Struct SqliteReceiptStore 

pub struct SqliteReceiptStore { /* private fields */ }

Implementations

impl SqliteReceiptStore

pub fn record_capability_snapshot( &self, token: &CapabilityToken, parent_capability_id: Option<&str>, ) -> Result<(), CapabilityLineageError>

Record a capability snapshot at issuance time.

Identical duplicate inserts are idempotent. Conflicting projections are rejected before the first-writer-wins insert.

The parent_capability_id argument must refer to a capability already present in the lineage table. If it is Some but the parent is missing, the depth defaults to 1 (the minimum delegation depth).

pub fn record_capability_snapshot_with_timeout( &self, token: &CapabilityToken, parent_capability_id: Option<&str>, budget: Duration, ) -> Result<(), CapabilityLineageError>

Bounded variant of [record_capability_snapshot]: the writer round trip is capped at budget. The evaluation hot path uses this so a wedged or dying commit writer that passed the pre-dispatch liveness check but stalls on this snapshot cannot hang the request inside an unbounded write.

pub fn upsert_capability_snapshot( &mut self, snapshot: &CapabilitySnapshot, ) -> Result<(), CapabilityLineageError>

Upsert an already-materialized capability snapshot.

This is used by cluster replication so followers can converge on the leader’s lineage table without reconstructing full signed tokens.

pub fn get_lineage( &self, capability_id: &str, ) -> Result<Option<CapabilitySnapshot>, CapabilityLineageError>

Retrieve a single capability snapshot by its ID.

Returns None if no snapshot exists for the given capability_id.

pub fn get_delegation_chain( &self, capability_id: &str, ) -> Result<Vec<CapabilitySnapshot>, CapabilityLineageError>

Walk the delegation chain for a capability, returning root-first ordering.

Uses a WITH RECURSIVE CTE that walks from the given capability up through its parent chain, tracking depth level. The ORDER BY level DESC produces root-first ordering because the root has the highest level value.

A max-depth guard (level < 20) prevents infinite recursion caused by accidental cycles in the parent chain.

pub fn list_capabilities_for_subject( &self, subject_key: &str, ) -> Result<Vec<CapabilitySnapshot>, CapabilityLineageError>

List all capability snapshots for a given subject key.

Returns snapshots ordered newest-first by issued_at.

pub fn list_capability_snapshots( &self, subject_key: Option<&str>, issuer_key: Option<&str>, ) -> Result<Vec<CapabilitySnapshot>, CapabilityLineageError>

List capability snapshots filtered by subject and/or issuer.

If both filters are present they are combined with AND semantics. Results are ordered deterministically oldest-first to keep reputation corpus construction stable across runs.

pub fn list_capability_snapshots_after_seq( &self, after_seq: u64, limit: usize, ) -> Result<Vec<StoredCapabilitySnapshot>, CapabilityLineageError>

Return capability lineage snapshots added after a given local sequence.

The sequence is the SQLite rowid, which is monotonic for this append-only table and therefore suitable as a replication cursor.

pub fn max_lineage_seq(&self) -> Result<u64, ReceiptStoreError>

Highest lineage snapshot seq (capability_lineage rowid), or 0 when empty. list_capability_snapshots_after_seq paginates on rowid, so the head is MAX(rowid). Returns ReceiptStoreError so the cluster status path converts it through the same CliError variant as the receipt heads.

impl SqliteReceiptStore

pub fn build_evidence_export_bundle( &self, query: &EvidenceExportQuery, ) -> Result<EvidenceExportBundle, EvidenceExportError>

Build a local-only evidence export bundle from the current SQLite store.

This method never fabricates joins that the runtime does not persist. Tool receipts can be scoped by capability or agent subject. Child receipts do not currently have the same attribution fields, so they are either included by query window or omitted with an explicit scope flag.

pub fn build_evidence_export_bundle_with_transparency( &self, query: &EvidenceExportQuery, ) -> Result<(EvidenceExportBundle, CheckpointTransparencySummary), EvidenceExportError>

Build a bundle and its transparency summary with one checkpoint validation pass.

pub fn build_evidence_export_transparency_summary( &self, checkpoints: &[KernelCheckpoint], ) -> Result<CheckpointTransparencySummary, EvidenceExportError>

impl SqliteReceiptStore

pub fn query_receipts( &self, query: &ReceiptQuery, ) -> Result<ReceiptQueryResult, ReceiptStoreError>

Query tool receipts with multi-filter support and cursor-based pagination.

