review

package
v0.1.6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 8, 2026 License: MIT Imports: 20 Imported by: 0

Documentation

Overview

Package review coordinates one deterministic, in-memory review run.

Index

Constants

View Source 
const OutputDestinationTrustedLayerID = "review:output-destination"

OutputDestinationTrustedLayerID is the fixed identity of the Mulgae-owned staged output destination layer. It is always the last trusted layer of a staged_file launch template, so consumers can recognize it by identity.

Variables

This section is empty.

Functions

func ComposeRootReviewOutputDestination added in v0.1.4 

func ComposeRootReviewOutputDestination(
	original prompt.TrustedTemplate,
	destination ports.StagedOutputDestination,
) (prompt.TrustedTemplate, error)

ComposeRootReviewOutputDestination appends the Mulgae-owned output destination contract as the last trusted layer of original. The destination is chosen by the adapter locator for exactly one launch, so the initial and repair launches of one attempt carry different absolute paths. Provider output never participates in the layer.

func ComputeStructuredExtractionStatus added in v0.1.4 

func ComputeStructuredExtractionStatus(results []domain.RoleResultSummary) domain.StructuredExtractionStatus

ComputeStructuredExtractionStatus derives Mulgae-owned structured-extraction coverage across selected role summaries.

func ConditionProviderFault added in v0.1.4 

func ConditionProviderFault(condition AttemptCondition) bool

ConditionProviderFault reports whether a condition attributes the failure to the provider at all. It is broader than ConditionProviderUnusable: a rate limit or a timeout is the provider's fault but says nothing about whether the provider is usable, so running the role again is a reasonable next step.

func ConditionProviderUnusable added in v0.1.4 

func ConditionProviderUnusable(condition AttemptCondition) bool

ConditionProviderUnusable reports whether a condition proves the provider itself must be fixed or replaced before it can review anything, rather than having merely failed this once. It reads the same closed policy table the coordinator decides from, so remediation advice cannot drift from the transition that produced the failure.

func DiagnosticCauseForCondition added in v0.1.3 

func DiagnosticCauseForCondition(condition AttemptCondition) domain.RuntimeDiagnosticCause

DiagnosticCauseForCondition projects one closed attempt condition to the safe runtime cause shared by review and specialized child-run diagnostics.

func OutputDestinationTrustedLayer added in v0.1.4 

func OutputDestinationTrustedLayer(destination ports.StagedOutputDestination) (prompt.TrustedLayer, error)

OutputDestinationTrustedLayer builds the exact trusted layer that instructs a provider to write its complete role report to the one staged file Mulgae granted it. Callers that resolve a destination and callers that verify one must derive the layer from this single constructor.

func ReduceVerifiedFindingEvidence 

func ReduceVerifiedFindingEvidence(
	findings []domain.Finding,
	groups []VerifiedFindingEvidence,
	policy EvidencePolicy,
) ([]domain.Finding, error)

ReduceVerifiedFindingEvidence proves each finding's exact unverified validation prestate has one nonempty verifier-owned receipt group with the same validation claim set, then projects receipt outcomes into immutable finding evidence states.

func ResolveStagedOutputDestination added in v0.1.4 

func ResolveStagedOutputDestination(
	locator ports.ProviderOutputStagingLocator,
	job InvocationJob,
) (ports.StagedOutputDestination, bool)

ResolveStagedOutputDestination returns the Mulgae-owned staged destination for exactly one provider launch. It is the single resolution used by both the prompt authority that states the path to the provider and the runtime that binds the same path to the invocation, so the two can never disagree. A nil locator, an unknown instance, or a declared stdout transport all keep the launch on stdout.

Types

type Assignment 

type Assignment struct {
	// contains filtered or unexported fields
}

Assignment is a trusted, immutable role selection. Required is always true for the logic required floor, independent of the supplied flag.

func NewAssignment 

func NewAssignment(role domain.Role, required bool, providerInstance string) (Assignment, error)

NewAssignment constructs a legacy trusted role assignment. All legacy assignments share the fixed legacy concurrency lane.

func NewScheduledAssignment 

func NewScheduledAssignment(
	role domain.Role,
	required bool,
	primary ports.ProviderRoute,
) (Assignment, error)

NewScheduledAssignment constructs one trusted role assignment binding the role to exactly one provider route.

func (Assignment) PrimaryRoute 

func (assignment Assignment) PrimaryRoute() ports.ProviderRoute

PrimaryRoute returns the trusted primary provider route.

func (Assignment) ProviderInstance 

func (assignment Assignment) ProviderInstance() string

ProviderInstance returns the trusted primary provider instance selected for the role.

func (Assignment) Required 

func (assignment Assignment) Required() bool

Required reports whether the role is part of this run's required coverage.

func (Assignment) Role 

func (assignment Assignment) Role() domain.Role

Role returns the coordinator-selected role.

type AssistantContentClass added in v0.1.4 

type AssistantContentClass int

AssistantContentClass separates free-form prose from structured candidates. 

const (
	AssistantContentFreeForm AssistantContentClass = iota
	AssistantContentStructuredLike
	AssistantContentStructured
)

func ClassifyAssistantContent added in v0.1.4 

func ClassifyAssistantContent(content []byte) (AssistantContentClass, []byte)

ClassifyAssistantContent separates free-form prose from structured or structured-like candidates before validation. Trusted structured content is exactly one JSON object (unique fence payload or whole body). Structured-like content is a unique fence payload or whole `{...` attempt that may be malformed and therefore repair-eligible. Ambiguous multi-fence and trailing JSON values stay free-form/untrusted.

type AttemptCapture 

type AttemptCapture struct {
	// contains filtered or unexported fields
}

AttemptCapture binds defensive captured provider streams to one coordinator attempt and invocation sequence. Artifacts with SecurityRejected set never expose their rejected bytes.

func (AttemptCapture) Artifacts 

func (capture AttemptCapture) Artifacts() []ports.CapturedAttemptArtifact

func (AttemptCapture) AttemptID 

func (capture AttemptCapture) AttemptID() domain.AttemptID

func (AttemptCapture) Sequence 

func (capture AttemptCapture) Sequence() uint64

type AttemptCondition 

type AttemptCondition string

AttemptCondition is the closed coordinator input classification for a completed review attempt. Workers and adapters report facts; only the coordinator turns those facts into a transition decision. 

const (
	AttemptConditionValidReview                AttemptCondition = "valid_review"
	AttemptConditionInvalidProviderOutput      AttemptCondition = "invalid_provider_output"
	AttemptConditionUnrepairableProviderOutput AttemptCondition = "unrepairable_provider_output"
	AttemptConditionInvalidEvidenceClaim       AttemptCondition = "invalid_evidence_claim"
	AttemptConditionUnrepairableEvidence       AttemptCondition = "unrepairable_evidence_claim"
	AttemptConditionSemanticContradiction      AttemptCondition = "semantic_contradiction"
	AttemptConditionProviderUnavailable        AttemptCondition = "provider_unavailable"
	AttemptConditionProviderSpawnFailed        AttemptCondition = "provider_spawn_failed"
	AttemptConditionTimeout                    AttemptCondition = "timeout"
	AttemptConditionAuthentication             AttemptCondition = "auth"
	AttemptConditionLoginRequired              AttemptCondition = "login_required"
	AttemptConditionQuota                      AttemptCondition = "quota"
	AttemptConditionRateLimit                  AttemptCondition = "rate_limit"
	AttemptConditionSecurityViolation          AttemptCondition = "security_violation"
	AttemptConditionMutationViolation          AttemptCondition = "mutation_violation"
	AttemptConditionConfigurationViolation     AttemptCondition = "configuration_violation"
	AttemptConditionArtifactFailure            AttemptCondition = "artifact_failure"
	AttemptConditionCancelled                  AttemptCondition = "cancelled"
	AttemptConditionInternalInvariant          AttemptCondition = "internal_invariant"
	AttemptConditionProviderPermissionDenied   AttemptCondition = "provider_permission_denied"
	AttemptConditionProviderTimeout            AttemptCondition = "provider_timeout"
	AttemptConditionProviderOutputMissing      AttemptCondition = "provider_output_missing"
	AttemptConditionProviderOutputDecodeFailed AttemptCondition = "provider_output_decode_failed"
)

func AttemptConditions 

func AttemptConditions() []AttemptCondition

AttemptConditions returns the complete closed condition set in policy order. The returned slice is caller-owned.

func ReduceAttemptConditions 

func ReduceAttemptConditions(conditions ...AttemptCondition) (AttemptCondition, error)

ReduceAttemptConditions returns the highest-precedence condition from the closed policy set. Equal-precedence conditions retain their earliest input order so the originating reason remains stable.

func (AttemptCondition) Valid 

func (condition AttemptCondition) Valid() bool

Valid reports whether condition is part of the closed coordinator policy.

func (AttemptCondition) Validate 

func (condition AttemptCondition) Validate() error

Validate rejects any condition outside the closed coordinator policy.

type AttemptKind 

type AttemptKind string

AttemptKind identifies which configured route an attempt used. A role now runs on exactly one provider, so every attempt Mulgae creates is primary. AttemptKindFallback is retained for reading manifests written before cross-provider fallback was removed; nothing writes it. 

