assurance

package
v1.10.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 4, 2026 License: MIT Imports: 31 Imported by: 0

Documentation

Overview

Package assurance shares immutable evidence and report persistence rules.

Index

Constants

View Source 
const (
	KindEvidence     = "evidence"
	KindContract     = "contract"
	KindReport       = "report"
	MaxEvidenceBytes = 1 << 20
)
View Source 
const KindEventStream = "public_event_stream"

KindEventStream identifies the bounded mutable replay window for one run.

View Source 
const KindJob = "verification_job"

KindJob is the only assurance record whose body job operations may replace.

View Source 
const KindOrchestrationBudget = "orchestration_budget"

KindOrchestrationBudget is the immutable anchor for team budget transactions.

View Source 
const KindPlan = kindPlan

KindPlan identifies the immutable initial plan row used to serialize writes.

View Source 
const KindRunCallGuard = "run_call_guard"

KindRunCallGuard is the shared row that serializes admission and closure.

View Source 
const SQLMigration = `` /* 718-byte string literal not displayed */

SQLMigration is shared by SQLite and PostgreSQL; only portable SQL is used.

Variables

View Source 
var (
	ErrAbsent = errors.New("cortex: assurance record absent")
	ErrExists = errors.New("cortex: assurance record exists")
)

Functions

func Columns 

func Columns(scope cortex.Scope) [3]string

Columns returns the exact indexed identity, including empty trailing levels.

func LessonPayloadKinds 

func LessonPayloadKinds() []string

LessonPayloadKinds is the complete list of records containing lesson content.

Types

type AskResolutionDriver 

type AskResolutionDriver interface {
	ReadPendingAsk(context.Context, string) (*a2a.PendingAsk, error)
	TransactAskResolution(context.Context, string, func(context.Context, AskResolutionTransaction) error) error
}

AskResolutionDriver serializes claims and immutable outcome insertion. Callbacks contain only storage work and may be replayed by MongoDB.

type AskResolutionTransaction 

type AskResolutionTransaction interface {
	Driver
	ReadPendingAsk(context.Context, string) (*a2a.PendingAsk, error)
	ClaimResolvedAsk(context.Context, string, time.Time) error
}

AskResolutionTransaction holds an exact-scope ask lock throughout the callback.

type ContinuationTransaction added in v1.10.0 

type ContinuationTransaction interface {
	SuspensionTransaction
	// SetRunContinuation saves r's state, lease, readiness, reclaim count and
	// notification time. It compares r.Revision and advances it, and returns
	// cortex.ErrRunConflict when the stored revision moved.
	SetRunContinuation(context.Context, *run.Run, time.Time) error
	// ClearSuspensionDeadline removes the expiry of the run's suspension at
	// the exact context scope.
	ClearSuspensionDeadline(context.Context, id.AgentRunID) error
	// SetRunLease writes r's lease on a running run at r.Revision without
	// advancing it, and returns cortex.ErrRunConflict when nothing matched.
	SetRunLease(context.Context, *run.Run) error
}

ContinuationTransaction writes the continuation columns of a run row and the suspension deadline while the run lock is held.

type Driver 

type Driver interface {
	Insert(context.Context, Record) error
	Select(context.Context, Query) ([]Record, error)
	ReplaceEvidence(context.Context, Record, string) error
}

Driver contains only database-specific operations. Insert must never update an existing row. ReplaceEvidence is a compare-and-swap on the complete body.

type LessonRetentionDriver 

type LessonRetentionDriver interface {
	EraseLessonPayloads(context.Context, id.ID) error
	FenceLessonRevision(context.Context, string, string) error
}

LessonRetentionDriver redacts every local payload revision and delivery copy. Implementations must run inside the source run transaction and exact scope.

type MessagingDriver 

type MessagingDriver interface {
	TransactMessaging(context.Context, id.DeliveryID, id.ConversationID, func(context.Context, MessagingTransaction) error) error
}

MessagingDriver locks one delivery or conversation before invoking storage work. Mongo may replay the callback; it must contain no external side effects.

type MessagingTransaction 

type MessagingTransaction interface {
	Driver
	LockConversation(context.Context, id.ConversationID) error
	ReadDelivery(context.Context, id.DeliveryID) (*a2a.Delivery, error)
	ReadMessage(context.Context, id.MessageID) (*a2a.Envelope, error)
	ReadConversation(context.Context, id.ConversationID) (*a2a.Conversation, error)
	SaveMessage(context.Context, *a2a.Envelope, *a2a.Conversation) error
	SaveReplyDelivery(context.Context, *a2a.Delivery) error
	FinishReplyDelivery(context.Context, *a2a.Delivery, time.Time) error
}

MessagingTransaction operates only inside its backend's active transaction. Reads and writes must constrain both exact scope and routing partition.

type OrchestrationBudgetDriver 

type OrchestrationBudgetDriver interface {
	TransactOrchestrationBudget(context.Context, id.OrchestrationID, func(context.Context, Driver) error) error
}

OrchestrationBudgetDriver serializes all account mutations against its anchor. Callbacks may be replayed and must contain only transactional storage work.

type PlanDriver 

type PlanDriver interface {
	TransactPlan(context.Context, id.ID, func(context.Context, Driver) error) error
}

PlanDriver serializes the callback with every writer of this exact plan. Mongo may replay the callback. It must contain only transactional storage work.

type ProgressTransaction added in v1.10.0 

type ProgressTransaction interface {
	RunTransaction
	// UpsertProgress inserts or replaces the snapshot of p.RunID at the
	// exact context scope. p.Scope and p.UpdatedAt are already set.
	UpsertProgress(context.Context, *suspension.Progress) error
}

ProgressTransaction writes a run's progress snapshot while the run lock is held.

type Query 

type Query struct {
	Kind, ID, Digest, RunID, After string
	Limit                          int
	Reverse                        bool
}

Query is always constrained by exact context scope in the backend.

type Record 

type Record struct {
	grove.BaseModel `grove:"table:cortex_assurance_records" bson:"-"`
	ID              string `grove:"id" bson:"id"`
	Kind            string `grove:"kind" bson:"kind"`
	ScopeL0         string `grove:"scope_l0" bson:"scope_l0"`
	ScopeL1         string `grove:"scope_l1" bson:"scope_l1"`
	ScopeL2         string `grove:"scope_l2" bson:"scope_l2"`
	ScopeExtra      string `grove:"scope_extra" bson:"-"`
	ScopeCanon      string `grove:"scope_canon" bson:"scope_canon"`
	Digest          string `grove:"digest" bson:"digest"`
	RunID           string `grove:"run_id" bson:"run_id"`
	Body            string `grove:"body" bson:"body"`
	Deleted         bool   `grove:"deleted" bson:"deleted"`
}

Record preserves canonical JSON as text, avoiding database JSON rewrites. The same indexed scope codec is used by every Cortex backend.

type Repository 

type Repository struct {
	// contains filtered or unexported fields
}

Repository implements optional store capabilities without widening Store.

func New 

func New(driver Driver) *Repository

New creates a shared persistence adapter for a backend driver.

func (*Repository) AbandonTaskCompletion 

func (s *Repository) AbandonTaskCompletion(ctx context.Context, request coordination.TaskCompletionAbandonmentRequest) (coordination.TaskCompletionSettlement, error)

AbandonTaskCompletion records authenticated permanent quiescence. The caller must hold the same execution exclusion fence as every delayed reviewer.

func (*Repository) AcceptLesson 

func (s *Repository) AcceptLesson(ctx context.Context, request learning.AcceptRequest) (learning.Publication, error)

AcceptLesson saves the exact verified output and its publication intent in one source-run transaction. Remote services and host authority run outside it.

func (*Repository) AcceptTaskResult 

func (s *Repository) AcceptTaskResult(ctx context.Context, request coordination.TaskAcceptanceRequest) (coordination.TaskAcceptance, error)

AcceptTaskResult validates retained evidence and completes ownership atomically.

