Help us shape the future of Go! Take the 2026 Go Developer Survey

reviewrun

package
v0.1.26 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 31, 2026 License: MIT Imports: 27 Imported by: 0

Documentation

Overview

Package reviewrun contains provider-independent review-run admission policy.

Package reviewrun owns transport-independent review requests and admission.

Index

Constants

View Source 
const (
	// ZCodeAppBundle is the standard ZCode application bundle on Darwin.
	ZCodeAppBundle = "/Applications/ZCode.app"
	// ZCodeExecutableRelativePath is the app-owned Electron runtime used as Node.
	ZCodeExecutableRelativePath = "Contents/MacOS/ZCode"
	// ZCodeLauncherRelativePath is the app-server launcher bundled by ZCode.
	ZCodeLauncherRelativePath = "Contents/Resources/glm/zcode.cjs"
	// ZCodeProviderConfigRelativePath is the provider catalog certified with the app bundle.
	ZCodeProviderConfigRelativePath = "Contents/Resources/config/provider/zcode-builtin.json"
	// ZCodeApplicationMetadataRelativePath contains the independently observed app version.
	ZCodeApplicationMetadataRelativePath = "Contents/Info.plist"
)

Variables

View Source 
var (
	ErrRoleNotEnabled       = errors.New("requested role is not enabled by production policy")
	ErrArtistInputsRequired = errors.New("artist review inputs are required")
	ErrArtistRoleRequired   = errors.New("artist inputs require the artist role")
)

Functions

func AdmitLiveProjectBinding added in v0.1.25 

func AdmitLiveProjectBinding(observed ports.ProjectBindingObservation, selector ports.LiveSourceSelector, expected domain.ProjectBinding) (domain.ProjectBinding, error)

AdmitLiveProjectBinding preserves unguarded non-Git workspace reviews without inventing a Git binding. An expected binding always requires Git authority.

func AdmitRequirementsInput added in v0.1.26 

func AdmitRequirementsInput(ctx context.Context, source ports.LiveSourceReader, path string, roles []domain.Role) (validation.RequirementsInput, error)

AdmitRequirementsInput retains exact local invocation bytes for subsequent use without reopening the file. Source identity and evidence stay separate.

func CoordinatorExecutionFailure 

func CoordinatorExecutionFailure(result review.CoordinatorResult) error

CoordinatorExecutionFailure applies the shared pre-publication terminal policy to root and child coordinator results. Operational provider failures remain publishable as incomplete coverage; authentication and closed fatal classes retain their typed execution authority instead of being flattened by a later publication validation error.

func GuardReason added in v0.1.24 

func GuardReason(err error) (string, bool)

GuardReason returns only a closed admission reason, never untrusted input.

func LiveSourceFailureClass added in v0.1.25 

func LiveSourceFailureClass(code ports.LiveSourceErrorCode) (domain.FailureClass, bool)

LiveSourceFailureClass maps the closed source boundary codes to application failure policy. Native Git diagnostics and paths are never public reasons.

func LoadDefaultReviewerGuide added in v0.1.25 

func LoadDefaultReviewerGuide(ctx context.Context, catalog ports.ContractCatalog) ([]byte, error)

LoadDefaultReviewerGuide supplies the generation-time default only. An existing safe operator guide remains the reviewer-home adapter's authority.

func LoadDefaultTemplateSet 

func LoadDefaultTemplateSet(ctx context.Context, catalog ports.ContractCatalog) (review.TemplateSet, error)

LoadDefaultTemplateSet loads the fixed root-review prompt contract from the supplied immutable contract catalog.

func LoadLiveReviewCommon added in v0.1.25 

func LoadLiveReviewCommon(ctx context.Context, catalog ports.ContractCatalog) (prompt.TrustedLayer, error)

func LoadRequirementsPrompt added in v0.1.26 

func LoadRequirementsPrompt(ctx context.Context, catalog ports.ContractCatalog) (prompt.TrustedLayer, error)

LoadRequirementsPrompt loads the internal assessment contract. Public requirements execution remains guarded until verified reads are activated.

func NewAllocatedRunIdentityError added in v0.1.4 

func NewAllocatedRunIdentityError(sessionID domain.SessionID, runID domain.RunID, cause error) error

NewAllocatedRunIdentityError retains an identity even when runtime diagnostics could not be installed or finalized.

func NewProjectBinding added in v0.1.24 

func NewProjectBinding(root, gitDirectory, commonDirectory ports.AnchoredRoot, rootIdentity, gitIdentity, commonIdentity ports.ProjectDirectoryIdentity) (domain.ProjectBinding, error)

NewProjectBinding retains the review planning API for the shared application identity policy.

func NewProviderExecutionFailuresError 

func NewProviderExecutionFailuresError(failures []ProviderExecutionFailure) error

NewProviderExecutionFailuresError constructs a canonical safe aggregate.

func NewProviderLoginRequiredError 

func NewProviderLoginRequiredError(providers []string, cause error) error

NewProviderLoginRequiredError constructs a safe application error for the supplied configured provider instances.

func NewProviderQualificationFailuresError 

func NewProviderQualificationFailuresError(failures []ProviderQualificationFailure) error

NewProviderQualificationFailuresError constructs the canonical safe aggregate used across qualification, planning, and command projection.

func NewReviewPreparationFailure added in v0.1.22 

func NewReviewPreparationFailure(stage ReviewPreparationStage, cause error) error

NewReviewPreparationFailure constructs a redaction-safe classified failure. The causal error remains available for in-process classification but is never included in Error, public diagnostics, or runtime diagnostic fields.

func NewRuntimeDiagnosticReferenceError 

func NewRuntimeDiagnosticReferenceError(uri ports.SafeRelativePath, cause error) error

NewRuntimeDiagnosticReferenceError attaches an installed runtime diagnostic URI to a terminal error without exposing any diagnostic contents.

func NewRuntimeDiagnosticReferenceErrorWithIdentity added in v0.1.4 

func NewRuntimeDiagnosticReferenceErrorWithIdentity(
	uri ports.SafeRelativePath,
	sessionID domain.SessionID,
	runID domain.RunID,
	cause error,
) error

NewRuntimeDiagnosticReferenceErrorWithIdentity attaches an installed runtime diagnostic URI and the already allocated run identity to a terminal error. Command projections use the identity for recovery without treating the diagnostic as publication authority.

func PartialProviderRunTerminalReceiptFromError 

func PartialProviderRunTerminalReceiptFromError(err error) (ports.ProviderRunTerminalReceipt, bool)

PartialProviderRunTerminalReceiptFromError exposes the last drain observation. The returned receipt is not terminal proof unless Valid reports true.

func ProviderLoginRequiredProvidersFromError 

func ProviderLoginRequiredProvidersFromError(err error) ([]string, bool)

ProviderLoginRequiredProvidersFromError returns sorted unique provider instances without exposing native stderr or credential material.

func ProviderRunTerminalReceiptFromError 

func ProviderRunTerminalReceiptFromError(err error) (ports.ProviderRunTerminalReceipt, bool)

ProviderRunTerminalReceiptFromError exposes complete cleanup proof from a failed construction. It returns false while cleanup remains retryable.

func RoleProviderInstanceMatches added in v0.1.22 

func RoleProviderInstanceMatches(family Family, role domain.Role, instance string) bool