Filters are applied with AND semantics. The cursor parameter enables forward-only pagination using the seq column as a stable cursor.

The limit is capped at MAX_QUERY_LIMIT. total_count reflects the full filtered set (no cursor applied), regardless of the page limit.

impl SqliteReceiptStore

pub fn import_federated_evidence_share( &mut self, import: &FederatedEvidenceShareImport, ) -> Result<FederatedEvidenceShareSummary, ReceiptStoreError>

pub fn get_federated_share_for_capability( &self, capability_id: &str, ) -> Result<Option<(FederatedEvidenceShareSummary, CapabilitySnapshot)>, ReceiptStoreError>

pub fn list_federated_share_subject_corpora( &self, subject_key: &str, since: Option<u64>, until: Option<u64>, ) -> Result<Vec<(FederatedEvidenceShareSummary, Vec<StoredToolReceipt>, Vec<CapabilitySnapshot>)>, ReceiptStoreError>

pub fn record_federated_lineage_bridge( &mut self, local_capability_id: &str, parent_capability_id: &str, share_id: Option<&str>, ) -> Result<(), ReceiptStoreError>

pub fn persist_federated_delegation_lineage( &mut self, anchor: &CapabilitySnapshot, upstream_bridge: Option<(&str, &str)>, child: &CapabilitySnapshot, ) -> Result<(), ReceiptStoreError>

Persist a federated issuance lineage as one all-or-nothing operation.

pub fn get_combined_lineage( &self, capability_id: &str, ) -> Result<Option<CapabilitySnapshot>, ReceiptStoreError>

pub fn get_combined_delegation_chain( &self, capability_id: &str, ) -> Result<Vec<CapabilitySnapshot>, ReceiptStoreError>

impl SqliteReceiptStore

pub fn tool_receipt_count(&self) -> Result<u64, ReceiptStoreError>

pub fn child_receipt_count(&self) -> Result<u64, ReceiptStoreError>

pub fn list_tool_receipts( &self, limit: usize, capability_id: Option<&str>, tool_server: Option<&str>, tool_name: Option<&str>, decision_kind: Option<&str>, ) -> Result<Vec<ChioReceipt>, ReceiptStoreError>

pub fn list_tool_receipts_with_context( &self, read_context: &ReceiptReadContext, limit: usize, capability_id: Option<&str>, tool_server: Option<&str>, tool_name: Option<&str>, decision_kind: Option<&str>, ) -> Result<Vec<ChioReceipt>, ReceiptStoreError>

pub fn list_tool_receipts_for_subject( &self, subject_key: &str, ) -> Result<Vec<ChioReceipt>, ReceiptStoreError>

List all tool receipts attributed to a given subject public key.

Uses the persisted subject_key column when present and falls back to the capability lineage join for older rows.

pub fn list_tool_receipts_for_subject_with_context( &self, read_context: &ReceiptReadContext, subject_key: &str, ) -> Result<Vec<ChioReceipt>, ReceiptStoreError>

pub fn list_tool_receipts_after_seq( &self, after_seq: u64, limit: usize, ) -> Result<Vec<StoredToolReceipt>, ReceiptStoreError>

pub fn list_tool_receipts_after_seq_with_context( &self, read_context: &ReceiptReadContext, after_seq: u64, limit: usize, ) -> Result<Vec<StoredToolReceipt>, ReceiptStoreError>

pub fn list_child_receipts( &self, limit: usize, session_id: Option<&str>, parent_request_id: Option<&str>, request_id: Option<&str>, operation_kind: Option<&str>, terminal_state: Option<&str>, ) -> Result<Vec<ChildRequestReceipt>, ReceiptStoreError>

