boundgraph_core/
lib.rs

1//! Core primitives for the BoundGraph runtime.
2//!
3//! BoundGraph governs the span between a reasoning engine proposing an action and a
4//! state change committing. This crate defines the immutable values that span
5//! is made of, and nothing else: no execution, no policy, no I/O.
6//!
7//! # The primitives
8//!
9//! | Symbol | Type | Role |
10//! |---|---|---|
11//! | `ω` | [`WorkOrder`] | A typed declaration of intended effect. A *proposal*. |
12//! | `Γ` | [`Context`] | The exact admitted token window, plus what was refused. |
13//! | `κ` | [`Condensate`] | A size-capped, structure-preserving summary of a result. |
14//! | `ε` | [`Evidence`] | A signed verdict from a model-free checker. |
15//! | `λ` | [`LedgerEntry`] | One tamper-evident record in the audit chain. |
16//!
17//! # Two invariants everything else rests on
18//!
19//! **Immutability.** Every primitive is constructed complete and never mutated.
20//! There are no setters. A "change" is a new value with a new [`Digest`].
21//!
22//! **Content addressing.** Identity is the `blake3` digest of the canonical
23//! CBOR encoding ([`Canonical`]). Equal digests mean equal values, which is
24//! what lets the ledger be verified by a third party and lets the content
25//! addressed store deduplicate.
26//!
27//! # How the Foundation Laws show up here
28//!
29//! The laws are enforced by the compiler and the runtime, not by this crate.
30//! What this crate does is make them *representable* — and make violating them
31//! awkward:
32//!
33//! - **Law I (Authority).** [`GrantSet::EMPTY`] is the default and there is no
34//!   value meaning "unrestricted", so a step that declares nothing gets
35//!   nothing. [`GrantDelta`] records requested against granted, so attenuation
36//!   is auditable rather than inferred.
37//! - **Law II (Context).** [`Context`] records what was *refused* as well as
38//!   what was admitted, and construction fails if admissions exceed the
39//!   ceiling. [`Condensate`] caps a result while keeping the original
40//!   addressable.
41//! - **Law III (Evidence).** [`Verdict`] has no implicit pass, and
42//!   [`Evidence::covers`] means a verdict cannot be reattached to data it never
43//!   saw.
44
45#![doc(html_root_url = "https://docs.rs/boundgraph-core")]
46
47pub mod budget;
48pub mod canonical;
49pub mod condensate;
50pub mod context;
51pub mod cost;
52pub mod digest;
53pub mod error;
54pub mod evidence;
55pub mod grant;
56pub mod id;
57pub mod isolation;
58pub mod ledger;
59pub mod work_order;
60
61pub use budget::{Budget, Excess, MICROS_PER_USD, Unit, micros_of_usd};
62pub use canonical::{Canonical, CanonicalError, from_canonical_cbor, to_canonical_cbor};
63pub use condensate::{Condensate, CondensatePayload, SchemaId, SlicerId};
64pub use context::{
65    AdmittedItem, Context, ContextSource, EvictionReason, EvictionRecord, TokenBudget,
66};
67pub use cost::{AsOf, AsOfParseError, CostModel, Pricing, PricingError, TokenUsage};
68pub use digest::{DIGEST_LEN, Digest, DigestParseError};
69pub use error::{BoundGraphError, Result};
70pub use evidence::{CheckerId, Evidence, EvidenceKind, Signature, SigningKeyId, Verdict};
71pub use grant::{GrantAtom, GrantAtomParseError, GrantSet, KNOWN_DOMAINS};
72pub use id::{RunId, StepId};
73pub use isolation::{Confinement, Enforcement, Isolation, Tier, Worker};
74pub use ledger::{CostRecord, GENESIS_PREV, GrantDelta, JournalRef, LedgerEntry};
75pub use work_order::{Intent, ProposalOrigin, ToolCall, WorkOrder};
boundgraph_core/lib.rs

boundgraph_core/
lib.rs
