Struct InterventionRouter 

pub struct InterventionRouter { /* private fields */ }

Routes an operator’s neutral command to the worker owning the target attempt, gating on the worker’s advertised capabilities first (NOI-6).

Implementations

impl InterventionRouter

pub fn new( registry: ConnectedWorkerRegistry, owners: AttemptOwnerIndex, transport: Arc<dyn InterventionTransport>, ) -> Self

Build a router over the connected-worker registry, the attempt-owner owners index, and the command transport.

pub fn with_transcript_publisher( self, publisher: ActivityEventPublisher, ) -> Self

Install the transcript publisher an applied InjectMessage is teed into (as an operator User message on the target attempt’s durable stream). Retention here is best-effort at this seam: a publish failure is logged and the Applied ack still returned, exactly like the worker-ingress tap.

pub fn owners(&self) -> &AttemptOwnerIndex

The attempt-owner index the router resolves through, so the dispatch path can bind/release ownership on the same index.

pub async fn route( &self, command: InterventionCommand, ) -> Result<InterventionOutcome, ServerError>

Route one operator command to the owning worker, returning the neutral ack.

Resolves the owning worker for the command’s (workflow, activity, attempt). A missing owner or a registry entry that has since disconnected is the attempt-scoped no-op (InterventionOutcome::stale_target). When the owning worker does not advertise the command’s primitive, the router refuses it at the server (InterventionOutcome::capability_not_supported) and NEVER sends it. Otherwise it pushes over the transport and returns the worker’s ack. A transport fault (the connection dropped mid-route) is mapped to a stale-target no-op — the target is unreachable, which is exactly the too-late class from the operator’s view.

Errors

Returns ServerError::LockPoisoned only if the registry lock is poisoned.

pub fn capabilities_for( &self, key: &AttemptKey, ) -> Result<Option<InterventionCapabilities>, ServerError>

The advertised capability set of the worker currently owning key, if any — what the ops console reads to decide which controls to offer (NOI-7).

Errors

Returns ServerError::LockPoisoned if the registry lock is poisoned.

pub fn intervenable_attempts( &self, workflow_id: &WorkflowId, ) -> Result<Vec<(AttemptKey, InterventionCapabilities)>, ServerError>

Every live, intervenable attempt of workflow_id paired with its owning worker’s advertised InterventionCapabilities — the enumeration the ops console reads to pick a target and gate controls (NOI-7).

Only attempts with a LIVE owner appear: a finished or superseded attempt has no owner entry and is not enumerated. An attempt whose owner has since disconnected (present in the index but gone from the registry) is likewise dropped, so the console never offers a control for an unreachable attempt. The capability set is the SAME advertised set the router gates route on, so the console and the server agree on exactly which primitives are supported.

Errors

Returns ServerError::LockPoisoned if the registry lock is poisoned.

Trait Implementations

impl Debug for InterventionRouter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.