Struct ContextOffloader 

pub struct ContextOffloader<'a> { /* private fields */ }

Substrate-level engine for offload+deref. Composed from the caller’s keypair, the existing SQLite connection, and the OffloadConfig defaults.

Implementations

impl<'a> ContextOffloader<'a>

pub fn new( conn: &'a Connection, signer: Option<&'a AgentKeypair>, config: OffloadConfig, ) -> Self

Construct a new offloader. Pass signer = None for read-only deref workflows.

pub fn offload( &self, content: &str, namespace: &str, ttl_seconds: Option<u64>, agent_id: &str, ) -> Result<OffloadResult>

Offload content and return the ref_id callers persist in place of the full payload.

Errors

• OffloadError::SizeLimitExceeded when content is larger than the configured per-blob ceiling.
• anyhow::Error for zstd / SQLite / signing failures.

pub fn deref( &self, ref_id: &str, caller_agent_id: Option<&str>, ) -> Result<DerefResult>

Dereference a ref_id and return the original content.

IDOR (SEC-4, Cluster D, issue #767)

caller_agent_id is the authenticated identity of the caller (resolved via crate::identity::resolve_agent_id upstream). The stored row’s agent_id is consulted as the owner of the blob; when the caller is not the owner, this function returns OffloadError::NotFound (leak-resistant — does NOT reveal the blob exists). A future K9 cross-agent grant check can layer on top of this; pass None to BYPASS the ownership gate (substrate-internal sweepers, integrity audits, operator dump tools — none of which originate from an authenticated agent context).

Errors

• OffloadError::NotFound when ref_id has no row OR when the caller is not the stored owner (leak-resistant).
• OffloadError::IntegrityFailed when the decompressed content’s SHA-256 disagrees with the stored hash (tamper).
• OffloadError::SignatureFailed when a signer was provided and the stored Ed25519 signature fails to verify.