func (*Repository) AcknowledgeCoordinationEvent 

func (s *Repository) AcknowledgeCoordinationEvent(ctx context.Context, receipt coordination.Delivery) error

AcknowledgeCoordinationEvent commits a trusted sink's exact authenticated receipt. Unknown delivery outcomes must never call this method.

func (*Repository) AcquireBudgetedTaskClaim 

func (s *Repository) AcquireBudgetedTaskClaim(ctx context.Context, request coordination.BudgetedClaimRequest) (coordination.BudgetedClaim, error)

AcquireBudgetedTaskClaim reserves a task owner and capacity atomically. It never adopts independently created records or returns fresh authority on retry.

func (*Repository) AcquireOrchestrationCoordinator 

func (s *Repository) AcquireOrchestrationCoordinator(ctx context.Context, request orchestration.CoordinatorRequest) (orchestration.CoordinatorClaim, error)

AcquireOrchestrationCoordinator atomically advances ownership and the parent generation under the budget lock. Initial requires generation one and no prior owner; hosts use it only immediately after creating the parent. Recovery of a running parent requires retained expired ownership.

func (*Repository) AcquireTaskClaim 

func (s *Repository) AcquireTaskClaim(ctx context.Context, req coordination.ClaimRequest) (coordination.Claim, error)

AcquireTaskClaim reserves one owner. This is not the readiness-aware scheduler admission API: callers must not dispatch solely because reservation succeeds.

func (*Repository) AdmitEffectContinuation 

func (s *Repository) AdmitEffectContinuation(ctx context.Context, request execution.EffectContinuationRequest) (execution.EffectContinuation, error)

AdmitEffectContinuation serializes a new charged attempt with recovering ownership and the permanently sealed original journal. Host authority is held by EffectExecutor; storage validates bindings and finite conservation rules.

func (*Repository) AdmitPlanReplan 

func (s *Repository) AdmitPlanReplan(ctx context.Context, request coordination.PlanReplanRequest) (coordination.PlanReplanAdmission, error)

AdmitPlanReplan serializes immutable proposal intent with a charged reservation. A lost acknowledgment never returns a fresh permission on a retry.

func (*Repository) AdmitReflection 

func (s *Repository) AdmitReflection(ctx context.Context, request cognitive.ReflectionRequest) (cognitive.ReflectionReceipt, error)

AdmitReflection serializes observations with run changes. All referenced bytes must remain available; host guards additionally authenticate their meaning.

func (*Repository) AdmitResume 

func (s *Repository) AdmitResume(ctx context.Context, input suspension.ResumeAdmissionRequest) (suspension.ResumeAdmission, error)

AdmitResume atomically claims an agent-reply pause and retains its exact input.

func (*Repository) AdmitResumeLeased added in v1.10.0 

func (s *Repository) AdmitResumeLeased(ctx context.Context, input suspension.ResumeAdmissionRequest, lease run.Lease, first *suspension.Progress) (suspension.ResumeAdmission, error)

AdmitResumeLeased is AdmitResume, taking the run's lease and writing its first progress snapshot in the transaction that claims the pause. An admission recorded before is returned as it was, and takes nothing.

func (*Repository) AdoptTaskResult 

func (s *Repository) AdoptTaskResult(ctx context.Context, request coordination.TaskAcceptanceRequest) (coordination.TaskAcceptance, error)

AdoptTaskResult requires authenticated recovery proof in addition to all ordinary acceptance evidence. It never renews ownership or releases capacity.

func (*Repository) AdvanceAssignment 

func (s *Repository) AdvanceAssignment(ctx context.Context, change coordination.AssignmentChange) (coordination.Assignment, error)

AdvanceAssignment appends progress and its audit fields in a single row.

func (*Repository) AppendPublicEvents 

func (s *Repository) AppendPublicEvents(ctx context.Context, request event.AppendRequest) (event.AppendReceipt, error)

AppendPublicEvents appends a checked batch under the same run fence as results.

func (*Repository) AssignmentHistory 

func (s *Repository) AssignmentHistory(ctx context.Context, req coordination.AssignmentHistoryRequest) ([]coordination.Assignment, error)

AssignmentHistory returns a bounded, contiguous page of immutable observations.

func (*Repository) BeginBoundEffect 

func (s *Repository) BeginBoundEffect(ctx context.Context, request execution.EffectRequest) (bool, error)

BeginBoundEffect requires the original tool invocation in the retained request.

func (*Repository) BeginCoordinatedInvocation 

func (s *Repository) BeginCoordinatedInvocation(ctx context.Context, lease orchestration.CoordinatorLease, intent orchestration.InvocationIntent) error

BeginCoordinatedInvocation fences a single-use strategy slot with ownership.

func (*Repository) BeginEffect 

func (s *Repository) BeginEffect(ctx context.Context, request execution.EffectRequest) (bool, error)

BeginEffect grants dispatch only after a confirmed fresh insert. An identical existing row never grants permission, even after a lost insert acknowledgement.

func (*Repository) BeginOrchestrationInvocation 

func (s *Repository) BeginOrchestrationInvocation(ctx context.Context, intent orchestration.InvocationIntent) error

BeginOrchestrationInvocation records single-use intent before reservation. Duplicate writes, including identical retries, never return fresh admission.

func (*Repository) BeginRunCall 

func (s *Repository) BeginRunCall(ctx context.Context, request execution.RunCallRequest) (bool, error)

BeginRunCall grants one dispatch only after a confirmed fresh insert. It preserves unresolved calls indefinitely rather than treating expiry as absence.

func (*Repository) BeginTaskDispatch 

func (s *Repository) BeginTaskDispatch(ctx context.Context, token coordination.ClaimToken, runID id.AgentRunID) (coordination.DispatchAdmission, error)

BeginTaskDispatch retains intent before the host invokes the reserved run.

func (*Repository) BeginVerificationCall 

func (s *Repository) BeginVerificationCall(ctx context.Context, lease verification.JobLease, request verification.CallRequest) (verification.Job, error)

BeginVerificationCall records a dispatch and reserves its allowance together.

func (*Repository) BindOrchestrationInvocation 

func (s *Repository) BindOrchestrationInvocation(ctx context.Context, intent orchestration.InvocationIntent, child id.AgentRunID) error

BindOrchestrationInvocation retains the original reserved child once.

func (*Repository) CancelVerificationJob 

func (s *Repository) CancelVerificationJob(ctx context.Context, jobID id.ID) (verification.Job, error)

CancelVerificationJob revokes unfinished work. It never retracts a commit.

func (*Repository) CaptureCandidate 

func (s *Repository) CaptureCandidate(ctx context.Context, request run.CandidateCapture) (verification.Job, error)

CaptureCandidate finishes generation without putting its text in the run row. Evidence, completion metadata, job and pending status share one transaction.

func (*Repository) CaptureFromIntent 

func (s *Repository) CaptureFromIntent(ctx context.Context, intentID id.ID) (verification.Job, error)

CaptureFromIntent derives candidate identity from the saved output and captures the job atomically. Historical retries never restore deleted bytes.

func (*Repository) CaptureVerificationJob 

func (s *Repository) CaptureVerificationJob(ctx context.Context, request verification.JobRequest) (verification.Job, error)

CaptureVerificationJob captures candidate bytes from the stored run in the same transaction as enqueue. The host authorizes capture before calling it.

func (*Repository) CheckOrchestrationCoordinator 

func (s *Repository) CheckOrchestrationCoordinator(ctx context.Context, lease orchestration.CoordinatorLease) (orchestration.CoordinatorLease, error)

CheckOrchestrationCoordinator verifies an acknowledged lease against current account admission, ownership and the parent generation in one transaction.

func (*Repository) ClaimContinuation added in v1.10.0 

func (s *Repository) ClaimContinuation(ctx context.Context, runID id.AgentRunID, lease run.Lease) (*run.Run, error)

