DeriveEquivalentFamilyRoute added in v0.1.4 

func (qualifier *ProviderCurrentQualifier) DeriveEquivalentFamilyRoute(
	ctx context.Context,
	request FamilyRouteDerivationRequest,
) (CurrentQualificationResult, error)

DeriveEquivalentFamilyRoute mints destination-bound receipts from a live family authority through the adapter derivation boundary.

func (*ProviderCurrentQualifier) QualifyCurrent 

func (qualifier *ProviderCurrentQualifier) QualifyCurrent(ctx context.Context, request CurrentQualificationRequest) (result CurrentQualificationResult, err error)

QualifyCurrent acquires one base-role fixture, performs one descriptor-bound family/runtime probe, and derives role admission from that evidence. Invalid capability formatting, capability evidence mismatches, security failures, and login-required responses are never retried; one transient operational probe failure admits at most one additional probe on a freshly materialized fixture under the same expiry basis. Every acquired fixture is drained exactly once before it returns, and the attempt-1 rejection stays in the observations.

type ProviderExecutionFailure 

type ProviderExecutionFailure struct {
	// contains filtered or unexported fields
}

ProviderExecutionFailure is one safe terminal provider fact. It contains no native output, path, credential material, or free-form provider text.

func NewProviderExecutionFailure 

func NewProviderExecutionFailure(
	providerInstance string,
	role domain.Role,
	reasonCode string,
	class domain.FailureClass,
) (ProviderExecutionFailure, error)

NewProviderExecutionFailure constructs one closed safe terminal provider fact.

func NewProviderExecutionFailureWithTimeoutFacts added in v0.1.2 

func NewProviderExecutionFailureWithTimeoutFacts(
	providerInstance string,
	role domain.Role,
	reasonCode string,
	class domain.FailureClass,
	facts review.ProviderTimeoutFacts,
) (ProviderExecutionFailure, error)

func ProviderExecutionFailuresFromError 

func ProviderExecutionFailuresFromError(err error) ([]ProviderExecutionFailure, bool)

ProviderExecutionFailuresFromError returns only closed safe provider facts.

func (ProviderExecutionFailure) FailureClass 

func (failure ProviderExecutionFailure) FailureClass() domain.FailureClass

func (ProviderExecutionFailure) ProviderInstance 

func (failure ProviderExecutionFailure) ProviderInstance() string

func (ProviderExecutionFailure) ProviderTimeoutFacts added in v0.1.2 

func (failure ProviderExecutionFailure) ProviderTimeoutFacts() (review.ProviderTimeoutFacts, bool)

func (ProviderExecutionFailure) ReasonCode 

func (failure ProviderExecutionFailure) ReasonCode() string

func (ProviderExecutionFailure) Role 

func (failure ProviderExecutionFailure) Role() domain.Role

type ProviderExecutionFailuresError 

type ProviderExecutionFailuresError struct {
	// contains filtered or unexported fields
}

func (*ProviderExecutionFailuresError) Error 

func (failure *ProviderExecutionFailuresError) Error() string

type ProviderLoginRequiredError 

type ProviderLoginRequiredError struct {
	// contains filtered or unexported fields
}

ProviderLoginRequiredError is the safe provider-attributed application failure raised when native authentication requires direct user action.

func (*ProviderLoginRequiredError) Error 

func (failure *ProviderLoginRequiredError) Error() string

func (*ProviderLoginRequiredError) Unwrap 

func (failure *ProviderLoginRequiredError) Unwrap() error

type ProviderQualificationFailure 

type ProviderQualificationFailure struct {
	// contains filtered or unexported fields
}

ProviderQualificationFailure is one safe configured-candidate rejection. It deliberately retains no native output or free-form provider text.

func NewProviderQualificationFailure 

func NewProviderQualificationFailure(providerInstance string, family Family, reasonCode string, cause error) (ProviderQualificationFailure, error)

NewProviderQualificationFailure constructs one closed safe candidate fact.

func ProviderQualificationFailuresFromError 

func ProviderQualificationFailuresFromError(err error) ([]ProviderQualificationFailure, bool)

ProviderQualificationFailuresFromError returns canonical safe rejection records without exposing wrapped native causes.