RoleProviderInstanceMatches reports whether an instance is the configured production identity for one family and role.

func RuntimeDiagnosticIdentityFromError added in v0.1.4 

func RuntimeDiagnosticIdentityFromError(err error) (domain.SessionID, domain.RunID, bool)

RuntimeDiagnosticIdentityFromError returns an allocated identity retained by a failed review after diagnostics were installed.

func RuntimeDiagnosticURIFromError 

func RuntimeDiagnosticURIFromError(err error) (ports.SafeRelativePath, bool)

func SupportedProductionRoles 

func SupportedProductionRoles(family Family) []domain.Role

SupportedProductionRoles returns the closed role capability matrix for one family.

func TakePreparedRunDiagnostics added in v0.1.19 

func TakePreparedRunDiagnostics(ctx context.Context, session domain.SessionID, run domain.RunID) (ports.RuntimeDiagnosticSink, time.Time, uint64, bool, error)

func ValidateLiveArtistInputs added in v0.1.25 

func ValidateLiveArtistInputs(ctx context.Context, source ports.LiveSourceReader, inputs ports.ArtistReviewInputs) error

ValidateLiveArtistInputs checks selected artist content during provider-free admission. It reads the brief and selected raster evidence without retaining an archive, creating execution state, or invoking a provider.

Types

type AdmittedRequest added in v0.1.24 

type AdmittedRequest struct {
	// contains filtered or unexported fields
}

AdmittedRequest records resolved project roles and artist input defaults. It confers no source, provider or publication authority.

func ResolveRequest added in v0.1.26 

func ResolveRequest(request Request, enabled map[domain.Role]bool, artistInputs ports.ArtistReviewInputs, hasArtistInputs bool) (AdmittedRequest, error)

ResolveRequest is the shared normal-run and preflight authority for enabled-role selection plus Config v1 artist defaults and request-scoped overrides. The returned request is canonical and explicitly selected.

func (AdmittedRequest) Request added in v0.1.26 

func (request AdmittedRequest) Request() Request

type AllocatedRunIdentityError added in v0.1.4 

type AllocatedRunIdentityError struct {
	// contains filtered or unexported fields
}

AllocatedRunIdentityError retains recovery identity without claiming that a diagnostic or publication artifact was installed.

func (*AllocatedRunIdentityError) Error added in v0.1.4 

func (err *AllocatedRunIdentityError) Error() string

func (*AllocatedRunIdentityError) Unwrap added in v0.1.4 

func (err *AllocatedRunIdentityError) Unwrap() error

type AuthorityScope 

type AuthorityScope string

AuthorityScope is the closed execution authority scope carried by a receipt. 

const (
	AuthorityScopeDirectExecution AuthorityScope = "direct-execution"
)

type BuildIdentity 

type BuildIdentity struct {
	Product     string
	Version     string
	Module      string
	ModuleSum   string
	VCSRevision string
}

BuildIdentity is immutable provenance attached to a qualified production run.

func (BuildIdentity) ImmutableReference 

func (identity BuildIdentity) ImmutableReference() string

func (BuildIdentity) Valid 

func (identity BuildIdentity) Valid() bool

type CurrentQualificationRequest 

type CurrentQualificationRequest struct {
	Profile        DiscoveredProviderProfile
	Definition     ports.ProviderRuntimeDefinition
	Identity       Identity
	Namespace      ports.ProviderQualificationNamespace
	RequestedRoles []domain.Role
	BaseRole       domain.Role
	Now            time.Time
}

CurrentQualificationRequest is the complete immutable probe boundary. The definition is production-only and the identity is shared by every receipt.

type CurrentQualificationResult 

type CurrentQualificationResult struct {
	VersionArgv       []string
	Version           string
	KnownIncompatible bool
	Receipts          []Receipt
	SupportedRoles    []domain.Role
	RoleReceipts      []CurrentRoleReceipt
	BaseRole          domain.Role
	Observations      []ProviderQualificationObservation
	// contains filtered or unexported fields
}

CurrentQualificationResult is immutable current evidence bound to exactly the supplied request identity. SupportedRoles must exactly match the canonical receipt-backed role authority. familyAuthority is the adapter-minted exact direct-execution authority for the probed definition and is never remapped by rewriting app-layer identity fields.

type CurrentQualifier 

type CurrentQualifier interface {
	QualifyCurrent(context.Context, CurrentQualificationRequest) (CurrentQualificationResult, error)
}

CurrentQualifier performs the isolated current checks for one discovered provider. It must never use the host HOME or working directory: the supplied identity names the namespace retained by the run-owned registry. VersionArgv must be the exact discovered invocation plus "--version".

type CurrentQualifierFunc 

type CurrentQualifierFunc func(context.Context, CurrentQualificationRequest) (CurrentQualificationResult, error)

CurrentQualifierFunc adapts a function for injection in tests and composition.

func (CurrentQualifierFunc) QualifyCurrent 

func (function CurrentQualifierFunc) QualifyCurrent(ctx context.Context, request CurrentQualificationRequest) (CurrentQualificationResult, error)

type CurrentRoleReceipt 

type CurrentRoleReceipt struct {
	Role     domain.Role
	State    ReceiptState
	Identity Identity
}

CurrentRoleReceipt is explicit current evidence for one role.

type DiscoveredProviderProfile 

type DiscoveredProviderProfile struct {
	// contains filtered or unexported fields
}

DiscoveredProviderProfile is an immutable identity-only executable discovery result. Discovery never launches a provider and is therefore not routable until a qualified version result is bound to this exact invocation shape.

func DiscoverConfiguredProviderProfiles 

func DiscoverConfiguredProviderProfiles(ctx context.Context, inspector ports.EnvironmentInspector, configured map[Family][]string) ([]DiscoveredProviderProfile, error)

DiscoverConfiguredProviderProfiles observes only the exact app-bundle or executable paths admitted from the project-local configuration.

func DiscoverProviderProfile 

func DiscoverProviderProfile(ctx context.Context, inspector ports.EnvironmentInspector, family Family) (DiscoveredProviderProfile, error)

DiscoverProviderProfile discovers one allowlisted family without observing any other provider. Discovery never executes the provider. ZCode has distinct app-owned Electron runtime and CJS launcher identities.

func DiscoverProviderProfileWithOverride added in v0.1.22 

func DiscoverProviderProfileWithOverride(ctx context.Context, inspector ports.EnvironmentInspector, family Family, pathOverride string) (DiscoveredProviderProfile, error)

DiscoverProviderProfileWithOverride observes one effective provider tuple. For ZCode the override is an application bundle; for direct providers it is an executable. An empty override selects the family-owned default.

func DiscoverProviderProfiles 

func DiscoverProviderProfiles(ctx context.Context, inspector ports.EnvironmentInspector) ([]DiscoveredProviderProfile, error)

DiscoverProviderProfiles discovers every allowlisted family in canonical order. Callers that select a subset must use DiscoverProviderProfile so an unselected provider cannot influence discovery.