ClaimContinuation moves a ready or reclaimable run to running under lease. Of two concurrent callers, the second reads the running state the first one committed and gets ErrRunNotContinuable. A half lease, an owner with no expiry or an expiry with no owner, is refused with ErrRunLeaseLost, as HoldLease refuses it: the first would never lapse and the second could be held by anyone.

func (*Repository) ClaimContinuationLeased added in v1.10.0 

func (s *Repository) ClaimContinuationLeased(ctx context.Context, runID id.AgentRunID, lease run.Lease, first *suspension.Progress) (*run.Run, error)

ClaimContinuationLeased is ClaimContinuation under a lease that must be set, with the run's first progress snapshot written in the same transaction.

func (*Repository) ClaimLessonPublication 

func (s *Repository) ClaimLessonPublication(ctx context.Context, identifier id.ID, revision int64, owner string) (learning.Publication, error)

ClaimLessonPublication fences one bounded delivery attempt across processes.

func (*Repository) ClaimReadyTask 

func (s *Repository) ClaimReadyTask(ctx context.Context, request coordination.ReadyTaskClaimRequest) (coordination.ReadyTaskClaim, error)

ClaimReadyTask reloads prerequisite evidence and reserves ownership, capacity and event intent under one plan transaction. Host guards must cover current authorization and external revisions; storage performs no external calls.

func (*Repository) ClaimSuspensionLeased added in v1.10.0 

func (s *Repository) ClaimSuspensionLeased(ctx context.Context, claim suspension.LeasedClaim) (*suspension.Suspension, error)

ClaimSuspensionLeased claims a pinned pause and takes the run's lease in one transaction, with the first progress snapshot when one is given. The run is never running without an owner, so a claimer that dies leaves a lease that lapses and a snapshot to continue from.

func (*Repository) ClaimSuspensionVersion 

func (s *Repository) ClaimSuspensionVersion(ctx context.Context, req suspension.ClaimVersion) (*suspension.Suspension, error)

ClaimSuspensionVersion claims only the validated suspension and run revision.

func (*Repository) ClaimVerificationJob 

func (s *Repository) ClaimVerificationJob(ctx context.Context, claim verification.JobClaim) (verification.Job, error)

ClaimVerificationJob acquires a new generation or recovers the same claim ack.

func (*Repository) CloseOrchestrationBudget 

func (s *Repository) CloseOrchestrationBudget(ctx context.Context, key id.OrchestrationID) error

CloseOrchestrationBudget permanently seals new admission without refunding unsettled reservations. Recreating an identical policy does not reopen it.

func (*Repository) CloseResume 

func (s *Repository) CloseResume(ctx context.Context, request suspension.ResumeClosureRequest) (suspension.ResumeClosure, error)

CloseResume records incomplete termination after host-authenticated quiescence. This low-level store method does not authenticate host proof. Use ResumeCloser for current authorization and fencing. No private result is accepted here.

func (*Repository) CloseTaskUsage 

func (s *Repository) CloseTaskUsage(ctx context.Context, request coordination.TaskUsageClosureRequest) (coordination.TaskUsageClosure, error)

CloseTaskUsage closes local verification admission after task acceptance or explicit termination or rejection, with terminal verifier jobs. Its caller must hold current host authority. Closure preserves unknown usage and does not prove external quiescence or refund funds.

func (*Repository) CommitPlanReplan 

func (s *Repository) CommitPlanReplan(ctx context.Context, control coordination.PlanReplanControl) (planning.Plan, error)

CommitPlanReplan appends a validated proposal only after every dispatched ownership incarnation is permanently quiescent and its journal and accounting agree. It retains previous claims, artifacts, results and effect debt.

func (*Repository) CommitReservedReply 

func (s *Repository) CommitReservedReply(ctx context.Context, input *a2a.Delivery, content string, success bool) (a2a.ReservedReply, error)

CommitReservedReply closes a bound delivery and queues its reply in one commit.

func (*Repository) CommitRevision 

func (s *Repository) CommitRevision(ctx context.Context, proposal planning.Revision, expected int64) (planning.Plan, error)

CommitRevision appends a successor while holding the same plan lock as assignment observations. Identical historical retries preserve their revision.

func (*Repository) CommitTerminalRun 

func (s *Repository) CommitTerminalRun(ctx context.Context, request event.TerminalUpdate) (event.TerminalReceipt, error)

CommitTerminalRun commits an unchecked terminal snapshot and metadata together.

func (*Repository) CommitVerifiedResult 

func (s *Repository) CommitVerifiedResult(ctx context.Context, request verification.CommitRequest) (verification.CommitReceipt, error)

CommitVerifiedResult atomically saves a checked result, its outbox and run revision.

func (*Repository) CompleteEffect 

func (s *Repository) CompleteEffect(ctx context.Context, request execution.EffectRequest, receipt execution.EffectReceipt) error

CompleteEffect appends terminal knowledge without replacing either history row. Conflicting external outcomes require separate host adjudication.

func (*Repository) CompleteEffectContinuation 

func (s *Repository) CompleteEffectContinuation(ctx context.Context, request execution.EffectContinuationRequest, receipt execution.EffectReceipt) (execution.EffectContinuationResult, error)

CompleteEffectContinuation records a new private observation and settles only its independent allowance. It never changes the original effect or task result.

func (*Repository) CompleteLessonPublication 

func (s *Repository) CompleteLessonPublication(ctx context.Context, claim learning.Publication, receipt *learning.Receipt, code string) error

CompleteLessonPublication records a delivery receipt or bounded retry status. A lost response leaves the original aggregate identity unchanged.

func (*Repository) CompleteRunCall 

func (s *Repository) CompleteRunCall(ctx context.Context, request execution.RunCallRequest, completion execution.RunCallCompletion) error

CompleteRunCall records a normal local return. It neither resolves effects nor refunds shared capacity. Conflicting return observations are retained as an error rather than silently replacing the first completion.

func (*Repository) CompleteVerificationCall 

func (s *Repository) CompleteVerificationCall(ctx context.Context, lease verification.JobLease, result verification.CallResult) (verification.Job, error)

CompleteVerificationCall saves usage, report and job progress atomically.

func (*Repository) CreateCaptureIntent 

func (s *Repository) CreateCaptureIntent(ctx context.Context, intent verification.CaptureIntent) error

CreateCaptureIntent registers policy against a pristine saved running run. The host must call it before any provider or tool dispatch; zero counters alone cannot prove that an external operation has not already happened.

func (*Repository) CreateContract 

func (s *Repository) CreateContract(ctx context.Context, c verification.Contract) error

CreateContract persists a sealed contract with immutable scope and identity.

func (*Repository) CreateOrchestrationBudget 

func (s *Repository) CreateOrchestrationBudget(ctx context.Context, policy orchestration.BudgetPolicy) error

CreateOrchestrationBudget retains immutable bounds without creating a plan.

func (*Repository) CreatePlan 

func (s *Repository) CreatePlan(ctx context.Context, p planning.Plan) error

CreatePlan persists revision one. Identical retries preserve its identity.

func (*Repository) CreateReservationPolicy 

func (s *Repository) CreateReservationPolicy(ctx context.Context, policy execution.ReservationPolicy) error

CreateReservationPolicy fixes a shared account without resetting on replans.

func (*Repository) CreateTaskRun 

func (s *Repository) CreateTaskRun(ctx context.Context, request coordination.TaskRunRequest) (coordination.TaskRunStart, error)

CreateTaskRun creates the reserved child and capture policy under live claim, parent, assignment and prerequisite fences. Hosts supply current authorization and external revision guards. This operation performs no external execution.

func (*Repository) DeleteLesson 

func (s *Repository) DeleteLesson(ctx context.Context, request learning.DeletionRequest) (learning.Tombstone, error)

DeleteLesson atomically erases lesson and outbox bodies and reserves its ID. A repeated matching request returns its original content-free audit record.