const (
	AttemptKindPrimary  AttemptKind = "primary"
	AttemptKindFallback AttemptKind = "fallback"
)

func (AttemptKind) Valid 

func (kind AttemptKind) Valid() bool

Valid reports whether kind is a coordinator-defined attempt kind. It accepts the historical fallback kind so stored artifacts stay readable.

type AttemptOutcome 

type AttemptOutcome struct {
	// contains filtered or unexported fields
}

AttemptOutcome is one immutable provider-runtime response for one invocation job. It contains either validated role content or one closed failure condition, never both.

func NewAttemptOutcome 

func NewAttemptOutcome(
	job InvocationJob,
	output *ValidatedRoleOutput,
	condition *AttemptCondition,
) (AttemptOutcome, error)

NewAttemptOutcome constructs a success with output or a failure with a closed condition. Successful outputs must retain the exact job role, provider, and target.

func NewProviderTimeoutAttemptOutcome added in v0.1.2 

func NewProviderTimeoutAttemptOutcome(job InvocationJob, elapsed time.Duration) (AttemptOutcome, error)

NewProviderTimeoutAttemptOutcome binds one observed provider timeout to the exact configured job limit and a safe elapsed duration.

func (AttemptOutcome) Condition 

func (outcome AttemptOutcome) Condition() (AttemptCondition, bool)

Condition returns the closed failure condition when this outcome failed.

func (AttemptOutcome) Job 

func (outcome AttemptOutcome) Job() InvocationJob

Job returns a defensive value copy of the invocation job this outcome answers.

func (AttemptOutcome) Output 

func (outcome AttemptOutcome) Output() (ValidatedRoleOutput, bool)

Output returns a defensive copy of the validated role output on success.

func (AttemptOutcome) ProviderTimeoutFacts added in v0.1.2 

func (outcome AttemptOutcome) ProviderTimeoutFacts() (ProviderTimeoutFacts, bool)

func (AttemptOutcome) Succeeded 

func (outcome AttemptOutcome) Succeeded() bool

Succeeded reports whether this outcome contains validated role output.

type BudgetReasonCode 

type BudgetReasonCode string

BudgetReasonCode is the closed, safe preflight outcome code recorded in a run budget receipt. 

const (
	BudgetReasonEligible              BudgetReasonCode = "eligible"
	BudgetReasonInvalidCeilings       BudgetReasonCode = "invalid_ceilings"
	BudgetReasonInvalidRole           BudgetReasonCode = "invalid_role"
	BudgetReasonDuplicateRole         BudgetReasonCode = "duplicate_role"
	BudgetReasonInvalidPrimaryRoute   BudgetReasonCode = "invalid_primary_route"
	BudgetReasonDuplicateRoleRoute    BudgetReasonCode = "duplicate_role_route"
	BudgetReasonInvocationCapExceeded BudgetReasonCode = "invocation_cap_exceeded"
	BudgetReasonRoleInvocationLimit   BudgetReasonCode = "role_invocation_limit"
	BudgetReasonRunInvocationLimit    BudgetReasonCode = "run_invocation_limit"
	BudgetReasonTotalOutputLimit      BudgetReasonCode = "total_output_limit"
	BudgetReasonLaneDeadlineLimit     BudgetReasonCode = "lane_deadline_limit"
	BudgetReasonRunDeadlineLimit      BudgetReasonCode = "run_deadline_limit"
)

func (BudgetReasonCode) Valid 

func (code BudgetReasonCode) Valid() bool

Valid reports whether code is a closed preflight reason code.

type Coordinator 

type Coordinator struct {
	// contains filtered or unexported fields
}

Coordinator owns one review run's mutable domain aggregates. Provider lanes receive only immutable InvocationJobs and return immutable AttemptOutcomes.

func NewCoordinator 

func NewCoordinator(
	clock ports.Clock,
	ids CoordinatorIDIssuer,
	runtime InvocationRuntime,
	locker ports.LaneLocker,
	maxActiveLanes int,
	receipt RunBudgetReceipt,
) (*Coordinator, error)

NewCoordinator constructs a deterministic in-memory review coordinator with the default authoritative evidence policy.

func NewCoordinatorWithEvidencePolicy 

func NewCoordinatorWithEvidencePolicy(
	clock ports.Clock,
	ids CoordinatorIDIssuer,
	runtime InvocationRuntime,
	locker ports.LaneLocker,
	maxActiveLanes int,
	receipt RunBudgetReceipt,
	policy EvidencePolicy,
) (*Coordinator, error)

NewCoordinatorWithEvidencePolicy constructs a deterministic in-memory review coordinator with an immutable authoritative evidence policy.

func NewCoordinatorWithRuntimeDiagnostics 

func NewCoordinatorWithRuntimeDiagnostics(
	clock ports.Clock,
	ids CoordinatorIDIssuer,
	runtime InvocationRuntime,
	locker ports.LaneLocker,
	maxActiveLanes int,
	receipt RunBudgetReceipt,
	diagnostics ports.RuntimeDiagnosticSink,
) (*Coordinator, error)

NewCoordinatorWithRuntimeDiagnostics constructs a coordinator whose logical decisions are synchronously persisted through the already-opened run sink.

func (*Coordinator) BindRuntimeDiagnostics 

func (coordinator *Coordinator) BindRuntimeDiagnostics(sink ports.RuntimeDiagnosticSink) error

BindRuntimeDiagnostics installs an already-opened child-run sink before the coordinator starts. Root runs continue to bind through the constructor.

func (*Coordinator) Execute 

func (coordinator *Coordinator) Execute(
	ctx context.Context,
	target domain.TargetIdentity,
	assignments []Assignment,
	threshold domain.Severity,
	policy *domain.CIPolicy,
) (CoordinatorResult, error)

Execute runs every selected role. It owns all mutable Run and Attempt state in this goroutine; lane workers only execute immutable jobs. Execute runs a new root review run.

func (*Coordinator) ExecuteDeltaRun 

func (coordinator *Coordinator) ExecuteDeltaRun(
	ctx context.Context,
	run *domain.Run,
	assignments []Assignment,
	threshold domain.Severity,
	policy *domain.CIPolicy,
	material DeltaInvocationMaterial,
) (CoordinatorResult, error)

ExecuteDeltaRun executes supplied child roles with the explicit immutable A-to-B provider material. The ordinary prompt path is not available.

func (*Coordinator) ExecuteExactReplayRun 

func (coordinator *Coordinator) ExecuteExactReplayRun(
	ctx context.Context,
	run *domain.Run,
	assignment Assignment,
	threshold domain.Severity,
	policy *domain.CIPolicy,
	input ExactReplayInput,
) (CoordinatorResult, error)

ExecuteExactReplayRun executes one selected child role with its stored wire authority. The wrapper rejects any non-initial invocation, so repair or multi-role scheduling cannot reach a provider.

func (*Coordinator) ExecuteRun 

func (coordinator *Coordinator) ExecuteRun(
	ctx context.Context,
	run *domain.Run,
	assignments []Assignment,
	threshold domain.Severity,
	policy *domain.CIPolicy,
) (CoordinatorResult, error)

ExecuteRun executes one supplied fresh pending run without replacing its run, session, or lineage identities. Root review runs have no lineage while child runs must retain both parent and source lineage.

type CoordinatorAttemptSummary 

type CoordinatorAttemptSummary struct {
	// contains filtered or unexported fields
}

CoordinatorAttemptSummary is the immutable terminal projection of one provider attempt.

func (CoordinatorAttemptSummary) FailureClass 

func (summary CoordinatorAttemptSummary) FailureClass() domain.FailureClass

FailureClass returns the terminal failure class, or empty on success.

func (CoordinatorAttemptSummary) ID 

func (summary CoordinatorAttemptSummary) ID() domain.AttemptID

ID returns the coordinator-issued attempt ID.

func (CoordinatorAttemptSummary) Invocations 

func (summary CoordinatorAttemptSummary) Invocations() []CoordinatorInvocationSummary

Invocations returns caller-owned immutable invocation summaries.

func (CoordinatorAttemptSummary) Kind 

func (summary CoordinatorAttemptSummary) Kind() AttemptKind

Kind returns the route kind this attempt used. Mulgae only creates primary attempts; the accessor exists because published artifacts record the kind.

func (CoordinatorAttemptSummary) ParseState added in v0.1.4 

func (summary CoordinatorAttemptSummary) ParseState() domain.ParseState

ParseState returns Mulgae-owned parse coverage retained for this attempt.

func (CoordinatorAttemptSummary) ProviderTimeoutFacts added in v0.1.2 

func (summary CoordinatorAttemptSummary) ProviderTimeoutFacts() (ProviderTimeoutFacts, bool)

func (CoordinatorAttemptSummary) ReasonCode 

func (summary CoordinatorAttemptSummary) ReasonCode() string

ReasonCode returns the stable terminal policy reason, or empty on success.

func (CoordinatorAttemptSummary) Route 

func (summary CoordinatorAttemptSummary) Route() ports.ProviderRoute

Route returns the selected immutable provider route.