pub fn list_child_receipts_with_context( &self, read_context: &ReceiptReadContext, limit: usize, session_id: Option<&str>, parent_request_id: Option<&str>, request_id: Option<&str>, operation_kind: Option<&str>, terminal_state: Option<&str>, ) -> Result<Vec<ChildRequestReceipt>, ReceiptStoreError>

pub fn list_child_receipts_after_seq( &self, after_seq: u64, limit: usize, ) -> Result<Vec<StoredChildReceipt>, ReceiptStoreError>

pub fn list_child_receipts_after_seq_with_context( &self, read_context: &ReceiptReadContext, after_seq: u64, limit: usize, ) -> Result<Vec<StoredChildReceipt>, ReceiptStoreError>

impl SqliteReceiptStore

pub fn open(path: impl AsRef<Path>) -> Result<Self, ReceiptStoreError>

pub fn wait_for_writer_ready( &self, timeout: Duration, ) -> Result<(), ReceiptStoreError>

Wait until the commit actor has seeded its durable head before a host advertises readiness. The flush barrier is processed only after actor initialization, and the serving check preserves a poisoned-head failure.

pub fn open_existing(path: impl AsRef<Path>) -> Result<Self, ReceiptStoreError>

pub fn open_with_pool_config( path: impl AsRef<Path>, pool_config: SqlitePoolConfig, ) -> Result<Self, ReceiptStoreError>

pub fn open_with_options( path: impl AsRef<Path>, options: SqliteStoreOptions, ) -> Result<Self, ReceiptStoreError>

pub fn open_existing_with_options( path: impl AsRef<Path>, options: SqliteStoreOptions, ) -> Result<Self, ReceiptStoreError>

pub fn open_with_pool_sizes( path: impl AsRef<Path>, reader_pool_max_size: u32, writer_pool_max_size: u32, ) -> Result<Self, ReceiptStoreError>

impl SqliteReceiptStore

pub fn append_chio_receipt_returning_seq( &self, receipt: &ChioReceipt, ) -> Result<u64, ReceiptStoreError>

pub fn store_checkpoint( &self, checkpoint: &KernelCheckpoint, ) -> Result<(), ReceiptStoreError>

Store a signed KernelCheckpoint in the kernel_checkpoints table.

pub fn load_checkpoint_by_seq( &self, checkpoint_seq: u64, ) -> Result<Option<KernelCheckpoint>, ReceiptStoreError>

Load a KernelCheckpoint by its checkpoint_seq.

pub fn receipts_canonical_bytes_range( &self, start_seq: u64, end_seq: u64, ) -> Result<Vec<(u64, Vec<u8>)>, ReceiptStoreError>

Return canonical JSON bytes for receipts with seq in [start_seq, end_seq], ordered by seq.

Uses RFC 8785 canonical JSON for deterministic Merkle leaf hashing.

pub fn db_size_bytes(&self) -> Result<u64, ReceiptStoreError>

Return the current on-disk size of the database in bytes.

Uses PRAGMA page_count and PRAGMA page_size to compute the size without requiring a filesystem stat, which is consistent in WAL mode.

pub fn live_db_size_bytes(&self) -> Result<u64, ReceiptStoreError>

Live logical size in bytes: (page_count - freelist_count) * page_size. Unlike db_size_bytes (on-disk, freelist included), this drops after an archival delete plus incremental_vacuum, so a size-driven rotation trigger converges instead of re-firing on freed-but-not-reclaimed pages.

pub fn oldest_receipt_timestamp(&self) -> Result<Option<u64>, ReceiptStoreError>

Return the Unix timestamp (seconds) of the oldest receipt in the live database, or None if there are no receipts.

pub fn oldest_receipt_timestamp_for_tenant( &self, tenant_id: &str, ) -> Result<Option<u64>, ReceiptStoreError>

Return the oldest live receipt timestamp for a tenant.

pub fn archive_receipts_before( &self, cutoff_unix_secs: u64, archive_path: &str, ) -> Result<u64, ReceiptStoreError>

Archive all receipts whose entire checkpointed prefix has aged past cutoff_unix_secs, co-archiving the claim-log projection and reconciliation evidence, then deleting the archived range from the live store, all on the single writer connection. Returns the number of tool-receipt rows archived.

pub fn rotate_if_needed( &self, config: &RetentionConfig, ) -> Result<u64, ReceiptStoreError>

Check the time and size thresholds and, if either is exceeded, run a checkpoint-aligned rotation on the writer connection.

