Module offdevice_hook 

The OffdeviceCallHook trait — the off-device call governance seam.

Cloud-bound LLM calls made by the memory subsystem (summarizers, embedders, anything that ships a chunk’s content over the network) are themselves governable events per cellar-memory-manager.md §11 / §16 “Privacy footgun.” Before such a call dispatches, the producer calls OffdeviceCallHook::before_call(descriptor). The hook can:

• return Ok(OffdeviceDecision::Allow) — the call proceeds.
• return Ok(OffdeviceDecision::Veto { reason }) — the producer skips the network round-trip and surfaces a structured error to the caller. Used to honor rules like “never call Anthropic during work hours” or “require confirmation on first off-device memory call per session.”
• return Err(_) — the call surfaces as a hard error to the caller.

The daemon wires a hook backed by the rule matcher: it synthesises a MemoryOffdeviceCallAttempted event from the descriptor, runs the rule matcher over it, and returns the appropriate decision.

Without a hook, producers always proceed — the test default and the correct behavior for daemons that haven’t wired the rule matcher path yet.

Structs

ClosureOffdeviceHook

Convenience wrapper for callers that want to plug a closure in without declaring a struct. Useful for tests and for the daemon’s adapter that wraps the rule matcher.

OffdeviceCallDescriptor

Describes the off-device call a producer is about to make. Passed to OffdeviceCallHook::before_call so rules can match on kind / provider / model / subsystem.

Enums

OffdeviceDecision

What an OffdeviceCallHook tells the producer to do.

Traits

OffdeviceCallHook

The hook producers consult before dispatching an off-device call.