func (CoordinatorAttemptSummary) State 

func (summary CoordinatorAttemptSummary) State() domain.AttemptState

State returns the attempt's terminal state.

func (CoordinatorAttemptSummary) ValidationState added in v0.1.4 

func (summary CoordinatorAttemptSummary) ValidationState() domain.ValidationState

ValidationState returns Mulgae-owned validation coverage retained for this attempt.

type CoordinatorEventKind 

type CoordinatorEventKind string

CoordinatorEventKind is the closed, logical event vocabulary emitted by the single coordinator owner. Event order, rather than wall-clock timing, is the authoritative execution trace. 

const (
	CoordinatorEventRunStarted            CoordinatorEventKind = "run_started"
	CoordinatorEventAttemptQueued         CoordinatorEventKind = "attempt_queued"
	CoordinatorEventInvocationDispatched  CoordinatorEventKind = "invocation_dispatched"
	CoordinatorEventInvocationCommitted   CoordinatorEventKind = "invocation_committed"
	CoordinatorEventRepairQueued          CoordinatorEventKind = "repair_queued"
	CoordinatorEventRoleTerminal          CoordinatorEventKind = "role_terminal"
	CoordinatorEventCancellationRequested CoordinatorEventKind = "cancellation_requested"
	CoordinatorEventLanesCloseAuthorized  CoordinatorEventKind = "lanes_close_authorized"
	CoordinatorEventRunTerminal           CoordinatorEventKind = "run_terminal"
)

func (CoordinatorEventKind) Valid 

func (kind CoordinatorEventKind) Valid() bool

Valid reports whether kind is a coordinator-defined logical event kind.

type CoordinatorIDIssuer 

type CoordinatorIDIssuer interface {
	NewSessionID(time.Time) (domain.SessionID, error)
	NewRunID(time.Time) (domain.RunID, error)
	NewAttemptID(time.Time) (domain.AttemptID, error)
}

CoordinatorIDIssuer is the narrow identity dependency required by a review coordinator. It intentionally excludes prompt and publication identities.

type CoordinatorIdentityIssuer 

type CoordinatorIdentityIssuer = CoordinatorIDIssuer

CoordinatorIdentityIssuer is an explicit alias for CoordinatorIDIssuer.

type CoordinatorInvocationSummary 

type CoordinatorInvocationSummary struct {
	// contains filtered or unexported fields
}

CoordinatorInvocationSummary is the immutable terminal projection of one invocation within a role attempt.

func (CoordinatorInvocationSummary) Purpose 

func (summary CoordinatorInvocationSummary) Purpose() domain.InvocationPurpose

Purpose returns whether this invocation was initial or repair work.

func (CoordinatorInvocationSummary) Sequence 

func (summary CoordinatorInvocationSummary) Sequence() uint64

Sequence returns the attempt-local invocation sequence.

func (CoordinatorInvocationSummary) State 

func (summary CoordinatorInvocationSummary) State() domain.InvocationState

State returns the invocation's terminal state.

type CoordinatorResult 

type CoordinatorResult struct {
	// contains filtered or unexported fields
}

CoordinatorResult is the immutable terminal snapshot of one coordinator run. It contains neither domain aggregates nor publication authority.

func (CoordinatorResult) Evidence 

func (result CoordinatorResult) Evidence() []VerifiedFindingEvidence

Evidence returns defensive verifier receipt-group copies in final finding order.

func (CoordinatorResult) Findings 

func (result CoordinatorResult) Findings() []domain.Finding

Findings returns caller-owned deterministically ordered findings.

func (CoordinatorResult) OutcomeAxes 

func (result CoordinatorResult) OutcomeAxes() domain.OutcomeAxes

OutcomeAxes is an explicit alias for Outcomes.

func (CoordinatorResult) Outcomes 

func (result CoordinatorResult) Outcomes() domain.OutcomeAxes

Outcomes returns the four system-owned outcome axes.

func (CoordinatorResult) ProviderUnusable added in v0.1.4 

func (result CoordinatorResult) ProviderUnusable() bool

ProviderUnusable reports whether any role failed in a way that proved its provider unusable.

func (CoordinatorResult) RoleSummaries 

func (result CoordinatorResult) RoleSummaries() []CoordinatorRoleSummary

RoleSummaries returns caller-owned immutable role projections in fixed role order.

func (CoordinatorResult) Roles 

func (result CoordinatorResult) Roles() []CoordinatorRoleSummary

Roles is an explicit alias for RoleSummaries.

func (CoordinatorResult) RunID 

func (result CoordinatorResult) RunID() domain.RunID

RunID returns the immutable review-run identity.

func (CoordinatorResult) RunState 

func (result CoordinatorResult) RunState() domain.RunState

RunState returns the terminal review-run state.

func (CoordinatorResult) SessionID 

func (result CoordinatorResult) SessionID() domain.SessionID

SessionID returns the immutable review-session identity.

func (CoordinatorResult) Trace 

func (result CoordinatorResult) Trace() []CoordinatorTraceEvent

Trace returns caller-owned logical trace events in canonical ordinal order.

func (CoordinatorResult) TraceEvents 

func (result CoordinatorResult) TraceEvents() []CoordinatorTraceEvent

TraceEvents is an explicit alias for Trace.

type CoordinatorRoleSummary 

type CoordinatorRoleSummary struct {
	// contains filtered or unexported fields
}

CoordinatorRoleSummary is the immutable terminal projection of one selected role. ReasonCode retains security and mutation terminal reasons even though those roles end in the cancelled state.

func (CoordinatorRoleSummary) Attempts 

func (summary CoordinatorRoleSummary) Attempts() []CoordinatorAttemptSummary

Attempts returns caller-owned attempt summaries in creation order.

func (CoordinatorRoleSummary) Degraded 

func (summary CoordinatorRoleSummary) Degraded() bool

Degraded reports whether accepted role output declared incomplete coverage.

func (CoordinatorRoleSummary) FailureClass 

func (summary CoordinatorRoleSummary) FailureClass() domain.FailureClass

FailureClass returns the terminal failure class, or empty on success.

func (CoordinatorRoleSummary) OutputTransport added in v0.1.4 

func (summary CoordinatorRoleSummary) OutputTransport() ports.ProviderOutputTransport

OutputTransport returns the transport that carried the accepted provider content for this role. A role without accepted output, and every legacy stdout acceptance, reports the stdout transport.

func (CoordinatorRoleSummary) ProviderUnusable added in v0.1.4 

func (summary CoordinatorRoleSummary) ProviderUnusable() bool

ProviderUnusable reports whether this role's failure proved its provider unusable rather than merely having failed once, so the report can tell the operator to fix or replace the provider instead of simply retrying.

func (CoordinatorRoleSummary) ReasonCode 

func (summary CoordinatorRoleSummary) ReasonCode() string

ReasonCode returns the stable terminal policy reason, or empty on success.

func (CoordinatorRoleSummary) Repaired 

func (summary CoordinatorRoleSummary) Repaired() bool

Repaired reports whether a repair invocation produced accepted output.

func (CoordinatorRoleSummary) ReportMarkdown added in v0.1.4 

func (summary CoordinatorRoleSummary) ReportMarkdown() []byte

ReportMarkdown returns a caller-owned copy of the Mulgae-owned role report body.

func (CoordinatorRoleSummary) ReportsOnly added in v0.1.4 

func (summary CoordinatorRoleSummary) ReportsOnly() bool

ReportsOnly reports whether accepted role output was free-form report content without a validated structured finding document.

func (CoordinatorRoleSummary) Required 

func (summary CoordinatorRoleSummary) Required() bool

Required reports whether the selected role was required for this run.

func (CoordinatorRoleSummary) Role 

func (summary CoordinatorRoleSummary) Role() domain.Role

Role returns the selected role.

func (CoordinatorRoleSummary) State 

func (summary CoordinatorRoleSummary) State() domain.RoleTaskState

State returns the role's terminal domain state.

func (CoordinatorRoleSummary) Valid 

func (summary CoordinatorRoleSummary) Valid() bool

Valid reports whether validated provider output was accepted for this role.

type CoordinatorTraceEvent 

type CoordinatorTraceEvent struct {
	// contains filtered or unexported fields
}

CoordinatorTraceEvent is one immutable, canonical coordinator decision. It intentionally excludes observed timestamps because timing has no transition authority.

func (CoordinatorTraceEvent) AttemptID 

func (event CoordinatorTraceEvent) AttemptID() (domain.AttemptID, bool)

AttemptID returns the coordinator-issued attempt identity when present.

func (CoordinatorTraceEvent) Condition 

func (event CoordinatorTraceEvent) Condition() (AttemptCondition, bool)

Condition returns the committed closed attempt condition when present.

func (CoordinatorTraceEvent) Kind 

func (event CoordinatorTraceEvent) Kind() CoordinatorEventKind

Kind returns the closed logical event kind.

func (CoordinatorTraceEvent) Lane 

func (event CoordinatorTraceEvent) Lane() (ports.ConcurrencyKey, bool)

Lane returns the normalized concurrency lane when an invocation is present.

func (CoordinatorTraceEvent) Ordinal 

func (event CoordinatorTraceEvent) Ordinal() uint64

Ordinal returns the canonical event order.