func (*Repository) DispatchReadyTask 

func (s *Repository) DispatchReadyTask(ctx context.Context, request coordination.TaskDispatchRequest) (coordination.TaskDispatch, error)

DispatchReadyTask checks current retained readiness, ownership, assignment and parent state before committing intent. The caller must hold current host grant and external revision guards. No transaction invokes the agent runtime.

func (*Repository) EnqueueVerificationJob 

func (s *Repository) EnqueueVerificationJob(ctx context.Context, request verification.JobRequest) (verification.Job, error)

EnqueueVerificationJob saves the job, revision binding and pending run together.

func (*Repository) ExpireOrchestrationBudget 

func (s *Repository) ExpireOrchestrationBudget(ctx context.Context, key id.OrchestrationID) (bool, error)

ExpireOrchestrationBudget checks the immutable deadline under the same account transaction as reservation admission. Expiry never releases retained charges.

func (*Repository) ExpireResumeAdmission 

func (s *Repository) ExpireResumeAdmission(ctx context.Context, runID id.AgentRunID, key id.SuspensionID, digest string) (suspension.ResumeExpiry, error)

ExpireResumeAdmission atomically ends only an expired, never-started admission.

func (*Repository) ExpireTaskClaim 

func (s *Repository) ExpireTaskClaim(ctx context.Context, planID, taskID id.ID, expected int64) (coordination.Claim, error)

ExpireTaskClaim releases an unused reservation or marks dispatch for recovery.

func (*Repository) ExpireVerificationJob 

func (s *Repository) ExpireVerificationJob(ctx context.Context, jobID id.ID) (verification.Job, error)

ExpireVerificationJob ends overdue or exhausted work without claiming it.

func (*Repository) FinishOrchestrationCoordinator 

func (s *Repository) FinishOrchestrationCoordinator(ctx context.Context, lease orchestration.CoordinatorLease, parent *orchestration.Run) error

FinishOrchestrationCoordinator atomically releases a waiting pass or saves a terminal parent and closes its account. A stale owner can do neither.

func (*Repository) GetAskResolution 

func (s *Repository) GetAskResolution(ctx context.Context, token string) (a2a.AskResolution, error)

GetAskResolution returns retained evidence, never authority to resume again.

func (*Repository) GetAssignment 

func (s *Repository) GetAssignment(ctx context.Context, identifier id.ID) (coordination.Assignment, error)

GetAssignment returns the latest committed observation at the exact scope.

func (*Repository) GetAssignmentReview 

func (s *Repository) GetAssignmentReview(ctx context.Context, identifier id.ID) (coordination.Review, error)

GetAssignmentReview reads a retained observation without reauthorizing bytes.

func (*Repository) GetBudgetSnapshot 

func (s *Repository) GetBudgetSnapshot(ctx context.Context, planID id.ID) (execution.BudgetSnapshot, error)

GetBudgetSnapshot serializes aggregate reads with every reservation/settlement. Its policy reflects current plan narrowing; GetReservationPolicy is immutable.

func (*Repository) GetBudgetedTaskClaim 

func (s *Repository) GetBudgetedTaskClaim(ctx context.Context, claimID id.ID) (coordination.BudgetedClaim, error)

GetBudgetedTaskClaim returns the retained acquisition for recovery. Fresh is always false; callers read current claims and reservations before new work.

func (*Repository) GetCaptureIntent 

func (s *Repository) GetCaptureIntent(ctx context.Context, intentID id.ID) (verification.CaptureIntent, error)

GetCaptureIntent returns immutable, exact-scope host policy.

func (*Repository) GetCommittedResult 

func (s *Repository) GetCommittedResult(ctx context.Context, resultID id.ID) (verification.CommitReceipt, error)

GetCommittedResult reads an exact-scope historical receipt, not a fresh verdict.

func (*Repository) GetContract 

func (s *Repository) GetContract(ctx context.Context, identifier id.ID) (verification.Contract, error)

GetContract reads a contract only at the exact caller scope.

func (*Repository) GetCoordinationDelivery 

func (s *Repository) GetCoordinationDelivery(ctx context.Context, e coordination.Event, sink string) (*coordination.Delivery, error)

GetCoordinationDelivery returns the immutable receipt for an exact sink/event.

func (*Repository) GetEffect 

func (s *Repository) GetEffect(ctx context.Context, key string) (execution.EffectRecord, error)

GetEffect reads the retained request and terminal receipt at exact scope.

func (*Repository) GetEffectContinuationResult 

func (s *Repository) GetEffectContinuationResult(ctx context.Context, request execution.EffectContinuationRequest) (*execution.EffectContinuationResult, error)

GetEffectContinuationResult returns nil for an unresolved retained attempt.

func (*Repository) GetEvidenceTombstone 

func (s *Repository) GetEvidenceTombstone(ctx context.Context, ref evidence.Ref) (evidence.Tombstone, error)

GetEvidenceTombstone reads audit metadata under exact scope. The caller must independently enforce audit permissions; it never returns removed bytes.

func (*Repository) GetHeldAskRelease 

func (s *Repository) GetHeldAskRelease(ctx context.Context, token string) (a2a.HeldAskReceipt, error)

GetHeldAskRelease reads exact-scope queue identities, never dispatch authority.

func (*Repository) GetLesson 

func (s *Repository) GetLesson(ctx context.Context, identifier id.ID) (learning.Lesson, error)

GetLesson returns the latest stored revision, including withdrawal metadata.

func (*Repository) GetLessonPublication 

func (s *Repository) GetLessonPublication(ctx context.Context, identifier id.ID, revision int64) (learning.Publication, error)

GetLessonPublication reads one accepted payload with its latest delivery state.

func (*Repository) GetLessonTombstone 

func (s *Repository) GetLessonTombstone(ctx context.Context, identifier id.ID) (learning.Tombstone, error)

GetLessonTombstone reads the content-free deletion audit under exact scope.

func (*Repository) GetOrchestrationBudget 

func (s *Repository) GetOrchestrationBudget(ctx context.Context, key id.OrchestrationID) (orchestration.BudgetPolicy, error)

GetOrchestrationBudget returns the immutable policy at the exact scope.

func (*Repository) GetOrchestrationBudgetSnapshot 

func (s *Repository) GetOrchestrationBudgetSnapshot(ctx context.Context, key id.OrchestrationID) (orchestration.BudgetSnapshot, error)

GetOrchestrationBudgetSnapshot serializes charges with admission and settlement.

func (*Repository) GetOrchestrationContinuation 

func (s *Repository) GetOrchestrationContinuation(ctx context.Context, team id.OrchestrationID) (orchestration.Continuation, error)

GetOrchestrationContinuation reads the frozen strategy at the exact scope.

func (*Repository) GetOrchestrationCoordinator 

func (s *Repository) GetOrchestrationCoordinator(ctx context.Context, team id.OrchestrationID) (orchestration.CoordinatorLease, error)

GetOrchestrationCoordinator returns retained ownership evidence, not a claim.

func (*Repository) GetOrchestrationInvocation 

func (s *Repository) GetOrchestrationInvocation(ctx context.Context, team id.OrchestrationID, slot string) (orchestration.InvocationRecord, error)

GetOrchestrationInvocation reads retained identity for reconciliation only.

func (*Repository) GetOrchestrationInvocationResult 

func (s *Repository) GetOrchestrationInvocationResult(ctx context.Context, intent orchestration.InvocationIntent) (*orchestration.AgentResult, error)

GetOrchestrationInvocationResult returns nil until a completed result is saved.

func (*Repository) GetPlan 

func (s *Repository) GetPlan(ctx context.Context, identifier id.ID) (planning.Plan, error)

GetPlan reads the highest committed revision, including revision one.

func (*Repository) GetPlanReplan 

func (s *Repository) GetPlanReplan(ctx context.Context, key id.ID) (*coordination.PlanReplanAdmission, error)

GetPlanReplan returns nil for an absent attempt, never fresh dispatch permission.

