Module formation 

The formation a session belongs to, and the one id that names it.

A formation is the set of sessions launched together to carry out one task. Its id is minted once, by whatever launches the formation’s members, and handed to each member through FORMATION_ID_ENV. A member’s own delegation plane hands the same id to every child it spawns, so a child joins its parent’s formation and never mints one. Nothing else mints: a standalone mur run that delegates grows a delegation tree, not a formation, and that tree’s sessions carry no formation id — they are joined by lineage (session_start.spawned_by, delegation_id) instead.

The id groups; it grants nothing. No authorization decision reads it alone — not the door’s Bearer check, not task-origin classification, not peer handoff, not the spawn referee. What a member may call is decided by a formation token (crate::formation_credentials), which the launcher signs over the id together with the caller and the callee; a session that merely carries the id, a delegated child among them, holds no such token and reaches nobody by it.

It belongs to the session, not the process. FormationId::from_env is the one read of FORMATION_ID_ENV from a process environment, and only mur run — whose process is one session — calls it, before the workspace .env is loaded. From there the id travels on crate::StageRequest::formation_id and the staged session, which is what hooks and the delegation plane read, so an in-process caller staging two sessions gives each its own.

The shape is strict. frm_ followed by the 32 lowercase hex digits of a UUIDv7: opaque, derived from nothing about the formation, its members or the host, and time-ordered so ids sort by launch. A value that sessions are grouped on admits no near-misses, so anything else in the variable — other than nothing at all — refuses the launch.

A member’s guests are handed its callees’ names. FORMATION_PEERS_ENV is set by a member’s runtime inside its own WASM guests, never by a launcher in a process environment: each callee at its virtual address http://<name>.formation.invalid, which only the runtime’s egress can reach. mur run refuses a launch whose own environment carries the variable (refuse_formation_peers_in_process_env). A delegated child and a subprocess are never handed it.

Structs

FormationId

The id of the formation a session belongs to, matching ^frm_[0-9a-f]{32}$.

FormationPeer

One member a member may call, and the address its guests call it at.

FormationPeers

The value of FORMATION_PEERS_ENV: name=url pairs separated by single spaces, in roster order, with at least one pair.

Constants

FORMATION_ID_ENV

The variable a launcher sets in a member’s environment, and a member’s runtime sets in each child’s, carrying its FormationId.

FORMATION_ID_PREFIX

Prefix on every formation id. Distinct from ses_/ctx_/tsk_/dlg_/wrk_, so a reader can tell at a glance which id space a value belongs to.

FORMATION_PEERS_ENV

The variable a formation member’s runtime sets in each of its WASM guests, naming every member the roster lets it call at that member’s virtual address.

Functions

refuse_formation_peers_in_process_env

Err when FORMATION_PEERS_ENV is set in this process’s environment.