Struct FlowEnvelope 

pub struct FlowEnvelope {
    pub ontological_type: String,
    pub result: Value,
    pub certainty: f64,
    pub epistemic_envelopes: Vec<EpistemicEnvelope>,
    pub provenance_chain: Vec<String>,
    pub step_audit: StepAuditTrail,
    pub audit_chain_hash: String,
    pub blame_attribution: Option<BlameContext>,
    pub execution_metrics: ExecutionMetrics,
    pub trace_id: String,
}

§Fase 39 (D1, D2, D5) — the wire payload of every transport: json axonendpoint response (HTTP 2xx) and every legacy POST /v1/execute invocation.

Fields are organized by Pillar (see module docs). At wire emission, result carries a serde_json::Value (monomorphic at runtime); D5 validation (Fase 32.d) — once simplified in 39.d — will type-check this slot against the declared inner T of the adopter’s output: FlowEnvelope<T> declaration.

Fields

ontological_type: String

The ontological type declared at the endpoint surface (the inner T of output: FlowEnvelope<T>). Slug form: TenantRecord, List<PatientRecord>, Stream<Token>. For legacy /v1/execute invocations (no endpoint declaration), this is the runtime-inferred type slug.

result: Value

The typed payload — member of ontological_type. serde_json::Value at the wire layer because the runtime is monomorphic; D5 (when simplified in 39.d) validates the inner shape against the declared T.

certainty: f64

Certainty c ∈ [0.0, 1.0], bounded by Theorem 5.1: c ≤ 0.99 whenever derived_status = true. In Fase 39.b the bound is enforced by FlowEnvelope::seal’s Rust fallback; in Fase 39.c the bound moves to the C23 kernel axon-csys::effects::envelope::validate_epistemic_degradation, making it structurally unbypassable.

epistemic_envelopes: Vec<EpistemicEnvelope>

§Fase 55.b — the Theorem 5.1 (base, scope, confidence) triple of every flow-level use <Tool> dispatch whose tool declares an epistemic:<level> effect. Surfaces the epistemic degradation on the wire — the §50.i.4 parity gate, promoted (the competitive differential: an adopter sees a query routed through an epistemic:speculate tool decay to confidence ≤ 0.80). Empty — and elided from the JSON — for flows with no epistemic tool (D5 backward-compat: byte-identical wire for every pre-55.b flow).

provenance_chain: Vec<String>

Ordered list of kind:identifier tuples capturing the lineage of result. Examples:

• ["flow:FetchTenants", "retrieve:tenants", "backend:stub"]
• ["step:Triage", "shield:Hipaa", "backend:anthropic"] Empty for endpoints with no derived state (singular literal returns); populated by FlowEnvelope::from_execution_result.

step_audit: StepAuditTrail

Per-step audit trail. Survives from v1.x as the canonical observability surface; here it is structured (not just Vec<String>). Step results are TYPED Value post-39.b (pre-v2.0.0 they were stringified — the typed form is a D5 simplification dividend).

audit_chain_hash: String

HMAC-SHA256 hex of the canonical form of provenance_chain || step_audit. Computed by FlowEnvelope::seal; in Fase 39.c the hash moves to the C23 kernel for byte- deterministic cross-deployment verification.

blame_attribution: Option<BlameContext>

Populated only when the flow’s success path produced a degraded posture (anchor breach, shield rejection, backend soft-fail, store breach, type-mismatch on recoverable path). None on the clean happy path.

execution_metrics: ExecutionMetrics

Execution metrics — latency, tokens, backend identity. Always populated.

trace_id: String

Correlation anchor (matches X-Axon-Trace-Id header). String form for cross-stack compat (the v1.x trace_id: u64 is reborn here as Uuid v4 hex string).

Implementations

impl FlowEnvelope

pub fn from_execution_result( exec_result: ServerExecutionResult, ontological_type: String, ) -> Self

§Fase 39.b — convert a v1.x crate::axon_server::ServerExecutionResult into a v2.0.0 envelope. Total: every legacy field maps to a pillar-organized slot; no information loss.

Epistemic field defaults applied here (refined in 39.c):

• certainty = 1.0 when anchor_breaches == 0 and errors == 0 (clean happy path; no derived posture).
• certainty = 0.99 when anchor_breaches > 0 || errors > 0 (Theorem 5.1: derived states bounded ≤ 0.99).
• provenance_chain built from flow_name + step_names + backend.
• blame_attribution = None always at this layer (the soft- degradation surface is populated by the runtime when it detects anchor/shield/store/backend events — 39.c lands that wiring).

The result slot is populated from the LAST step’s typed output (step_results.last() parsed as Value). For flows with no steps (degenerate) the result is Value::Null.

trace_id is converted from the legacy u64 to a Uuid v4 hex string. When the legacy id is 0 (pre-record), a fresh Uuid is minted.

impl FlowEnvelope

pub fn seal(self) -> Self

§Fase 39.b — apply epistemic enforcement + compute the audit_chain_hash before wire serialization. This is the ONLY public sealing surface; the wire bytes emitted by axon_server MUST pass through this method (the seal() invariant — Fase 39.b establishes it; 39.h grep gate locks it structurally).

Fase 39.c.x implementation (C23 kernel canonical)

1. Theorem 5.1 enforcement DELEGATES to the C23 kernel axon-csys::envelope::validate_degradation. The kernel: a. Defensively normalises NaN / Inf / out-of-range certainty into [0.0, 1.0]. b. Clamps certainty ≤ 0.99 when derived_status = true. c. Returns the envelope with derived_status + epistemic_kind passed through unchanged. The C23 kernel is the SINGLE point of structural truth — no Rust path bypasses it for production code paths.
2. derived_status algebra (Rust-side, matches the producer in FlowEnvelope::from_execution_result verbatim): derived = step_audit.anchor_breaches > 0 || step_audit.errors > 0. The Rust side decides WHO is derived (semantic); the C23 kernel enforces WHAT the ceiling looks like (structural).
3. audit_chain_hash = SHA-256 hex of the canonical-JSON serialization of [provenance_chain, step_audit]. Deterministic on identical inputs; tamper-evident. (39.c.x leaves the SHA-256 in Rust pending a future sub-fase that moves it to axon-csys::crypto for true silicon-grounded tamper-evidence.)

Trait Implementations

impl Clone for FlowEnvelope

fn clone(&self) -> FlowEnvelope

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FlowEnvelope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for FlowEnvelope

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for FlowEnvelope

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.