func (DiscoveredProviderProfile) ApplicationMetadata added in v0.1.22 

func (profile DiscoveredProviderProfile) ApplicationMetadata() string

func (DiscoveredProviderProfile) ApplicationMetadataSHA256 added in v0.1.22 

func (profile DiscoveredProviderProfile) ApplicationMetadataSHA256() string

func (DiscoveredProviderProfile) ApplicationVersion added in v0.1.22 

func (profile DiscoveredProviderProfile) ApplicationVersion() string

func (DiscoveredProviderProfile) ApplicationVersionClassification added in v0.1.22 

func (profile DiscoveredProviderProfile) ApplicationVersionClassification() VersionClassification

func (DiscoveredProviderProfile) Argv 

func (profile DiscoveredProviderProfile) Argv() []string

Argv returns a caller-owned direct invocation shape.

func (DiscoveredProviderProfile) Available 

func (profile DiscoveredProviderProfile) Available() bool

Available reports whether executable discovery and version-floor eligibility passed.

func (DiscoveredProviderProfile) Classification 

func (profile DiscoveredProviderProfile) Classification() VersionClassification

Classification returns the version guidance classification.

func (DiscoveredProviderProfile) Executable 

func (profile DiscoveredProviderProfile) Executable() string

Executable returns the canonical executable provenance, when discovered.

func (DiscoveredProviderProfile) Family 

func (profile DiscoveredProviderProfile) Family() Family

Family returns the allowlisted family discovered by this profile.

func (DiscoveredProviderProfile) Launcher 

func (profile DiscoveredProviderProfile) Launcher() string

Launcher returns ZCode's fixed canonical launcher, or empty for direct binaries.

func (DiscoveredProviderProfile) LauncherSHA256 

func (profile DiscoveredProviderProfile) LauncherSHA256() string

LauncherSHA256 returns the current launcher identity hash.

func (DiscoveredProviderProfile) Reason 

func (profile DiscoveredProviderProfile) Reason() string

Reason returns the stable discovery reason.

func (DiscoveredProviderProfile) SHA256 

func (profile DiscoveredProviderProfile) SHA256() string

SHA256 returns diagnostic executable provenance.

func (DiscoveredProviderProfile) Version 

func (profile DiscoveredProviderProfile) Version() string

Version returns the observed version text.

func (DiscoveredProviderProfile) WithQualifiedVersion 

func (profile DiscoveredProviderProfile) WithQualifiedVersion(argv []string, version string) DiscoveredProviderProfile

WithQualifiedVersion binds a version returned by the isolated exact [executable, launcher, "--version"] invocation. Direct families use the executable as their launcher.

func (DiscoveredProviderProfile) ZCodeProviderConfig added in v0.1.22 

func (profile DiscoveredProviderProfile) ZCodeProviderConfig() string

ZCodeProviderConfig returns the exact bundled provider configuration bound to this ZCode runtime. Other provider families return an empty string.

func (DiscoveredProviderProfile) ZCodeProviderConfigSHA256 added in v0.1.22 

func (profile DiscoveredProviderProfile) ZCodeProviderConfigSHA256() string

ZCodeProviderConfigSHA256 returns the identity of the bundled ZCode provider configuration. Other provider families return an empty string.

type ExecutionPlan 

type ExecutionPlan struct {
	Assignments []review.Assignment
	Budgets     []review.RoleBudget
	Ceilings    review.HarnessCeilings
	Threshold   domain.Severity
	Policy      *domain.CIPolicy
	MaxWorkers  int
	Extraction  bool
}

ExecutionPlan contains only already-qualified routing and trusted execution limits. Planning has no provider invocation or publication authority.

func PreflightConfiguredPlan added in v0.1.2 

func PreflightConfiguredPlan(
	policy PlannerPolicy,
	providerTimeouts map[Family]time.Duration,
	selectedRoles []domain.Role,
) (ExecutionPlan, review.RunBudgetReceipt, error)

PreflightConfiguredPlan projects the production route topology and its enclosing budgets without discovering, qualifying, or invoking providers. It deliberately shares the production instance, output-cap, timeout, assignment, and budget authorities used by qualified execution planning.

type ExecutionPlanner 

type ExecutionPlanner interface {
	PlanSelectedRoles(context.Context, []domain.Role) (ExecutionPlan, error)
}

ExecutionPlanner supplies already-qualified assignments and matching budgets.

func NewQualifiedPlanner 

func NewQualifiedPlanner(routes []QualifiedRoute, policy PlannerPolicy) (ExecutionPlanner, error)

NewQualifiedPlanner freezes current qualified routes for pure deterministic assignment planning. Discovery availability alone is never accepted.

type Family 

type Family string

Family identifies a current allowlisted provider family. 

const (
	FamilyZCode  Family = "zcode"
	FamilyGrok   Family = "grok"
	FamilyCodex  Family = "codex"
	FamilyCursor Family = "cursor"
	FamilyAgy    Family = "agy"
)

func ConfiguredProviderSecurityFamilies 

func ConfiguredProviderSecurityFamilies(err error) []Family

ConfiguredProviderSecurityFamilies returns the configured families whose identity observation failed security admission. The returned slice is caller-owned and contains no local path material.

func Families 

func Families() []Family

Families returns the allowlisted families in canonical order. The returned slice is caller-owned.

func (Family) Valid 

func (family Family) Valid() bool

Valid reports whether family is allowlisted.

type FamilyRouteDerivationRequest added in v0.1.4 

type FamilyRouteDerivationRequest struct {
	Source               CurrentQualificationResult
	SourceDefinition     ports.ProviderRuntimeDefinition
	SourceNamespaceGen   string
	Destination          QualifiedRunCandidate
	DestinationIdentity  Identity
	DestinationNamespace ports.ProviderQualificationNamespace
	Now                  time.Time
}

FamilyRouteDerivationRequest binds one live family result to a sibling route.

type FamilyRouteDeriver added in v0.1.4 

type FamilyRouteDeriver interface {
	DeriveEquivalentFamilyRoute(context.Context, FamilyRouteDerivationRequest) (CurrentQualificationResult, error)
}

FamilyRouteDeriver derives exact sibling-route admission from one live family qualification without copying the representative authority identity.

type GuardError added in v0.1.24 

type GuardError string
const (
	ErrGuardInvalid           GuardError = "guard_invalid"
	ErrProjectBindingMismatch GuardError = "project_binding_mismatch"
	ErrContractUnsupported    GuardError = "contract_unsupported"
)

func (GuardError) Error added in v0.1.24 

func (err GuardError) Error() string

type Identity 

type Identity struct {
	Family                    Family
	Instance                  string
	ProfileGeneration         string
	AdapterProfile            string
	Version                   string
	Executable                string
	ExecutableSHA256          string
	Launcher                  string
	LauncherSHA256            string
	ApplicationVersion        string
	ApplicationMetadata       string
	ApplicationMetadataSHA256 string
	ExecutionTargetIdentity   string
	NamespaceLease            string
	NamespaceGeneration       string
}

Identity is the full current binding that every qualification receipt must share.