func (CoordinatorTraceEvent) Purpose 

func (event CoordinatorTraceEvent) Purpose() (domain.InvocationPurpose, bool)

Purpose returns the initial/repair purpose when an invocation is present.

func (CoordinatorTraceEvent) Reason 

func (event CoordinatorTraceEvent) Reason() string

Reason returns the stable policy reason when one applies.

func (CoordinatorTraceEvent) Role 

func (event CoordinatorTraceEvent) Role() (domain.Role, bool)

Role returns the event role when the event is role-specific.

func (CoordinatorTraceEvent) RunState 

func (event CoordinatorTraceEvent) RunState() (domain.RunState, bool)

RunState returns the terminal run state for run-terminal events.

type DeltaInvocationMaterial 

type DeltaInvocationMaterial struct {
	SourceRunID           domain.RunID
	SourceTarget          []byte
	SourceTargetIdentity  domain.TargetIdentity
	CurrentTarget         []byte
	CurrentTargetIdentity domain.TargetIdentity
	Delta                 []byte
}

DeltaInvocationMaterial is the immutable A-to-B input for one delta invocation. Source and current bytes are independently bound to their identities; Delta is comparator-owned material and is never recomputed here.

type DeltaInvocationPromptSource 

type DeltaInvocationPromptSource interface {
	DeltaPrompt(context.Context, InvocationJob, DeltaInvocationMaterial, *InvocationRepairInput) (RuntimePrompt, error)
}

DeltaInvocationPromptSource composes a canonical delta-aware prompt. It is intentionally separate from Prompt so delta execution cannot fall back to a current-target-only prompt.

type EvidencePolicy 

type EvidencePolicy struct {
	// contains filtered or unexported fields
}

EvidencePolicy is an immutable minimum receipt-verification policy.

func DefaultEvidencePolicy 

func DefaultEvidencePolicy() EvidencePolicy

DefaultEvidencePolicy requires verified receipts for exactly high, critical, and blocker findings.

func NewEvidencePolicy 

func NewEvidencePolicy(required []domain.Severity) (EvidencePolicy, error)

NewEvidencePolicy canonicalizes required severities. Every policy must retain the high, critical, and blocker verification minimum.

func (EvidencePolicy) RequiredSeverities 

func (policy EvidencePolicy) RequiredSeverities() []domain.Severity

RequiredSeverities returns the canonical required severity set.

func (EvidencePolicy) Requires 

func (policy EvidencePolicy) Requires(severity domain.Severity) bool

Requires reports whether severity must have all receipts verified.

type EvidencePolicyError 

type EvidencePolicyError struct {
	// contains filtered or unexported fields
}

EvidencePolicyError rejects output whose policy-required finding lacks fully verified evidence. It identifies the finding without exposing receipt data.

func AsEvidencePolicyError 

func AsEvidencePolicyError(err error) (*EvidencePolicyError, bool)

AsEvidencePolicyError returns the typed policy error, including when wrapped.

func (*EvidencePolicyError) Error 

func (err *EvidencePolicyError) Error() string

Error implements error.

func (*EvidencePolicyError) EvidenceState 

func (err *EvidencePolicyError) EvidenceState() domain.EvidenceState

EvidenceState returns the reduced state that violated the policy.

func (*EvidencePolicyError) FindingID 

func (err *EvidencePolicyError) FindingID() string

FindingID returns the policy-rejected finding ID.

func (*EvidencePolicyError) Severity 

func (err *EvidencePolicyError) Severity() domain.Severity

Severity returns the policy-rejected finding severity.

type ExactReplayInput 

type ExactReplayInput struct {
	SourceRunID                 domain.RunID
	SourceAttemptID             domain.AttemptID
	SourceProviderInstance      string
	Stdin                       []byte
	CompleteStdinSHA256         string
	SourceInvocationID          string
	SourceExecutionInvocationID string
	TemplateID                  string
	TemplateVersion             string
	TemplateSHA256              string
	Role                        domain.Role
	AdapterProfile              string
	AdapterParameters           map[string]string
}

ExactReplayInput is the stored provider-wire authority for one selected attempt. Only ExecutionInvocationID is minted afresh by the prompt source.

type ExactReplayPromptSource 

type ExactReplayPromptSource interface {
	ExactReplayPrompt(context.Context, InvocationJob, ExactReplayInput) (RuntimePrompt, error)
}

ExactReplayPromptSource replays stored wire authority into a fresh execution identity. Implementations must preserve every ExactReplayInput field.

type HarnessCeilings 

type HarnessCeilings struct {
	// contains filtered or unexported fields
}

HarnessCeilings are trusted preflight ceilings. They can only strengthen the fixed SOT resource limits; they never authorize a larger budget.

func DefaultHarnessCeilings 

func DefaultHarnessCeilings() HarnessCeilings

DefaultHarnessCeilings returns the immutable SOT default envelope. Callers must pass it explicitly to PreflightRunBudget when these defaults are wanted.

func NewHarnessCeilings 

func NewHarnessCeilings(
	maxTimeout time.Duration,
	maxStdout, maxStderr, maxTotalOutput int64,
	maxLaneDeadline, maxRunDeadline time.Duration,
	maxInvocationsPerRole, maxInvocationsPerRun int,
) (HarnessCeilings, error)

NewHarnessCeilings validates trusted execution ceilings. The fixed SOT maxima are closed: four invocations per role, 28 per run, 64 MiB output, and a topology-derived deadline for 60-minute provider invocations.

func (HarnessCeilings) MaxInvocationsPerRole 

func (ceilings HarnessCeilings) MaxInvocationsPerRole() int

MaxInvocationsPerRole returns the trusted role invocation ceiling.

func (HarnessCeilings) MaxInvocationsPerRun 

func (ceilings HarnessCeilings) MaxInvocationsPerRun() int

MaxInvocationsPerRun returns the trusted run invocation ceiling.

func (HarnessCeilings) MaxLaneDeadline 

func (ceilings HarnessCeilings) MaxLaneDeadline() time.Duration

MaxLaneDeadline returns the trusted per-lane deadline ceiling.

func (HarnessCeilings) MaxRunDeadline 

func (ceilings HarnessCeilings) MaxRunDeadline() time.Duration

MaxRunDeadline returns the trusted full-run deadline ceiling.

func (HarnessCeilings) MaxStderrBytes 

func (ceilings HarnessCeilings) MaxStderrBytes() int64

MaxStderrBytes returns the trusted per-invocation stderr ceiling.

func (HarnessCeilings) MaxStdoutBytes 

func (ceilings HarnessCeilings) MaxStdoutBytes() int64

MaxStdoutBytes returns the trusted per-invocation stdout ceiling.

func (HarnessCeilings) MaxTimeout 

func (ceilings HarnessCeilings) MaxTimeout() time.Duration

MaxTimeout returns the trusted per-invocation timeout ceiling.

func (HarnessCeilings) MaxTotalOutput 

func (ceilings HarnessCeilings) MaxTotalOutput() int64

MaxTotalOutput returns the trusted aggregate stdout-plus-stderr ceiling.

func (HarnessCeilings) Valid 

func (ceilings HarnessCeilings) Valid() bool

Valid reports whether ceilings are positive and no weaker than the fixed SOT resource bounds.

type IdentityGenerator 

type IdentityGenerator interface {
	NewSessionID(time.Time) (domain.SessionID, error)
	NewRunID(time.Time) (domain.RunID, error)
	NewAttemptID(time.Time) (domain.AttemptID, error)
	NewRoleTaskID(time.Time) (string, error)
	NewSourceInvocationID(time.Time) (string, error)
	NewExecutionInvocationID(time.Time) (string, error)
}

IdentityGenerator is the consumer-owned composition used by the review coordinator. It deliberately has no sequencing, scheduling, or publication authority.

type InvocationJob 

type InvocationJob struct {
	// contains filtered or unexported fields
}

InvocationJob is the immutable, value-only work item sent from the coordinator to a provider runtime. It carries no mutable run or attempt aggregate.

func NewInvocationJob 

func NewInvocationJob(
	role domain.Role,
	route ports.ProviderRoute,
	target domain.TargetIdentity,
	limits InvocationLimits,
	attemptID domain.AttemptID,
	purpose domain.InvocationPurpose,
	ordinal uint64,
) (InvocationJob, error)

NewInvocationJob validates and canonicalizes a legacy direct provider invocation job. Coordinator-issued jobs must use newCoordinatorInvocationJob and always carry run coordinates.

func (InvocationJob) AttemptID 

func (job InvocationJob) AttemptID() domain.AttemptID

AttemptID returns the coordinator-issued attempt identity.

func (InvocationJob) Limits 

func (job InvocationJob) Limits() InvocationLimits

Limits returns the exact validated runtime authority for this invocation.

func (InvocationJob) Ordinal 

func (job InvocationJob) Ordinal() uint64

Ordinal returns the stable positive coordinator dispatch ordinal.

func (InvocationJob) Purpose 

func (job InvocationJob) Purpose() domain.InvocationPurpose

Purpose returns the initial or repair invocation purpose.

func (InvocationJob) Role 

func (job InvocationJob) Role() domain.Role

Role returns the canonical coordinator-selected role.