• Time threshold: receipts older than config.retention_days days age out of the checkpointed prefix.
• Size threshold: if the live database size exceeds max_size_bytes, the median-timestamp cutoff archives roughly the checkpointed half.

Returns the number of tool-receipt rows archived (0 when no whole checkpointed batch has fully aged, i.e. a no-op rotation).

impl SqliteReceiptStore

pub fn record_liability_claim_package( &mut self, claim: &SignedLiabilityClaimPackage, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_claim_response( &mut self, response: &SignedLiabilityClaimResponse, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_claim_dispute( &mut self, dispute: &SignedLiabilityClaimDispute, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_claim_adjudication( &mut self, adjudication: &SignedLiabilityClaimAdjudication, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_claim_payout_instruction( &mut self, payout_instruction: &SignedLiabilityClaimPayoutInstruction, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_claim_payout_receipt( &mut self, payout_receipt: &SignedLiabilityClaimPayoutReceipt, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_claim_settlement_instruction( &mut self, settlement_instruction: &SignedLiabilityClaimSettlementInstruction, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_claim_settlement_receipt( &mut self, settlement_receipt: &SignedLiabilityClaimSettlementReceipt, ) -> Result<(), ReceiptStoreError>

pub fn query_liability_claim_workflows( &self, query: &LiabilityClaimWorkflowQuery, ) -> Result<LiabilityClaimWorkflowReport, ReceiptStoreError>

impl SqliteReceiptStore

pub fn record_liability_provider( &mut self, provider: &SignedLiabilityProvider, ) -> Result<(), ReceiptStoreError>

pub fn query_liability_providers( &self, query: &LiabilityProviderListQuery, ) -> Result<LiabilityProviderListReport, ReceiptStoreError>

pub fn resolve_liability_provider( &self, query: &LiabilityProviderResolutionQuery, ) -> Result<LiabilityProviderResolutionReport, ReceiptStoreError>

pub fn record_liability_quote_request( &mut self, request: &SignedLiabilityQuoteRequest, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_quote_response( &mut self, response: &SignedLiabilityQuoteResponse, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_placement( &mut self, placement: &SignedLiabilityPlacement, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_pricing_authority( &mut self, authority: &SignedLiabilityPricingAuthority, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_bound_coverage( &mut self, coverage: &SignedLiabilityBoundCoverage, ) -> Result<(), ReceiptStoreError>

pub fn record_liability_auto_bind_decision( &mut self, decision: &SignedLiabilityAutoBindDecision, ) -> Result<(), ReceiptStoreError>

pub fn query_liability_market_workflows( &self, query: &LiabilityMarketWorkflowQuery, ) -> Result<LiabilityMarketWorkflowReport, ReceiptStoreError>

impl SqliteReceiptStore

pub fn query_receipt_analytics( &self, query: &ReceiptAnalyticsQuery, ) -> Result<ReceiptAnalyticsResponse, ReceiptStoreError>

impl SqliteReceiptStore

pub fn query_authorization_context_report( &self, query: &OperatorReportQuery, ) -> Result<AuthorizationContextReport, ReceiptStoreError>

pub fn authorization_profile_metadata_report( &self, ) -> ChioOAuthAuthorizationMetadataReport

pub fn query_authorization_review_pack( &self, query: &OperatorReportQuery, ) -> Result<ChioOAuthAuthorizationReviewPack, ReceiptStoreError>

impl SqliteReceiptStore

pub fn query_behavioral_feed_receipts( &self, query: &BehavioralFeedQuery, ) -> Result<(BehavioralFeedSettlementSummary, BehavioralFeedGovernedActionSummary, BehavioralFeedMeteredBillingSummary, BehavioralFeedReceiptSelection), ReceiptStoreError>