type LiveDependencies added in v0.1.25 

type LiveDependencies struct {
	PublicationWriter  ports.SecureFileWriter
	RequirementsPrompt prompt.TrustedLayer
	Sources            ports.LiveSourceOpener
	ReviewerHome       ports.ReviewerHome
	CredentialRoots    []ports.AnchoredRoot
	Admission          LiveRequestAdmission
	Clock              ports.Clock
	IDs                review.IdentityGenerator
	Build              BuildIdentity
	Authority          LiveRunAuthorityFactory
	Validator          *validation.ReviewValidator
	Publication        LivePublicationCommitter
	Templates          review.TemplateSet
	Common             prompt.TrustedLayer
	Diagnostics        ports.RuntimeDiagnosticSinkFactory
	Detector           ports.ReviewInputContentDetector
	ProjectContext     []byte
}

type LivePublicationCommitter added in v0.1.25 

type LivePublicationCommitter interface {
	PublishLiveNextObserved(context.Context, ports.AnchoredRoot, publication.PreparedLiveCandidate, publication.LifecycleObserver) (publication.PublicationResult, error)
}

type LiveQualifiedRunCandidateSource added in v0.1.25 

type LiveQualifiedRunCandidateSource interface {
	BindLiveQualifiedRunContext(context.Context, ports.LiveReviewExecution) (context.Context, error)
	NewLiveQualifiedRunCandidates(context.Context, ports.LiveSourceTarget, RunSelection) ([]QualifiedRunCandidate, error)
}

type LiveRequest added in v0.1.25 

type LiveRequest struct {
	RequirementsPath       string
	HasRequirements        bool
	ProjectRoot            ports.AnchoredRoot
	ArtifactRoot           ports.AnchoredRoot
	Target                 ports.LiveSourceSelector
	Selection              RunSelection
	Objective              []byte
	HasObjective           bool
	ExpectedProjectBinding domain.ProjectBinding
	ArtistInputs           ports.ArtistReviewInputs
	HasArtistInputs        bool
}

type LiveRequestAdmission added in v0.1.25 

type LiveRequestAdmission interface {
	AdmitLive(context.Context, LiveRequest, ports.LiveSourceReader, domain.ProjectBinding) (ExecutionPlan, error)
}

type LiveRunAuthorityFactory added in v0.1.25 

type LiveRunAuthorityFactory interface {
	NewQualifiedLiveRun(context.Context, ports.LiveReviewExecution, RunSelection) (RunAuthority, error)
}

type LiveRunCleanup added in v0.1.25 

type LiveRunCleanup struct {
	// contains filtered or unexported fields
}

LiveRunCleanup retains a source lease when provider termination is unproven. Retrying cleanup grants no review, replay, or publication authority.

func LiveCleanupFromError added in v0.1.25 

func LiveCleanupFromError(err error) (*LiveRunCleanup, bool)

func (*LiveRunCleanup) DrainAndClose added in v0.1.25 

func (cleanup *LiveRunCleanup) DrainAndClose(ctx context.Context) error

type LiveService added in v0.1.25 

type LiveService struct {
	// contains filtered or unexported fields
}

func NewLiveService added in v0.1.25 

func NewLiveService(dependencies LiveDependencies) (*LiveService, error)

func (*LiveService) Execute added in v0.1.25 

func (service *LiveService) Execute(ctx context.Context, request LiveRequest) (result Result, err error)

Execute retains the original-source lease until every provider has drained and evidence has been verified. Publication follows successful source closure.

type PlannerPolicy 

type PlannerPolicy struct {
	Ceilings      review.HarnessCeilings
	Threshold     domain.Severity
	Policy        *domain.CIPolicy
	MaxWorkers    int
	Assignments   []RoleProviderAssignment
	RequiredRoles []domain.Role
	// Extraction admits the Mulgae-owned structured extraction trailer. It
	// consumes the same second invocation repair competes for, so it never
	// changes a role path's projected invocation count.
	Extraction bool
}

PlannerPolicy supplies trusted execution limits, explicit Config v1 provider assignments, outcome policy, and active-worker capacity. Zero threshold, ceilings, and capacity select the closed defaults; assignments never default.

func DefaultPlannerPolicy 

func DefaultPlannerPolicy() PlannerPolicy

DefaultPlannerPolicy returns the closed planner policy used when no narrower trusted policy is supplied.

type PreparedRunDiagnostics added in v0.1.19 

type PreparedRunDiagnostics struct {
	// contains filtered or unexported fields
}

PreparedRunDiagnostics owns the pre-execution child identity until the child executor takes over the same sink. It never creates publication authority.

func PrepareChildRunDiagnostics added in v0.1.19 

func PrepareChildRunDiagnostics(ctx context.Context, factory ports.RuntimeDiagnosticSinkFactory, root ports.AnchoredRoot, session domain.SessionID, roles []domain.Role, clock ports.Clock, ids review.IdentityGenerator) (*PreparedRunDiagnostics, context.Context, error)

func (*PreparedRunDiagnostics) Finish added in v0.1.19 

func (prepared *PreparedRunDiagnostics) Finish(ctx context.Context, terminalErr error) error

func (*PreparedRunDiagnostics) RunID added in v0.1.19 

func (prepared *PreparedRunDiagnostics) RunID() domain.RunID

type ProductionQualifiedRunCandidateSource 

type ProductionQualifiedRunCandidateSource struct {
	// contains filtered or unexported fields
}

ProductionQualifiedRunCandidateSource binds startup-frozen identity-only discovery to the fixed production runtime templates. It has no process, credential, environment, or configuration authority.

func NewProductionQualifiedRunCandidateSource 

func NewProductionQualifiedRunCandidateSource(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSource constructs the production candidate source from the identity-only profiles captured at startup. Profiles are retained by value; their caller-owned argv slices are cloned.

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentities 

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentities(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile, identities map[Family]string) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSourceWithPolicyIdentities constructs the production candidate source using the exact policies installed into provider credential namespaces for this composition.

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndAllProviderSettingsAndTimeouts added in v0.1.24 

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndAllProviderSettingsAndTimeouts(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile, identities map[Family]string, zcodeModel, zcodeReasoningEffort, grokModel, grokReasoningEffort, codexModel, codexReasoningEffort, agyModel, agyReasoningEffort string, codexCredentialProfiles map[domain.Role]string, providerTimeouts map[Family]time.Duration, cursorAuthToken string) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndAllProviderSettingsAndTimeouts binds independently optional ZCode, Grok, Codex, and AGY settings.

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndCodexSettingsAndTimeouts added in v0.1.22 

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndCodexSettingsAndTimeouts(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile, identities map[Family]string, codexModel, codexReasoningEffort string, codexCredentialProfiles map[domain.Role]string, providerTimeouts map[Family]time.Duration) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndCodexSettingsAndTimeouts binds role-specific Codex credential profiles into provider instance and adapter-profile identity without changing shared Codex model policy.

