capability

type Client ¶

type Client struct {
	// contains filtered or unexported fields
}

func NewClient(token string) *Client

func NewClientWithToken(token func() string) *Client

func (c *Client) Get(ctx context.Context, baseURL, expectedNodeID string) (corecap.NodeInventory, error)

func (c *Client) Refresh(ctx context.Context, baseURL, expectedNodeID string, refresh corecap.RecheckRequest) (corecap.NodeInventory, error)

type CodexAppServerContract ¶

type CodexAppServerContract struct {
	ExecutableDigest         string
	NormalSchemaDigest       string
	NormalSchemaFiles        int
	ExperimentalSchemaDigest string
	ExperimentalSchemaFiles  int
	GmailIsolationReady      bool
	SupabaseIsolationReady   bool
}

CodexAppServerContract carries facts verified outside the live JSONL session. The inspector copies only these normalized schema/isolation facts; account and model readiness always come from the current app-server session.

type CodexAppServerInspector ¶

type CodexAppServerInspector struct {
	// contains filtered or unexported fields
}

func NewCodexAppServerInspector(starter CodexAppServerStarter, contract CodexAppServerContract) *CodexAppServerInspector

func NewVerifiedCodexAppServerInspector(starter CodexAppServerStarter, verifier CodexContractVerifier) *CodexAppServerInspector

func (i *CodexAppServerInspector) Inspect(ctx context.Context) (CodexInspection, error)

type CodexAppServerProcess ¶

type CodexAppServerProcess interface {
	io.Reader
	io.Writer
	io.Closer
	ExecutableDigest() string
}

CodexAppServerProcess is the private JSONL process boundary used by the no-turn inspector. Tests substitute an in-memory transcript; production starts the exact executable identity held by CommandResolver.

type CodexAppServerStarter ¶

type CodexAppServerStarter interface {
	Start(context.Context) (CodexAppServerProcess, error)
}

type CodexContractVerifier ¶

type CodexContractVerifier interface {
	Verify(context.Context) (CodexAppServerContract, error)
}

CodexContractVerifier proves the held Codex executable's no-turn app-server schema contract. Production verification is intentionally lazy: wiring and read-only CLI commands must never run provider commands.

type CodexInspection ¶

type CodexInspection struct {
	AccountReady             bool
	AccountHandle            string
	AccountType              string
	AccountPlan              string
	Models                   map[string]bool
	DefaultModel             string
	ExecutableDigest         string
	NormalSchemaDigest       string
	NormalSchemaFiles        int
	ExperimentalSchemaDigest string
	ExperimentalSchemaFiles  int
	GmailIsolationReady      bool
	SupabaseIsolationReady   bool
}

CodexInspection contains normalized process-private facts extracted from one no-turn app-server session and its generated schema bundles. The executable digest is compared internally and must never cross a public API boundary.

type CodexInspector ¶

type CodexInspector interface {
	Inspect(context.Context) (CodexInspection, error)
}

type CodexSchemaContractVerifier ¶

type CodexSchemaContractVerifier struct {
	// contains filtered or unexported fields
}

func NewCodexSchemaContractVerifier(resolver *CommandResolver) *CodexSchemaContractVerifier

func (v *CodexSchemaContractVerifier) Verify(ctx context.Context) (CodexAppServerContract, error)

type CodexSchemaGenerator ¶

type CodexSchemaGenerator interface {
	Generate(context.Context, string, string) (string, error)
}

CodexSchemaGenerator is the bounded command seam for generating both schema bundles from one executable identity.

type CodexSubscriptionResolver ¶ added in v1.0.4

type CodexSubscriptionResolver struct {
	// contains filtered or unexported fields
}

CodexSubscriptionResolver bridges capability-authorized, content-addressed Codex bytes into the isolated subscription runtime. It returns no account identifiers or auth paths beyond the process-private environment required by the already authenticated Codex executable.

func NewCodexSubscriptionResolver(resolver *CommandResolver) *CodexSubscriptionResolver

func (r *CodexSubscriptionResolver) ResolveCodex(ctx context.Context) (codexsubscription.HeldExecutable, error)

type CommandExecutor ¶

type CommandExecutor interface {
	Run(context.Context, string, ...string) CommandResult
}

CommandExecutor is the narrow command-probe seam used by LocalProber.

type CommandResolver ¶

type CommandResolver struct {
	// contains filtered or unexported fields
}

CommandResolver resolves a command once, reads it through a no-follow file descriptor, and stages immutable content-addressed bytes for both probes and dispatch. Paths and fingerprints stay execution-private.

func NewCommandResolver(options CommandResolverOptions) (*CommandResolver, error)

func (r *CommandResolver) AuthorizeExecutable(name, digest string) error

func (r *CommandResolver) Hold(name string) (*HeldCommand, error)

func (r *CommandResolver) ResolveVerifiedExecutable(name string) (string, error)

type CommandResolverOptions ¶

type CommandResolverOptions struct {
	Platform             string
	StageDir             string
	Environment          []string
	PreferredExecutables map[string]string
}

type CommandResult ¶

type CommandResult struct {
	Output           []byte
	ExecutableDigest string
	Err              error
}

