Trait ReceiptStore 

pub trait ReceiptStore: Send + Sync {
    // Required methods
    fn append_chio_receipt(
        &self,
        receipt: &ChioReceipt,
    ) -> Result<(), ReceiptStoreError>;
    fn append_child_receipt(
        &self,
        receipt: &ChildRequestReceipt,
    ) -> Result<(), ReceiptStoreError>;

    // Provided methods
    fn admission_projection_capabilities(
        &self,
    ) -> AdmissionProjectionCapabilities { ... }
    fn commit_admission_projection(
        &self,
        _projection: &AdmissionTerminalProjection,
    ) -> Result<AdmissionTerminal, ReceiptStoreError> { ... }
    fn settlement_store_binding(&self) -> Option<SettlementStoreBinding> { ... }
    fn atomic_receipt_projection(&self) -> AtomicReceiptProjection { ... }
    fn supports_atomic_receipt_projection_with_timeout(&self) -> bool { ... }
    fn append_chio_receipt_with_pending_observation(
        &self,
        _receipt: &ChioReceipt,
        _pending: &PendingSettlementObservation,
    ) -> Result<(), ReceiptStoreError> { ... }
    fn append_chio_receipt_with_pending_observation_and_timeout(
        &self,
        _receipt: &ChioReceipt,
        _pending: &PendingSettlementObservation,
        _budget: Duration,
    ) -> Result<Option<u64>, ReceiptStoreError> { ... }
    fn load_chio_receipt(
        &self,
        _receipt_id: &str,
    ) -> Result<Option<ChioReceipt>, ReceiptStoreError> { ... }
    fn load_child_receipt(
        &self,
        _receipt_id: &str,
    ) -> Result<Option<ChildRequestReceipt>, ReceiptStoreError> { ... }
    fn append_chio_receipt_canonical(
        &self,
        receipt: &ChioReceipt,
        _canonical: &CanonicalBytes,
    ) -> Result<(), ReceiptStoreError> { ... }
    fn append_chio_receipt_returning_seq(
        &self,
        receipt: &ChioReceipt,
    ) -> Result<Option<u64>, ReceiptStoreError> { ... }
    fn append_chio_receipt_with_timeout(
        &self,
        receipt: &ChioReceipt,
        _budget: Duration,
    ) -> Result<Option<u64>, ReceiptStoreError> { ... }
    fn writer_liveness(
        &self,
        _stall_threshold: Duration,
    ) -> ReceiptWriterLiveness { ... }
    fn append_chio_receipt_consuming_authorization(
        &self,
        _receipt: &ChioReceipt,
        _consumption: &AuthorizationReceiptConsumption,
    ) -> Result<(), ReceiptStoreError> { ... }
    fn append_child_receipt_returning_seq(
        &self,
        receipt: &ChildRequestReceipt,
    ) -> Result<Option<u64>, ReceiptStoreError> { ... }
    fn append_child_receipt_with_timeout(
        &self,
        receipt: &ChildRequestReceipt,
        _budget: Duration,
    ) -> Result<Option<u64>, ReceiptStoreError> { ... }
    fn receipts_canonical_bytes_range(
        &self,
        _start_seq: u64,
        _end_seq: u64,
    ) -> Result<Vec<(u64, Vec<u8>)>, ReceiptStoreError> { ... }
    fn flush_receipt_writes(
        &self,
    ) -> Result<ReceiptFlushReport, ReceiptStoreError> { ... }
    fn flush_receipt_writes_with_timeout(
        &self,
        _timeout: Duration,
    ) -> Result<ReceiptFlushReport, ReceiptStoreError> { ... }
    fn receipt_store_health(
        &self,
    ) -> Result<ReceiptStoreHealthReport, ReceiptStoreError> { ... }
    fn writer_serving_closed(&self) -> bool { ... }
    fn latest_committed_entry_seq(&self) -> Result<u64, ReceiptStoreError> { ... }
    fn latest_checkpointed_entry_seq(&self) -> Result<u64, ReceiptStoreError> { ... }
    fn next_checkpoint_range(
        &self,
        _max_batch: u64,