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndProviderSettingsAndTimeouts added in v0.1.23 

func NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndProviderSettingsAndTimeouts(builder ports.ProviderRuntimeBuilder, profiles []DiscoveredProviderProfile, identities map[Family]string, grokModel, grokReasoningEffort, codexModel, codexReasoningEffort string, codexCredentialProfiles map[domain.Role]string, providerTimeouts map[Family]time.Duration) (*ProductionQualifiedRunCandidateSource, error)

NewProductionQualifiedRunCandidateSourceWithPolicyIdentitiesAndProviderSettingsAndTimeouts binds the closed set of admitted provider-wide settings into each matching runtime definition without introducing role-level overrides.

func (*ProductionQualifiedRunCandidateSource) NewLiveQualifiedRunCandidates added in v0.1.25 

func (source *ProductionQualifiedRunCandidateSource) NewLiveQualifiedRunCandidates(target ports.LiveSourceTarget, selection RunSelection) ([]QualifiedRunCandidate, error)

NewLiveQualifiedRunCandidates binds qualification to source selection metadata without inventing a captured workspace or manifest.

func (*ProductionQualifiedRunCandidateSource) NewSyntheticQualifiedRunCandidates added in v0.1.15 

func (source *ProductionQualifiedRunCandidateSource) NewSyntheticQualifiedRunCandidates(workspace ports.WorkspaceSnapshotIdentity, selection RunSelection) ([]QualifiedRunCandidate, error)

NewSyntheticQualifiedRunCandidates creates candidates bound only to a Mulgae-owned synthetic workspace. It is used by explicitly authorized live diagnostics and carries no review input or publication authority.

type Provenance 

type Provenance struct {
	Version string
	Path    string
	SHA256  string
	Profile string
}

Provenance is diagnostic-only receipt metadata. Its values deliberately do not participate in admission identity comparisons.

type ProviderCurrentQualifier 

type ProviderCurrentQualifier struct {
	// contains filtered or unexported fields
}

ProviderCurrentQualifier adapts descriptor-bound provider probes into provider-independent current admission evidence.

func NewProviderCurrentQualifier 

func NewProviderCurrentQualifier(probe ports.ProviderCurrentProbe, fixtures ports.ProviderQualificationFixtureFactory) (*ProviderCurrentQualifier, error)

NewProviderCurrentQualifier constructs the production current qualifier.

func (*ProviderCurrentQualifier) DeriveEquivalentFamilyRoute added in v0.1.4 

func (qualifier *ProviderCurrentQualifier) DeriveEquivalentFamilyRoute(
	ctx context.Context,
	request FamilyRouteDerivationRequest,
) (CurrentQualificationResult, error)

DeriveEquivalentFamilyRoute mints destination-bound receipts from a live family authority through the adapter derivation boundary.

func (*ProviderCurrentQualifier) QualifyCurrent 

func (qualifier *ProviderCurrentQualifier) QualifyCurrent(ctx context.Context, request CurrentQualificationRequest) (result CurrentQualificationResult, err error)

QualifyCurrent acquires one base-role fixture, performs one descriptor-bound family/runtime probe, and derives role admission from that evidence. Invalid capability formatting, capability evidence mismatches, security failures, and login-required responses are never retried; one transient operational probe failure admits at most one additional probe on a freshly materialized fixture under the same expiry basis. Every acquired fixture is drained exactly once before it returns, and the attempt-1 rejection stays in the observations.

type ProviderExecutionFailure 

type ProviderExecutionFailure struct {
	// contains filtered or unexported fields
}

ProviderExecutionFailure is one safe terminal provider fact. It contains no native output, path, credential material, or free-form provider text.

func NewProviderExecutionFailure 

func NewProviderExecutionFailure(
	providerInstance string,
	role domain.Role,
	reasonCode string,
	class domain.FailureClass,
) (ProviderExecutionFailure, error)

NewProviderExecutionFailure constructs one closed safe terminal provider fact.

func NewProviderExecutionFailureWithTimeoutFacts added in v0.1.2 

func NewProviderExecutionFailureWithTimeoutFacts(
	providerInstance string,
	role domain.Role,
	reasonCode string,
	class domain.FailureClass,
	facts review.ProviderTimeoutFacts,
) (ProviderExecutionFailure, error)

func ProviderExecutionFailuresFromError 

func ProviderExecutionFailuresFromError(err error) ([]ProviderExecutionFailure, bool)

ProviderExecutionFailuresFromError returns only closed safe provider facts.

func (ProviderExecutionFailure) FailureClass 

func (failure ProviderExecutionFailure) FailureClass() domain.FailureClass

func (ProviderExecutionFailure) ProviderInstance 

func (failure ProviderExecutionFailure) ProviderInstance() string

func (ProviderExecutionFailure) ProviderTimeoutFacts added in v0.1.2 

func (failure ProviderExecutionFailure) ProviderTimeoutFacts() (review.ProviderTimeoutFacts, bool)

func (ProviderExecutionFailure) ReasonCode 

func (failure ProviderExecutionFailure) ReasonCode() string

func (ProviderExecutionFailure) Role 

func (failure ProviderExecutionFailure) Role() domain.Role

type ProviderExecutionFailuresError 

type ProviderExecutionFailuresError struct {
	// contains filtered or unexported fields
}

func (*ProviderExecutionFailuresError) Error 

func (failure *ProviderExecutionFailuresError) Error() string

type ProviderLoginRequiredError 

type ProviderLoginRequiredError struct {
	// contains filtered or unexported fields
}

ProviderLoginRequiredError is the safe provider-attributed application failure raised when native authentication requires direct user action.

func (*ProviderLoginRequiredError) Error 

func (failure *ProviderLoginRequiredError) Error() string

func (*ProviderLoginRequiredError) Unwrap 

func (failure *ProviderLoginRequiredError) Unwrap() error

type ProviderQualificationFailure 

type ProviderQualificationFailure struct {
	// contains filtered or unexported fields
}

ProviderQualificationFailure is one safe configured-candidate rejection. It deliberately retains no native output or free-form provider text.

func NewProviderQualificationFailure 

func NewProviderQualificationFailure(providerInstance string, family Family, reasonCode string, cause error) (ProviderQualificationFailure, error)

NewProviderQualificationFailure constructs one closed safe candidate fact.

func ProviderQualificationFailuresFromError 

func ProviderQualificationFailuresFromError(err error) ([]ProviderQualificationFailure, bool)

ProviderQualificationFailuresFromError returns canonical safe rejection records without exposing wrapped native causes.

func (ProviderQualificationFailure) DiagnosticCause 

func (failure ProviderQualificationFailure) DiagnosticCause() domain.RuntimeDiagnosticCause

func (ProviderQualificationFailure) Family 

func (failure ProviderQualificationFailure) Family() Family

func (ProviderQualificationFailure) ProviderInstance 

func (failure ProviderQualificationFailure) ProviderInstance() string

func (ProviderQualificationFailure) ReasonCode 

func (failure ProviderQualificationFailure) ReasonCode() string

type ProviderQualificationFailuresError 

type ProviderQualificationFailuresError struct {
	// contains filtered or unexported fields
}

ProviderQualificationFailuresError retains only safe candidate identities while its wrapped typed causes preserve operational exit precedence.

func (*ProviderQualificationFailuresError) Error 

func (failure *ProviderQualificationFailuresError) Error() string

func (*ProviderQualificationFailuresError) QualificationObservations 

func (failure *ProviderQualificationFailuresError) QualificationObservations() []ProviderQualificationObservation

func (*ProviderQualificationFailuresError) Unwrap 

func (failure *ProviderQualificationFailuresError) Unwrap() error

type ProviderQualificationObservation 

type ProviderQualificationObservation struct {
	// contains filtered or unexported fields
}

ProviderQualificationObservation is one closed, safe probe-attempt fact. It retains no native output or free-form provider text.

func (ProviderQualificationObservation) Cause 

func (observation ProviderQualificationObservation) Cause() domain.RuntimeDiagnosticCause

func (ProviderQualificationObservation) Failure 

func (observation ProviderQualificationObservation) Failure() string

func (ProviderQualificationObservation) Mitigation 

func (observation ProviderQualificationObservation) Mitigation() string

func (ProviderQualificationObservation) Outcome 

func (observation ProviderQualificationObservation) Outcome() string

func (ProviderQualificationObservation) ProviderInstance 

func (observation ProviderQualificationObservation) ProviderInstance() string

type Qualification 

type Qualification struct {
	// contains filtered or unexported fields
}

Qualification is an immutable provider-independent admission decision.