pub fn query_recent_credit_loss_receipts( &self, query: &BehavioralFeedQuery, limit: usize, ) -> Result<(u64, Vec<BehavioralFeedReceiptRow>), ReceiptStoreError>

impl SqliteReceiptStore

pub fn query_compliance_report( &self, query: &OperatorReportQuery, ) -> Result<ComplianceReport, ReceiptStoreError>

impl SqliteReceiptStore

pub fn query_cost_attribution_report( &self, query: &CostAttributionQuery, ) -> Result<CostAttributionReport, ReceiptStoreError>

impl SqliteReceiptStore

pub fn query_economic_receipt_projection_report( &self, query: &OperatorReportQuery, ) -> Result<EconomicReceiptProjectionReport, ReceiptStoreError>

pub fn query_economic_completion_flow_report( &self, query: &ExposureLedgerQuery, read_context: ReceiptReadContext, ) -> Result<EconomicCompletionFlowReport, ReceiptStoreError>

impl SqliteReceiptStore

pub fn upsert_settlement_reconciliation( &self, receipt_id: &str, reconciliation_state: SettlementReconciliationState, note: Option<&str>, ) -> Result<i64, ReceiptStoreError>

pub fn upsert_metered_billing_reconciliation( &self, receipt_id: &str, evidence: &MeteredBillingEvidenceRecord, reconciliation_state: MeteredBillingReconciliationState, note: Option<&str>, ) -> Result<i64, ReceiptStoreError>

pub fn query_metered_billing_reconciliation_report( &self, query: &OperatorReportQuery, ) -> Result<MeteredBillingReconciliationReport, ReceiptStoreError>

impl SqliteReceiptStore

pub fn query_settlement_reconciliation_report( &self, query: &OperatorReportQuery, ) -> Result<SettlementReconciliationReport, ReceiptStoreError>

impl SqliteReceiptStore

pub fn query_shared_evidence_report( &self, query: &SharedEvidenceQuery, ) -> Result<SharedEvidenceReferenceReport, ReceiptStoreError>

impl SqliteReceiptStore

pub fn record_session_anchor_record( &self, session_id: &str, anchor_id: &str, auth_context_fingerprint: &str, issued_at: u64, supersedes_anchor_id: Option<&str>, anchor_json: &Value, ) -> Result<(), ReceiptStoreError>

pub fn record_request_lineage_record( &self, session_id: &str, request_id: &str, parent_request_id: Option<&str>, session_anchor_id: Option<&str>, recorded_at: u64, request_fingerprint: Option<&str>, lineage_json: &Value, ) -> Result<(), ReceiptStoreError>

pub fn record_receipt_lineage_statement_record( &self, child_receipt_id: &str, request_id: Option<&str>, session_id: Option<&str>, session_anchor_id: Option<&str>, parent_request_id: Option<&str>, parent_receipt_id: Option<&str>, chain_id: Option<&str>, recorded_at: u64, statement_json: &Value, ) -> Result<(), ReceiptStoreError>

pub fn list_receipt_lineage_statement_links( &self, receipt_id: &str, ) -> Result<Vec<ReceiptLineageStatementLink>, ReceiptStoreError>

pub fn receipt_lineage_verification( &self, receipt_id: &str, ) -> Result<Option<ReceiptLineageVerification>, ReceiptStoreError>

pub fn append_child_receipt_record( &self, receipt: &ChildRequestReceipt, ) -> Result<u64, ReceiptStoreError>

pub fn append_child_receipt_record_with_timeout( &self, receipt: &ChildRequestReceipt, budget: Duration, ) -> Result<u64, ReceiptStoreError>

Deadline-bounded variant of [append_child_receipt_record]. Fails closed with ReceiptStoreError::Timeout if the commit round trip exceeds budget, so a wedged writer cannot pin the kernel-wide receipt write lock while nested-flow child receipts drain.