    ) -> Result<Option<ReceiptCheckpointRange>, ReceiptStoreError> { ... }
    fn receipt_checkpoint_status(
        &self,
        _max_batch: Option<u64>,
    ) -> Result<ReceiptCheckpointStatusReport, ReceiptStoreError> { ... }
    fn store_checkpoint(
        &self,
        _checkpoint: &KernelCheckpoint,
    ) -> Result<(), ReceiptStoreError> { ... }
    fn create_next_receipt_checkpoint(
        &self,
        _max_batch: u64,
        _keypair: &Keypair,
    ) -> Result<ReceiptCheckpointCreateReport, ReceiptStoreError> { ... }
    fn load_checkpoint_by_seq(
        &self,
        _checkpoint_seq: u64,
    ) -> Result<Option<KernelCheckpoint>, ReceiptStoreError> { ... }
    fn load_latest_checkpoint(
        &self,
    ) -> Result<Option<KernelCheckpoint>, ReceiptStoreError> { ... }
    fn supports_kernel_signed_checkpoints(&self) -> bool { ... }
    fn enable_background_checkpoints(
        &self,
        _keypair: Keypair,
        _max_batch: u64,
    ) -> Result<bool, ReceiptStoreError> { ... }
    fn supports_retention(&self) -> bool { ... }
    fn supports_tenant_scoped_retention(&self) -> bool { ... }
    fn rotate_receipts(
        &self,
        _config: &RetentionConfig,
    ) -> Result<u64, ReceiptStoreError> { ... }
    fn record_retention_rotation_outcome(&self, _failure: Option<&str>) { ... }
    fn record_capability_snapshot(
        &self,
        _token: &CapabilityToken,
        _parent_capability_id: Option<&str>,
    ) -> Result<(), ReceiptStoreError> { ... }
    fn record_capability_snapshot_with_timeout(
        &self,
        token: &CapabilityToken,
        parent_capability_id: Option<&str>,
        _budget: Duration,
    ) -> Result<(), ReceiptStoreError> { ... }
    fn get_capability_snapshot(
        &self,
        _capability_id: &str,
    ) -> Result<Option<CapabilitySnapshot>, ReceiptStoreError> { ... }
    fn get_capability_delegation_chain(
        &self,
        _capability_id: &str,
    ) -> Result<Vec<CapabilitySnapshot>, ReceiptStoreError> { ... }
    fn resolve_credit_bond(
        &self,
        _bond_id: &str,
    ) -> Result<Option<CreditBondRow>, ReceiptStoreError> { ... }
    fn record_session_anchor(
        &self,
        _session_id: &str,
        _anchor_id: &str,
        _auth_context_fingerprint: &str,
        _issued_at: u64,
        _supersedes_anchor_id: Option<&str>,
        _anchor_json: &Value,
    ) -> Result<(), ReceiptStoreError> { ... }
    fn record_request_lineage(
        &self,
        _session_id: &str,
        _request_id: &str,
        _parent_request_id: Option<&str>,
        _session_anchor_id: Option<&str>,
        _recorded_at: u64,
        _request_fingerprint: Option<&str>,
        _lineage_json: &Value,
    ) -> Result<(), ReceiptStoreError> { ... }
    fn record_receipt_lineage_statement(
        &self,
        _child_receipt_id: &str,
        _request_id: Option<&str>,
        _session_id: Option<&str>,
        _session_anchor_id: Option<&str>,
        _parent_request_id: Option<&str>,
        _parent_receipt_id: Option<&str>,
        _chain_id: Option<&str>,
        _recorded_at: u64,
        _statement_json: &Value,
    ) -> Result<(), ReceiptStoreError> { ... }
    fn get_receipt_lineage_verification(
        &self,
        _receipt_id: &str,
    ) -> Result<Option<ReceiptLineageVerification>, ReceiptStoreError> { ... }
    fn list_receipt_lineage_statement_links(
        &self,
        _receipt_id: &str,
    ) -> Result<Vec<ReceiptLineageStatementLink>, ReceiptStoreError> { ... }
    fn as_any_mut(&self) -> Option<&dyn Any> { ... }
}

