Module core

Expand description

Domain-agnostic types and traits. No I/O lives here.

This module’s only dependencies are serde, thiserror, async-trait, and the hashing primitives. That is enforced by a test in tests/guards/layering.rs which fails the build if core gains an edge to any I/O-bearing module.

The discipline matters more than it looks: it keeps the type layer reviewable, lets the whole runtime be swapped under a simulator, and makes an eventual crate split mechanical rather than archaeological.

Modules§

canon: Canonical serialization.
merkle: Binding runs to each other.
visible: Making what a reviewer cannot see visible, and flagging what they might misread.

Structs§

Ask: What a question task accepts as an answer.
AwaitSpec: What a run is waiting for.
BatchId: One business act made of many independent ones.
BreachNote: Somebody’s account of a breach.
Budget: What a run is allowed to consume.
Capability: An abstract, domain-neutral capability name.
Case: A long-lived, correlated business fact.
CaseId: A long-lived, correlated business fact spanning many runs and weeks.
CaseVersion: Which revision of a case’s state a reader saw.
CloudEvent: One CloudEvents 1.0 message.
Consumed: Running totals for one run.
ContentRefusal: Which rule refused a value, and where. The pointer writes an object key a rule matched as *.
ContentVerdict: The content rules’ verdict on a value that arrived, or on a run’s input.
CorrelationKey: A business key that identifies a case from the outside.
DeadLetter: An event that aged out of the buffer without anyone claiming it.
Deadline: A registered obligation with a resolved instant.
DeadlineSpec: A domain-specific deadline description.
Decision: A human’s answer.
DeclaredOutput: What an effect declared about its own output, as a recorded fact.
DeclaredReach: A callee’s declaration, as much of it as bounds what the callee may do.
Delegation: A verified chain from a human owner down to the acting workload.
DenyAll: Refuses everything, naming itself.
Digest: SHA-256 over an artifact’s canonical serialization.
EffectDescriptor: What an effect does, in terms the runtime can hash and the journal can show.
EffectKey: Stable identity of one effect within one run.
Egress: The hosts this plane may connect to.
GenAiRequest: Who a GenAI operation asked, for the span attributes of that name.
GenAiResponse: What a GenAI operation answered, for the span attributes of that name.
InboundEvent: A message from outside, correlated by business key.
Justification: What a reviewer needs in order to disagree.
KeySignature: A signature, and the key that made it — over a record’s chain hash, a manifest or a provenance block, each under its own domain.
Label: A value’s position in the information-flow lattice.
Ledger: Tracks a run’s consumption against its budget.
LegalHold: An instruction from outside the plane that a matter must be preserved.
MixedScript: One word mixing alphabets, flagged beside the text it appears in.
Operator: Who asked, and what established it.
PlanIR: A frozen, content-addressed plan.
PlanNode: One unit of work in a plan.
PolicyBundleIdentity: The complete immutable identity of an executable policy bundle.
PolicyRequest: What is being asked.
Principal: One link in a delegation chain.
ProtectedField: A stricter information-flow rule for one JSON field sent to a sink.
Provenance: Who is calling, on whose behalf, for which piece of work.
Quorum: How many judgements, from how many angles, and how many must agree.
Reach: What a consulted agent may do: the reach a reviewer approves along with the hand-off.
ReachGrant: One thing a callee may call.
Release: A typed request to improve labels on a whole value or selected JSON fields.
ReleaseMark: One destination-scoped improvement a Release granted, carried on the Tainted value it covers.
ReleaseScope: Which label dimensions an authorized release may improve.
Rendering: What every surface shows a person for one task: the one rendering.
RetryPolicy: How many times to repeat a failed effect, and how far apart.
RunId: A single execution: one goal, one plan, one lifetime.
Scope: What a principal is allowed to do.
Secret: A secret that is wiped when it drops.
SkillDescriptor: What a skill is and what it promises.
SourceId: Where a value came from. Free-form so the engine stays domain-agnostic; the runtime stamps tool refs, peer ids, and collection names.
Spend: What one effect consumed.
StepId: Position of a step within a plan.
SubjectRef: One entry of a run’s DataSubjectBound record, by position: opaque and non-identifying, so it may travel in every clear label.
Subscription: A durable registration of interest in a future event.
Tainted: A value carrying its information-flow label.
Tally: What the panel produced.
Task: A pending item of human work.
TaskId: Identifies a task.
TaskSpec: A request for a human decision.
TenantId: Which tenant a run, key, or decision belongs to.
Timer: A run’s durable wake-up.
Undecided: One effect whose outcome the journal cannot establish.
WallClock: The built-in calendar: plain wall-clock offsets.

