evidence

type Factory ¶

type Factory interface {
	Capture(context.Context, Input) (Pending, error)
	Restore(context.Context, Turn) (context.Context, error)
}

Factory is an optional composition-root dependency. Restore must load the original immutable admission; it must never recapture current input or clock.

type FenceStream ¶

type FenceStream struct {
	// contains filtered or unexported fields
}

FenceStream buffers structured fences across arbitrary provider byte chunks. Ordinary complete lines can progress while a later fence is being validated. The caller owns one instance per message and serializes calls. On cancellation discard the instance: buffered, unvalidated content is never released.

func NewFenceStream(transform FenceTransform) *FenceStream

func (s *FenceStream) Push(delta string, final bool) (string, error)

type FenceTransform ¶

type FenceTransform func(kind, body string) (string, error)

FenceTransform validates and consumes a complete authored structured fence. Returning an error prevents any bytes of that fence from being published.

type Input ¶

type Input struct {
	Context    json.RawMessage
	ReceivedAt time.Time
	Nested     bool
}

Input is captured before routing/intake can modify visible request context. Context is a private copy; policy factories select only their reserved field.

type Pending ¶

type Pending interface {
	Begin(context.Context, Turn) (context.Context, error)
}

type Publication ¶

type Publication interface {
	Content(context.Context, string) (string, error)
	Fence(context.Context, string, string) (string, error)
	Stream(context.Context, string, string, bool) (string, error)
}

Publication is the same trusted turn capability at each write boundary. It returns canonical visible content, while raw provider audit bytes remain untouched. Stream state is scoped to the original assistant message ID.

func PublicationFromContext(ctx context.Context) Publication

type Rejection ¶

type Rejection struct{ Cause error }

func (e *Rejection) Error() string

func (e *Rejection) Unwrap() error

type ReportAdmissionInput ¶

type ReportAdmissionInput struct {
	ConversationID string
	BuilderRef     string
	RequestID      string
	AdmissionRef   string
}

type ReportAdmissions ¶

type ReportAdmissions interface {
	AdmitReport(context.Context, ReportAdmissionInput) (json.RawMessage, error)
	VerifyReport(context.Context, string, json.RawMessage, ReportArtifacts) error
}

ReportAdmissions is injected in the authenticated HTTP report lifecycle. The caller supplies only an opaque reference; implementations load all authority from the immutable native command receipt, not from an active-turn guess.

type ReportArtifacts ¶

type ReportArtifacts struct {
	Spec  json.RawMessage
	Fill  json.RawMessage
	Print json.RawMessage
}

type ReportCommand ¶

type ReportCommand struct {
	RequestID    string `json:"requestId"`
	AdmissionRef string `json:"reportAdmissionRef"`
}

type ReportCommandTarget ¶

type ReportCommandTarget struct {
	WindowID  string
	Workspace json.RawMessage
}

type ReportCommands ¶

type ReportCommands interface {
	IssueReportCommand(context.Context, ReportCommandTarget) (*ReportCommand, error)
}

func ReportCommandsFromContext(ctx context.Context) ReportCommands

type ReportCompilation ¶

type ReportCompilation interface {
	CompileContext(context.Context, string, string) (context.Context, error)
	RecordCompiled(context.Context, string, ReportArtifacts) error
}

ReportCompilation brackets the trusted pure compiler. RecordCompiled receives only server-produced canonical artifacts, never a client completion payload.

type Tools ¶

type Tools interface {
	Prepare(context.Context, string, string, json.RawMessage) (json.RawMessage, bool, error)
	Completed(context.Context, string, string) (json.RawMessage, bool, error)
}

Tools prepares the exact effective request before any durable capture and projects a result only after the executor confirms its durable completion. Implementations must revalidate the authenticated turn on every invocation.

func ToolsFromContext(ctx context.Context) Tools

type Turn ¶

type Turn struct {
	ConversationID   string
	TurnID           string
	StarterMessageID string
	LeaseOwner       func() string
}

Turn is supplied after the real starter and execution run are durable. LeaseOwner resolves the current execution token, not an admission-time copy.