Required Methods

fn append_chio_receipt( &self, receipt: &ChioReceipt, ) -> Result<(), ReceiptStoreError>

fn append_child_receipt( &self, receipt: &ChildRequestReceipt, ) -> Result<(), ReceiptStoreError>

Provided Methods

fn admission_projection_capabilities(&self) -> AdmissionProjectionCapabilities

fn commit_admission_projection( &self, _projection: &AdmissionTerminalProjection, ) -> Result<AdmissionTerminal, ReceiptStoreError>

fn settlement_store_binding(&self) -> Option<SettlementStoreBinding>

Identify the durable writer shared with a settlement outcome store.

fn atomic_receipt_projection(&self) -> AtomicReceiptProjection

Report the atomic receipt-sidecar projection implemented by this store.

fn supports_atomic_receipt_projection_with_timeout(&self) -> bool

Whether the atomic receipt projection also honors the supplied append deadline. Settlement runtime installation requires this capability so a legacy atomic-only store cannot reintroduce an unbounded writer wait.

fn append_chio_receipt_with_pending_observation( &self, _receipt: &ChioReceipt, _pending: &PendingSettlementObservation, ) -> Result<(), ReceiptStoreError>

Atomically append a receipt and its initial settlement observation.

The default fails without appending either record.

fn append_chio_receipt_with_pending_observation_and_timeout( &self, _receipt: &ChioReceipt, _pending: &PendingSettlementObservation, _budget: Duration, ) -> Result<Option<u64>, ReceiptStoreError>

Atomically append a receipt and its initial settlement observation while honoring the receipt-append deadline on stores with an async writer.

The default fails without invoking the legacy unbounded atomic method. Stores that advertise supports_atomic_receipt_projection_with_timeout must override this method and enforce budget.

fn load_chio_receipt( &self, _receipt_id: &str, ) -> Result<Option<ChioReceipt>, ReceiptStoreError>

Load a chio receipt by id. The provided default returns None; a store backing a store-authoritative deployment MUST override this (and load_child_receipt) with a real point lookup.

The kernel consults this BEFORE the bounded in-memory receipt mirror and falls back to the mirror only on a genuine Ok(None) miss. An append-only or remote store that does NOT override this therefore relies entirely on the mirror for point lookups: once the mirror evicts a receipt (past receipt_mirror_capacity), governed call-chain validation of an older parent_receipt_id misses both the store and the mirror and fails closed (a deny of the dependent claim, never a false allow). A store-authoritative remote deployment that must resolve older parent receipts MUST implement this point load so bounded-mirror eviction does not cause false denials.

fn load_child_receipt( &self, _receipt_id: &str, ) -> Result<Option<ChildRequestReceipt>, ReceiptStoreError>

Load a child-request receipt by id. Provided default returns None; a store used for a store-authoritative deployment must override both this and load_chio_receipt. A miss is a fail-closed deny of the dependent call-chain claim, never a false allow. The same bounded-mirror eviction caveat documented on load_chio_receipt applies.

fn append_chio_receipt_canonical( &self, receipt: &ChioReceipt, _canonical: &CanonicalBytes, ) -> Result<(), ReceiptStoreError>

fn append_chio_receipt_returning_seq( &self, receipt: &ChioReceipt, ) -> Result<Option<u64>, ReceiptStoreError>

fn append_chio_receipt_with_timeout( &self, receipt: &ChioReceipt, _budget: Duration, ) -> Result<Option<u64>, ReceiptStoreError>