func (ProviderQualificationFailure) DiagnosticCause 

func (failure ProviderQualificationFailure) DiagnosticCause() domain.RuntimeDiagnosticCause

func (ProviderQualificationFailure) Family 

func (failure ProviderQualificationFailure) Family() Family

func (ProviderQualificationFailure) ProviderInstance 

func (failure ProviderQualificationFailure) ProviderInstance() string

func (ProviderQualificationFailure) ReasonCode 

func (failure ProviderQualificationFailure) ReasonCode() string

type ProviderQualificationFailuresError 

type ProviderQualificationFailuresError struct {
	// contains filtered or unexported fields
}

ProviderQualificationFailuresError retains only safe candidate identities while its wrapped typed causes preserve operational exit precedence.

func (*ProviderQualificationFailuresError) Error 

func (failure *ProviderQualificationFailuresError) Error() string

func (*ProviderQualificationFailuresError) QualificationObservations 

func (failure *ProviderQualificationFailuresError) QualificationObservations() []ProviderQualificationObservation

func (*ProviderQualificationFailuresError) Unwrap 

func (failure *ProviderQualificationFailuresError) Unwrap() error

type ProviderQualificationObservation 

type ProviderQualificationObservation struct {
	// contains filtered or unexported fields
}

ProviderQualificationObservation is one closed, safe probe-attempt fact. It retains no native output or free-form provider text.

func (ProviderQualificationObservation) Cause 

func (observation ProviderQualificationObservation) Cause() domain.RuntimeDiagnosticCause

func (ProviderQualificationObservation) Failure 

func (observation ProviderQualificationObservation) Failure() string

func (ProviderQualificationObservation) Mitigation 

func (observation ProviderQualificationObservation) Mitigation() string

func (ProviderQualificationObservation) Outcome 

func (observation ProviderQualificationObservation) Outcome() string

func (ProviderQualificationObservation) ProviderInstance 

func (observation ProviderQualificationObservation) ProviderInstance() string

type Qualification 

type Qualification struct {
	// contains filtered or unexported fields
}

Qualification is an immutable provider-independent admission decision.

func ValidateQualification 

func ValidateQualification(input QualificationInput) Qualification

ValidateQualification applies the complete, side-effect-free admission conjunction. It always returns a decision; malformed or incomplete facts are ineligible rather than errors.

func (Qualification) Available 

func (qualification Qualification) Available() bool

Available reports whether the admission conjunction is satisfied.

func (Qualification) Classification 

func (qualification Qualification) Classification() VersionClassification

Classification returns the evaluated version classification.

func (Qualification) Identity 

func (qualification Qualification) Identity() Identity

Identity returns the evaluated identity.

func (Qualification) Reason 

func (qualification Qualification) Reason() string

Reason returns the stable reason for the admission decision.

func (Qualification) Receipts 

func (qualification Qualification) Receipts() []Receipt

Receipts returns a caller-owned copy of the evaluated receipt facts.

func (Qualification) Version 

func (qualification Qualification) Version() string

Version returns the evaluated version text.

type QualificationInput 

type QualificationInput struct {
	Identity          Identity
	Version           string
	KnownIncompatible bool
	Receipts          []Receipt
	Now               time.Time
}

QualificationInput supplies the current facts for one admission decision. Receipts are copied before evaluation and are never retained by the result.

type QualifiedProviderTerminalEvidence 

type QualifiedProviderTerminalEvidence struct {
	// contains filtered or unexported fields
}

QualifiedProviderTerminalEvidence binds exact accepted current evidence to the actual terminal namespace receipt for one admitted provider.

func (QualifiedProviderTerminalEvidence) Identity 

func (evidence QualifiedProviderTerminalEvidence) Identity() Identity

func (QualifiedProviderTerminalEvidence) NamespaceTerminalReceiptID 

func (evidence QualifiedProviderTerminalEvidence) NamespaceTerminalReceiptID() string

func (QualifiedProviderTerminalEvidence) PacketTransportReceiptIDs 

func (evidence QualifiedProviderTerminalEvidence) PacketTransportReceiptIDs() []string

func (QualifiedProviderTerminalEvidence) QualificationReceiptIDs 

func (evidence QualifiedProviderTerminalEvidence) QualificationReceiptIDs() []string

func (QualifiedProviderTerminalEvidence) Valid 

func (evidence QualifiedProviderTerminalEvidence) Valid() bool

type QualifiedRoute 

type QualifiedRoute struct {
	// contains filtered or unexported fields
}

QualifiedRoute is the complete immutable planning authority for one provider instance. It contains no discovery or invocation power.

func NewQualifiedRoute 

func NewQualifiedRoute(qualification Qualification, route ports.ProviderRoute, limits review.InvocationLimits, supportedRoles []domain.Role, baseRole domain.Role, providedOrdinal int) (QualifiedRoute, error)

