Crate chio_http_core 

Protocol-agnostic HTTP security types for the Chio kernel.

This crate defines the shared types that every HTTP substrate adapter uses: request model, caller identity, session context, HTTP receipts, and verdicts. It is the foundation for chio-openapi, chio-config, chio api protect, and all language-specific middleware crates.

Re-exports

pub use approvals::handle_batch_respond;

pub use approvals::handle_get_approval;

pub use approvals::handle_list_pending;

pub use approvals::handle_respond;

pub use approvals::ApprovalAdmin;

pub use approvals::ApprovalHandlerError;

pub use approvals::BatchDecisionEntry;

pub use approvals::BatchRespondRequest;

pub use approvals::BatchRespondResponse;

pub use approvals::BatchRespondResult;

pub use approvals::BatchRespondSummary;

pub use approvals::GetApprovalResponse;

pub use approvals::PendingListResponse;

pub use approvals::PendingQuery;

pub use approvals::RespondRequest;

pub use approvals::RespondResponse;

pub use compliance::handle_compliance_score;

pub use compliance::ComplianceScoreError;

pub use compliance::ComplianceScoreRequest;

pub use compliance::ComplianceScoreResponse;

pub use compliance::ComplianceScoreWindow;

pub use compliance::ComplianceSource;

pub use compliance::ComplianceSourceResult;

pub use emergency::handle_emergency_resume;

pub use emergency::handle_emergency_status;

pub use emergency::handle_emergency_stop;

pub use emergency::EmergencyAdmin;

pub use emergency::EmergencyHandlerError;

pub use emergency::EmergencyResumeResponse;

pub use emergency::EmergencyStatusResponse;

pub use emergency::EmergencyStopRequest;

pub use emergency::EmergencyStopResponse;

pub use plan::handle_evaluate_plan;

pub use plan::PlanHandlerError;

pub use regulatory_api::handle_regulatory_receipts_signed;

pub use regulatory_api::sign_regulatory_export;

pub use regulatory_api::verify_regulatory_export;

pub use regulatory_api::RegulatorIdentity;

pub use regulatory_api::RegulatoryApiError;

pub use regulatory_api::RegulatoryReceiptExport;

pub use regulatory_api::RegulatoryReceiptQueryResult;

pub use regulatory_api::RegulatoryReceiptSource;

pub use regulatory_api::RegulatoryReceiptsQuery;

pub use regulatory_api::SignedRegulatoryReceiptExport;

pub use regulatory_api::MAX_REGULATORY_EXPORT_LIMIT;

pub use regulatory_api::REGULATORY_RECEIPT_EXPORT_SCHEMA;

pub use routes::approval_route_registrations;

pub use routes::emergency_route_registrations;

pub use routes::regulatory_route_registrations;

pub use routes::EmergencyRouteRegistration;

pub use routes::APPROVALS_BATCH_RESPOND_PATH;

pub use routes::APPROVALS_GET_PATH;

pub use routes::APPROVALS_PENDING_PATH;

pub use routes::APPROVALS_RESPOND_PATH;

pub use routes::COMPLIANCE_SCORE_PATH;

pub use routes::EMERGENCY_ADMIN_TOKEN_HEADER;

pub use routes::EMERGENCY_RESUME_PATH;

pub use routes::EMERGENCY_STATUS_PATH;

pub use routes::EMERGENCY_STOP_PATH;

pub use routes::EVALUATE_PLAN_PATH;

pub use routes::REGULATORY_RECEIPTS_PATH;

pub use routes::REGULATORY_TOKEN_HEADER;

Modules

approvals

Phase 3.4-3.6 HITL approval HTTP surface.

compliance

Phase 19.1 – HTTP handler for POST /compliance/score.

emergency

Phase 1.4 emergency kill-switch HTTP surface.

plan

Phase 2.4 plan-level evaluation HTTP surface.

regulatory_api

Phase 19.3 – read-only regulatory API over the receipt store.

routes

Route path constants shared across every HTTP substrate adapter.

Structs

CallerIdentity

The identity of the caller as extracted from the HTTP request. This is protocol-agnostic – the same type is used regardless of whether the request came through a reverse proxy, framework middleware, or sidecar.

ChioHttpRequest

A protocol-agnostic HTTP request that Chio evaluates. This is the shared input type for all HTTP substrate adapters – reverse proxy, framework middleware, and sidecar alike.

DenyDetails

Structured deny context attached to Verdict::Deny.

EvaluateResponse

Response body for sidecar HTTP request evaluation.

ExecutionNonce

The signable body of an execution nonce.

ExecutionNonceConfig

Configuration for execution nonce issuance and verification.

GuardEvidence

Evidence from a single guard’s evaluation.

HealthResponse

Response body for sidecar health checks.

HttpAuthority

HttpAuthorityEvaluation

HttpAuthorityInput

HttpReceipt

Signed receipt for an HTTP request evaluation. Binds the request identity, route, method, verdict, and guard evidence under an Ed25519 signature from the kernel.

HttpReceiptBody

The body of an HTTP receipt (everything except the signature). Used for signing and verification.

InMemoryExecutionNonceStore

In-memory LRU-backed execution nonce store.

Keypair

Ed25519 keypair for signing.

NonceBinding

Fields that tie a nonce to one specific tool invocation.

PlanEvaluationRequest

Request body for POST /evaluate-plan.

PlanEvaluationResponse

Response body for POST /evaluate-plan.

PlannedToolCall

One step in a submitted plan.

PreparedHttpEvaluation

PublicKey

Public key for verifying Chio signatures.

SessionContext

Per-session context carried through the Chio HTTP pipeline. A session groups related requests from the same caller over a bounded time window.

Signature

Signature produced by an Chio SigningBackend.

SignedExecutionNonce

A kernel-signed execution nonce ready for transmission on an allow verdict.

StepVerdict

Verdict for a single step in a submitted plan.

VerifyReceiptResponse

Response body for receipt verification.

Enums

AuthMethod

How the caller authenticated to the upstream API.

Error

All errors produced by chio-core.

ExecutionNonceError

All the reasons an execution nonce can fail verification.

HttpAuthorityError

HttpAuthorityPolicy

HttpMethod

HTTP method. Used to determine default policy (GET = session-scoped allow, POST/PUT/PATCH/DELETE = deny without capability).

PlanVerdict

Aggregate verdict across every step in the plan.

SidecarStatus

Sidecar health states.

StepVerdictKind

Allow/deny decision for a single step.

Verdict

The verdict for an HTTP request evaluation. Consistent with chio_core_types::Decision but carries HTTP-specific context.

Constants

CHIO_DECISION_RECEIPT_ID_KEY

CHIO_HTTP_STATUS_SCOPE_DECISION

CHIO_HTTP_STATUS_SCOPE_FINAL

CHIO_HTTP_STATUS_SCOPE_KEY

CHIO_KERNEL_RECEIPT_ID_KEY

EXECUTION_NONCE_SCHEMA

Schema identifier for Chio execution nonces.

Traits

ExecutionNonceStore

Persistence boundary for replay-prevention of execution nonces.

Functions

canonical_json_bytes

Serialize a value to canonical JSON bytes (RFC 8785).

canonical_json_string

Serialize a value to a canonical JSON string (RFC 8785).

http_status_metadata_decision

http_status_metadata_final

http_status_scope

sha256_hex

Compute SHA-256 of the given bytes, returning the hash as lowercase hex.

Type Aliases

PlannedToolCallId

Stable identifier for a planned tool call within a plan.

Result

Convenience alias.