Enums§

ArgSource: Where one argument comes from.
Assertion: What a person asserts about an effect the runtime could not decide.
Basis: What established the name on an operator act.
BudgetExceeded: Which limit stopped the run, and where it stood.
CalendarError
CaseStatus: Where a case is in its life.
ClaimError: Why a claim was refused.
CloudEventError: Why an envelope was not accepted.
Collaboration: Why collaboration is worth its cost here.
Compensation: A step’s place in the saga, and what undoing it means.
CredentialBinding: What a hop’s credential named, as its announcement records it.
DeadlineState
Decided: Who answered, and on what footing.
DelegationError: Why a delegation was refused.
Delivery: What happened to a delivered event.
Disposition: What a failure says about whether the call reached the outside world.
Doubt: Why one effect’s outcome is unknown.
EffectError: Failure of a single external interaction.
EgressError: Why a connection was refused before it was made.
Expiry: What a skill declares should happen when nobody answers its task in time.
GroupOutcome: How a group ended.
ObservedDecision: What came back when a person was asked to permit a call.
ObservedStatus: Where the agent said a tool call had got to.
ObservedStep: One thing an observed agent reported.
OnExpiry: What happens when nobody answers in time, as a stored task records it.
OperatorError: Why a name was refused.
Outcome: What a step produced.
PanelOutcome: The panel’s decision, or its failure to reach one.
Phase: Which pass of a step an effect belongs to.
PlanError: A plan that must not run, and why.
PolicyDecision: The answer.
PolicyError: Authorization failure.
PrincipalKind: What a PolicyRequest::principal names.
Priority
QuarantineDecision: What a person decided about a run the runtime could not decide.
QuorumError: Why a declared panel was refused.
Reconciliation: What a reconciliation probe established about a call whose outcome was unknown.
Recovery: How to recover when a crash leaves an effect’s outcome unknown.
RuntimeError: Failures reaching the operator.
Sensitivity: How much damage disclosure would do.
SignError: Why a signature could not be produced.
SignatureError: Why a chain’s signatures were not acceptable.
SkillError: Failure inside a skill.
StepError: Failure surfaced to a skill through StepCtx.
StoreError: Persistence failure.
SuspendReason: Why a run stopped without finishing.
SweptAction: What the sweeper did to something nobody was watching.
TaskState: The BPMN-shaped lifecycle, minus the states this runtime has no use for.
TaskVerdict: What a person decided.
TenantError: Why a tenant name was refused.
Topology: How many agents contribute to one task.
Trust: Whether a value may influence control flow.
Verdict: One judge’s answer.
Withheld: Why a task’s proposal cannot be shown.

Constants§

ACTIONS: Every action the runtime tier puts to a PolicyEngine.
ACTION_ADMIT: The action string for starting a run.
ACTION_CONTENT: The action string for a value a declared content rule refused.
ACTION_DECLARED: The action string for an effect refused by the agent’s own manifest.
ACTION_EGRESS: The action string for a value refused at a sink’s information-flow gates.
ACTION_PERFORM: The action string for performing an effect.
ACTION_RELEASE: The action string for removing an information-flow label.
CLOUDEVENT_CONTENT_TYPE: The media type of a structured-mode CloudEvent, as the HTTP binding requires it on Content-Type.
CLOUDEVENT_HEADER_PREFIX: The HTTP binding’s header prefix for binary-mode attributes.
CLOUDEVENT_SPEC_VERSION: The only envelope version this plane reads or writes.
DOMAIN_GRADER_VERDICT: The domain a grader-verdict sidecar is signed under.
DOMAIN_MANIFEST: The domain a manifest signature is made under.
DOMAIN_PROVENANCE: The domain a provenance seal is made under.
DOMAIN_RECORD: The domain a journal record’s signature is made under.
MAX_DELEGATION_DEPTH: How deep a chain may go before nobody can reason about it.
MAX_WINDOW_SECONDS: The longest window of seconds this crate will turn into an instant.
PROVENANCE_NS: The _meta key prefix this crate writes under.
REFUSED: What a model may be told about a refusal.

Traits§

AnyEffect: An Effect whose output type has been erased to Value.
Calendar: Resolves a domain-specific deadline description to an instant.
CheckpointSigner: Signs the rare, high-value things: checkpoints and cosignatures.
Effect: Anything non-deterministic or externally visible.
PolicyEngine: Decides whether an action is allowed.
Signer: Signs a record’s chain hash.
Skill: A stateless unit of logic.
Verifier: Checks a signature against the key that claims to have made it.

Functions§

content_joined: declared joined with a classification. The one place a content verdict touches a sensitivity, so no path can assign where it must join.
erasure_scope: The name of one erasure unit: a case, a run, a memory subject, a named retention policy — always under its tenant.
first_instant: The first instant a Timestamp can name.
format_timestamp: One instant, RFC 3339, for a place that is not a struct field.
is_cloudevent_media_type: Whether a Content-Type selects CloudEvents structured mode.
last_instant: The last instant a Timestamp can name.
origin_key: A producer-scoped identity — (source, id) — as one key.
origin_source: The source half of an origin_key, read back.
retry_after_seconds: Parse a Retry-After value into seconds.
seconds_after: The instant seconds after from, or None where that is not an instant.
signing_hash: Bind a signature to what it is about, not just to the bytes it covers.
verdict_fits: Whether verdict decides a task that asks asks — None for an approval task.

Type Aliases§

Epoch: Ownership fencing epoch.
KeyId: Names the key that produced a signature.
Seq: Per-run monotonic journal position, starting at 1.
Timestamp: Wall-clock instant. Only ever obtained through a journaled effect (StepCtx::now), never by reading the ambient clock.

Module core

Module core Copy item path

Modules§

Structs§

Enums§

Constants§

Traits§

Functions§

Type Aliases§

Module core