func (*Repository) GetPlanReplanCommit 

func (s *Repository) GetPlanReplanCommit(ctx context.Context, key id.ID) (*planning.Plan, error)

GetPlanReplanCommit reads an acknowledged historical graph transition.

func (*Repository) GetPlanReplanOutcome 

func (s *Repository) GetPlanReplanOutcome(ctx context.Context, key id.ID) (*coordination.PlanReplanOutcome, error)

GetPlanReplanOutcome returns immutable observed disposition and accounting.

func (*Repository) GetPlanRevision 

func (s *Repository) GetPlanRevision(ctx context.Context, identifier id.ID, revision int64) (planning.Plan, error)

GetPlanRevision reads one immutable revision at the exact caller scope.

func (*Repository) GetProviderCallReceipt 

func (s *Repository) GetProviderCallReceipt(ctx context.Context, request execution.RunCallRequest) (*execution.ProviderCallReceipt, error)

GetProviderCallReceipt returns immutable proof, or nil for an unresolved call. It preserves contradictory local evidence for the recovery guard to reject.

func (*Repository) GetReadyTaskClaim 

func (s *Repository) GetReadyTaskClaim(ctx context.Context, claimID id.ID) (coordination.ReadyTaskClaim, error)

GetReadyTaskClaim returns a historical admission for recovery and event discovery. Fresh is false, including after a lost commit acknowledgment.

func (*Repository) GetReflection 

func (s *Repository) GetReflection(ctx context.Context, runID id.AgentRunID) (*cognitive.ReflectionReceipt, error)

GetReflection returns the latest immutable transition, never dispatch permission.

func (*Repository) GetReport 

func (s *Repository) GetReport(ctx context.Context, identifier id.ID) (verification.Report, error)

GetReport reads a report at the exact caller scope, including historical ones.

func (*Repository) GetReservation 

func (s *Repository) GetReservation(ctx context.Context, identifier id.ID) (execution.Reservation, error)

GetReservation returns allocation plus its optional final accounting receipt.

func (*Repository) GetReservationPolicy 

func (s *Repository) GetReservationPolicy(ctx context.Context, planID id.ID) (execution.ReservationPolicy, error)

GetReservationPolicy reads the immutable policy, before current plan narrowing.

func (*Repository) GetReservedReply 

func (s *Repository) GetReservedReply(ctx context.Context, key id.DeliveryID) (a2a.ReservedReply, error)

GetReservedReply returns a committed reply observation, never dispatch rights.

func (*Repository) GetResumeAdmission 

func (s *Repository) GetResumeAdmission(ctx context.Context, runID id.AgentRunID, key id.SuspensionID) (suspension.ResumeAdmission, error)

GetResumeAdmission reads immutable input and never grants execution authority.

func (*Repository) GetResumeClosure 

func (s *Repository) GetResumeClosure(ctx context.Context, runID id.AgentRunID, pauseID id.SuspensionID) (suspension.ResumeClosure, error)

GetResumeClosure returns retained incomplete closure evidence in exact scope.

func (*Repository) GetResumeExpiry 

func (s *Repository) GetResumeExpiry(ctx context.Context, runID id.AgentRunID, key id.SuspensionID) (suspension.ResumeExpiry, error)

GetResumeExpiry reads an immutable terminal decision without granting replay.

func (*Repository) GetResumeStart 

func (s *Repository) GetResumeStart(ctx context.Context, runID id.AgentRunID, key id.SuspensionID) (suspension.ResumeStart, error)

GetResumeStart observes a possible execution start. It cannot authorize replay.

func (*Repository) GetRunCall 

func (s *Repository) GetRunCall(ctx context.Context, runID id.AgentRunID, operationDigest string) (execution.RunCallRecord, error)

GetRunCall retrieves the original invocation and any immutable local return.

func (*Repository) GetRunCallSeal 

func (s *Repository) GetRunCallSeal(ctx context.Context, runID id.AgentRunID) (*execution.RunCallSeal, error)

GetRunCallSeal returns a permanent barrier or nil when membership is still open.

func (*Repository) GetRunCaptureIntent 

func (s *Repository) GetRunCaptureIntent(ctx context.Context, runID id.AgentRunID) (verification.CaptureIntent, error)

GetRunCaptureIntent discovers the stable capture identity after a restart.

func (*Repository) GetTaskAcceptance 

func (s *Repository) GetTaskAcceptance(ctx context.Context, identifier id.ID) (coordination.TaskAcceptance, error)

GetTaskAcceptance returns a historical transition, not fresh access permission.

func (*Repository) GetTaskAdjudication 

func (s *Repository) GetTaskAdjudication(ctx context.Context, identifier id.ID) (coordination.TaskAdjudication, error)

GetTaskAdjudication reads a historical decision under exact caller scope.

func (*Repository) GetTaskClaim 

func (s *Repository) GetTaskClaim(ctx context.Context, planID, taskID id.ID) (coordination.Claim, error)

GetTaskClaim returns the latest ownership observation, even after replanning.

func (*Repository) GetTaskCompletion 

func (s *Repository) GetTaskCompletion(ctx context.Context, assignmentID id.ID) (*coordination.TaskCompletion, error)

GetTaskCompletion returns the original reserved review, or nil if absent.

func (*Repository) GetTaskCompletionSettlement 

func (s *Repository) GetTaskCompletionSettlement(ctx context.Context, assignmentID id.ID) (*coordination.TaskCompletionSettlement, error)

GetTaskCompletionSettlement reads a retained terminal accounting observation.

func (*Repository) GetTaskDispatch 

func (s *Repository) GetTaskDispatch(ctx context.Context, claimID id.ID) (coordination.TaskDispatch, error)

GetTaskDispatch returns the original historical intent for recovery, never permission to invoke the reserved child or repeat external effects.

func (*Repository) GetTaskRetirement 

func (s *Repository) GetTaskRetirement(ctx context.Context, claimID id.ID) (*coordination.TaskRetirement, error)

GetTaskRetirement reads an immutable receipt for the original claim identity.

func (*Repository) GetTaskRunStart 

func (s *Repository) GetTaskRunStart(ctx context.Context, claimID id.ID) (coordination.TaskRunStart, error)

GetTaskRunStart reads the original creation metadata, never execution permission or the child's latest state. Read the current run for recovery.

func (*Repository) GetTaskUsageClosure 

func (s *Repository) GetTaskUsageClosure(ctx context.Context, runID id.AgentRunID) (*coordination.TaskUsageClosure, error)

GetTaskUsageClosure reads historical closure, without granting access or funds.

func (*Repository) GetTaskUsageSettlement 

func (s *Repository) GetTaskUsageSettlement(ctx context.Context, runID id.AgentRunID) (*coordination.TaskUsageSettlement, error)

GetTaskUsageSettlement reads historical accounting without granting authority.

func (*Repository) GetVerificationJob 

func (s *Repository) GetVerificationJob(ctx context.Context, jobID id.ID) (verification.Job, error)

GetVerificationJob returns one exact-scope durable work record.

func (*Repository) ImportCoordinationEvents 

func (s *Repository) ImportCoordinationEvents(ctx context.Context, req coordination.EventImport) (coordination.EventImportPage, error)

ImportCoordinationEvents materializes existing immutable source intents under the plan lock. Replaying a source page cannot change event identity or order. History cursors traverse superseded claims without scanning another plan.

func (*Repository) LatestResumeAdmission 

func (s *Repository) LatestResumeAdmission(ctx context.Context, runID id.AgentRunID) (suspension.ResumeAdmission, error)

LatestResumeAdmission reads the most recent retained pause identity for a run.

func (*Repository) ListAcceptedTaskClaims 

func (s *Repository) ListAcceptedTaskClaims(ctx context.Context, request coordination.TaskAcceptanceListRequest) ([]coordination.Claim, error)

