Module origin 

Why a task woke the capsule, and how far its content is trusted.

An origin is set by whoever enqueued the task. A trust class is derived from that origin and, for the two origins that cross a capsule boundary, from the trust of the sending capsule’s own current task. No sender declares its trust class: TaskProvenance has no constructor that takes one on its own, so “derived, never declared” is a property of the type rather than a convention callers are asked to keep.

Nothing in the runtime branches on trust: the value is recorded on task_start and left on the store state for the task’s duration, and no task is refused, delayed or reordered for it. The origin half is not inert — it picks the queue lane a task waits in, so two tasks with the same trust can still run in a different order. See crate::lanes.

Structs

TaskProvenance

An origin paired with the trust class derived from it.

Enums

TaskOrigin

Why the runtime woke the capsule.

TrustClass

How far the content of a task is trusted.

Constants

PEER_ORIGIN_HEADER

Header carrying the sending runtime’s origin claim on an inter-capsule request.

PEER_TRUST_HEADER

Header carrying the trust class of the sending capsule’s own current task.

Functions

artifact_trust

How far an installed artifact’s text is trusted, from who pinned it in murmur.lock.

from_wire

Classify a task arriving over the peer door from the two request headers.

stamp_for_peer

The provenance a runtime stamps on an outbound peer message, given its own current task.