func (InvocationJob) Route 

func (job InvocationJob) Route() ports.ProviderRoute

Route returns a reconstructed canonical provider route.

func (InvocationJob) RunID 

func (job InvocationJob) RunID() domain.RunID

RunID returns the coordinator-authorized review run identity, or zero for a legacy direct job.

func (InvocationJob) SessionID 

func (job InvocationJob) SessionID() domain.SessionID

SessionID returns the coordinator-authorized review session identity, or zero for a legacy direct job.

func (InvocationJob) Target 

func (job InvocationJob) Target() domain.TargetIdentity

Target returns a reconstructed canonical immutable target identity.

type InvocationLimits 

type InvocationLimits struct {
	// contains filtered or unexported fields
}

InvocationLimits are the immutable resource caps for every possible invocation through one provider route.

func NewInvocationLimits 

func NewInvocationLimits(timeout time.Duration, stdoutCap, stderrCap int64) (InvocationLimits, error)

NewInvocationLimits validates positive, independent invocation caps.

func (InvocationLimits) MaxStderrBytes 

func (limits InvocationLimits) MaxStderrBytes() int64

MaxStderrBytes returns the positive stderr capture cap.

func (InvocationLimits) MaxStdoutBytes 

func (limits InvocationLimits) MaxStdoutBytes() int64

MaxStdoutBytes returns the positive stdout diagnostic capture cap.

func (InvocationLimits) Timeout 

func (limits InvocationLimits) Timeout() time.Duration

Timeout returns the positive invocation deadline.

func (InvocationLimits) Valid 

func (limits InvocationLimits) Valid() bool

Valid reports whether limits contain only positive invocation caps.

type InvocationPromptSource 

type InvocationPromptSource interface {
	Prompt(context.Context, InvocationJob, *InvocationRepairInput) (RuntimePrompt, error)
}

InvocationPromptSource supplies trusted prompt material keyed by the immutable coordinator job. repair is nil for initial jobs and is present only for the one coordinator-authorized repair invocation of the same attempt.

type InvocationRepairInput 

type InvocationRepairInput struct {
	// contains filtered or unexported fields
}

InvocationRepairInput is trusted state retained from a repair-eligible initial invocation. Its accessors return defensive copies.

func (InvocationRepairInput) InitialCandidate 

func (input InvocationRepairInput) InitialCandidate() []byte

func (InvocationRepairInput) Plan 

func (input InvocationRepairInput) Plan() validation.RepairPlan

func (InvocationRepairInput) PrimaryReport added in v0.1.4 

func (input InvocationRepairInput) PrimaryReport() []byte

PrimaryReport returns the original full assistant content retained as the Mulgae-owned role report body across structured repair.

type InvocationRuntime 

type InvocationRuntime interface {
	Invoke(context.Context, InvocationJob) AttemptOutcome
}

InvocationRuntime executes immutable jobs. Calls for jobs in distinct provider concurrency lanes may occur concurrently. The runtime MUST enforce job.Limits() timeout plus stdout/stderr diagnostic capture caps. Primary provider report content is not bounded by the stdout diagnostic cap. Both the job and outcome are value-only boundaries and must not carry mutable coordinator state.

type LaneDeadline 

type LaneDeadline struct {
	// contains filtered or unexported fields
}

LaneDeadline records the fully accumulated worst-case deadline for one normalized concurrency lane.

func (LaneDeadline) ConcurrencyKey 

func (lane LaneDeadline) ConcurrencyKey() ports.ConcurrencyKey

ConcurrencyKey returns the immutable normalized lane key.

func (LaneDeadline) Deadline 

func (lane LaneDeadline) Deadline() time.Duration

Deadline returns invocation timeouts plus two seconds per transition.

func (LaneDeadline) InvocationCount 

func (lane LaneDeadline) InvocationCount() int

InvocationCount returns the number of possible invocations assigned to lane.

func (LaneDeadline) InvocationTimeouts 

func (lane LaneDeadline) InvocationTimeouts() time.Duration

InvocationTimeouts returns the sum of all possible invocation timeouts.

func (LaneDeadline) TransitionCount 

func (lane LaneDeadline) TransitionCount() int

TransitionCount returns the number of possible repair transitions charged to lane.

type PromptWireIdentity 

type PromptWireIdentity struct {
	// contains filtered or unexported fields
}

PromptWireIdentity records the exact source and execution identities of one compiled provider packet. It contains no provider output.

func (PromptWireIdentity) CompleteStdinSHA256 

func (identity PromptWireIdentity) CompleteStdinSHA256() string

CompleteStdinSHA256 returns the exact complete-stdin wire identity.

func (PromptWireIdentity) ExecutionInvocationID 

func (identity PromptWireIdentity) ExecutionInvocationID() string

ExecutionInvocationID returns the process execution identity for the packet.

func (PromptWireIdentity) Purpose 

func (identity PromptWireIdentity) Purpose() ports.ProviderInvocationPurpose

Purpose returns whether this was an initial or repair invocation.

func (PromptWireIdentity) SourceInvocationID 

func (identity PromptWireIdentity) SourceInvocationID() string

SourceInvocationID returns the source identity framed in the packet.

func (PromptWireIdentity) StdinByteLength 

func (identity PromptWireIdentity) StdinByteLength() int

StdinByteLength returns the exact number of bytes in the provider packet.

type ProviderInvocationRuntime 

type ProviderInvocationRuntime struct {
	// contains filtered or unexported fields
}

ProviderInvocationRuntime is the real bridge from coordinator jobs to prompt, provider, validation, repair, and evidence verification. It has no scheduler, transition or publication authority.

func NewObservedProviderInvocationRuntime 

func NewObservedProviderInvocationRuntime(provider ports.ObservedReviewProvider, source InvocationPromptSource, validator *validation.ReviewValidator, verifier *evidence.Verifier) (*ProviderInvocationRuntime, error)

NewObservedProviderInvocationRuntime constructs a runtime directly from the observation boundary. It preserves process streams as artifacts while using only the provider result's isolated stdout as the validation candidate.

func NewObservedProviderInvocationRuntimeWithDiagnostics 

func NewObservedProviderInvocationRuntimeWithDiagnostics(
	provider ports.ObservedReviewProvider,
	source InvocationPromptSource,
	validator *validation.ReviewValidator,
	verifier *evidence.Verifier,
	diagnostics RuntimeDiagnosticSinkResolver,
) (*ProviderInvocationRuntime, error)

NewObservedProviderInvocationRuntimeWithDiagnostics constructs an observed runtime that may persist separated raw streams through an already-open sink.

func NewObservedProviderInvocationRuntimeWithWorkspace 

func NewObservedProviderInvocationRuntimeWithWorkspace(provider ports.ObservedReviewProvider, source InvocationPromptSource, workspace ports.WorkspaceExecutionAuthority, validator *validation.ReviewValidator, verifier *evidence.Verifier) (*ProviderInvocationRuntime, error)

NewObservedProviderInvocationRuntimeWithWorkspace constructs an observed runtime bound to one capture-owned workspace authority for every invocation.

func NewObservedProviderInvocationRuntimeWithWorkspaceAndDiagnostics 

func NewObservedProviderInvocationRuntimeWithWorkspaceAndDiagnostics(
	provider ports.ObservedReviewProvider,
	source InvocationPromptSource,
	workspace ports.WorkspaceExecutionAuthority,
	validator *validation.ReviewValidator,
	verifier *evidence.Verifier,
	diagnostics RuntimeDiagnosticSinkResolver,
) (*ProviderInvocationRuntime, error)

NewObservedProviderInvocationRuntimeWithWorkspaceAndDiagnostics combines a capture-owned workspace with an already-opened per-run diagnostic sink.

func NewProviderInvocationRuntime 

func NewProviderInvocationRuntime(provider ports.ReviewProvider, source InvocationPromptSource, validator *validation.ReviewValidator, verifier *evidence.Verifier) (*ProviderInvocationRuntime, error)

NewProviderInvocationRuntime constructs a coordinator InvocationRuntime using the existing authoritative review validator and evidence reducer.

func (*ProviderInvocationRuntime) BindProviderOutputStaging added in v0.1.4 

func (runtime *ProviderInvocationRuntime) BindProviderOutputStaging(locator ports.ProviderOutputStagingLocator) error

BindProviderOutputStaging installs the adapter-owned staging locator before the runtime executes its first invocation. It is intentionally one-shot: the destination of every launch must be resolved by exactly one authority.

func (*ProviderInvocationRuntime) BindRuntimeDiagnostics 

func (runtime *ProviderInvocationRuntime) BindRuntimeDiagnostics(resolver RuntimeDiagnosticSinkResolver) error

BindRuntimeDiagnostics installs the child-run sink resolver before the runtime executes its first invocation. It is intentionally one-shot.

func (*ProviderInvocationRuntime) Capture 

func (runtime *ProviderInvocationRuntime) Capture(attemptID domain.AttemptID, sequence uint64) (AttemptCapture, bool)

Capture returns one defensive receipt by coordinator attempt and invocation sequence.

