Struct FlowEnvelope 

pub struct FlowEnvelope {
    pub ontological_type: String,
    pub result: Value,
    pub certainty: f64,
    pub epistemic_envelopes: Vec<EpistemicEnvelope>,
    pub provenance_chain: Vec<String>,
    pub step_audit: StepAuditTrail,
    pub audit_chain_hash: String,
    pub blame_attribution: Option<BlameContext>,
    pub execution_metrics: ExecutionMetrics,
    pub trace_id: String,
    pub error: Option<String>,
    pub temporal_context: Option<TemporalRecord>,
}

v2.0.0 (D1, D2, D5) — the wire payload of every transport: json axonendpoint response (HTTP 2xx) and every legacy POST /v1/execute invocation.

Fields are organized by Pillar (see module docs). At wire emission, result carries a serde_json::Value (monomorphic at runtime); D5 validation (v1.23.0) — once simplified in 39.d — will type-check this slot against the declared inner T of the adopter’s output: FlowEnvelope<T> declaration.

Fields

ontological_type: String

The ontological type declared at the endpoint surface (the inner T of output: FlowEnvelope<T>). Slug form: TenantRecord, List<PatientRecord>, Stream<Token>. For legacy /v1/execute invocations (no endpoint declaration), this is the runtime-inferred type slug.

result: Value

The typed payload — member of ontological_type. serde_json::Value at the wire layer because the runtime is monomorphic; D5 (when simplified in 39.d) validates the inner shape against the declared T.

certainty: f64

Certainty c ∈ [0.0, 1.0], bounded by Theorem 5.1: c ≤ 0.99 whenever derived_status = true. In v2.0.0 the bound is enforced by FlowEnvelope::seal’s Rust fallback; in v2.0.0 the bound moves to the C23 kernel axon-csys::effects::envelope::validate_epistemic_degradation, making it structurally unbypassable.

epistemic_envelopes: Vec<EpistemicEnvelope>

v2.7.0 — the Theorem 5.1 (base, scope, confidence) triple of every flow-level use <Tool> dispatch whose tool declares an epistemic:<level> effect. Surfaces the epistemic degradation on the wire — the v2.4.0 parity gate, promoted (the competitive differential: an adopter sees a query routed through an epistemic:speculate tool decay to confidence ≤ 0.80). Empty — and elided from the JSON — for flows with no epistemic tool (D5 backward-compat: byte-identical wire for every pre-55.b flow).

provenance_chain: Vec<String>

Ordered list of kind:identifier tuples capturing the lineage of result. Examples:

• ["flow:FetchTenants", "retrieve:tenants", "backend:stub"]
• ["step:Triage", "shield:Hipaa", "backend:anthropic"] Empty for endpoints with no derived state (singular literal returns); populated by FlowEnvelope::from_execution_result.

step_audit: StepAuditTrail

Per-step audit trail. Survives from v1.x as the canonical observability surface; here it is structured (not just Vec<String>). Step results are TYPED Value post-39.b (pre-v2.0.0 they were stringified — the typed form is a D5 simplification dividend).

audit_chain_hash: String

HMAC-SHA256 hex of the canonical form of provenance_chain || step_audit. Computed by FlowEnvelope::seal; in v2.0.0 the hash moves to the C23 kernel for byte- deterministic cross-deployment verification.

blame_attribution: Option<BlameContext>

Populated only when the flow’s success path produced a degraded posture (anchor breach, shield rejection, backend soft-fail, store breach, type-mismatch on recoverable path). None on the clean happy path.

execution_metrics: ExecutionMetrics

Execution metrics — latency, tokens, backend identity. Always populated.

trace_id: String

Correlation anchor (matches X-Axon-Trace-Id header). String form for cross-stack compat (the v1.x trace_id: u64 is reborn here as Uuid v4 hex string).

error: Option<String>

v2.15.0 — the HONEST hard-failure detail when the flow aborted on a node’s DispatchError (a failing persist/mutate/purge store write, a backend error, etc.). Some("flow 'F' failed at persist into 'S': <cause>") names the failing node + the underlying cause. This is distinct from blame_attribution, which is reserved for SOFT degradation reported ON the success path — a hard fail needs its own slot. Mirrors the streaming dispatcher’s FlowError.error so a non-streaming endpoint surfaces store-write failures with the SAME honesty the SSE path always had (closing the v2.15.0 silent-abort regression). None — and elided from the JSON — on the clean path, so every pre-v2.15.0 happy-path wire stays byte-identical.

temporal_context: Option<TemporalRecord>

v2.46.0 — the run’s temporal record when any step rendered a declared now: (time_is_an_explicit_input applied to cognition): the single captured instant (RFC 3339 UTC), the tz-database release it resolved against, and the declared zones actually rendered — the triple that makes the exact prompt the model saw reconstructible byte-for-byte. None — and elided from the JSON — for every now:-less flow, so every pre-v2.46.0 wire stays byte-identical.

Implementations

impl FlowEnvelope

pub fn from_execution_result( exec_result: ServerExecutionResult, ontological_type: String, ) -> Self

v2.0.0 — convert a v1.x crate::execution_result::ServerExecutionResult into a v2.0.0 envelope. Total: every legacy field maps to a pillar-organized slot; no information loss.

Epistemic field defaults applied here (refined in 39.c):

• certainty = 1.0 when anchor_breaches == 0 and errors == 0 (clean happy path; no derived posture).
• certainty = 0.99 when anchor_breaches > 0 || errors > 0 (Theorem 5.1: derived states bounded ≤ 0.99).
• provenance_chain built from flow_name + step_names + backend.
• blame_attribution = None always at this layer (the soft- degradation surface is populated by the runtime when it detects anchor/shield/store/backend events — 39.c lands that wiring).

The result slot is populated from the LAST step’s typed output (step_results.last() parsed as Value). For flows with no steps (degenerate) the result is Value::Null.

trace_id is converted from the legacy u64 to a Uuid v4 hex string. When the legacy id is 0 (pre-record), a fresh Uuid is minted.

impl FlowEnvelope

pub fn seal(self) -> Self

v2.0.0 — apply epistemic enforcement + compute the audit_chain_hash before wire serialization. This is the ONLY public sealing surface; the wire bytes emitted by axon_server MUST pass through this method (the seal() invariant — v2.0.0 establishes it; 39.h grep gate locks it structurally).

v2.0.0 implementation (C23 kernel canonical)

1. Theorem 5.1 enforcement DELEGATES to the C23 kernel axon-csys::envelope::validate_degradation. The kernel: a. Defensively normalises NaN / Inf / out-of-range certainty into [0.0, 1.0]. b. Clamps certainty ≤ 0.99 when derived_status = true. c. Returns the envelope with derived_status + epistemic_kind passed through unchanged. The C23 kernel is the SINGLE point of structural truth — no Rust path bypasses it for production code paths.
2. derived_status algebra (Rust-side, matches the producer in FlowEnvelope::from_execution_result verbatim): derived = step_audit.anchor_breaches > 0 || step_audit.errors > 0. The Rust side decides WHO is derived (semantic); the C23 kernel enforces WHAT the ceiling looks like (structural).
3. audit_chain_hash = SHA-256 hex of the canonical-JSON serialization of [provenance_chain, step_audit]. Deterministic on identical inputs; tamper-evident. (39.c.x leaves the SHA-256 in Rust pending a future step that moves it to axon-csys::crypto for true silicon-grounded tamper-evidence.)

Trait Implementations

impl Clone for FlowEnvelope

fn clone(&self) -> FlowEnvelope

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FlowEnvelope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for FlowEnvelope

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for FlowEnvelope

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.