func ValidateQualification 

func ValidateQualification(input QualificationInput) Qualification

ValidateQualification applies the complete, side-effect-free admission conjunction. It always returns a decision; malformed or incomplete facts are ineligible rather than errors.

func (Qualification) Available 

func (qualification Qualification) Available() bool

Available reports whether the admission conjunction is satisfied.

func (Qualification) Classification 

func (qualification Qualification) Classification() VersionClassification

Classification returns the evaluated version classification.

func (Qualification) Identity 

func (qualification Qualification) Identity() Identity

Identity returns the evaluated identity.

func (Qualification) Reason 

func (qualification Qualification) Reason() string

Reason returns the stable reason for the admission decision.

func (Qualification) Receipts 

func (qualification Qualification) Receipts() []Receipt

Receipts returns a caller-owned copy of the evaluated receipt facts.

func (Qualification) Version 

func (qualification Qualification) Version() string

Version returns the evaluated version text.

type QualificationInput 

type QualificationInput struct {
	Identity          Identity
	Version           string
	KnownIncompatible bool
	Receipts          []Receipt
	Now               time.Time
}

QualificationInput supplies the current facts for one admission decision. Receipts are copied before evaluation and are never retained by the result.

type QualifiedProviderTerminalEvidence 

type QualifiedProviderTerminalEvidence struct {
	// contains filtered or unexported fields
}

QualifiedProviderTerminalEvidence binds exact accepted current evidence to the actual terminal namespace receipt for one admitted provider.

func (QualifiedProviderTerminalEvidence) Identity 

func (evidence QualifiedProviderTerminalEvidence) Identity() Identity

func (QualifiedProviderTerminalEvidence) NamespaceTerminalReceiptID 

func (evidence QualifiedProviderTerminalEvidence) NamespaceTerminalReceiptID() string

func (QualifiedProviderTerminalEvidence) PacketTransportReceiptIDs 

func (evidence QualifiedProviderTerminalEvidence) PacketTransportReceiptIDs() []string

func (QualifiedProviderTerminalEvidence) QualificationReceiptIDs 

func (evidence QualifiedProviderTerminalEvidence) QualificationReceiptIDs() []string

func (QualifiedProviderTerminalEvidence) Valid 

func (evidence QualifiedProviderTerminalEvidence) Valid() bool

type QualifiedRoute 

type QualifiedRoute struct {
	// contains filtered or unexported fields
}

QualifiedRoute is the complete immutable planning authority for one provider instance. It contains no discovery or invocation power.

func NewQualifiedRoute 

func NewQualifiedRoute(qualification Qualification, route ports.ProviderRoute, limits review.InvocationLimits, supportedRoles []domain.Role, baseRole domain.Role, providedOrdinal int) (QualifiedRoute, error)

NewQualifiedRoute accepts only a current, fully passing qualification bound to the supplied provider route. The base role must be included in supportedRoles.

func (QualifiedRoute) BaseRole 

func (route QualifiedRoute) BaseRole() domain.Role

BaseRole returns the role whose current base-role receipt was passed.

func (QualifiedRoute) FamilyOrdinal 

func (route QualifiedRoute) FamilyOrdinal() int

FamilyOrdinal returns the canonical allowlist ordinal used for deterministic planning.

func (QualifiedRoute) Limits 

func (route QualifiedRoute) Limits() review.InvocationLimits

Limits returns immutable invocation limits for this route.

func (QualifiedRoute) Qualification 

func (route QualifiedRoute) Qualification() Qualification

Qualification returns the immutable current admission decision.

func (QualifiedRoute) Route 

func (route QualifiedRoute) Route() ports.ProviderRoute

Route returns the immutable provider identity.

func (QualifiedRoute) SupportedRoles 

func (route QualifiedRoute) SupportedRoles() []domain.Role

SupportedRoles returns a caller-owned canonical role list.

func (QualifiedRoute) Supports 

func (route QualifiedRoute) Supports(role domain.Role) bool

Supports reports whether this route has passing authority for role.

func (QualifiedRoute) Valid 

func (route QualifiedRoute) Valid() bool

Valid reports whether route remains a complete immutable planning operand.

type QualifiedRun 

type QualifiedRun struct {
	// contains filtered or unexported fields
}

QualifiedRun owns immutable routes and an admitted-only composite registry.

func (*QualifiedRun) DrainTerminal 

func (run *QualifiedRun) DrainTerminal(ctx context.Context) (QualifiedRunTerminalReceipt, error)

DrainTerminal closes the registry once all calls have finished. It joins the actual namespace terminal receipts to exactly the providers admitted earlier.

func (*QualifiedRun) QualificationFailures 

func (run *QualifiedRun) QualificationFailures() []ProviderQualificationFailure

QualificationFailures returns safe rejected configured-candidate facts.

func (*QualifiedRun) QualificationObservations 

func (run *QualifiedRun) QualificationObservations() []ProviderQualificationObservation

QualificationObservations returns ordered, safe probe-attempt facts.

func (*QualifiedRun) Registry 

func (run *QualifiedRun) Registry() QualifiedRunRegistry

Registry returns the run-owned production execution authority.

func (*QualifiedRun) Routes 

func (run *QualifiedRun) Routes() []QualifiedRoute

Routes returns caller-owned immutable planning authorities.

type QualifiedRunCandidate 

type QualifiedRunCandidate struct {
	Profile                 DiscoveredProviderProfile
	Definition              ports.ProviderRuntimeDefinition
	ExecutionTargetIdentity string
	SupportedRoles          []domain.Role
	BaseRole                domain.Role
	Limits                  review.InvocationLimits
}

QualifiedRunCandidate binds one identity-only discovered profile to its declared production process profile and role authority.

type QualifiedRunFactory 

type QualifiedRunFactory struct {
	// contains filtered or unexported fields
}

QualifiedRunFactory turns identity-only discovery into immutable routes and a run-owned registry. It has no fallback to live process state.

func NewQualifiedRunFactory 

func NewQualifiedRunFactory(qualifier CurrentQualifier, registries QualifiedRunRegistryFactory, clock ports.Clock) (*QualifiedRunFactory, error)

NewQualifiedRunFactory validates the injected current probe and production registry authorities. Clock is required so all receipts share one expiry basis.

func (*QualifiedRunFactory) NewQualifiedRun 

func (factory *QualifiedRunFactory) NewQualifiedRun(ctx context.Context, candidates []QualifiedRunCandidate) (*QualifiedRun, error)

NewQualifiedRun qualifies each candidate in its own retained namespace. Operational unavailability skips only that candidate; all other failures drain every acquired namespace and fail closed.

type QualifiedRunRegistry 

type QualifiedRunRegistry = ports.ProviderQualificationRegistry

QualifiedRunRegistry is the retained production execution authority.

func QualifiedRunRegistryFromError 

func QualifiedRunRegistryFromError(err error) (QualifiedRunRegistry, bool)

QualifiedRunRegistryFromError exposes the acquisition-owned cleanup authority when construction cleanup exhausted its bounded retries.