ListAcceptedTaskClaims preserves accounting discovery after ownership changes. Pagination follows acceptance IDs, so successive revisions of one task each occupy their own position. No returned claim authorizes execution or settlement.

func (*Repository) ListAskResolutions 

func (s *Repository) ListAskResolutions(ctx context.Context, after string, limit int) (a2a.AskResolutionPage, error)

ListAskResolutions pages immutable outcomes within one exact scope and partition.

func (*Repository) ListAssignmentReviews 

func (s *Repository) ListAssignmentReviews(ctx context.Context, req coordination.ReviewListRequest) ([]coordination.Review, error)

ListAssignmentReviews preserves every contradiction instead of voting on it.

func (*Repository) ListAssignments 

func (s *Repository) ListAssignments(ctx context.Context, req coordination.AssignmentListRequest) ([]coordination.Assignment, error)

ListAssignments pages plan assignments. Each current observation may advance independently during this non-snapshot read.

func (*Repository) ListCoordinationEvents 

func (s *Repository) ListCoordinationEvents(ctx context.Context, req coordination.EventPage) ([]coordination.Event, error)

ListCoordinationEvents reads a finite private metadata page in index order.

func (*Repository) ListEffectContinuations 

func (s *Repository) ListEffectContinuations(ctx context.Context, original execution.EffectRequest) ([]execution.EffectContinuation, error)

ListEffectContinuations reads the finite sequence without granting dispatch.

func (*Repository) ListEffects 

func (s *Repository) ListEffects(ctx context.Context, req execution.EffectListRequest) ([]execution.EffectRecord, error)

ListEffects returns a bounded page including both pending and terminal records. Repeated scans are required: concurrent inserts can sort before the cursor.

func (*Repository) ListLessonPublications 

func (s *Repository) ListLessonPublications(ctx context.Context, after string, limit int) (learning.PublicationPage, error)

ListLessonPublications scans a bounded durable page; callers choose eligible work.

func (*Repository) ListLessonTombstones 

func (s *Repository) ListLessonTombstones(ctx context.Context, after string, limit int) (learning.TombstonePage, error)

ListLessonTombstones supplies durable restartable destination cleanup work.

func (*Repository) ListOrchestrationBudgets 

func (s *Repository) ListOrchestrationBudgets(ctx context.Context, req orchestration.BudgetListRequest) ([]orchestration.BudgetPolicy, error)

ListOrchestrationBudgets returns immutable policies, including closed accounts, at the caller's exact scope. Pagination advances by retained account identity.

func (*Repository) ListOrchestrationReservations 

func (s *Repository) ListOrchestrationReservations(ctx context.Context, req execution.ReservationListRequest) ([]execution.Reservation, error)

ListOrchestrationReservations provides bounded recovery discovery for one team.

func (*Repository) ListPlanReplans 

func (s *Repository) ListPlanReplans(ctx context.Context, planID id.ID) ([]coordination.PlanReplanAdmission, error)

ListPlanReplans returns the bounded lifetime attempt history in exact scope.

func (*Repository) ListPlans 

func (s *Repository) ListPlans(ctx context.Context, req planning.ListRequest) ([]planning.Plan, error)

ListPlans pages stable plan identities and returns each current revision. Concurrent commits may advance individual plans during this non-snapshot list.

func (*Repository) ListReflections 

func (s *Repository) ListReflections(ctx context.Context, runID id.AgentRunID, after int64, limit int) (cognitive.ReflectionPage, error)

ListReflections reads immutable decisions without granting execution authority.

func (*Repository) ListReports 

func (s *Repository) ListReports(ctx context.Context, req verification.ListRequest) ([]verification.Report, error)

ListReports returns bounded report history for one scoped run.

func (*Repository) ListReservations 

func (s *Repository) ListReservations(ctx context.Context, req execution.ReservationListRequest) ([]execution.Reservation, error)

ListReservations is bounded discovery, not a transactional accounting view.

func (*Repository) ListResumeAdmissions 

func (s *Repository) ListResumeAdmissions(ctx context.Context, after string, limit int) (suspension.ResumeAdmissionPage, error)

ListResumeAdmissions pages exact-scope history, including already started work.

func (*Repository) ListRunCalls 

func (s *Repository) ListRunCalls(ctx context.Context, request execution.RunCallListRequest) ([]execution.RunCallRecord, error)

ListRunCalls returns a bounded exact-scope page, including unresolved calls.

func (*Repository) ListTaskAcceptances 

func (s *Repository) ListTaskAcceptances(ctx context.Context, req coordination.TaskAcceptanceListRequest) ([]coordination.TaskAcceptance, error)

ListTaskAcceptances supports bounded recovery and metadata outbox discovery.

func (*Repository) ListTaskClaims 

func (s *Repository) ListTaskClaims(ctx context.Context, req coordination.ClaimListRequest) ([]coordination.Claim, error)

ListTaskClaims includes removed tasks so their dispatches remain recoverable.

func (*Repository) ListVerificationJobs 

func (s *Repository) ListVerificationJobs(ctx context.Context, req verification.JobListRequest) ([]verification.Job, error)

ListVerificationJobs pages work records without granting cross-scope discovery.

func (*Repository) LoadEvidence 

func (s *Repository) LoadEvidence(ctx context.Context, ref evidence.Ref) (evidence.Artifact, error)

LoadEvidence validates persisted metadata and bytes on every read.

func (*Repository) LockRunRecoverySnapshot 

func (s *Repository) LockRunRecoverySnapshot(ctx context.Context, seal execution.RunCallSeal, expected string) (execution.RunRecoverySnapshot, error)

LockRunRecoverySnapshot compares complete evidence while joining the caller's active transaction. It is an internal storage primitive, not an adoption API. The caller must already hold the plan guard, bound the outer transaction and authenticate proof. Locks survive this read until the outer commit or rollback. A returned snapshot is provisional until that outer commit is acknowledged.

func (*Repository) MarkReady added in v1.10.0 

func (s *Repository) MarkReady(ctx context.Context, runID id.AgentRunID, ready run.Readiness) (*run.Run, error)

MarkReady moves a paused run whose suspension has not expired to ready. The run and its suspension are locked together, so an approval cannot slip past a deadline the sweeper is acting on, and two approvals cannot both succeed: the second one reads a run that is no longer paused.

func (*Repository) MarkReclaimable added in v1.10.0 

func (s *Repository) MarkReclaimable(ctx context.Context, runID id.AgentRunID, now time.Time, owner string) (*run.Run, error)

MarkReclaimable takes a running run away from its worker. The sweeper passes no owner and may only take a lease that has lapsed; a worker handing its own run off passes its owner name.

func (*Repository) ObservePlanReplan 

func (s *Repository) ObservePlanReplan(ctx context.Context, control coordination.PlanReplanControl) (*coordination.PlanReplanOutcome, error)

ObservePlanReplan reads the exact retained runtime under its write lock. A missing, running or paused run stays pending unless permanent abandonment is authenticated by the caller. Model JSON is bounded and strictly decoded.

func (*Repository) ProposeAssignment 

func (s *Repository) ProposeAssignment(ctx context.Context, h coordination.Handoff) (coordination.Assignment, error)

ProposeAssignment retains a plan-bound proposal, without accepting its grants.

func (*Repository) PrunePublicEvents 

func (s *Repository) PrunePublicEvents(ctx context.Context, through event.Cursor) error

PrunePublicEvents drops retained envelopes through a cursor. ID/digest tombstones remain so a delayed retry cannot recreate a pruned event or reuse its identity.

func (*Repository) PutOrchestrationContinuation 

func (s *Repository) PutOrchestrationContinuation(ctx context.Context, c orchestration.Continuation) error

PutOrchestrationContinuation retains the original private execution snapshot.

func (*Repository) PutOrchestrationInvocationResult 

func (s *Repository) PutOrchestrationInvocationResult(ctx context.Context, intent orchestration.InvocationIntent, result orchestration.AgentResult) error

PutOrchestrationInvocationResult retains one completed result for strategy replay.

