Module capability

Expand description

Immutable, source-owned capability identity and scoped lifecycle kernel.

This module deliberately contains no package resolution, runtime activation, or mutable latest-value registry. A capability source submits one complete contribution, and CapabilitySet freezes the validated descriptors behind an std::sync::Arc. Typed scopes add monotonic ceilings, borrowed leases, reversible effects, and bounded structured teardown. Closed runtime values and typestate transactions publish one complete projected generation through a short catalog CAS.

Re-exports§

pub use crate::mcp::McpBinding;

Structs§

CapabilityAdapterError: Bounded failure returned by a surface-owned capability projection adapter.
CapabilityCatalog: Session-local immutable capability publication catalog.
CapabilityCatalogStamp: Exact local generation and identity digest used by catalog CAS publication.
CapabilityCeiling: Complete immutable authority ceiling for one catalog generation.
CapabilityCleanupReport: Bounded reverse-teardown result for retired or rolled-back effects.
CapabilityCommitReceipt: Successful all-or-nothing projection publication evidence.
CapabilityContribution: Complete descriptor batch owned by one exact source generation.
CapabilityDescriptor: Serializable identity plane for one projected capability surface.
CapabilityEffectError: Bounded failure returned by asynchronous capability teardown.
CapabilityExecutionCeiling: Numeric execution limits. None is unbounded and is therefore the widest value for an optional duration ceiling.
CapabilityId: Stable source, category, and local-surface identity.
CapabilityLease: Borrowed capability access tied to one typed scope owner.
CapabilityProjection: Immutable pairing of one identity set with exactly one typed runtime value for every descriptor.
CapabilityProjectionLease: Non-clone reader lease retaining one exact projected generation.
CapabilityReadinessPlan: Deterministic dependency-first ordering for one immutable capability set.
CapabilityScope: Typed immutable catalog and monotonic governance scope.
CapabilityScopeHandle: Cloneable weak registration handle for one typed capability scope.
CapabilityScopeId: Canonical hierarchical scope identity assigned by the Code host.
CapabilitySet: Canonically ordered immutable capability identity set.
CapabilitySource: Immutable identity and authority class for one complete contribution. Fields are private so untrusted package data cannot manufacture built-in precedence.
CapabilitySourceId: Stable identity of one trusted contribution source.
CapabilityTxn: Atomic capability contribution transaction guarded by Rust typestate.
CodeCatalogGeneration: Session-local immutable Code catalog generation.
FlowBinding: Immutable A3S Flow definition paired with the exact engine that can replay it.
GovernanceCapabilityCeiling: Parent governance bindings that every child must retain.
KnowledgeSurfaceBinding: Immutable multi-instance Knowledge readiness value accepted by the Code capability projection kernel.
KnowledgeSurfaceBindingSpec: Host-reviewed, path-free readiness evidence for one Knowledge surface.
Prepared: Transaction state after every adapter prepared successfully.
PreparedCapability: One atomically returned runtime value and its reversible resources.
Run
RunCapabilityBindingV1: Serializable identity of the complete immutable capability generation and authority ceiling admitted for one Agent Run.
RunUseCapabilityGenerationV1: Diagnostic copy of the exact upstream A3S Use snapshot cursor retained by the Run. The catalog digest already binds these fields; keeping them explicit lets a recovery host request the correct generation without resolving latest.
ScopeClosePolicy: Bounded close policy inherited by every child scope.
ScopeCloseReport: Deterministic, bounded outcome of one idempotent scope close.
Session
SessionCapabilityBatch: One complete next-generation Tool/Skill/Agent/Command/Hook/MCP/Flow/ Knowledge Surface/Knowledge/UI/Context projection for a Session.
SessionCapabilityRun: Non-clone Run guard retaining one Code projection and one exact Use lease.
Sha256Digest: Canonical lowercase SHA-256 value used by capability identity contracts.
Staged: Transaction state before fallible runtime preparation.
Subtask
SupervisedTaskId: Opaque identity of one task owned by a capability scope supervisor.
Turn
UiAsset: A bounded, path-free UTF-8 asset with a content-derived identity.
UiBinding: Immutable UI value accepted by the Code capability projection kernel.
UiBindingSpec: Renderer-neutral metadata and exact static document selected by a host.
UiDocument: Exact path-free document bytes selected for one UI generation.
UseCapabilityGeneration: Exact immutable A3S Use capability publication identity.
UseGenerationLeaseError: Bounded failure returned while retaining one exact A3S Use generation.
UsePackageGeneration: Exact immutable A3S Use package lifecycle generation identity.
Validated: Transaction state after the complete value projection passed validation.
WorkspaceCapabilityCeiling: Workspace operations a scope may expose. A child may only turn flags off.

Enums§

CapabilityKind: Closed product capability categories. Implementations inside a category remain open; arbitrary runtime categories do not enter the set.
CapabilityProjectionError: Failure that leaves the currently published projection unchanged.
CapabilityRuntimeError: Session-host failure that cannot expose a partial capability generation.
CapabilityScopeError: Failure to construct, narrow, admit, or operate a capability scope.
CapabilityScopeKind: Closed scope hierarchy used by the capability lifecycle kernel.
CapabilitySetError: Validation failure that prevents an immutable capability set from being constructed.
CapabilitySourceClass: Trusted precedence class assigned by the host adapter, never by package content.
CapabilityValue: Closed runtime value categories accepted by the Code projection kernel.
KnowledgeSurfaceBindingError
RunCapabilityBindingError: Stable validation and comparison failures for a persisted Run capability identity.
UiAssetKind: Closed static asset roles accepted by the renderer-neutral UI contract.
UiBindingError

Constants§

Traits§

CapabilityEffect: One reversible resource owned by exactly one capability scope.
CapabilityProjectionAdapter: Surface-owned fallible preparation boundary.
RetainedUseGeneration: Host adapter for the exact non-clone lease returned by A3S Use.
ScopeKind: Sealed marker implemented only by the four supported scope levels.
UseGenerationLeaseProvider: Generation-bound host seam for the real non-clone A3S Use snapshot lease.