NewQualifiedRoute accepts only a current, fully passing qualification bound to the supplied provider route. The base role must be included in supportedRoles.

func (QualifiedRoute) BaseRole 

func (route QualifiedRoute) BaseRole() domain.Role

BaseRole returns the role whose current base-role receipt was passed.

func (QualifiedRoute) FamilyOrdinal 

func (route QualifiedRoute) FamilyOrdinal() int

FamilyOrdinal returns the canonical allowlist ordinal used for deterministic planning.

func (QualifiedRoute) Limits 

func (route QualifiedRoute) Limits() review.InvocationLimits

Limits returns immutable invocation limits for this route.

func (QualifiedRoute) Qualification 

func (route QualifiedRoute) Qualification() Qualification

Qualification returns the immutable current admission decision.

func (QualifiedRoute) Route 

func (route QualifiedRoute) Route() ports.ProviderRoute

Route returns the immutable provider identity.

func (QualifiedRoute) SupportedRoles 

func (route QualifiedRoute) SupportedRoles() []domain.Role

SupportedRoles returns a caller-owned canonical role list.

func (QualifiedRoute) Supports 

func (route QualifiedRoute) Supports(role domain.Role) bool

Supports reports whether this route has passing authority for role.

func (QualifiedRoute) Valid 

func (route QualifiedRoute) Valid() bool

Valid reports whether route remains a complete immutable planning operand.

type QualifiedRun 

type QualifiedRun struct {
	// contains filtered or unexported fields
}

QualifiedRun owns immutable routes and an admitted-only composite registry.

func (*QualifiedRun) DrainTerminal 

func (run *QualifiedRun) DrainTerminal(ctx context.Context) (QualifiedRunTerminalReceipt, error)

DrainTerminal closes the registry once all calls have finished. It joins the actual namespace terminal receipts to exactly the providers admitted earlier.

func (*QualifiedRun) QualificationFailures 

func (run *QualifiedRun) QualificationFailures() []ProviderQualificationFailure

QualificationFailures returns safe rejected configured-candidate facts.

func (*QualifiedRun) QualificationObservations 

func (run *QualifiedRun) QualificationObservations() []ProviderQualificationObservation

QualificationObservations returns ordered, safe probe-attempt facts.

func (*QualifiedRun) Registry 

func (run *QualifiedRun) Registry() QualifiedRunRegistry

Registry returns the run-owned production execution authority.

func (*QualifiedRun) Routes 

func (run *QualifiedRun) Routes() []QualifiedRoute

Routes returns caller-owned immutable planning authorities.

type QualifiedRunCandidate 

type QualifiedRunCandidate struct {
	Profile          DiscoveredProviderProfile
	Definition       ports.ProviderRuntimeDefinition
	SnapshotManifest string
	SupportedRoles   []domain.Role
	BaseRole         domain.Role
	Limits           review.InvocationLimits
}

QualifiedRunCandidate binds one identity-only discovered profile to its declared production process profile and role authority.

type QualifiedRunCandidateSource 

type QualifiedRunCandidateSource interface {
	NewQualifiedRunCandidates(context.Context, CapturedRunInput, RunSelection) ([]QualifiedRunCandidate, error)
}

QualifiedRunCandidateSource constructs production candidates from the one captured input and requested role selection. Implementations may perform identity-only discovery, but must not acquire provider execution authority.

type QualifiedRunContextBinder 

type QualifiedRunContextBinder interface {
	BindQualifiedRunContext(context.Context, CapturedRunInput) (context.Context, error)
}

QualifiedRunContextBinder lets a production candidate source bind run-specific security authority after immutable target capture and before any provider observation. The returned context is used for candidate discovery, qualification, and registry construction.

type QualifiedRunFactory 

type QualifiedRunFactory struct {
	// contains filtered or unexported fields
}

QualifiedRunFactory turns identity-only discovery into immutable routes and a run-owned registry. It has no fallback to live process state.

func NewQualifiedRunFactory 

func NewQualifiedRunFactory(qualifier CurrentQualifier, registries QualifiedRunRegistryFactory, clock ports.Clock) (*QualifiedRunFactory, error)

NewQualifiedRunFactory validates the injected current probe and production registry authorities. Clock is required so all receipts share one expiry basis.

