Struct SchedulerContext 

pub struct SchedulerContext<'a> {

    pub accessible_workdir: PathBuf,
    pub session_workdir: PathBuf,
    pub capability_policy: CapabilityPolicy,
    pub installed_tools: HashSet<String>,
    pub capsule_versions: HashMap<String, String>,
    pub current_session_id: Option<String>,
    pub current_context_id: Option<String>,
    pub registry: Arc<dyn Registry>,
    pub spawn_credential: Option<SpawnCredential>,
    pub formation_id: Option<FormationId>,
    pub trace: Option<&'a PlanTraceAppender>,
    pub gate_step: &'a (dyn Fn(&PlannedCall<'_>) -> Option<String> + Sync),
    pub invoke_tool: &'a (dyn Fn(&str, ToolInput) -> Result<ToolResult, String> + Sync),
    pub task: Option<&'a dyn PlanTask>,
}

Fields

accessible_workdir: PathBuf

The directory a shell step runs in and a tool step resolves a data_path against — the capsule’s own workdir, which under --workdir is the operator’s directory.

session_workdir: PathBuf

<accessible_workdir>/.murmur/<session id>/ under --workdir, and the same path as Self::accessible_workdir without it. Where a shell step’s synthetic $HOME and, on a sealed host, its /tmp and /etc staging live.

capability_policy: CapabilityPolicy

installed_tools: HashSet<String>

capsule_versions: HashMap<String, String>

current_session_id: Option<String>

current_context_id: Option<String>

The conversation the task that started this plan is running in, named on the MURMUR_SPAWNER handle every capsule step injects into its child.

Nothing is minted here. None names no conversation and injects no handle at all, which is the existing behaviour for a caller that has none, and not an error: a child told it was spawned from a conversation that does not exist is worse than one told nothing.

registry: Arc<dyn Registry>

Where a capsule step reads a sub-capsule’s manifest from, to learn which host variables that sub-capsule declares. The session’s own store, so a step resolves the artifact its child will run.

spawn_credential: Option<SpawnCredential>

The credential this session presents to mur-roost when a capsule step delegates.

None for every session that was not granted capabilities.spawn.allow, and a capsule step in such a session fails before any request is made. The token is held here and read exactly twice — into the two request headers below — so nothing that formats this context, a step result or a trace record can carry it.

formation_id: Option<FormationId>

The session’s formation, which every capsule step’s child joins. None for a session nobody placed in a formation, whose children carry none either.

trace: Option<&'a PlanTraceAppender>

Where this run’s per-step lifecycle records and its capsule steps’ delegation records go, or None to record nothing.

Emission is opt-in at the call site: with None no file is opened and no line is written, and the run’s ExecutionReport is identical either way.

A capsule step writes into it twice over, and the two pairs describe different things: the plan-step pair is the scheduler’s unit of work — its dependencies, its attempts, its status after on_error — and the delegation pair is one child launch, named by its dlg_ id. A retried step is one plan step and several delegations.

gate_step: &'a (dyn Fn(&PlannedCall<'_>) -> Option<String> + Sync)

The session’s own pre-dispatch decision point, asked about every tool and shell step before it runs. Some(reason) fails that step with reason as its error and dispatches nothing.

A plan step is a call the model made, one indirection removed, so it is subject to the same two refusals a direct call is: capabilities.filesystem.read_only and a commit_policy: deny policy hook. Without this the scheduler would reach the session’s executors underneath both, and a command the session refuses would run as a plan step.

A capsule step is not asked about: it runs nothing in this session, and the child it delegates to applies its own manifest to whatever it does.

invoke_tool: &'a (dyn Fn(&str, ToolInput) -> Result<ToolResult, String> + Sync)

task: Option<&'a dyn PlanTask>

The task this plan runs for, or None for a run that cannot be cancelled and whose capsule steps account for their children in no set beyond their own trace lines.

Once it reports cancelled, a running capsule step ends its sub-capsule, no step is retried or dispatched, and the run ends canceled. A tool or shell step already running finishes on its own bound.