Module offdevice_hook 

The OffdeviceCallHook trait — the off-device call governance seam.

Cloud-bound LLM calls made by the memory subsystem (summarizers, embedders, anything that ships a chunk’s content over the network) are themselves governable events — shipping memory content off-device is a privacy footgun. Before such a call dispatches, the producer calls OffdeviceCallHook::before_call(descriptor). The hook can:

• return Ok(OffdeviceDecision::Allow) — the call proceeds.
• return Ok(OffdeviceDecision::Veto { reason }) — the producer skips the network round-trip and surfaces a structured error to the caller. Used to honor rules like “never call Anthropic during work hours” or “require confirmation on first off-device memory call per session.”
• return Err(_) — the call surfaces as a hard error to the caller.

A production runtime can wire this to a policy engine: synthesize an event from the descriptor, evaluate rules, and return the appropriate decision.

Without a hook, producers always proceed.

Structs

ClosureOffdeviceHook

Convenience wrapper for callers that want to plug a closure in without declaring a struct. Useful for tests, examples, and small policy adapters.

OffdeviceCallDescriptor

Describes the off-device call a producer is about to make. Passed to OffdeviceCallHook::before_call so rules can match on kind / provider / model / subsystem.

Enums

OffdeviceDecision

What an OffdeviceCallHook tells the producer to do.

Traits

OffdeviceCallHook

The hook producers consult before dispatching an off-device call.