Documentation
¶
Overview ¶
Package policy resolves the continuity egress policy at request time.
The resolver has no canonical Call input by design. Only proxy-owned typed execution context may supply a session override; client headers, session hints, extensions, and prompt content are not policy authority.
Index ¶
- Constants
- Variables
- func AuthorizeTranscriptScope(ctx context.Context, requestedTenant, requestedWorkspace string) bool
- func AuthorizeTranscriptWorkspace(ctx context.Context, requestedWorkspace string) bool
- func WithTrustedOverride(ctx context.Context, o Override) context.Context
- type Categories
- type CategoryPatch
- type Defaults
- type Effective
- type Extractor
- type HardMaxima
- type LimitOverride
- type Limits
- type Override
- type TranscriptAuthorization
Constants ¶
const ( LabelPrefix = "compaction_continuity." LabelEnabled = LabelPrefix + "enabled" LabelRoute = LabelPrefix + "extractor.route" LabelInherit = LabelPrefix + "extractor.inherit" LabelTimeout = LabelPrefix + "extractor.timeout" LabelMaxInputTokens = LabelPrefix + "extractor.max_input_tokens" LabelMaxOutputTokens = LabelPrefix + "extractor.max_output_tokens" LabelBarrierTimeout = LabelPrefix + "barrier.timeout" LabelCapsuleMaxTokens = LabelPrefix + "capsule.max_tokens" LabelCapsuleMaxBytes = LabelPrefix + "capsule.max_bytes" LabelSourceMaxBytes = LabelPrefix + "source.max_bytes" LabelResultMaxBytes = LabelPrefix + "result.max_bytes" LabelResultMaxCount = LabelPrefix + "result.max_count" LabelPlan = LabelPrefix + "preserve.plan" LabelUserDecisions = LabelPrefix + "preserve.user_decisions" LabelConstraints = LabelPrefix + "preserve.constraints" LabelRationale = LabelPrefix + "preserve.rationale" LabelRejected = LabelPrefix + "preserve.rejected_alternatives" )
Variables ¶
var ( ErrInvalidDefaults = errors.New("continuity policy: invalid defaults") ErrUnapprovedRoute = errors.New("continuity policy: default extractor route is not approved") )
Functions ¶
func AuthorizeTranscriptScope ¶
AuthorizeTranscriptScope checks both tenant and workspace ownership. Empty requested values mean "use the already-authorized session scope"; a caller cannot broaden a read by omitting one dimension.
func AuthorizeTranscriptWorkspace ¶
AuthorizeTranscriptWorkspace preserves the existing tenant/workspace scope when a reader asks for a specific workspace. Empty requested scope means the caller must use the session's already-authorized workspace.
func WithTrustedOverride ¶
WithTrustedOverride attaches a proxy-owned override. Callers must invoke it only after the secure-session/session-open policy has authenticated and authorized the value. Resolve still requires an authoritative session view, so a frontend cannot self-authorize by supplying this value on a wire path.
Types ¶
type Categories ¶
type Categories struct {
Plan bool
UserDecisions bool
Constraints bool
Rationale bool
RejectedAlternatives bool
}
Categories is the allowlist of semantic continuity categories.
type CategoryPatch ¶
type CategoryPatch struct {
Plan *bool
UserDecisions *bool
Constraints *bool
Rationale *bool
RejectedAlternatives *bool
}
CategoryPatch preserves omitted category values when labels provide only a subset of approved session controls.
type Defaults ¶
type Defaults struct {
Enabled bool
Preserve Categories
Extractor Extractor
Limits Limits
}
Defaults are immutable global feature defaults for one generation.
type Effective ¶
type Effective struct {
Enabled bool
Preserve Categories
Extractor Extractor
Limits Limits
TrustedSession bool
TranscriptRead bool
}
Effective is the request-local policy after precedence and hard bounds.
type Extractor ¶
type Extractor struct {
Route string
Inherit bool
Timeout time.Duration
MaxInputTokens int
MaxOutputTokens int
}
Extractor is the route and semantic child budget selected for one request. It intentionally carries no branch, account, session, or prompt identifiers.
type HardMaxima ¶
type HardMaxima struct {
Enabled bool
Preserve Categories
ApprovedRoutes []string
AllowTranscriptRead bool
AllowInherit bool
Limits Limits
}
HardMaxima are operator safety limits. Enabled=false is a hard global disable. A non-empty ApprovedRoutes list is the only route allowlist for trusted per-session route replacement.
type LimitOverride ¶
type LimitOverride struct {
Timeout *time.Duration
MaxInputTokens *int
MaxOutputTokens *int
BarrierTimeout *time.Duration
CapsuleMaxTokens *int
CapsuleMaxBytes *int
SourceMaxBytes *int
ResultMaxBytes *int
ResultMaxCount *int
}
LimitOverride contains optional trusted tighter bounds. A session value is accepted only when it is positive and no greater than both the global value and the operator maximum.
type Limits ¶
type Limits struct {
Timeout time.Duration
MaxInputTokens int
MaxOutputTokens int
BarrierTimeout time.Duration
CapsuleMaxTokens int
CapsuleMaxBytes int
SourceMaxBytes int
ResultMaxBytes int
ResultMaxCount int
}
Limits contains the remaining bounded continuity resources.
type Override ¶
type Override struct {
Enabled *bool
Preserve *Categories
PreservePatch *CategoryPatch
Route string
RouteSet bool
Inherit *bool
Limits LimitOverride
// contains filtered or unexported fields
}
Override is the explicitly approved, proxy-owned per-session control set. Preserve is a complete category value when non-nil; omitted categories are not guessed from client data.
func (Override) InheritValue ¶
type TranscriptAuthorization ¶
type TranscriptAuthorization struct {
SessionID string
PrincipalID string
TenantID string
WorkspaceID string
}
TranscriptAuthorization is the scope retained for an optional authorized transcript read. It must not be passed to the extractor prompt.
func TranscriptAuthorizationFromContext ¶
func TranscriptAuthorizationFromContext(ctx context.Context) (TranscriptAuthorization, bool)
TranscriptAuthorizationFromContext returns the already-authorized scope for an optional transcript read. It refuses missing secure-session authority or transcript-disabled policy, and it does not fall back to client hints.
Source Files