impl SqliteReceiptStore

pub fn record_checkpoint_publication_trust_anchor_binding( &self, checkpoint_seq: u64, binding: &CheckpointPublicationTrustAnchorBinding, ) -> Result<(), ReceiptStoreError>

impl SqliteReceiptStore

pub fn record_underwriting_decision( &mut self, decision: &SignedUnderwritingDecision, ) -> Result<(), ReceiptStoreError>

pub fn create_underwriting_appeal( &mut self, request: &UnderwritingAppealCreateRequest, ) -> Result<UnderwritingAppealRecord, ReceiptStoreError>

pub fn resolve_underwriting_appeal( &mut self, request: &UnderwritingAppealResolveRequest, ) -> Result<UnderwritingAppealRecord, ReceiptStoreError>

pub fn query_underwriting_decisions( &self, query: &UnderwritingDecisionQuery, ) -> Result<UnderwritingDecisionListReport, ReceiptStoreError>

pub fn record_credit_facility( &mut self, facility: &SignedCreditFacility, ) -> Result<(), ReceiptStoreError>

pub fn query_credit_facilities( &self, query: &CreditFacilityListQuery, ) -> Result<CreditFacilityListReport, ReceiptStoreError>

pub fn record_credit_bond( &mut self, bond: &SignedCreditBond, ) -> Result<(), ReceiptStoreError>

pub fn query_credit_bonds( &self, query: &CreditBondListQuery, ) -> Result<CreditBondListReport, ReceiptStoreError>

pub fn record_credit_loss_lifecycle( &mut self, event: &SignedCreditLossLifecycle, ) -> Result<(), ReceiptStoreError>

pub fn query_credit_loss_lifecycle( &self, query: &CreditLossLifecycleListQuery, ) -> Result<CreditLossLifecycleListReport, ReceiptStoreError>

impl SqliteReceiptStore

pub fn max_tool_receipt_seq(&self) -> Result<u64, ReceiptStoreError>

Highest tool-receipt replication seq, or 0 on an empty store. Single indexed MAX read; does not materialize the store.

pub fn max_child_receipt_seq(&self) -> Result<u64, ReceiptStoreError>

Highest child-receipt replication seq, or 0 on an empty store.

pub fn with_strict_tenant_isolation(&self, strict: bool)

Multi-tenant receipt isolation: toggle strict-isolation mode on tenant-scoped queries.

When strict = true, a tenant_filter = Some(id) query returns ONLY rows whose tenant_id = id. Pre-multitenant receipts with tenant_id IS NULL are excluded.

When strict = false, the same query also includes rows where tenant_id IS NULL – the pre-multitenant “public” fallback set – so pre-multitenant (NULL-tagged) receipts remain visible during an explicit compatibility window.

A tenant_filter = None admin / compat query always returns every row regardless of this setting.

pub fn strict_tenant_isolation_enabled(&self) -> bool

Read the current strict-tenant-isolation setting.

pub fn incremental_verification_enabled(&self) -> bool

Read-only after open (staged-rollout flag).

pub fn append_chio_receipt_canonical( &self, canonical: Arc<CanonicalBytes>, ) -> Result<(), ReceiptStoreError>

pub fn append_chio_receipt_canonical_bytes( &self, canonical: Arc<CanonicalBytes>, ) -> Result<(), ReceiptStoreError>

pub fn append_chio_receipt_canonical_returning_seq( &self, canonical: Arc<CanonicalBytes>, ) -> Result<u64, ReceiptStoreError>

pub fn append_chio_receipt_canonical_bytes_returning_seq( &self, canonical: Arc<CanonicalBytes>, ) -> Result<u64, ReceiptStoreError>

pub fn writer_liveness( &self, stall_threshold: Duration, ) -> ReceiptWriterLiveness

Best-effort writer liveness derived from the commit-actor counters, assessed against the operator-configured stall_threshold. See [classify_writer_liveness] for the transition rules.

pub fn append_chio_receipt_consuming_authorization( &self, receipt: &ChioReceipt, consumption: &AuthorizationReceiptConsumption, ) -> Result<(), ReceiptStoreError>

pub fn flush_receipt_writes( &self, ) -> Result<ReceiptFlushReport, ReceiptStoreError>

pub fn retention_repair( &self, archive_path: &str, ) -> Result<u64, ReceiptStoreError>

Recover a store whose claim-log projection rows survived a source-row delete. Fail-closed: only removes claim-log extra rows (absent from both source tables) that are (a) present in the named archive and (b) at or below the smallest checkpoint batch_end_seq that covers them, so the uncheckpointed suffix is never touched. Returns the number of rows removed.