func NewQualifiedRunFactoryWithLoginAuthenticator 

func NewQualifiedRunFactoryWithLoginAuthenticator(qualifier CurrentQualifier, registries QualifiedRunRegistryFactory, clock ports.Clock, authenticator ports.ProviderLoginAuthenticator) (*QualifiedRunFactory, error)

NewQualifiedRunFactoryWithLoginAuthenticator enables one bounded Kimi login recovery after a typed qualification-stage login-required response.

func (*QualifiedRunFactory) NewQualifiedRun 

func (factory *QualifiedRunFactory) NewQualifiedRun(ctx context.Context, candidates []QualifiedRunCandidate) (*QualifiedRun, error)

NewQualifiedRun qualifies each candidate in its own retained namespace. Operational unavailability skips only that candidate; all other failures drain every acquired namespace and fail closed.

type QualifiedRunRegistry 

type QualifiedRunRegistry = ports.ProviderQualificationRegistry

QualifiedRunRegistry is the retained production execution authority.

func QualifiedRunRegistryFromError 

func QualifiedRunRegistryFromError(err error) (QualifiedRunRegistry, bool)

QualifiedRunRegistryFromError exposes the acquisition-owned cleanup authority when construction cleanup exhausted its bounded retries.

type QualifiedRunRegistryFactory 

type QualifiedRunRegistryFactory = ports.ProviderQualificationRegistryFactory

QualifiedRunRegistryFactory creates production-only retained registries.

type QualifiedRunTerminalReceipt 

type QualifiedRunTerminalReceipt struct {
	// contains filtered or unexported fields
}

QualifiedRunTerminalReceipt records a successful terminal drain of every namespace retained by the run.

func DrainRunAuthorityTerminal 

func DrainRunAuthorityTerminal(parent context.Context, qualified RunAuthority) (QualifiedRunTerminalReceipt, error)

DrainRunAuthorityTerminal retries one partial or failed terminal drain with a fresh bounded context. Root and child workflows must use the same cleanup proof policy so a transient first drain cannot change command semantics.

func (QualifiedRunTerminalReceipt) Drained 

func (receipt QualifiedRunTerminalReceipt) Drained() bool

func (QualifiedRunTerminalReceipt) Instances 

func (receipt QualifiedRunTerminalReceipt) Instances() []string

func (QualifiedRunTerminalReceipt) NamespaceReceipts 

func (receipt QualifiedRunTerminalReceipt) NamespaceReceipts() []ports.ProviderNamespaceTerminalReceipt

func (QualifiedRunTerminalReceipt) ProviderRunTerminalReceipt 

func (receipt QualifiedRunTerminalReceipt) ProviderRunTerminalReceipt() ports.ProviderRunTerminalReceipt

func (QualifiedRunTerminalReceipt) Providers 

func (receipt QualifiedRunTerminalReceipt) Providers() []QualifiedProviderTerminalEvidence

type Receipt 

type Receipt struct {
	Kind           ReceiptKind
	State          ReceiptState
	ExpiresAt      time.Time
	Identity       Identity
	AuthorityID    string
	AuthorityScope AuthorityScope
	Provenance     Provenance
	// contains filtered or unexported fields
}

Receipt is a provider-independent qualification fact. AuthorityID and AuthorityScope are diagnostic projections of package-private validated proof; callers cannot use raw values to establish an authoritative PASS.

type ReceiptKind 

type ReceiptKind string

ReceiptKind identifies a required current qualification receipt. 

const (
	ReceiptWorkspace       ReceiptKind = "workspace"
	ReceiptEnvironment     ReceiptKind = "environment"
	ReceiptTransport       ReceiptKind = "transport"
	ReceiptNativeReference ReceiptKind = "native-reference"
	ReceiptCapability      ReceiptKind = "capability"
	ReceiptBaseRole        ReceiptKind = "base-role"
	ReceiptAssignment      ReceiptKind = "assignment"
	ReceiptSecurityPolicy  ReceiptKind = "security-policy"
)

func ReceiptKinds 

func ReceiptKinds() []ReceiptKind

ReceiptKinds returns the required receipt kinds in canonical order. The returned slice is caller-owned.

type ReceiptState 

type ReceiptState string

ReceiptState is the closed state of a qualification receipt. 

const (
	ReceiptPass         ReceiptState = "pass"
	ReceiptMissing      ReceiptState = "missing"
	ReceiptStale        ReceiptState = "stale"
	ReceiptSkipped      ReceiptState = "skipped"
	ReceiptInconclusive ReceiptState = "inconclusive"
	ReceiptFailed       ReceiptState = "failed"
)

type Request 

type Request struct {
	InputSource  ImmutableInputSource
	ProjectRoot  ports.AnchoredRoot
	ArtifactRoot ports.AnchoredRoot
	Selection    RunSelection
}