func (*ProviderInvocationRuntime) Captures 

func (runtime *ProviderInvocationRuntime) Captures() []AttemptCapture

Captures returns defensive captured artifacts in attempt then invocation order.

func (*ProviderInvocationRuntime) DrainCaptures 

func (runtime *ProviderInvocationRuntime) DrainCaptures() []AttemptCapture

DrainCaptures returns all captured artifacts and removes them from this runtime. Callers that share a runtime across runs must drain receipts after durable publication.

func (*ProviderInvocationRuntime) DrainRuntimeArtifacts 

func (runtime *ProviderInvocationRuntime) DrainRuntimeArtifacts() []RuntimeArtifactInventory

DrainRuntimeArtifacts returns source snapshots and removes them from this runtime. The snapshot is keyed by run, attempt, and invocation sequence.

func (*ProviderInvocationRuntime) DrainRuntimeArtifactsForRun 

func (runtime *ProviderInvocationRuntime) DrainRuntimeArtifactsForRun(runID domain.RunID) []RuntimeArtifactInventory

DrainRuntimeArtifactsForRun returns and removes only source snapshots owned by runID. It is safe to use when one runtime serves concurrent child runs.

func (*ProviderInvocationRuntime) Invoke 

func (runtime *ProviderInvocationRuntime) Invoke(ctx context.Context, job InvocationJob) (outcome AttemptOutcome)

Invoke executes exactly one coordinator-authorized invocation. A repair job is accepted only after this runtime retained a repair plan for its initial job.

func (*ProviderInvocationRuntime) InvokeDelta 

func (runtime *ProviderInvocationRuntime) InvokeDelta(ctx context.Context, job InvocationJob, input DeltaInvocationMaterial) AttemptOutcome

InvokeDelta executes a delta-aware invocation through the explicit delta prompt source. Initial and its one coordinator-authorized repair both retain the same immutable A-to-B material; no ordinary prompt fallback is available.

func (*ProviderInvocationRuntime) InvokeExactReplay 

func (runtime *ProviderInvocationRuntime) InvokeExactReplay(ctx context.Context, job InvocationJob, input ExactReplayInput) AttemptOutcome

InvokeExactReplay executes exactly one stored provider wire invocation using a fresh execution identity supplied by the explicit replay prompt source.

func (*ProviderInvocationRuntime) RuntimeArtifacts 

func (runtime *ProviderInvocationRuntime) RuntimeArtifacts() []RuntimeArtifactInventory

RuntimeArtifacts returns defensive source snapshots in attempt then invocation order. Provider output remains limited to the captured attempt streams.

type ProviderTimeoutFacts added in v0.1.2 

type ProviderTimeoutFacts struct {
	// contains filtered or unexported fields
}

ProviderTimeoutFacts contains only safe timing facts from a provider process boundary. Configured is bound to the coordinator job, and elapsed is derived from validated process timestamps or a local monotonic measurement; no provider streams are retained.

func NewProviderTimeoutFacts added in v0.1.2 

func NewProviderTimeoutFacts(configured, elapsed time.Duration) (ProviderTimeoutFacts, error)

func (ProviderTimeoutFacts) ConfiguredTimeout added in v0.1.2 

func (facts ProviderTimeoutFacts) ConfiguredTimeout() time.Duration

func (ProviderTimeoutFacts) Elapsed added in v0.1.2 

func (facts ProviderTimeoutFacts) Elapsed() time.Duration

func (ProviderTimeoutFacts) Valid added in v0.1.2 

func (facts ProviderTimeoutFacts) Valid() bool

type Request 

type Request struct {
	Target         ports.CapturedGitTarget
	Assignments    []Assignment
	Templates      TemplateSet
	ProjectContext *prompt.Payload
	Objective      string
}

Request is the complete trusted and untrusted input to one in-memory review run. Target is already captured and therefore requires no Git access here.

func NewRequest 

func NewRequest(target ports.CapturedGitTarget, assignments []Assignment, templates TemplateSet, projectContext *prompt.Payload, objective string) Request

NewRequest defensively copies the selected assignments and optional payload value. It performs semantic validation in Execute so constructor use remains convenient for callers building a request incrementally.

type Result 

type Result struct {
	// contains filtered or unexported fields
}

Result is an immutable review-service snapshot. It intentionally exposes no mutable domain.Run, provider output, publication authority, or filesystem receipt.

func (Result) Evidence 

func (result Result) Evidence() []ResultFindingEvidence

Evidence returns defensive verifier receipt-group copies in final finding order.

func (Result) Findings 

func (result Result) Findings() []domain.Finding

Findings returns a caller-owned ordered finding slice.

func (Result) OutcomeAxes 

func (result Result) OutcomeAxes() domain.OutcomeAxes

OutcomeAxes is an explicit alias for Outcomes.

func (Result) Outcomes 

func (result Result) Outcomes() domain.OutcomeAxes

Outcomes returns the four system-owned outcome axes.

func (Result) RoleExecutions 

func (result Result) RoleExecutions() []RoleExecution

RoleExecutions returns caller-owned terminal role execution records.

func (Result) RunID 

func (result Result) RunID() domain.RunID

RunID returns the immutable review run ID.

func (Result) RunState 

func (result Result) RunState() domain.RunState

RunState returns the terminal state of the in-memory run.

func (Result) SessionID 

func (result Result) SessionID() domain.SessionID

SessionID returns the immutable review session ID.

type ResultFindingEvidence 

type ResultFindingEvidence struct {
	// contains filtered or unexported fields
}

ResultFindingEvidence binds one final global finding ID to its exact verifier-owned receipt group. The validation proof remains private so callers cannot substitute a different finding for the receipts.

func (ResultFindingEvidence) Finding 

func (group ResultFindingEvidence) Finding() domain.Finding

Finding returns the final global finding associated with the receipts.

func (ResultFindingEvidence) FindingID 

func (group ResultFindingEvidence) FindingID() string

FindingID returns the final global finding ID.

func (ResultFindingEvidence) MatchesFinding 

func (group ResultFindingEvidence) MatchesFinding(finding domain.Finding) bool

MatchesFinding reports whether finding is the exact final finding associated with this verifier-owned receipt group.

func (ResultFindingEvidence) Receipts 

func (group ResultFindingEvidence) Receipts() []evidence.CurrentReceipt

Receipts returns caller-owned verifier receipt values in validation claim order.

type RoleBudget 

type RoleBudget struct {
	// contains filtered or unexported fields
}

RoleBudget contains the single provider route for one selected review role.

func NewRoleBudget 

func NewRoleBudget(role domain.Role, primary RouteBudget) (RoleBudget, error)

NewRoleBudget constructs one role's route operand.

func (RoleBudget) Primary 

func (budget RoleBudget) Primary() RouteBudget

Primary returns the immutable primary route budget.

func (RoleBudget) Role 

func (budget RoleBudget) Role() domain.Role

Role returns the selected review role.

func (RoleBudget) Valid 

func (budget RoleBudget) Valid() bool

Valid reports whether budget is a complete role selection.

type RoleExecution 

type RoleExecution struct {
	// contains filtered or unexported fields
}

RoleExecution is an immutable record of one selected role. An unstarted role has no attempt identity or prompt identities.

func (RoleExecution) AttemptID 

func (execution RoleExecution) AttemptID() (domain.AttemptID, bool)

AttemptID returns the coordinator-issued attempt ID when the role started.

func (RoleExecution) AttemptState 

func (execution RoleExecution) AttemptState() (domain.AttemptState, bool)

AttemptState returns the terminal attempt state when the role started.

func (RoleExecution) PromptWireIdentities 

func (execution RoleExecution) PromptWireIdentities() []PromptWireIdentity

PromptWireIdentities returns caller-owned identity records in invocation order. The values contain no mutable bytes.

func (RoleExecution) Repaired 

func (execution RoleExecution) Repaired() bool

Repaired reports whether a repair response was accepted for this role.

func (RoleExecution) Role 

func (execution RoleExecution) Role() domain.Role

Role returns the selected role.

func (RoleExecution) State 

func (execution RoleExecution) State() domain.RoleTaskState

State returns the terminal role-task state.

type RouteBudget 

type RouteBudget struct {
	// contains filtered or unexported fields
}

RouteBudget binds immutable invocation limits to one normalized provider route. The limits apply to both the route's initial and repair invocations.

func NewRouteBudget 

func NewRouteBudget(route ports.ProviderRoute, limits InvocationLimits) (RouteBudget, error)

NewRouteBudget constructs a valid route-and-limits operand.

func (RouteBudget) Limits 

func (budget RouteBudget) Limits() InvocationLimits

Limits returns the immutable invocation limits for the route.

func (RouteBudget) Route 

func (budget RouteBudget) Route() ports.ProviderRoute

Route returns the immutable provider route.

func (RouteBudget) Valid 

func (budget RouteBudget) Valid() bool

Valid reports whether budget has a valid route and positive invocation caps.

type RunBudgetReceipt 

type RunBudgetReceipt struct {
	// contains filtered or unexported fields
}

RunBudgetReceipt is the immutable result of a pure assignment preflight. All slice getters return caller-owned copies in canonical order.