Dispatched as its own writer-actor command (RetentionRepair), not writer_handle().run_write: a Write job is rejected outright while the head is Poisoned (see handle_non_append_command’s Write arm), which is exactly the state a bricked store’s writer actor is in on open, so run_write can never reach the store this method exists to repair. RetentionRepair runs unconditionally on the single writer connection (still fully serialized with every other writer command, same single-writer discipline as run_write), like ReseedHead and Rotate, and reseeds the head on success so the same store instance is appendable again without requiring a fresh open.

pub fn audit_receipt_cost_projection(&self) -> Result<(), ReceiptStoreError>

pub fn reseed_verified_head(&self) -> Result<(), ReceiptStoreError>

Rerun the one-time full verification on the writer connection and adopt the resulting head. This is the chio receipt audit --repair entry point; it is also safe to call on a healthy store.

pub fn enable_background_checkpoints( &self, signer: BackgroundCheckpointSigner, ) -> Result<(), ReceiptStoreError>

Install the background checkpoint signer. Idempotent per store (a second call replaces the signer). Until called, the store appends without producing checkpoints.

pub fn flush_receipt_writes_with_timeout( &self, timeout: Duration, ) -> Result<ReceiptFlushReport, ReceiptStoreError>

pub fn record_retention_rotation_outcome(&self, failure: Option<&str>)

Record the outcome of a background retention rotation into health. None clears a prior failure after a successful rotation; Some(message) records a rotation error or panic so a persistently failing background maintenance task surfaces as unhealthy in receipt_store_health instead of the failure living only in the worker’s logs. Called by the kernel maintenance worker on the store handle it holds; the health snapshot is shared across all handles of this store, so the failure is visible to any other handle sampling health.

pub fn receipt_store_health( &self, ) -> Result<ReceiptStoreHealthReport, ReceiptStoreError>

pub fn writer_serving_closed(&self) -> bool

Whether the commit writer can no longer be trusted to persist receipts, so the kernel pre-dispatch gate must deny before a tool executes. True when the supervised writer thread has left the healthy state, and also when the writer’s verified head is poisoned: the thread is alive but every append is rejected until an operator reseeds.

pub fn receipt_store_health_read_only( path: &Path, ) -> Result<ReceiptStoreHealthReport, ReceiptStoreError>

Sample receipt-store health from a READ-ONLY connection.

The SIEM serve-mode watchdog observes a receipt DB the kernel owns; it must not create it, switch it to WAL, or spin a writer pool on it, matching the read-only receipt-polling contract. open does all three, so it cannot be used on a read-only mount and would create an empty DB on a mistyped path. This opens a single READ_ONLY connection instead: a missing file reports NotFound rather than being created, and a read-only mount is sampled without any write attempt.

A read-only observer cannot see the owning writer’s in-memory counters, so writer is defaulted; the checkpoint-progress fields the watchdog gauges consume (committed/checkpointed seqs and the uncheckpointed range) are computed from the read connection with the same helpers as receipt_store_health.

pub fn latest_committed_entry_seq(&self) -> Result<u64, ReceiptStoreError>

pub fn latest_checkpointed_entry_seq(&self) -> Result<u64, ReceiptStoreError>

pub fn next_checkpoint_range( &self, max_batch: u64, ) -> Result<Option<ReceiptCheckpointRange>, ReceiptStoreError>

pub fn receipt_checkpoint_status( &self, max_batch: Option<u64>, ) -> Result<ReceiptCheckpointStatusReport, ReceiptStoreError>

pub fn create_next_receipt_checkpoint( &self, max_batch: u64, keypair: &Keypair, ) -> Result<ReceiptCheckpointCreateReport, ReceiptStoreError>

