Module runtime 

Host-neutral agent runtime contracts — the L4/L5 boundary a composing host answers.

Concrete process, CLI, RPC, and approval drivers remain private to the composing host. This module owns the contracts that let those drivers be selected and invoked without making the host depend on a particular lifetime or transport implementation:

• identity — ProviderId: the opaque catalog identifier one runtime provider answers to, never a command, path, endpoint, or account;
• capability evidence — SubagentCapabilities, ReadinessEvidence and ExecutionAdmissionEvidence, reduced by reduce_readiness and reduce_execution_admission: missing evidence is an explicit denial, never an optimistic fallback;
• session binding — NativeResumeIdentity and DurableNativeBinding: adapter-owned opaque bindings with no serialization implementation, so they cannot be projected into wire payloads;
• dispatch vocabulary — SubagentDispatchRequest, RuntimeTransition, RuntimeDispatchReceipt and RuntimeObservation;
• ports — McpCallerIntegration (provider-owned caller registration behind a single-use RegistrationApproval) and SubagentRuntimeAdapter (the target runtime the host selects through its registry), plus the lane-erased RuntimeDriver / RuntimeDriverRegistry / PersistentTurnRuntime contracts.

Structs

CallerRegistrationPlan

CallerRegistrationReceipt

DurableNativeBinding

Private durable binding read from the host’s canonical conversation state. It has no serialization implementation and must never enter an Event or MCP receipt.

ExecutionAdmissionDecision

ExecutionAdmissionEvidence

Canonical facts that decide whether a selected subagent runtime can be attempted. Conversation readiness is deliberately absent: it is observational evidence for probe, not execution permission.

NativeResumeIdentity

Adapter-owned native identity. Its fields are intentionally private and it has no serialization implementation, preventing projection into MCP/Event payloads. Only the adapter that resolved it should interpret the opaque binding.

ProviderId

Providers supported by the host-owned subagent mesh. The value is an opaque catalog identifier, never a command, path, endpoint, or account.

ReadinessDecision

ReadinessEvidence

Evidence used by the one readiness reducer. Missing evidence is an explicit denial; callers never receive an optimistic fallback.

RegistrationApproval

Single-use approval bound to one immutable registration digest.

RuntimeDispatchReceipt

RuntimeEventPart

RuntimeObservation

SubagentCapabilities

Explicit capability differences consumed by direct and Graph admission.

SubagentContinueRequest

SubagentDispatchRequest

Enums

InstructionPolicy

Provider-declared delivery for generated runtime guidance. User Events are never rewritten; this policy is applied only to the ephemeral driver call.

RuntimeTransition

Traits

McpCallerIntegration

Provider-owned caller registration/install/readiness/removal port.

PersistentTurnRuntime

Persistent-turn operations shared by desktop reconnect and mobile resume. Conversation state and replay cursors are supplied by the durable store; an implementation may cache them, but the cache is never authoritative.

RuntimeDriver

Stable identity and capability surface of one runtime driver.

RuntimeDriverRegistry

Read-only driver selection. The composing host owns registration and process lifetime; callers receive no mutable process-global authority.

SubagentRuntimeAdapter

Provider-owned target runtime port. Application code selects this trait through the registry and contains no provider conditional.

Functions

reduce_execution_admission

reduce_readiness

Reduce readiness identically for direct and Graph dispatch.

Type Aliases

AdapterFailure

The failure vocabulary every runtime port reports through: the crate’s one AdapterError, under the name this boundary has always carried.