func PreflightRunBudget 

func PreflightRunBudget(roles []RoleBudget, ceilings HarnessCeilings) (RunBudgetReceipt, error)

PreflightRunBudget evaluates every possible primary, repair, and configured repair invocation without starting providers, scheduling work, or changing runtime state. Rejected inputs still return a receipt containing copied canonical operands and every safely computable result.

func PreflightRunBudgetWithCapacity added in v0.1.2 

func PreflightRunBudgetWithCapacity(
	roles []RoleBudget,
	ceilings HarnessCeilings,
	maxActiveLanes int,
) (RunBudgetReceipt, error)

PreflightRunBudgetWithCapacity derives the enclosing run budget for the process-wide active-lane capacity that execution will use. Capacity waiting is charged to the run deadline, never to an individual provider timeout.

func (RunBudgetReceipt) Ceilings 

func (receipt RunBudgetReceipt) Ceilings() HarnessCeilings

Ceilings returns the trusted ceilings used for this preflight.

func (RunBudgetReceipt) CriticalPathDeadline added in v0.1.2 

func (receipt RunBudgetReceipt) CriticalPathDeadline() time.Duration

CriticalPathDeadline returns the longest serial provider/repair or concurrency-lane path charged by preflight, before run grace.

func (RunBudgetReceipt) Eligible 

func (receipt RunBudgetReceipt) Eligible() bool

Eligible reports whether every closed resource constraint passed.

func (RunBudgetReceipt) LaneDeadlines 

func (receipt RunBudgetReceipt) LaneDeadlines() []LaneDeadline

LaneDeadlines returns copied per-lane results in normalized key order.

func (RunBudgetReceipt) MaxActiveLanes added in v0.1.2 

func (receipt RunBudgetReceipt) MaxActiveLanes() int

MaxActiveLanes returns the process capacity used to derive RunDeadline.

func (RunBudgetReceipt) ReasonCode 

func (receipt RunBudgetReceipt) ReasonCode() BudgetReasonCode

ReasonCode returns the safe, closed preflight result code.

func (RunBudgetReceipt) RoleBudgets 

func (receipt RunBudgetReceipt) RoleBudgets() []RoleBudget

RoleBudgets returns copied role operands in fixed role order.

func (RunBudgetReceipt) RunDeadline 

func (receipt RunBudgetReceipt) RunDeadline() time.Duration

RunDeadline returns the capacity-aware execution bound plus run grace.

func (RunBudgetReceipt) TotalInvocations 

func (receipt RunBudgetReceipt) TotalInvocations() int

TotalInvocations returns the count of every possible initial and repair invocation across the role's route.

func (RunBudgetReceipt) TotalOutputCap 

func (receipt RunBudgetReceipt) TotalOutputCap() int64

TotalOutputCap returns the worst-case stdout-plus-stderr capture total.

type RuntimeArtifactInventory 

type RuntimeArtifactInventory struct {
	// contains filtered or unexported fields
}

RuntimePrompt is the trusted prompt and target material supplied for one job. Source implementations own template, objective, target-byte, and identity selection; provider output never participates in their construction. RuntimeArtifactInventory is the immutable source material retained for one provider invocation. It has no provider-output or publication authority.

func (RuntimeArtifactInventory) AdapterParameters 

func (inventory RuntimeArtifactInventory) AdapterParameters() map[string]string

func (RuntimeArtifactInventory) AdapterProfile 

func (inventory RuntimeArtifactInventory) AdapterProfile() string

func (RuntimeArtifactInventory) AttemptID 

func (inventory RuntimeArtifactInventory) AttemptID() domain.AttemptID

func (RuntimeArtifactInventory) CapturedArchive 

func (inventory RuntimeArtifactInventory) CapturedArchive() []byte

func (RuntimeArtifactInventory) Captures 

func (inventory RuntimeArtifactInventory) Captures() []ports.CapturedAttemptArtifact

func (RuntimeArtifactInventory) DiagnosticStderr 

func (inventory RuntimeArtifactInventory) DiagnosticStderr() (ports.RuntimeDiagnosticRawResult, bool)

func (RuntimeArtifactInventory) DiagnosticStdout 

func (inventory RuntimeArtifactInventory) DiagnosticStdout() (ports.RuntimeDiagnosticRawResult, bool)

func (RuntimeArtifactInventory) ExecutionInvocationID 

func (inventory RuntimeArtifactInventory) ExecutionInvocationID() string

func (RuntimeArtifactInventory) Purpose 

func (inventory RuntimeArtifactInventory) Purpose() domain.InvocationPurpose

func (RuntimeArtifactInventory) Role 

func (inventory RuntimeArtifactInventory) Role() domain.Role

func (RuntimeArtifactInventory) RunID 

func (inventory RuntimeArtifactInventory) RunID() domain.RunID

func (RuntimeArtifactInventory) Scope 

func (inventory RuntimeArtifactInventory) Scope() string

func (RuntimeArtifactInventory) Sequence 

func (inventory RuntimeArtifactInventory) Sequence() uint64

func (RuntimeArtifactInventory) SourceInvocationID 

func (inventory RuntimeArtifactInventory) SourceInvocationID() string

func (RuntimeArtifactInventory) Stdin 

func (inventory RuntimeArtifactInventory) Stdin() []byte

func (RuntimeArtifactInventory) StdinSHA256 

func (inventory RuntimeArtifactInventory) StdinSHA256() string

func (RuntimeArtifactInventory) Target 

func (inventory RuntimeArtifactInventory) Target() []byte

func (RuntimeArtifactInventory) TargetIdentity 

func (inventory RuntimeArtifactInventory) TargetIdentity() domain.TargetIdentity

func (RuntimeArtifactInventory) TemplateID 

func (inventory RuntimeArtifactInventory) TemplateID() string

func (RuntimeArtifactInventory) TemplateSHA256 

func (inventory RuntimeArtifactInventory) TemplateSHA256() string

func (RuntimeArtifactInventory) TemplateVersion 

func (inventory RuntimeArtifactInventory) TemplateVersion() string

type RuntimeDiagnosticSinkResolver 

type RuntimeDiagnosticSinkResolver interface {
	RuntimeDiagnosticSink(domain.RunID) (ports.RuntimeDiagnosticSink, bool)
}

RuntimeDiagnosticSinkResolver supplies an already-opened run sink. The provider runtime may persist per-invocation raw streams but never opens or finalizes the sink; reviewrun owns that lifecycle in D-E03.

type RuntimePrompt 

type RuntimePrompt struct {
	Prompt            prompt.CompiledPrompt
	Target            []byte
	CapturedArchive   []byte
	AdapterProfile    string
	AdapterParameters map[string]string
}

AdapterProfile and AdapterParameters identify the trusted execution adapter. They are source material, never provider output.

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service is the G004 compatibility path for deterministic, sequential, in-memory fake-provider runs. Coordinator owns concurrent scheduling and live provider lanes.

func NewService 

func NewService(
	clock ports.Clock,
	ids IdentityGenerator,
	provider ports.ReviewProvider,
	reviewValidator *validation.ReviewValidator,
	verifier *evidence.Verifier,
) (*Service, error)

NewService constructs a sequential compatibility service with the default immutable evidence policy.

func NewServiceWithEvidencePolicy 

func NewServiceWithEvidencePolicy(
	clock ports.Clock,
	ids IdentityGenerator,
	provider ports.ReviewProvider,
	reviewValidator *validation.ReviewValidator,
	verifier *evidence.Verifier,
	policy EvidencePolicy,
) (*Service, error)

NewServiceWithEvidencePolicy constructs a sequential compatibility service with verifier-owned current-evidence authority.

func (*Service) Execute 

func (service *Service) Execute(ctx context.Context, request Request) (Result, error)

Execute performs every selected role in canonical order. It neither queues a repair nor writes, publishes, or returns an artifact.

type TemplateSet 

type TemplateSet struct {
	// contains filtered or unexported fields
}

TemplateSet holds the trusted prompt layers required to compose a role packet. It owns defensive copies of all layer bytes and exposes copies.

func NewTemplateSet 

func NewTemplateSet(common, reviewRun, jsonOutput, repair prompt.TrustedLayer, roleSpecific map[domain.Role]prompt.TrustedLayer) (TemplateSet, error)

NewTemplateSet validates and defensively copies the common, review-run, JSON-output, repair, and role-specific trusted layers.

func (TemplateSet) Common 

func (templates TemplateSet) Common() prompt.TrustedLayer

Common returns a caller-owned copy of the common trusted layer.

func (TemplateSet) ComposeRootReview 

func (templates TemplateSet) ComposeRootReview(role domain.Role, objective *prompt.Objective) (prompt.TrustedTemplate, error)

ComposeRootReview composes the fixed-order trusted template for role.

func (TemplateSet) ComposeRootReviewRepair 

func (templates TemplateSet) ComposeRootReviewRepair(original prompt.TrustedTemplate, plan validation.RepairPlan) (prompt.TrustedTemplate, error)

ComposeRootReviewRepair appends the frozen repair contract and canonical plan to the original trusted template without promoting prior provider output.

func (TemplateSet) JSONOutput 

func (templates TemplateSet) JSONOutput() prompt.TrustedLayer

JSONOutput returns a caller-owned copy of the JSON-output trusted layer.