type QualifiedRunRegistryFactory 

type QualifiedRunRegistryFactory = ports.ProviderQualificationRegistryFactory

QualifiedRunRegistryFactory creates production-only retained registries.

type QualifiedRunTerminalReceipt 

type QualifiedRunTerminalReceipt struct {
	// contains filtered or unexported fields
}

QualifiedRunTerminalReceipt records a successful terminal drain of every namespace retained by the run.

func DrainRunAuthorityTerminal 

func DrainRunAuthorityTerminal(parent context.Context, qualified RunAuthority) (QualifiedRunTerminalReceipt, error)

DrainRunAuthorityTerminal retries one partial or failed terminal drain with a fresh bounded context. Root and child workflows must use the same cleanup proof policy so a transient first drain cannot change command semantics.

func (QualifiedRunTerminalReceipt) Drained 

func (receipt QualifiedRunTerminalReceipt) Drained() bool

func (QualifiedRunTerminalReceipt) Instances 

func (receipt QualifiedRunTerminalReceipt) Instances() []string

func (QualifiedRunTerminalReceipt) NamespaceReceipts 

func (receipt QualifiedRunTerminalReceipt) NamespaceReceipts() []ports.ProviderNamespaceTerminalReceipt

func (QualifiedRunTerminalReceipt) ProviderRunTerminalReceipt 

func (receipt QualifiedRunTerminalReceipt) ProviderRunTerminalReceipt() ports.ProviderRunTerminalReceipt

func (QualifiedRunTerminalReceipt) Providers 

func (receipt QualifiedRunTerminalReceipt) Providers() []QualifiedProviderTerminalEvidence

type Receipt 

type Receipt struct {
	Kind           ReceiptKind
	State          ReceiptState
	ExpiresAt      time.Time
	Identity       Identity
	AuthorityID    string
	AuthorityScope AuthorityScope
	Provenance     Provenance
	// contains filtered or unexported fields
}

Receipt is a provider-independent qualification fact. AuthorityID and AuthorityScope are diagnostic projections of package-private validated proof; callers cannot use raw values to establish an authoritative PASS.

type ReceiptKind 

type ReceiptKind string

ReceiptKind identifies a required current qualification receipt. 

const (
	ReceiptWorkspace       ReceiptKind = "workspace"
	ReceiptEnvironment     ReceiptKind = "environment"
	ReceiptTransport       ReceiptKind = "transport"
	ReceiptNativeReference ReceiptKind = "native-reference"
	ReceiptCapability      ReceiptKind = "capability"
	ReceiptBaseRole        ReceiptKind = "base-role"
	ReceiptAssignment      ReceiptKind = "assignment"
	ReceiptSecurityPolicy  ReceiptKind = "security-policy"
)

func ReceiptKinds 

func ReceiptKinds() []ReceiptKind

ReceiptKinds returns the required receipt kinds in canonical order. The returned slice is caller-owned.

type ReceiptState 

type ReceiptState string

ReceiptState is the closed state of a qualification receipt. 

const (
	ReceiptPass         ReceiptState = "pass"
	ReceiptMissing      ReceiptState = "missing"
	ReceiptStale        ReceiptState = "stale"
	ReceiptSkipped      ReceiptState = "skipped"
	ReceiptInconclusive ReceiptState = "inconclusive"
	ReceiptFailed       ReceiptState = "failed"
)

type Request 

type Request struct {
	// contains filtered or unexported fields
}

Request contains the immutable independent-review fields.

func NewRequest added in v0.1.26 

func NewRequest(input RequestInput) Request

NewRequest freezes transport-admitted fields and owns every mutable input.

func (Request) ArtistAutomatic added in v0.1.26 

func (request Request) ArtistAutomatic() bool

func (Request) ArtistBrief added in v0.1.26 

func (request Request) ArtistBrief() (string, bool)

ArtistBrief returns the optional review-scoped artist brief path.

func (Request) ArtistDesignSpecs added in v0.1.26 

func (request Request) ArtistDesignSpecs() []string

ArtistDesignSpecs returns a caller-owned copy of the optional review-scoped visual asset globs.

func (Request) ExpectedProjectBinding added in v0.1.26 

func (request Request) ExpectedProjectBinding() string

func (Request) Objective added in v0.1.26 

func (request Request) Objective() (string, bool)

Objective returns the optional review objective.

func (Request) Preflight added in v0.1.26 

func (request Request) Preflight() bool

Preflight reports whether the review is an provider-free live source, routing, and budget projection.

func (Request) RequestedRolesExplicit added in v0.1.26 

func (request Request) RequestedRolesExplicit() bool

RequestedRolesExplicit preserves caller intent after policy selection.

func (Request) RequirementsPath added in v0.1.26 

func (request Request) RequirementsPath() (string, bool)

RequirementsPath returns the optional local invocation input path.

func (Request) Roles added in v0.1.26 

func (request Request) Roles() []string

Roles returns a caller-owned copy of the requested roles.

func (Request) RolesExplicit added in v0.1.24 

func (request Request) RolesExplicit() bool

RolesExplicit reports whether --roles was supplied by the caller.

func (Request) SessionID added in v0.1.26 

func (request Request) SessionID() (string, bool)

SessionID returns the optional imported workflow session ID.

func (Request) Target added in v0.1.26 

func (request Request) Target() TargetRequest

Target returns the literal target request.

type RequestInput added in v0.1.26 

type RequestInput struct {
	Target                 ports.LiveSourceSelector
	Objective              string
	HasObjective           bool
	Roles                  []string
	RolesExplicit          bool
	RequirementsPath       string
	HasRequirements        bool
	ArtistBriefPath        string
	HasArtistBrief         bool
	ArtistDesignGlobs      []string
	SessionID              *domain.SessionID
	Preflight              bool
	ExpectedProjectBinding domain.ProjectBinding
}

RequestInput contains fields already admitted by a transport's grammar. Byte bounds and representation stay at that entrypoint; configured policy is resolved separately. Construction allocates no execution identity or resource.

type Result 

type Result struct {
	// contains filtered or unexported fields
}

Result exposes only the coherent P2 authority returned by publication.

func (Result) Coordinator 

func (result Result) Coordinator() review.CoordinatorResult

func (Result) Final 

func (result Result) Final() ports.FinalReviewIdentity

func (Result) Guarded added in v0.1.24 

func (result Result) Guarded() bool

func (Result) LiveProjectBinding added in v0.1.25 

func (result Result) LiveProjectBinding() domain.ProjectBinding

func (Result) RoleReportURIs added in v0.1.4 

func (result Result) RoleReportURIs() []RoleReportURI

func (Result) RunID 

func (result Result) RunID() domain.RunID

func (Result) RuntimeDiagnosticURI 

func (result Result) RuntimeDiagnosticURI() (ports.SafeRelativePath, bool)

func (Result) SessionID 

func (result Result) SessionID() domain.SessionID

func (Result) Snapshot 

func (result Result) Snapshot() ports.CommittedPublicationSnapshot

func (Result) SourceIdentitySHA256 added in v0.1.25 

func (result Result) SourceIdentitySHA256() string

func (Result) TerminalExit 

func (result Result) TerminalExit() domain.OperationalExitDecision

type ReviewPreparationStage added in v0.1.22 

type ReviewPreparationStage string

ReviewPreparationStage is one closed step after planning has been admitted and before the coordinator durably records run_started. 

