Module steer 

Steering: pause, resume and veto, the privileged kinds of a message (msg.rs Kind).

They travel as lines of messages.jsonl like any message, and count only under a role: an Admission in <store>/messages/admitted.jsonl names the message (id and node) and the role its node was checked under. This node’s own lines are admitted when sent (Role::Local: the engineer at this machine steers its own sessions). Another node’s are admitted by the mesh, which knows the line’s origin key and the membership: only a node whose member role is admin or steer (Role::of_member); a share: local collective never admits another node. A privileged line without an admission is neither shown nor in force. The hook does no crypto and no network: one failed stat (active) when nobody ever steered, at every tool call.

Delivery is msg.rs deliver’s, at a prompt or tool call on every harness: each veto once, and of the pauses and resumes only the latest (claimed with every earlier one), labelled with the sender and the role (label).

Pause (around): while the latest admitted pause/resume for a session is a pause, its pre-tool hook refuses every tool call with the reason, and its stop is not blocked (stopping is waiting), nor does the conscience run. Past TTL_MS a steer no longer counts; anything unreadable fails open: not paused.

Bounded: every write to the admissions drops entries past the TTL and keeps the KEEP newest, and removes the file once it is empty; the refusal log keeps its newest DROPPED_BYTES or so.

Structs

Admission

One line of admitted.jsonl: the message id from node counts under role. ms is the message’s, so the entry goes when the message no longer counts.

Dropped

A privileged message refused on admission: one line of the refusal log.

Roles

The admissions in force, by message id.

Enums

Role

The role a privileged message counts under.

Constants

DROPPED_BYTES

The refusal log keeps about this many bytes: past twice that, the older half goes. Guard: a node refusing a flood of forged or unadmitted steers cannot fill the disk.

KEEP

The most entries the admissions keep: the newest. Guard: bounds the file the hook reads at every tool call while anyone steers (a flood of admitted steers cannot grow it).

SLACK_MS

How long past a TTL an entry is kept before pruning. Derived from msg.rs SKEW_MS, the one clock skew between members: an entry must outlive its TTL by at least that skew, or a member whose clock runs that far behind would still count, and offer back, a line this node already pruned. The 60 skews (one hour) are margin kept from before it was derived, so pruning is unchanged; the slack only delays when dead entries leave the disk, never what counts (that checks the TTL alone).

TTL_MS

A steer older than this no longer counts: not shown, and a pause no longer holds (fail open). Guard: a pause the engineer forgot, or whose resume never arrived, stops a session for a day (clock::DAY_MS) at most.

Functions

active

Whether anyone steers in this store: the hook’s one stat.

admit

Adds admissions, each id once, under the file’s lock. Expired entries go and at most KEEP newest stay (keep_bounded). Returns how many were new.

admitted_path

around

The hook’s call around everything else the hook would answer (inner: the checkpoint). At a tool call it refuses while paused and says nothing otherwise (inner is not called); at a stop while paused it neither blocks nor runs inner. started is the session’s start (presence.rs).

dropped_path

Privileged messages refused on admission, and why (the mesh writes it).

keep_bounded

Drops entries past the TTL (with slack) and keeps the KEEP newest, in their order.

label

One steer as the recipient sees it, on one line (msg.rs keeps the text on one).

lines

One JSON line per item.

log_dropped

Appends d to the refusal log, keeping it bounded (fail quietly: it is for the engineer).

notices

What deliver shows of mine (the session’s messages, as msg.rs applies takes them) that steers it: every admitted veto not shown, and the latest admitted pause or resume if not shown, oldest first; and every pause/resume id, claimed with a shown one.

pause

The pause in force for session (started at started; None: no broadcast is its), if the latest admitted pause or resume for it is a pause.

pause_reason

The pre-tool refusal while paused.

paused

read_admitted

retain

Keeps only the admissions keep still allows and keep_bounded keeps at now (the mesh calls it every round: a revoked or demoted node’s pause stops holding, an expired one goes). Returns how many went.

rewrite

Replaces p with body atomically (a reader sees the old file or the new one).

roles

The admissions of the store home (none when nobody steers).