func (TemplateSet) Repair 

func (templates TemplateSet) Repair() prompt.TrustedLayer

Repair returns a caller-owned copy of the repair trusted layer.

func (TemplateSet) ReviewRun 

func (templates TemplateSet) ReviewRun() prompt.TrustedLayer

ReviewRun returns a caller-owned copy of the review-run trusted layer.

func (TemplateSet) RoleTemplate 

func (templates TemplateSet) RoleTemplate(role domain.Role) (prompt.TrustedLayer, bool)

RoleTemplate returns a caller-owned copy of a role-specific trusted layer.

func (TemplateSet) RoleTemplates 

func (templates TemplateSet) RoleTemplates() map[domain.Role]prompt.TrustedLayer

RoleTemplates returns a caller-owned map and caller-owned layer values.

type TerminalProjection 

type TerminalProjection string

TerminalProjection is the terminal role projection selected when this decision does not schedule more work. None means that repair was selected and the coordinator must await that result. 

const (
	TerminalProjectionNone      TerminalProjection = ""
	TerminalProjectionSucceeded TerminalProjection = "succeeded"
	TerminalProjectionFailed    TerminalProjection = "failed"
	TerminalProjectionCancelled TerminalProjection = "cancelled"
)

func (TerminalProjection) Valid 

func (projection TerminalProjection) Valid() bool

Valid reports whether projection is a policy-defined terminal projection.

type TransitionDecision 

type TransitionDecision struct {
	// contains filtered or unexported fields
}

TransitionDecision is an immutable coordinator-owned result. It contains no references and exposes its facts only through value-returning accessors.

func DecideTransition 

func DecideTransition(input TransitionInput) (TransitionDecision, error)

DecideTransition applies the closed coordinator policy to immutable attempt facts. It has no scheduling, provider, publication, or other side effects.

func (TransitionDecision) CancelRun 

func (decision TransitionDecision) CancelRun() bool

CancelRun reports whether the coordinator must cancel the run and prevent further work.

func (TransitionDecision) Condition 

func (decision TransitionDecision) Condition() AttemptCondition

Condition returns the effective condition selected by closed precedence reduction, including an observed cancellation when it takes precedence.

func (TransitionDecision) ProviderUnusable added in v0.1.4 

func (decision TransitionDecision) ProviderUnusable() bool

ProviderUnusable reports whether this failure proves the provider itself is unusable rather than having merely failed this once. It separates "log in to this provider, or move the role to another one" from "this may well succeed on a retry", so the report can tell the operator which one they are looking at. It selects no work: every role runs on exactly one provider, and the choice of replacement is the operator's.

func (TransitionDecision) ReasonCode 

func (decision TransitionDecision) ReasonCode() string

ReasonCode returns the stable condition-specific reason code. In particular, invalid evidence claims retain invalid_evidence_claim even though their terminal class is invalid_provider_output.

func (TransitionDecision) ScheduleRepair 

func (decision TransitionDecision) ScheduleRepair() bool

ScheduleRepair reports whether the coordinator must schedule the one allowed repair invocation.

func (TransitionDecision) Terminal 

func (decision TransitionDecision) Terminal() bool

Terminal reports whether the decision closes this role rather than scheduling repair work.

func (TransitionDecision) TerminalClass 

func (decision TransitionDecision) TerminalClass() domain.FailureClass

TerminalClass returns the domain failure class for the effective condition. It is empty only for a valid review.

func (TransitionDecision) TerminalProjection 

func (decision TransitionDecision) TerminalProjection() TerminalProjection

TerminalProjection returns the selected terminal role projection. It is None while the decision schedules repair work.

type TransitionInput 

type TransitionInput struct {
	Condition            AttemptCondition
	RepairUsed           bool
	CancellationObserved bool
}

TransitionInput contains the facts the coordinator needs to make one policy decision.

type ValidatedRoleOutput 

type ValidatedRoleOutput struct {
	// contains filtered or unexported fields
}

ValidatedRoleOutput is immutable validated provider content for one role, provider instance, and immutable target. It has no transition, policy, outcome-axis, or publication authority.

func NewEvidenceValidatedRoleOutput 

func NewEvidenceValidatedRoleOutput(
	role domain.Role,
	providerInstance string,
	target domain.TargetIdentity,
	findings []domain.Finding,
	completeness string,
	limitations []string,
	evidenceGroups []VerifiedFindingEvidence,
) (ValidatedRoleOutput, error)

NewEvidenceValidatedRoleOutput records finding output only after receipt groups prove one nonempty verifier-owned group for every assigned finding. It projects receipt states with a structural policy; the coordinator applies its authoritative policy separately.

func NewReportsOnlyValidatedRoleOutput added in v0.1.4 

func NewReportsOnlyValidatedRoleOutput(
	role domain.Role,
	providerInstance string,
	target domain.TargetIdentity,
	reportMarkdown []byte,
) (ValidatedRoleOutput, error)

NewReportsOnlyValidatedRoleOutput accepts one free-form role report without a validated structured finding document. Provider prose remains untrusted content; Mulgae owns identity and publication.

func NewValidatedRoleOutput 

func NewValidatedRoleOutput(
	role domain.Role,
	providerInstance string,
	target domain.TargetIdentity,
	findings []domain.Finding,
	completeness string,
	limitations []string,
) (ValidatedRoleOutput, error)

NewValidatedRoleOutput records a zero-finding validated role output. Finding output requires verifier-owned receipts and must use NewEvidenceValidatedRoleOutput.

func (ValidatedRoleOutput) Completeness 

func (output ValidatedRoleOutput) Completeness() string

Completeness returns the validated provider-declared review completeness.

func (ValidatedRoleOutput) Evidence 

func (output ValidatedRoleOutput) Evidence() []VerifiedFindingEvidence

Evidence returns defensive receipt-group copies in deterministic finding-ID order.

func (ValidatedRoleOutput) Findings 

func (output ValidatedRoleOutput) Findings() []domain.Finding

Findings returns caller-owned copies in deterministic assigned-ID order.

func (ValidatedRoleOutput) Limitations 

func (output ValidatedRoleOutput) Limitations() []string

Limitations returns a caller-owned copy of the validated limitations.

func (ValidatedRoleOutput) OutputTransport added in v0.1.4 

func (output ValidatedRoleOutput) OutputTransport() ports.ProviderOutputTransport

OutputTransport returns the transport that carried the accepted provider content. An output that records no explicit transport was carried by process stdout, which keeps every legacy accept path unchanged.

func (ValidatedRoleOutput) ParseState added in v0.1.4 

func (output ValidatedRoleOutput) ParseState() domain.ParseState

ParseState returns Mulgae-owned parse coverage for the accepted attempt.

func (ValidatedRoleOutput) ProviderInstance 

func (output ValidatedRoleOutput) ProviderInstance() string

ProviderInstance returns the exact selected provider instance.

func (ValidatedRoleOutput) ReportMarkdown added in v0.1.4 

func (output ValidatedRoleOutput) ReportMarkdown() []byte

ReportMarkdown returns a caller-owned copy of the Mulgae-owned role report body.

func (ValidatedRoleOutput) ReportsOnly added in v0.1.4 

func (output ValidatedRoleOutput) ReportsOnly() bool

ReportsOnly reports whether the role delivered a free-form report without a validated structured finding document.

func (ValidatedRoleOutput) Role 

func (output ValidatedRoleOutput) Role() domain.Role

Role returns the selected review role.

func (ValidatedRoleOutput) Target 

func (output ValidatedRoleOutput) Target() domain.TargetIdentity

Target returns a reconstructed canonical immutable target identity.

func (ValidatedRoleOutput) ValidationState added in v0.1.4 

func (output ValidatedRoleOutput) ValidationState() domain.ValidationState

ValidationState returns Mulgae-owned validation coverage for the accepted attempt.

type VerifiedFindingEvidence 

type VerifiedFindingEvidence struct {
	// contains filtered or unexported fields
}

VerifiedFindingEvidence binds an exact final finding proof to the immutable receipts produced by the coordinator-owned current-evidence verifier.

func VerifyValidatedEvidence 

func VerifyValidatedEvidence(
	ctx context.Context,
	verifier *evidence.Verifier,
	groups []validation.FindingEvidenceClaims,
) ([]VerifiedFindingEvidence, error)

VerifyValidatedEvidence converts validated current-evidence claims into verifier-owned claims and verifies them in their deterministic input order. Any invalid bridge input, cancellation, or verifier failure rejects the whole result so no partial evidence can escape.

func (VerifiedFindingEvidence) FindingID 

func (verified VerifiedFindingEvidence) FindingID() string

FindingID returns the final system-assigned finding ID.

func (VerifiedFindingEvidence) Receipts 

func (verified VerifiedFindingEvidence) Receipts() []evidence.CurrentReceipt

Receipts returns caller-owned receipt values in the supplied claim order.

func (VerifiedFindingEvidence) VisualReferences 

func (verified VerifiedFindingEvidence) VisualReferences() []validation.VerifiedVisualReference

VisualReferences returns verified visual references aligned with Receipts. Zero values identify current claims without visual evidence.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.