func (*Repository) PutProviderCallReceipt 

func (s *Repository) PutProviderCallReceipt(ctx context.Context, request execution.RunCallRequest, receipt execution.ProviderCallReceipt) error

PutProviderCallReceipt retains authenticated proof without changing a local return or reservation. The caller owns authentication and the authority fence.

func (*Repository) ReadArtifactBoard 

func (s *Repository) ReadArtifactBoard(ctx context.Context, request coordination.ArtifactBoardRead) ([]coordination.ArtifactBoardEntry, error)

ReadArtifactBoard reads exact resource history. Callers authenticate current metadata access; these immutable references never authorize content export.

func (*Repository) ReadCurrentTaskAcceptance 

func (s *Repository) ReadCurrentTaskAcceptance(ctx context.Context, request coordination.CurrentTaskAcceptanceRequest) (coordination.CurrentTaskAcceptance, error)

ReadCurrentTaskAcceptance rechecks current stored evidence without mutating ownership, settling usage or generating a new acceptance acknowledgment.

func (*Repository) ReadEventWatermark 

func (s *Repository) ReadEventWatermark(ctx context.Context, runID id.AgentRunID) (event.Watermark, error)

ReadEventWatermark identifies the current run snapshot and retained sequence range.

func (*Repository) ReadPendingAsk 

func (s *Repository) ReadPendingAsk(ctx context.Context, token string) (*a2a.PendingAsk, error)

ReadPendingAsk reads the retained ask, including an already claimed ask.

func (*Repository) ReadPublicEvents 

func (s *Repository) ReadPublicEvents(ctx context.Context, request event.ReadRequest) (event.Page, error)

ReadPublicEvents returns one consistent retained page. It does not authorize a subscriber.

func (*Repository) ReadResultSnapshot 

func (s *Repository) ReadResultSnapshot(ctx context.Context, request verification.ResultReadRequest) (verification.ResultSnapshot, error)

ReadResultSnapshot reads current result material under the backend's run fence. It supplies no public authorization and never updates lifecycle state or events.

func (*Repository) ReadTasks 

func (s *Repository) ReadTasks(ctx context.Context, identifier id.ID) ([]planning.Task, error)

ReadTasks returns current definitions, detached from persisted records.

func (*Repository) RecordAssignmentReview 

func (s *Repository) RecordAssignmentReview(ctx context.Context, r coordination.Review) (coordination.Review, error)

RecordAssignmentReview validates retained producer/reviewer execution under the plan fence. It never changes either run or the producer assignment state. Hosts must authenticate reviewers and enforce current scheduler/grant policy.

func (*Repository) RecordMessage 

func (s *Repository) RecordMessage(ctx context.Context, input *a2a.Envelope) (*a2a.Envelope, error)

RecordMessage records an immutable envelope and hop admission atomically.

func (*Repository) RecordTaskAdjudication 

func (s *Repository) RecordTaskAdjudication(ctx context.Context, request coordination.TaskAdjudicationRequest) (coordination.TaskAdjudication, error)

RecordTaskAdjudication derives policy from retained independent execution. Current host authority must surround this call, including historical retries.

func (*Repository) ReleaseHeldAsk 

func (s *Repository) ReleaseHeldAsk(ctx context.Context, req a2a.HeldAskRequest) (a2a.HeldAskReceipt, error)

ReleaseHeldAsk commits one question's queue and receipt under its run lock.

func (*Repository) RenewOrchestrationCoordinator 

func (s *Repository) RenewOrchestrationCoordinator(ctx context.Context, lease orchestration.CoordinatorLease, duration time.Duration) (orchestration.CoordinatorLease, error)

RenewOrchestrationCoordinator retains a new immutable revision without extending the team's immutable deadline or reviving an expired acknowledgment.

func (*Repository) RenewTaskClaim 

func (s *Repository) RenewTaskClaim(ctx context.Context, token coordination.ClaimToken, duration time.Duration) (coordination.Claim, error)

RenewTaskClaim extends only the current live token on the current plan.

func (*Repository) RenewTaskExecution 

func (s *Repository) RenewTaskExecution(ctx context.Context, request coordination.TaskRenewalRequest) (coordination.TaskRenewal, error)

RenewTaskExecution extends ownership only while its retained execution chain remains eligible. The plan transaction fences claims, assignment, parent, child, prerequisites and shared budget. No lock spans an external invocation.

func (*Repository) RenewVerificationJob 

func (s *Repository) RenewVerificationJob(ctx context.Context, lease verification.JobLease, duration time.Duration) (verification.Job, error)

RenewVerificationJob extends a live lease without changing its generation.

func (*Repository) Reserve 

func (s *Repository) Reserve(ctx context.Context, request execution.ReservationRequest) (execution.Reservation, error)

Reserve admits capacity under the plan lock before any worker dispatch.

func (*Repository) ReserveCoordinatedChild 

func (s *Repository) ReserveCoordinatedChild(ctx context.Context, lease orchestration.CoordinatorLease, request execution.ReservationRequest) (execution.Reservation, error)

ReserveCoordinatedChild atomically charges and links one child while ownership is current. A retained reservation is evidence, never another dispatch grant.

func (*Repository) ReserveOrchestrationChild 

func (s *Repository) ReserveOrchestrationChild(ctx context.Context, request execution.ReservationRequest) (execution.Reservation, error)

ReserveOrchestrationChild atomically admits one bounded participant invocation. Identical retries return retained accounting, including after admission closes.

func (*Repository) ReserveTaskCompletion 

func (s *Repository) ReserveTaskCompletion(ctx context.Context, request coordination.TaskCompletionRequest) (coordination.TaskCompletion, error)

ReserveTaskCompletion atomically binds reviewer identity, progress and shared allocation. A retry never returns fresh permission, even after a lost reply.

func (*Repository) ResolveLesson 

func (s *Repository) ResolveLesson(ctx context.Context, ref learning.Ref) (learning.Lesson, error)

ResolveLesson rechecks local withdrawal and current saved source evidence. The host still must authorize content and fence external source revisions.

func (*Repository) RetireTaskClaim 

func (s *Repository) RetireTaskClaim(ctx context.Context, request coordination.TaskRetirementRequest) (coordination.TaskRetirement, error)

RetireTaskClaim atomically checks closed unsuccessful work and its final accounting, then preserves the retired claim and receipt. Its caller must authenticate Recovery and fence permanent external quiescence throughout.

func (*Repository) RetryLessonPublication 

func (s *Repository) RetryLessonPublication(ctx context.Context, identifier id.ID, revision, generation int64) error

RetryLessonPublication starts another bounded cycle at the expected generation. The host must authorize this operator action before calling trusted storage.

func (*Repository) RevokeLesson 

func (s *Repository) RevokeLesson(ctx context.Context, request learning.RevokeRequest) (learning.Publication, error)

RevokeLesson withdraws local eligibility before remote delivery. Source expiry or loss cannot prevent withdrawal, and retries keep the same outbox identity.

func (*Repository) SaveEvidence 

func (s *Repository) SaveEvidence(ctx context.Context, a evidence.Artifact) error

SaveEvidence persists bounded, immutable content. The host must separately authorize sensitivity and source access through evidence.Repository.

func (*Repository) SaveProgress added in v1.10.0 

func (s *Repository) SaveProgress(ctx context.Context, p *suspension.Progress) error

SaveProgress writes a running run's snapshot for the worker that holds its lease. The run's state and lease owner are read under the run lock, in the same transaction as the write, so a worker whose run was handed off, reclaimed or finished cannot land one more snapshot after it lost the run: the write either commits before the change that took the run, or it reads that change and is refused.

func (*Repository) SaveReport 

func (s *Repository) SaveReport(ctx context.Context, r verification.Report) error

SaveReport validates the persisted contract before accepting an immutable report. Contracts cannot change, so this read needs no update transaction.

