contract

type ActorID string

type ActorKind string

type BudgetTier string

type ChannelStatus struct {
	Principal     ActorID   `json:"principal"`
	Digest        string    `json:"digest"`
	Resources     int       `json:"resources"`
	ActorKind     ActorKind `json:"actor_kind,omitempty"`
	StoreRef      string    `json:"store_ref"`
	Mode          string    `json:"mode"`
	SyncPending   int       `json:"sync_pending"`
	SyncSynced    int       `json:"sync_synced"`
	SyncConflicts int       `json:"sync_conflicts"`
}

type Conflict struct {
	Ref             ResourceRef
	ExpectedVersion Version
	ActualVersion   Version
	Kind            ConflictKind
}

type ConflictKind string

type Decision struct {
	DecisionID    string
	OpID          string
	IngestSeq     int64
	Actor         ActorID
	CorrelationID string // carries the triggering event's correlation; the durable escalation key (Invariant #10)
	Status        DecisionStatus
	Reason        string
	Conflicts     []Conflict
	NextAction    string // "" (terminal) | "rebase" | "human_review"
	AppliedAt     string // RFC3339; set iff Accepted
	NewVersions   []ResourceVersion
	NewResources  []ResourceSnapshot
}

type DecisionStatus string

type Diagnostic struct {
	Stage  string
	Reason string
	Ref    string
}

type Event struct {
	SchemaVersion int               `json:"schema_version"`
	ID            string            `json:"id"`
	IngestSeq     int64             `json:"ingest_seq"` // = events.rowid; the ONLY ordering key (Invariant #9)
	TS            string            `json:"ts"`         // provenance only; NEVER orders
	Type          string            `json:"type"`
	Actor         ActorID           `json:"actor"`
	ResourceRefs  []ResourceRef     `json:"resource_refs"`
	BasedOn       []ResourceVersion `json:"based_on"`       // read-set (Invariant #6)
	ProjectionRef string            `json:"projection_ref"` // provenance of the projection acted on
	ContextDigest string            `json:"context_digest"` // provenance; P1 may promote to a validation anchor
	CorrelationID string            `json:"correlation_id"`
	CausedBy      string            `json:"caused_by,omitempty"`
	Payload       map[string]any    `json:"payload"`
}

type KernelOp struct {
	OpID          string
	Actor         ActorID
	Writes        []ResourceWrite
	ReadSet       []ResourceVersion
	IngestSeq     int64
	CorrelationID string // trusted envelope field; the durable key for liveness escalation (Invariant #10)
}

type LocalCommit struct {
	OriginReplicaID string
	LocalDecisionID string
	LocalIngestSeq  int64
	Actor           ActorID
	CorrelationID   string
	ResourceRef     ResourceRef
	ResourceVersion Version
	FieldsDigest    string
	Fields          map[string]any
	DecidedAt       string
	Status          string
}

type Modes struct{ Conflict, Isolation, Authz string }

type ObservationEnvelope struct {
	Source     ActorID
	ExternalID string
	Event      Event
}

type OpKind string

type ProposedEvent struct {
	Type    string
	Payload map[string]any
}

type ReplicaGrant struct {
	Principal ActorID
	Token     string
	Scopes    []ResourceRef
}

type ResourceID string

type ResourceKind string // "memory", "goal", "skill"

type ResourceRef struct {
	Kind ResourceKind
	ID   ResourceID
}

type ResourceSnapshot struct {
	Ref     ResourceRef
	Version Version
	Fields  map[string]any
}

type ResourceVersion struct {
	Ref     ResourceRef
	Version Version
}

type ResourceWrite struct {
	Ref     ResourceRef
	Kind    OpKind
	BasedOn Version // expected current version; 0 for create
	Fields  map[string]any
}

type RuleDecision struct {
	Verdict  RuleVerdict
	Reasons  []string
	Proposal *ProposedEvent
	// ProposalActor is the TRUSTED origin actor of the carried Proposal — stamped by the RuleSet reducer from
	// the producing rule's Actor(), never by a rule's own output (json:"-" so an untrusted wasm rule cannot
	// forge it: the field is dropped on decode and re-set from the trusted Rule.Actor()). The server stamps the
	// bridge write identity from this instead of guessing the producer by scanning Handles/Emits.
	ProposalActor ActorID `json:"-"`
}

type RuleVerdict string

type Subscription struct {
	Actor       ActorID
	Refs        []ResourceRef
	PrivacyTier string
	// Budget is the context-budget tier (P4): a LOCAL derived-mirror shape (hot/warm/digest-only),
	// never a hub-side filter. It bounds how much of the pulled commit set the local packet renders;
	// the remote serves the same scoped set regardless (I11: remote settles, local decides). Empty
	// resolves to hot (full) — budget is not a security axis (the grant scope is), so the empty default
	// PRESERVES existing full-delivery behavior, mirroring ClampRefs's "empty requested = full scope".
	Budget BudgetTier
}

type SyncCommitResult struct {
	OriginReplicaID string      `json:"origin_replica_id"`
	LocalDecisionID string      `json:"local_decision_id"`
	ResourceRef     ResourceRef `json:"resource_ref"`
	Status          string      `json:"status"`
	Diagnostic      string      `json:"diagnostic,omitempty"`
}

type SyncPullRequest struct {
	ReplicaID    string        `json:"replica_id"`
	RemoteCursor string        `json:"remote_cursor"`
	Scopes       []ResourceRef `json:"scopes"`
}

type SyncPullResponse struct {
	Commits     []LocalCommit      `json:"commits"`
	Diagnostics []SyncCommitResult `json:"diagnostics"`
	NextCursor  string             `json:"next_cursor"`
}

type SyncPushRequest struct {
	ReplicaID string        `json:"replica_id"`
	BatchID   string        `json:"batch_id"`
	Commits   []LocalCommit `json:"commits"`
}

type SyncPushResponse struct {
	Accepted   []SyncCommitResult `json:"accepted"`
	Rejected   []SyncCommitResult `json:"rejected"`
	Conflicts  []SyncCommitResult `json:"conflicts"`
	NextCursor string             `json:"next_cursor,omitempty"`
}

type SyncStatusResponse struct {
	Principal          ActorID           `json:"principal"`
	RemoteWorkspace    string            `json:"remote_workspace"`
	HubCommitsReceived int64             `json:"hub_commits_received"`
	HubCommitsServed   int64             `json:"hub_commits_served"`
	HubReplicaCursors  map[string]string `json:"hub_replica_cursors,omitempty"`
}

type Version int64 // per-resource; 1 on create; +1 each accepted write. NEVER global.