Struct PeerCall 

pub struct PeerCall { /* private fields */ }

One request to one peer.

Implementations

impl PeerCall

pub fn prepare( registry: &PeerRegistry, client: Arc<dyn PeerClient>, caller: &Delegation, peer: PeerId, capability: impl Into<String>, payload: Value, ) -> Result<Self, PeerError>

Prepare a hop, attenuating the caller’s authority onto the peer and presenting the credential the chain’s owner is owed.

Errors

• PeerError::Unknown if the peer is not registered — fail closed.
• PeerError::NotGranted if the capability is outside the grant.
• PeerError::Delegation if the grant would widen the caller’s own authority, or if the chain is already at its depth limit.
• PeerError::WrongAudience if the credential held is for someone else.

pub fn prepare_as_plane( registry: &PeerRegistry, client: Arc<dyn PeerClient>, chain: &Delegation, peer: PeerId, capability: impl Into<String>, payload: Value, ) -> Result<Self, PeerError>

Prepare a hop for a run admitted as the plane, under the plane’s own chain.

The plane is the party that asked, so a peer told who asked is shown the plane’s own credential rather than one naming the chain’s owner as if a person had asked.

Errors

As prepare, plus PeerError::NoPlaneCredential.

pub fn governed_by(self, safety: &ToolSafety) -> Self

Hold this call to a manifest grant’s declaration.

A registry entry is operator wiring — where the peer is, what it is granted, which credential reaches it. The reviewed tool://<peer>/<capability> grant in the calling agent’s manifest is what says how the call may be used, and it governs the same way it governs a tool: its protected fields are checked at the sink, its ceiling bounds what may be sent, and its mutates can only make the call more cautious than the wiring did.

pub const fn acting_as(&self) -> &Delegation

The chain the peer will act under.

Trait Implementations

impl Debug for PeerCall

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Effect for PeerCall

fn sink_arguments(&self) -> Option<&Value>

The payload is what reaches the peer, so it is what the sink gate judges — the whole-value taint rule for a mutating grant, and the per-field rules a manifest declares.

fn source(&self) -> SourceId

The reference a manifest grants this call under, so a source rule can name this peer’s answer — tool://reviewer/audit.check — rather than whichever peer an injected prompt reached first.

fn trust(&self) -> Trust

A peer’s answer is another party’s data.

Stated rather than inherited because a peer feels more trusted than a tool — it is our agent, on our side. It is not: it runs somewhere else, under someone else’s control, and it may itself have read the internet.

type Output = Value

What comes back. Must round-trip through JSON: replay reconstructs it from the journal rather than from the driver.

fn descriptor(&self) -> EffectDescriptor

What this effect does. Hashed (with position) into the effect key.

fn mutates(&self) -> bool

Whether this mutates external state.

fn recovery(&self) -> Recovery

What to do when the outcome is unknown — after a crash, or after an InDoubt failure. The two are the same situation reached from different directions.

fn retry(&self) -> RetryPolicy

How many times to repeat this effect when it fails, and how far apart.

fn max_sensitivity(&self) -> Sensitivity

The highest data sensitivity this sink may receive.

fn delegation_depth(&self) -> Option<usize>

The resulting delegation depth when this effect hands authority onward.

fn protected_fields(&self) -> &[ProtectedField]

Field-specific source and sensitivity rules for a structured sink.

fn output_sensitivity(&self) -> Sensitivity

How sensitive this effect’s output is, at minimum.

fn attach(&mut self, provenance: &Provenance)

Receive the run-scoped provenance for this call.

fn credential_binding(&self) -> Option<CredentialBinding>

Whom the credential this effect presents names, for an effect that presents one to another party.

fn perform<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<Value, EffectError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Do the thing. Called at most once per key per run; never called during replay.

fn gen_ai_operation(&self) -> Option<&'static str>

Which OpenTelemetry GenAI operation this effect is, if it is one.

fn gen_ai_request(&self) -> Option<GenAiRequest>

Who this operation asks, and for what — the request half of the GenAI span attributes.

fn gen_ai_response(&self, output: &Self::Output) -> Option<GenAiResponse>

What came back, split the way the convention reports it.

fn retries_landed(&self) -> bool

Whether a failure that landed may be tried again, within retry.

fn rebind(&mut self, _arguments: Value) -> bool

Bind arguments in place of the ones this effect was built over, where it can — what a declared redaction at a sink needs.

fn outbound_bytes(&self) -> u64

How many bytes dispatching this effect sends out of the plane.

fn spend(&self, _output: &Self::Output) -> Spend

What this effect consumed.

fn reconcile<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<Reconciliation<Self::Output>, EffectError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Ask the provider whether a call landed.