Request identifies the one trusted root-review invocation. ProjectRoot binds capture to the original repository while ArtifactRoot binds durable P2 output to its private project-local namespace.

type Result 

type Result struct {
	// contains filtered or unexported fields
}

Result exposes only the coherent P2 authority returned by publication.

func (Result) Coordinator 

func (result Result) Coordinator() review.CoordinatorResult

func (Result) Final 

func (result Result) Final() ports.FinalReviewIdentity

func (Result) RoleReportURIs added in v0.1.4 

func (result Result) RoleReportURIs() []RoleReportURI

func (Result) RunID 

func (result Result) RunID() domain.RunID

func (Result) RuntimeDiagnosticURI 

func (result Result) RuntimeDiagnosticURI() (ports.SafeRelativePath, bool)

func (Result) SessionID 

func (result Result) SessionID() domain.SessionID

func (Result) Snapshot 

func (result Result) Snapshot() ports.CommittedPublicationSnapshot

func (Result) TerminalExit 

func (result Result) TerminalExit() domain.OperationalExitDecision

type ReviewRunCleanup 

type ReviewRunCleanup struct {
	// contains filtered or unexported fields
}

ReviewRunCleanup retains the exact provider and workspace cleanup authorities until both terminal operations have conclusively succeeded.

func CleanupStateFromError 

func CleanupStateFromError(err error) (*ReviewRunCleanup, bool)

CleanupStateFromError exposes the retained composite cleanup authority for retry. It is terminal proof only when both cleanup operations are drained.

func (*ReviewRunCleanup) DrainAndAbort 

func (cleanup *ReviewRunCleanup) DrainAndAbort(ctx context.Context, reason ports.WorkspaceAbortReason) error

func (*ReviewRunCleanup) ProviderDrained 

func (cleanup *ReviewRunCleanup) ProviderDrained() bool

func (*ReviewRunCleanup) ProviderOwner 

func (cleanup *ReviewRunCleanup) ProviderOwner() RunAuthority

func (*ReviewRunCleanup) ProviderTerminalReceipt 

func (cleanup *ReviewRunCleanup) ProviderTerminalReceipt() ports.ProviderRunTerminalReceipt

func (*ReviewRunCleanup) WorkspaceDrained 

func (cleanup *ReviewRunCleanup) WorkspaceDrained() bool

func (*ReviewRunCleanup) WorkspaceLease 

func (cleanup *ReviewRunCleanup) WorkspaceLease() ports.WorkspaceSnapshotLease

type RoleProviderAssignment 

type RoleProviderAssignment struct {
	// contains filtered or unexported fields
}

RoleProviderAssignment is the configured provider-family route for one role. A role names exactly one family; Mulgae never substitutes another.

func NewRoleProviderAssignment 

func NewRoleProviderAssignment(role domain.Role, primary Family) (RoleProviderAssignment, error)

NewRoleProviderAssignment validates one explicit Config v1 assignment.

func NewRoleProviderAssignmentWithCredentialProfile added in v0.1.14 

func NewRoleProviderAssignmentWithCredentialProfile(role domain.Role, primary Family, credentialProfile string) (RoleProviderAssignment, error)

NewRoleProviderAssignmentWithCredentialProfile binds a named Codex credential profile to one role. Other provider families cannot carry one.

func (RoleProviderAssignment) CredentialProfile added in v0.1.14 

func (assignment RoleProviderAssignment) CredentialProfile() string

func (RoleProviderAssignment) Primary 

func (assignment RoleProviderAssignment) Primary() Family

func (RoleProviderAssignment) ProviderInstance added in v0.1.14 

func (assignment RoleProviderAssignment) ProviderInstance() string

func (RoleProviderAssignment) Role 

func (assignment RoleProviderAssignment) Role() domain.Role

type RoleReportURI added in v0.1.4 

type RoleReportURI struct {
	Role       string
	URI        string
	SHA256     string
	ByteLength int
}

RoleReportURI is one trusted project-relative role-report identity projected from a PublicationResult verified support inventory before Result is built.

type RunAuthority 

type RunAuthority interface {
	Provider() ports.ObservedReviewProvider
	Planner() ExecutionPlanner
	BuildIdentity() BuildIdentity
	DrainTerminal(context.Context) (QualifiedRunTerminalReceipt, error)
}

