pub struct Commit {
pub id: ObjectId,
pub state_root: ObjectId,
pub parents: Vec<ObjectId>,
pub timestamp: DateTime<Utc>,
pub agent_id: AgentId,
pub authority: Authority,
pub intent: Intent,
pub reasoning: Option<String>,
pub confidence: Option<f64>,
pub tool_calls: Vec<ToolCall>,
}Expand description
An immutable record that links a state tree to its history and provenance metadata.
Fields§
§id: ObjectIdContent-address of this commit (BLAKE3 hash of all other fields).
state_root: ObjectIdRoot of the state tree at this commit.
parents: Vec<ObjectId>Parent commit(s). Empty for initial commit, one for normal, two+ for merge.
timestamp: DateTime<Utc>When this commit was created.
agent_id: AgentIdThe agent or human who made this state change.
The authorization chain for this action.
intent: IntentStructured intent metadata.
reasoning: Option<String>Agent’s chain-of-thought or explanation.
confidence: Option<f64>Agent’s self-assessed confidence (0.0 to 1.0).
tool_calls: Vec<ToolCall>Tool calls that contributed to this state change.
Implementations§
Source§impl Commit
impl Commit
Sourcepub fn enforce_caps(&mut self)
pub fn enforce_caps(&mut self)
Apply the same size caps CommitBuilder::build uses to a commit
loaded from storage. Idempotent — commits already within caps are
returned unchanged.
CommitBuilder::build truncates on construction, but a .db file
seeded out-of-band (older ASG versions without caps, or a malicious
operator) may contain unbounded description / reasoning /
agent_id / tool_calls. Blame/log would otherwise replay them
verbatim to untrusted readers. Higher-level APIs that surface
commits to callers invoke this implicitly.
(security threat model v2, F3)
Note: this mutates the commit in place and does NOT recompute the
content-addressed id — a commit’s id is a historical identifier
of what was stored, and re-hashing on read would break log/blame
identity. The caps here exist purely to bound what’s shown to
readers, not to rewrite history.