Append a receipt, failing closed with ReceiptStoreError::Timeout if the commit round trip exceeds budget. The default ignores the budget and keeps the unbounded behavior for stores without an async writer; a store with a commit actor overrides this so a wedged writer cannot pin the kernel-wide receipt write lock indefinitely.

fn writer_liveness(&self, _stall_threshold: Duration) -> ReceiptWriterLiveness

Point-in-time writer liveness, assessed against the operator-configured stall threshold. Default Unknown keeps stores with no async writer, or no watchdog wired, permissive at the pre-dispatch gate; such stores ignore the threshold.

fn append_chio_receipt_consuming_authorization( &self, _receipt: &ChioReceipt, _consumption: &AuthorizationReceiptConsumption, ) -> Result<(), ReceiptStoreError>

fn append_child_receipt_returning_seq( &self, receipt: &ChildRequestReceipt, ) -> Result<Option<u64>, ReceiptStoreError>

fn append_child_receipt_with_timeout( &self, receipt: &ChildRequestReceipt, _budget: Duration, ) -> Result<Option<u64>, ReceiptStoreError>

Append a child receipt, failing closed with ReceiptStoreError::Timeout if the commit round trip exceeds budget. The default ignores the budget and keeps the unbounded behavior for stores without an async writer; a store with a commit actor overrides this so a wedged writer cannot pin the kernel-wide receipt write lock while nested-flow child receipts drain.

fn receipts_canonical_bytes_range( &self, _start_seq: u64, _end_seq: u64, ) -> Result<Vec<(u64, Vec<u8>)>, ReceiptStoreError>

fn flush_receipt_writes(&self) -> Result<ReceiptFlushReport, ReceiptStoreError>

fn flush_receipt_writes_with_timeout( &self, _timeout: Duration, ) -> Result<ReceiptFlushReport, ReceiptStoreError>

fn receipt_store_health( &self, ) -> Result<ReceiptStoreHealthReport, ReceiptStoreError>

fn writer_serving_closed(&self) -> bool

Whether the store’s commit writer has degraded to the point that durable persistence can no longer be trusted, so evaluations must fail closed before dispatch rather than after executing a tool with no receipt path.

The default is false: a store with no supervised background writer has nothing to trip. Stores that supervise a writer thread override this to read the writer’s health flag.

fn latest_committed_entry_seq(&self) -> Result<u64, ReceiptStoreError>

fn latest_checkpointed_entry_seq(&self) -> Result<u64, ReceiptStoreError>

fn next_checkpoint_range( &self, _max_batch: u64, ) -> Result<Option<ReceiptCheckpointRange>, ReceiptStoreError>

fn receipt_checkpoint_status( &self, _max_batch: Option<u64>, ) -> Result<ReceiptCheckpointStatusReport, ReceiptStoreError>

fn store_checkpoint( &self, _checkpoint: &KernelCheckpoint, ) -> Result<(), ReceiptStoreError>

fn create_next_receipt_checkpoint( &self, _max_batch: u64, _keypair: &Keypair, ) -> Result<ReceiptCheckpointCreateReport, ReceiptStoreError>

fn load_checkpoint_by_seq( &self, _checkpoint_seq: u64, ) -> Result<Option<KernelCheckpoint>, ReceiptStoreError>

fn load_latest_checkpoint( &self, ) -> Result<Option<KernelCheckpoint>, ReceiptStoreError>

fn supports_kernel_signed_checkpoints(&self) -> bool

fn enable_background_checkpoints( &self, _keypair: Keypair, _max_batch: u64, ) -> Result<bool, ReceiptStoreError>

Install a background checkpoint signer on stores that build their own checkpoints on the writer thread. Returns Ok(false) when the store does not support background checkpointing (default).

fn supports_retention(&self) -> bool

Whether this store actually implements retention rotation (rotate_receipts). Default false: the default rotate_receipts is a fail-closed default, so a kernel configured with retention_config uses this to refuse attaching a store that cannot rotate, rather than serving traffic under a retention policy whose background worker would only log “not supported” on every interval and never archive.