RunAuthority owns provider credentials and routing authority for exactly one changed run. DrainTerminal must be bounded and idempotent.

func CleanupOwnerFromError 

func CleanupOwnerFromError(err error) (RunAuthority, bool)

CleanupOwnerFromError exposes retained terminal-drain ownership so callers can retry cleanup without treating incomplete evidence as terminal proof.

func RunAuthorityFromError 

func RunAuthorityFromError(err error) (RunAuthority, bool)

RunAuthorityFromError exposes the qualified-run cleanup owner retained after planner construction exhausts its bounded cleanup retries.

type RunAuthorityAdapter 

type RunAuthorityAdapter struct {
	// contains filtered or unexported fields
}

RunAuthorityAdapter adapts a concrete qualified-run factory to the service authority boundary. It retains the concrete terminal receipt until the service-facing aggregate receipt is available.

func NewRunAuthorityAdapter 

func NewRunAuthorityAdapter(
	qualifiedRuns *QualifiedRunFactory,
	candidates QualifiedRunCandidateSource,
	policy PlannerPolicy,
	build BuildIdentity,
) (*RunAuthorityAdapter, error)

NewRunAuthorityAdapter constructs the service-facing adapter using only injected discovery/candidate construction and qualified-run authority.

func (*RunAuthorityAdapter) NewQualifiedRun 

func (adapter *RunAuthorityAdapter) NewQualifiedRun(ctx context.Context, captured CapturedRunInput, selection RunSelection) (RunAuthority, error)

NewQualifiedRun constructs a service authority from the immutable captured input. Candidate construction is fully injected and every malformed result fails closed before a provider registry is acquired.

type RunAuthorityFactory 

type RunAuthorityFactory interface {
	NewQualifiedRun(context.Context, CapturedRunInput, RunSelection) (RunAuthority, error)
}

RunAuthorityFactory is the sole production authority factory for a changed run. It is deliberately invoked only after no-change admission.

type RunSelection 

type RunSelection struct {
	// contains filtered or unexported fields
}

RunSelection is the trusted ordered role selection and optional existing session identity for one root review invocation.

func NewRunSelection 

func NewRunSelection(roles []domain.Role, sessionID *domain.SessionID) (RunSelection, error)

NewRunSelection validates a non-empty, duplicate-free ordered role list. sessionID may be nil; a supplied ID must be canonical.

func (RunSelection) Roles 

func (selection RunSelection) Roles() []domain.Role

Roles returns a caller-owned copy in the original requested order.

func (RunSelection) SessionID 

func (selection RunSelection) SessionID() (domain.SessionID, bool)

SessionID returns the optional canonical session ID.

func (RunSelection) Valid 

func (selection RunSelection) Valid() bool

type RuntimeDiagnosticReferenceError 

type RuntimeDiagnosticReferenceError struct {
	// contains filtered or unexported fields
}

func (*RuntimeDiagnosticReferenceError) Error 

func (err *RuntimeDiagnosticReferenceError) Error() string

func (*RuntimeDiagnosticReferenceError) Unwrap 

func (err *RuntimeDiagnosticReferenceError) Unwrap() error

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service is the provider-neutral root review composition boundary. It delegates scheduling, runtime validation/evidence, repair, and publication to their existing authoritative services.

func NewService 

func NewService(dependencies Dependencies) (*Service, error)

func (*Service) Execute 

func (service *Service) Execute(ctx context.Context, request Request) (result Result, err error)

Execute captures input once, fails closed before provider observation on any admission failure, and returns only a coherent P2 publication result.

type VersionClassification 

type VersionClassification string

VersionClassification describes a version's qualification guidance. 

const (
	VersionRed     VersionClassification = "red"
	VersionGreen   VersionClassification = "green"
	VersionYellow  VersionClassification = "yellow"
	VersionUnknown VersionClassification = "unknown"
)

func ClassifyVersion 

func ClassifyVersion(family Family, text string) VersionClassification

ClassifyVersion returns red below the minimum, green through the verified latest version, and yellow above it or when the observed version cannot be parsed. An unparseable version remains unavailable to admission.

type VersionGuidance 

type VersionGuidance struct {
	Family         Family
	Minimum        string
	VerifiedLatest string
}

VersionGuidance is the immutable qualification guidance for one family.

func Guidance 

func Guidance(family Family) (VersionGuidance, bool)

Guidance returns the qualification guidance for family.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.