CommandResult is the private result of one bounded, held executable probe. Output must be parsed and discarded by the prober; it never enters public inventory or error text.

type DiscoveryError ¶

type DiscoveryError struct {
	Reason corecap.Reason
}

func (e *DiscoveryError) Error() string

type GmailInspection ¶

type GmailInspection struct {
	Ready         bool
	BindingHandle string
}

type GmailInspector ¶

type GmailInspector interface {
	InspectGmail(context.Context) (GmailInspection, error)
}

type HeldCommand ¶

type HeldCommand struct {
	// contains filtered or unexported fields
}

func (h *HeldCommand) Digest() string

func (h *HeldCommand) Environment() []string

func (h *HeldCommand) Executable() string

func (h *HeldCommand) Run(ctx context.Context, args []string, maximum int, timeout time.Duration) ([]byte, error)

type LocalProber ¶

type LocalProber struct {
	// contains filtered or unexported fields
}

LocalProber implements only the catalog's closed predicate IDs. Raw command output and private connector identifiers are reduced to stable binding material before Registry hashes them into opaque revisions.

func NewLocalProber(commands CommandExecutor, codex CodexInspector, gmail GmailInspector, supabase SupabaseInspector) *LocalProber

func (p *LocalProber) Probe(ctx context.Context, request ProbeRequest) ProbeObservation

type MachineRefresher ¶

type MachineRefresher interface {
	RefreshMachine(context.Context, string, corecap.RefreshMode, []string) (corecap.MachineInventory, error)
}

MachineRefresher is the narrow capability-control seam needed immediately before provider dispatch. It refreshes only the machine placement already selected by the deterministic core.

type ProbeError ¶

type ProbeError struct {
	Reason corecap.Reason
}

ProbeError permits a private inspector to return a closed public reason without exposing its underlying output or credentials.

func (e *ProbeError) Error() string

type ProbeObservation ¶

type ProbeObservation struct {
	State          corecap.PredicateState
	Reason         corecap.Reason
	StableBinding  []string
	ResolvedModel  string
	TextOnlyOption *corecap.TextOnlyOptionOffer
}

type ProbeRequest ¶

type ProbeRequest struct {
	AdapterID   string
	TargetID    string
	ProfileID   string
	BindingID   string
	PredicateID string
}

type Prober ¶

type Prober interface {
	Probe(context.Context, ProbeRequest) ProbeObservation
}

type ProfileGate ¶

type ProfileGate struct {
	// contains filtered or unexported fields
}

ProfileGate blocks legacy dispatch unless its exact cataloged execution profile is ready on the already-selected machine. It never substitutes a model or changes placement.

func NewProfileGate(next runtime.Runtime, refresher MachineRefresher) *ProfileGate

func (g *ProfileGate) Dispatch(ctx context.Context, spec runtime.RunSpec) (runtime.Run, error)

func (g *ProfileGate) Name() string

type ProfilePreflightError ¶

type ProfilePreflightError struct {
	ProfileID string
	Machine   string
	Reason    corecap.Reason
}

ProfilePreflightError is safe to persist and render. It contains only closed catalog identifiers, the public machine name, and a closed reason code.

func (e *ProfilePreflightError) Error() string

type Registry ¶

type Registry struct {
	// contains filtered or unexported fields
}

func NewRegistry(options RegistryOptions) (*Registry, error)

func (r *Registry) Current() corecap.NodeInventory

func (r *Registry) Refresh(ctx context.Context, request corecap.RecheckRequest) (corecap.NodeInventory, error)

type RegistryOptions ¶

type RegistryOptions struct {
	NodeID      string
	Platform    string
	RevisionKey []byte
	Prober      Prober
	Now         func() time.Time
}

type ResolverCodexAppServerStarter ¶

type ResolverCodexAppServerStarter struct {
	Resolver *CommandResolver
}

ResolverCodexAppServerStarter launches the same immutable staged Codex bytes and environment policy used by the ordinary command probes.

func (s ResolverCodexAppServerStarter) Start(ctx context.Context) (CodexAppServerProcess, error)

type ResolverCodexSchemaGenerator ¶

type ResolverCodexSchemaGenerator struct {
	Resolver *CommandResolver
}

ResolverCodexSchemaGenerator runs both schema commands from one held Codex executable identity. Command output is bounded and discarded.

func (g ResolverCodexSchemaGenerator) Generate(ctx context.Context, normalDir, experimentalDir string) (string, error)

type ResolverExecutor ¶

type ResolverExecutor struct {
	Resolver *CommandResolver
}

ResolverExecutor holds the exact executable bytes before every probe and runs that staged identity with the capability probe bounds.

func (e ResolverExecutor) AuthorizeExecutable(name, digest string) error

func (e ResolverExecutor) Run(ctx context.Context, name string, args ...string) CommandResult

type SupabaseInspection ¶

type SupabaseInspection struct {
	Ready         bool
	BindingHandle string
}

type SupabaseInspector ¶

type SupabaseInspector interface {
	InspectSupabase(context.Context) (SupabaseInspection, error)
}