Crate chio_kernel_core 

Portable Chio kernel core.

This crate contains the pure-compute subset of Chio evaluation as a no_std + alloc library so the same verdict-producing code can run inside a browser (wasm32-unknown-unknown), a Cloudflare Worker (wasm32-wasip1), a mobile app (UniFFI static lib), or the desktop sidecar (chio-kernel). The contract is described in docs/protocols/PORTABLE-KERNEL-ARCHITECTURE.md.

What lives here

• Verdict – the three-valued outcome of an evaluation.
• Guard – the sync guard trait (identical signature to chio_kernel::Guard, modulo Error surface mapped onto KernelCoreError).
• GuardContext – the inputs a guard sees.
• [evaluate] – pure compute that walks a capability + request through the sync checks (signature, time, subject binding, scope, guard pipeline) and returns Ok(Verdict::Allow) or Ok(Verdict::Deny { reason }). No I/O, no budget mutation, no revocation lookup.
• verify_capability – offline capability verification used by tools that only need to inspect a token (no scope, no revocation).
• sign_receipt – WYSIWYS signing: recompute content_hash over the supplied canonical content inside the trust boundary and refuse on mismatch (fail-closed). The production signing primitive.
• sign_receipt_with_handle – WYSIWYS signing bound to a one-time, move-only signing handle (the strongest API; cannot be replayed).
• sign_receipt_relaying_trusted_body – body-only relay that trusts the caller content_hash; for transport adapters that cannot hold the content preimage (mobile/browser/cpp-ffi). Explicit, auditable trust seam.
• Clock / Rng – abstract trait boundaries for time/entropy so adapters on wasm/mobile can inject platform clocks and CSPRNGs.

What stays in chio-kernel

The full chio-kernel crate keeps every piece that actually touches I/O or async: tokio tasks, rusqlite receipt/revocation/budget stores, ureq price-oracle client, lru DPoP nonce cache, async session ops, HTTP/stdio transport, nested-flow bridges, tool-server dispatch. Those modules depend on chio-kernel-core for the pure-compute kernels but add the IO glue around them.

no_std status

The crate is #![no_std] with extern crate alloc;. At the source level we never name std::*, and the portable proof is scripted in scripts/check-portable-kernel.sh.

That proof runs both:

• cargo build -p chio-kernel-core --no-default-features
• cargo build -p chio-kernel-core --target wasm32-unknown-unknown --no-default-features

The browser and mobile adapter crates perform their own platform-specific qualification on top of this core.

Re-exports

pub use budget_split::BudgetRegistry;

pub use budget_split::BudgetSplit;

pub use budget_split::BudgetSplitError;

pub use budget_split::InMemoryBudgetRegistry;

pub use budget_split::NoopBudgetRegistry;

pub use budget_split::MAX_BUDGET_SHARE_BPS;

pub use capability_verify::verify_capability;

pub use capability_verify::verify_capability_full;

pub use capability_verify::verify_capability_full_with_root;

pub use capability_verify::verify_capability_with_floor;

pub use capability_verify::verify_capability_with_floor_and_resolver;

pub use capability_verify::verify_capability_with_floor_and_trust_root;

pub use capability_verify::verify_capability_with_negotiated_floor;

pub use capability_verify::CapabilityError;

pub use capability_verify::CapabilityFeatureContext;

pub use capability_verify::TrustRootResolver;

pub use capability_verify::VerifiedCapability;

pub use clock::Clock;

pub use clock::FixedClock;

pub use evaluate::evaluate;

pub use evaluate::evaluate_with_crypto_floor;

pub use evaluate::evaluate_with_crypto_floor_and_budgets;

pub use evaluate::evaluate_with_full_floor;

pub use evaluate::evaluate_with_full_floor_and_root;

pub use evaluate::EvaluateInput;

pub use evaluate::EvaluationVerdict;

pub use evaluate::KernelCoreError;

pub use guard::Guard;

pub use guard::GuardContext;

pub use guard::PortableToolCallRequest;

pub use normalized::NormalizationError;

pub use normalized::NormalizedCapability;

pub use normalized::NormalizedConstraint;

pub use normalized::NormalizedEvaluationVerdict;

pub use normalized::NormalizedMonetaryAmount;

pub use normalized::NormalizedOperation;

pub use normalized::NormalizedPromptGrant;

pub use normalized::NormalizedRequest;

pub use normalized::NormalizedResourceGrant;

pub use normalized::NormalizedRuntimeAssuranceTier;

pub use normalized::NormalizedScope;

pub use normalized::NormalizedToolGrant;

pub use normalized::NormalizedVerdict;

pub use normalized::NormalizedVerifiedCapability;

pub use passport_verify::verify_parsed_passport;

pub use passport_verify::verify_passport;

pub use passport_verify::PortablePassportBody;

pub use passport_verify::PortablePassportEnvelope;

pub use passport_verify::VerifiedPassport;

pub use passport_verify::VerifyError;

pub use passport_verify::PORTABLE_PASSPORT_SCHEMA;

pub use receipts::sign_receipt;

pub use receipts::sign_receipt_relaying_trusted_body;

pub use receipts::sign_receipt_with_handle;

pub use receipts::ReceiptSigningError;

pub use revocation_view::RevocationSnapshot;

pub use revocation_view::RevocationView;

pub use revocation_view::RevocationViewError;

pub use revocation_view::RevocationViewSubject;

pub use rng::NullRng;

pub use rng::Rng;

pub use scope::MatchedGrant;

pub use scope::ScopeMatchError;

Modules

budget_split

Sibling-sum budget enforcement for delegated capability tokens.

capability_verify

Pure capability verification.

clock

Abstract clock for capability time-bound enforcement.

evaluate

Pure-compute verdict evaluation.

guard

Sync guard trait for portable evaluation.

normalized

Proof-facing normalized types for the bounded verified core.

passport_verify

Portable passport verification.

receipts

Portable receipt signing.

revocation_view

Read-only revocation snapshot consulted on every dispatch.

rng

Abstract entropy source for receipt IDs and DPoP nonces.

scope

Portable scope matching for tool grants.

Enums

Verdict

Three-valued outcome of a kernel evaluation step.