func (*Repository) SaveVerificationJobReport 

func (s *Repository) SaveVerificationJobReport(ctx context.Context, lease verification.JobLease, report verification.Report) (verification.Job, error)

SaveVerificationJobReport atomically records a leased worker's report and progress. Accepted criteria cannot be overwritten by a more favorable retry.

func (*Repository) SealAskResolution 

func (s *Repository) SealAskResolution(ctx context.Context, input *a2a.PendingAsk, reply a2a.AskReply) (a2a.AskResolution, error)

SealAskResolution preserves the exact selected payload with the ask claim.

func (*Repository) SealRunCalls 

func (s *Repository) SealRunCalls(ctx context.Context, request execution.RunCallSealRequest) (execution.RunCallSeal, error)

SealRunCalls permanently closes admission while retaining late observations. The caller must hold current host authority through this transaction.

func (*Repository) SealTaskCalls 

func (s *Repository) SealTaskCalls(ctx context.Context, request coordination.TaskCallSealRequest) (execution.RunCallSeal, error)

SealTaskCalls closes ordinary accepted task admission under the plan, run and journal guards. The caller must hold current host authority through commit. Already admitted calls may still finish; no billing or quiescence is inferred.

func (*Repository) Settle 

func (s *Repository) Settle(ctx context.Context, settlement execution.Settlement) error

Settle retains final usage once. It remains available after expiry or replan so unknown work is not refunded and late provider overruns can be accounted for.

func (*Repository) SettleOrchestrationChild 

func (s *Repository) SettleOrchestrationChild(ctx context.Context, settlement execution.Settlement) error

SettleOrchestrationChild retains final host usage after expiry or closure too.

func (*Repository) SettleTaskCompletion 

func (s *Repository) SettleTaskCompletion(ctx context.Context, assignmentID id.ID, completionDigest string) (*coordination.TaskCompletionSettlement, error)

SettleTaskCompletion closes an exact terminal reviewer without refunding unknown provider usage. Failed or malformed output is still charged. Absence or unfinished execution stays pending; this method never infers quiescence.

func (*Repository) SettleTaskUsage 

func (s *Repository) SettleTaskUsage(ctx context.Context, request coordination.TaskUsageSettlementRequest) (coordination.TaskUsageSettlement, error)

SettleTaskUsage compares complete evidence and writes accounting and its guard receipt atomically. Callers must authenticate Billing and hold host authority.

func (*Repository) SnapshotRunRecovery 

func (s *Repository) SnapshotRunRecovery(ctx context.Context, seal execution.RunCallSeal) (execution.RunRecoverySnapshot, error)

SnapshotRunRecovery reads all retained evidence under the run journal guard. All writers must share this protocol. A failed or ambiguous transaction returns no snapshot; callers must authenticate proof and authorize any later adoption.

func (*Repository) SnapshotTaskUsage 

func (s *Repository) SnapshotTaskUsage(ctx context.Context, request coordination.TaskUsageRequest) (coordination.TaskUsageSnapshot, error)

SnapshotTaskUsage reads the full verifier history and sealed journal under plan, run and journal guards. It never refunds capacity or closes job admission. Recovering ownership must be current; completed ownership may be historical when its acceptance, preceding revision and original dispatch remain intact.

func (*Repository) StartResume 

func (s *Repository) StartResume(ctx context.Context, runID id.AgentRunID, key id.SuspensionID, digest string) (suspension.ResumeStart, error)

StartResume grants execution once, after checking the unchanged claimed run. Ambiguous acknowledgments and existing starts return no suspension to execute.

func (*Repository) StartResumeLeased added in v1.10.0 

func (s *Repository) StartResumeLeased(ctx context.Context, runID id.AgentRunID, key id.SuspensionID, digest string, lease run.Lease, first *suspension.Progress) (suspension.ResumeStart, error)

StartResumeLeased is StartResume, taking the lease of the run the admission claimed and writing its first progress snapshot in the transaction that grants execution, so the one worker allowed to execute the resume holds the run from that moment. The run's revision is left as the admission recorded it. A start recorded before is returned as it is, and takes nothing.

func (*Repository) TaskClaimHistory 

func (s *Repository) TaskClaimHistory(ctx context.Context, req coordination.ClaimHistoryRequest) ([]coordination.Claim, error)

TaskClaimHistory reads contiguous immutable ownership revisions.

func (*Repository) TombstoneEvidence 

func (s *Repository) TombstoneEvidence(ctx context.Context, ref evidence.Ref, reason string) error

TombstoneEvidence atomically removes bytes or reserves an absent identity. The durable tombstone rejects delayed uploads and preserves the first actor and reason. A retry cannot rewrite that audit record.

func (*Repository) UnownedOrchestrationParent 

func (s *Repository) UnownedOrchestrationParent(ctx context.Context, team id.OrchestrationID, allowClosed bool, change func(orchestrationstate.Driver) error) (bool, error)

UnownedOrchestrationParent serializes legacy parent mutations with possible coordinator acquisition. Closed accounts permit only the caller's explicitly selected cleanup path. A missing budget leaves ordinary orchestration intact.

func (*Repository) WithClock 

func (s *Repository) WithClock(clock verification.Clock) *Repository

WithClock returns an adapter with trusted host time, for deterministic lease tests. Nil clocks leave the default clock in place.

func (*Repository) WriteArtifactBoard 

func (s *Repository) WriteArtifactBoard(ctx context.Context, request coordination.ArtifactBoardRequest) (coordination.ArtifactBoardEntry, error)

WriteArtifactBoard rechecks accepted evidence and appends a candidate and head decision under the existing plan transaction. Conflicts retain both candidates.

type RunCallDriver 

type RunCallDriver interface {
	TransactRunCalls(context.Context, id.AgentRunID, func(context.Context, Driver) error) error
}

RunCallDriver fences one exact run's call admission and closure. Callbacks contain transactional storage work only; Mongo may repeat them after conflicts.

type RunCallLocker 

type RunCallLocker interface {
	LockRunCalls(context.Context, id.AgentRunID) error
}

RunCallLocker adds a journal guard to an existing database transaction. The driver must reject calls outside a live transaction. Hold a plan guard before journal guards when changing plan state; never acquire a plan guard while holding only a journal guard. Callbacks contain storage operations only.

type RunDriver 

type RunDriver interface {
	TransactRun(context.Context, id.AgentRunID, func(context.Context, RunTransaction) error) error
}

RunDriver supplies a database transaction; callbacks contain no remote I/O. Mongo callbacks may repeat after transaction conflicts and receive session context.

type RunTransaction 

type RunTransaction interface {
	Driver
	GetRun(context.Context, id.AgentRunID) (*run.Run, error)
	SetRunVerification(context.Context, id.AgentRunID, int64, verification.Status, id.ID, time.Time) error
	SetRunCandidate(context.Context, *run.Run, time.Time) error
	ReplaceJob(context.Context, Record, string) error
	ReplaceEventStream(context.Context, Record, string) error
}

RunTransaction fences the run and all evidence reads until commit. Implementations must roll back both the result record and run update on error.

type SubmissionRunReader 

type SubmissionRunReader interface {
	LockSubmissionRun(context.Context, id.AgentRunID) (*run.Run, error)
}

SubmissionRunReader fences the run inside an already-held plan transaction. Lock order is plan, run, then evidence. The fence lasts through commit.

type SuspensionTransaction 

type SuspensionTransaction interface {
	RunTransaction
	LockSuspension(context.Context, id.AgentRunID) (*suspension.Suspension, error)
}

SuspensionTransaction locks the suspension while the outer run lock is held.

type TaskRunTransaction 

type TaskRunTransaction interface {
	Driver
	SubmissionRunReader
	GetRun(context.Context, id.AgentRunID) (*run.Run, error)
	InsertTaskRun(context.Context, *run.Run) error
}

TaskRunTransaction inserts a fresh child inside the held plan transaction. InsertTaskRun must use insert-only semantics and roll back with all other writes.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.