const (
	ReviewPreparationPromptSource          ReviewPreparationStage = "prompt_source"
	ReviewPreparationProviderRuntime       ReviewPreparationStage = "provider_runtime"
	ReviewPreparationProviderOutputStaging ReviewPreparationStage = "provider_output_staging"
	ReviewPreparationCoordinator           ReviewPreparationStage = "coordinator"
	ReviewPreparationCoordinatorAdmission  ReviewPreparationStage = "coordinator_admission"
	ReviewPreparationRootRun               ReviewPreparationStage = "root_run"
)

func ReviewPreparationFailureFromError added in v0.1.22 

func ReviewPreparationFailureFromError(err error) (ReviewPreparationStage, domain.RuntimeDiagnosticCause, bool)

ReviewPreparationFailureFromError returns the closed public-safe details of one preparation failure without exposing its causal error.

func (ReviewPreparationStage) Valid added in v0.1.22 

func (stage ReviewPreparationStage) Valid() bool

type RoleProviderAssignment 

type RoleProviderAssignment struct {
	// contains filtered or unexported fields
}

RoleProviderAssignment is the configured provider-family route for one role. A role names exactly one family; Mulgae never substitutes another.

func NewRoleProviderAssignment 

func NewRoleProviderAssignment(role domain.Role, primary Family) (RoleProviderAssignment, error)

NewRoleProviderAssignment validates one explicit Config v1 assignment.

func NewRoleProviderAssignmentWithCredentialProfile added in v0.1.14 

func NewRoleProviderAssignmentWithCredentialProfile(role domain.Role, primary Family, credentialProfile string) (RoleProviderAssignment, error)

NewRoleProviderAssignmentWithCredentialProfile binds a named Codex credential profile to one role. Other provider families cannot carry one.

func (RoleProviderAssignment) CredentialProfile added in v0.1.14 

func (assignment RoleProviderAssignment) CredentialProfile() string

func (RoleProviderAssignment) Primary 

func (assignment RoleProviderAssignment) Primary() Family

func (RoleProviderAssignment) ProviderInstance added in v0.1.14 

func (assignment RoleProviderAssignment) ProviderInstance() string

func (RoleProviderAssignment) Role 

func (assignment RoleProviderAssignment) Role() domain.Role

type RoleReportURI added in v0.1.4 

type RoleReportURI struct {
	Role       string
	URI        string
	SHA256     string
	ByteLength int
}

RoleReportURI is one trusted project-relative role-report identity projected from a PublicationResult verified support inventory before Result is built.

type RunAuthority 

type RunAuthority interface {
	Provider() ports.ObservedReviewProvider
	Planner() ExecutionPlanner
	BuildIdentity() BuildIdentity
	DrainTerminal(context.Context) (QualifiedRunTerminalReceipt, error)
}

RunAuthority owns provider credentials and routing authority for exactly one changed run. DrainTerminal must be bounded and idempotent.

func CleanupOwnerFromError 

func CleanupOwnerFromError(err error) (RunAuthority, bool)

CleanupOwnerFromError exposes retained terminal-drain ownership so callers can retry cleanup without treating incomplete evidence as terminal proof.

func RunAuthorityFromError 

func RunAuthorityFromError(err error) (RunAuthority, bool)

RunAuthorityFromError exposes the qualified-run cleanup owner retained after planner construction exhausts its bounded cleanup retries.

type RunAuthorityAdapter 

type RunAuthorityAdapter struct {
	// contains filtered or unexported fields
}

RunAuthorityAdapter adapts a concrete qualified-run factory to the service authority boundary. It retains the concrete terminal receipt until the service-facing aggregate receipt is available.

func NewRunAuthorityAdapter 

func NewRunAuthorityAdapter(
	qualifiedRuns *QualifiedRunFactory,
	candidates LiveQualifiedRunCandidateSource,
	policy PlannerPolicy,
	build BuildIdentity,
) (*RunAuthorityAdapter, error)

NewRunAuthorityAdapter constructs the service-facing adapter using only injected discovery/candidate construction and qualified-run authority.

func (*RunAuthorityAdapter) NewQualifiedLiveRun added in v0.1.25 

func (adapter *RunAuthorityAdapter) NewQualifiedLiveRun(ctx context.Context, execution ports.LiveReviewExecution, selection RunSelection) (RunAuthority, error)

type RunSelection 

type RunSelection struct {
	// contains filtered or unexported fields
}

RunSelection is the trusted ordered role selection and optional existing session identity for one root review invocation.

func NewRunSelection 

func NewRunSelection(roles []domain.Role, sessionID *domain.SessionID) (RunSelection, error)

NewRunSelection validates a non-empty, duplicate-free ordered role list. sessionID may be nil; a supplied ID must be canonical.

func (RunSelection) Roles 

func (selection RunSelection) Roles() []domain.Role

Roles returns a caller-owned copy in the original requested order.

func (RunSelection) SessionID 

func (selection RunSelection) SessionID() (domain.SessionID, bool)

SessionID returns the optional canonical session ID.

func (RunSelection) Valid 

func (selection RunSelection) Valid() bool

type RuntimeDiagnosticReferenceError 

type RuntimeDiagnosticReferenceError struct {
	// contains filtered or unexported fields
}

func (*RuntimeDiagnosticReferenceError) Error 

func (err *RuntimeDiagnosticReferenceError) Error() string

func (*RuntimeDiagnosticReferenceError) Unwrap 

func (err *RuntimeDiagnosticReferenceError) Unwrap() error

type TargetRequest added in v0.1.26 

type TargetRequest struct {
	// contains filtered or unexported fields
}

TargetRequest contains one literal command-request target.

func (TargetRequest) Kind added in v0.1.26 

func (request TargetRequest) Kind() string

Kind returns the selected live source scope: workspace, stage, head, commit, or diff.

func (TargetRequest) Value added in v0.1.26 

func (request TargetRequest) Value() string

Value returns the target value.

type VersionClassification 

type VersionClassification string

VersionClassification describes a version's qualification guidance. 

const (
	VersionRed     VersionClassification = "red"
	VersionGreen   VersionClassification = "green"
	VersionYellow  VersionClassification = "yellow"
	VersionUnknown VersionClassification = "unknown"
)

func ClassifyVersion 

func ClassifyVersion(family Family, text string) VersionClassification

ClassifyVersion returns red below the minimum, green through the verified latest version, yellow above it, and unknown when the observation cannot be parsed. Unparseable versions remain unavailable to admission and doctor.

func ClassifyZCodeApplicationVersion added in v0.1.22 

func ClassifyZCodeApplicationVersion(text string) VersionClassification

ClassifyZCodeApplicationVersion classifies the app bundle independently from the bundled launcher protocol.

type VersionGuidance 

type VersionGuidance struct {
	Family         Family
	Minimum        string
	VerifiedLatest string
}

VersionGuidance is the immutable qualification guidance for one family.

func Guidance 

func Guidance(family Family) (VersionGuidance, bool)

Guidance returns the qualification guidance for family.

func ZCodeApplicationGuidance added in v0.1.22 

func ZCodeApplicationGuidance() VersionGuidance

ZCodeApplicationGuidance returns the independently enforced app-release compatibility floor and latest verified release.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.