fn supports_tenant_scoped_retention(&self) -> bool

Whether this store can honor a TENANT-SCOPED retention config (RetentionConfig.tenant_id set). Default false: prefix-watermark retention archives a contiguous checkpointed prefix of the WHOLE log and cannot carve out a single tenant, so a tenant-scoped rotate_receipts fails closed. A kernel configured with a tenant-scoped retention policy uses this to refuse attaching a store that could never archive under it, rather than spawning a worker that only logs “unsupported” every interval.

fn rotate_receipts( &self, _config: &RetentionConfig, ) -> Result<u64, ReceiptStoreError>

Archive receipts that have aged out under config (day/size threshold, or an explicit cutoff). Returns the number of archived tool-receipt rows. Default: unsupported (fail-closed) for stores that do not implement retention.

fn record_retention_rotation_outcome(&self, _failure: Option<&str>)

Record the outcome of a background retention rotation so a persistent failure is observable in receipt_store_health (and any health/flush report) rather than living only in logs. None clears a prior failure after a successful rotation; Some(message) records a rotation error or panic so a silently-failing background retention task marks the store unhealthy and surfaces the cause to operators and automation. Default no-op for stores without a health surface.

fn record_capability_snapshot( &self, _token: &CapabilityToken, _parent_capability_id: Option<&str>, ) -> Result<(), ReceiptStoreError>

fn record_capability_snapshot_with_timeout( &self, token: &CapabilityToken, parent_capability_id: Option<&str>, _budget: Duration, ) -> Result<(), ReceiptStoreError>

Record a capability snapshot, failing closed with ReceiptStoreError::Timeout if the writer round trip exceeds budget. The default ignores the budget and keeps the unbounded behavior for stores without an async writer; a store with a commit actor overrides this so a writer that stalls after the pre-dispatch liveness check cannot hang the evaluation hot path inside the snapshot write.

fn get_capability_snapshot( &self, _capability_id: &str, ) -> Result<Option<CapabilitySnapshot>, ReceiptStoreError>

fn get_capability_delegation_chain( &self, _capability_id: &str, ) -> Result<Vec<CapabilitySnapshot>, ReceiptStoreError>

fn resolve_credit_bond( &self, _bond_id: &str, ) -> Result<Option<CreditBondRow>, ReceiptStoreError>

fn record_session_anchor( &self, _session_id: &str, _anchor_id: &str, _auth_context_fingerprint: &str, _issued_at: u64, _supersedes_anchor_id: Option<&str>, _anchor_json: &Value, ) -> Result<(), ReceiptStoreError>

Persist a serialized SessionAnchor (JSON form).

fn record_request_lineage( &self, _session_id: &str, _request_id: &str, _parent_request_id: Option<&str>, _session_anchor_id: Option<&str>, _recorded_at: u64, _request_fingerprint: Option<&str>, _lineage_json: &Value, ) -> Result<(), ReceiptStoreError>

Persist a serialized RequestLineageRecord (JSON form).

fn record_receipt_lineage_statement( &self, _child_receipt_id: &str, _request_id: Option<&str>, _session_id: Option<&str>, _session_anchor_id: Option<&str>, _parent_request_id: Option<&str>, _parent_receipt_id: Option<&str>, _chain_id: Option<&str>, _recorded_at: u64, _statement_json: &Value, ) -> Result<(), ReceiptStoreError>

Persist a serialized ReceiptLineageStatement (JSON form).

fn get_receipt_lineage_verification( &self, _receipt_id: &str, ) -> Result<Option<ReceiptLineageVerification>, ReceiptStoreError>

fn list_receipt_lineage_statement_links( &self, _receipt_id: &str, ) -> Result<Vec<ReceiptLineageStatementLink>, ReceiptStoreError>

fn as_any_mut(&self) -> Option<&dyn Any>

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors