Module wal 

WAL header + records + BLAKE3-keyed chain.

Each record’s this_chain_hash is computed as blake3::keyed(chain_key, prev_chain_hash || canonical(body)) where chain_key = blake3::derive_key(WAL domain context, world_id). Tampering any record’s body or reordering records breaks the chain at verify_chain time.

Structs

TrustAnchor

Operator-supplied trust anchor for authenticated WAL verification (Wal::verify_chain_anchored).

TypeRegistryPin

Pinned (TypeCode, schema_hash) registered for this world. v0.14 ships the slot empty; the snapshot integration will populate it from ActionRegistry (cross-restart pin set).

Wal

Sealed WAL — the durable read-side counterpart to WalWriter. Produced by Wal::from_writer or Wal::deserialize; consumed by Wal::verify_chain / replay_into.

WalHeader

WAL header — pinned at construction, frozen for the lifetime of the WAL. Replay against an incompatible header is a structural error (A14).

WalRecord

Single record in the WAL chain (Canonical Input Log). Carries the kind-discriminated WalRecordContent plus the chain/signature fields common to both kinds.

WalWriter

Append-only WAL writer. Each successful Kernel::step writes one WalRecord via the kernel’s internal append path.

Enums

SignatureTier

Signature strength tier advertised by a WAL header, ordered None < Ed25519 < Hybrid. Compared against TrustAnchor::min_tier to reject a downgrade.

SkipReason

Why a popped action produced no execution (a Skipped verdict).

StepVerdict

Outcome of a single step_one pop, recorded on a Step record. Replay re-reaches the same verdict by re-execution; a mismatch fails fast.

WalError

WAL operation failures. #[non_exhaustive] — adding variants is not a breaking change for external matchers.

WalRecordContent

Kind-discriminated canonical content of a WAL record. The serde variant tag is the record WalRecordKind and the first hashed body field. The CIL records only non-reproducible facts: exogenous submissions and per-step verdicts + post-state digest — every deterministic effect (child schedules, signal routing, internal ids) is re-derived on replay.

WalRecordKind

Which fact a WalRecord captures under the Canonical Input Log model: an exogenous external submission, or a per-pop step verdict. The kind is the serde variant tag — the first byte of the hashed body.