Trait Implementations

impl ReceiptStore for SqliteReceiptStore

fn append_chio_receipt( &self, receipt: &ChioReceipt, ) -> Result<(), ReceiptStoreError>

fn settlement_store_binding(&self) -> Option<SettlementStoreBinding>

Identify the durable writer shared with a settlement outcome store.

fn atomic_receipt_projection(&self) -> AtomicReceiptProjection

Report the atomic receipt-sidecar projection implemented by this store.

fn supports_atomic_receipt_projection_with_timeout(&self) -> bool

Whether the atomic receipt projection also honors the supplied append deadline. Settlement runtime installation requires this capability so a legacy atomic-only store cannot reintroduce an unbounded writer wait.

fn append_chio_receipt_with_pending_observation( &self, receipt: &ChioReceipt, pending: &PendingSettlementObservation, ) -> Result<(), ReceiptStoreError>

Atomically append a receipt and its initial settlement observation.

fn append_chio_receipt_with_pending_observation_and_timeout( &self, receipt: &ChioReceipt, pending: &PendingSettlementObservation, budget: Duration, ) -> Result<Option<u64>, ReceiptStoreError>

Atomically append a receipt and its initial settlement observation while honoring the receipt-append deadline on stores with an async writer.

fn load_chio_receipt( &self, receipt_id: &str, ) -> Result<Option<ChioReceipt>, ReceiptStoreError>

Load a chio receipt by id. The provided default returns None; a store backing a store-authoritative deployment MUST override this (and load_child_receipt) with a real point lookup.

fn load_child_receipt( &self, receipt_id: &str, ) -> Result<Option<ChildRequestReceipt>, ReceiptStoreError>

Load a child-request receipt by id. Provided default returns None; a store used for a store-authoritative deployment must override both this and load_chio_receipt. A miss is a fail-closed deny of the dependent call-chain claim, never a false allow. The same bounded-mirror eviction caveat documented on load_chio_receipt applies.

fn append_chio_receipt_canonical( &self, _receipt: &ChioReceipt, canonical: &CanonicalBytes, ) -> Result<(), ReceiptStoreError>

fn append_chio_receipt_returning_seq( &self, receipt: &ChioReceipt, ) -> Result<Option<u64>, ReceiptStoreError>

fn append_chio_receipt_with_timeout( &self, receipt: &ChioReceipt, budget: Duration, ) -> Result<Option<u64>, ReceiptStoreError>

Append a receipt, failing closed with ReceiptStoreError::Timeout if the commit round trip exceeds budget. The default ignores the budget and keeps the unbounded behavior for stores without an async writer; a store with a commit actor overrides this so a wedged writer cannot pin the kernel-wide receipt write lock indefinitely.

fn writer_liveness(&self, stall_threshold: Duration) -> ReceiptWriterLiveness

Point-in-time writer liveness, assessed against the operator-configured stall threshold. Default Unknown keeps stores with no async writer, or no watchdog wired, permissive at the pre-dispatch gate; such stores ignore the threshold.

fn append_chio_receipt_consuming_authorization( &self, receipt: &ChioReceipt, consumption: &AuthorizationReceiptConsumption, ) -> Result<(), ReceiptStoreError>

fn receipts_canonical_bytes_range( &self, start_seq: u64, end_seq: u64, ) -> Result<Vec<(u64, Vec<u8>)>, ReceiptStoreError>

fn flush_receipt_writes(&self) -> Result<ReceiptFlushReport, ReceiptStoreError>

fn flush_receipt_writes_with_timeout( &self, timeout: Duration, ) -> Result<ReceiptFlushReport, ReceiptStoreError>

fn receipt_store_health( &self, ) -> Result<ReceiptStoreHealthReport, ReceiptStoreError>

fn writer_serving_closed(&self) -> bool

Whether the store’s commit writer has degraded to the point that durable persistence can no longer be trusted, so evaluations must fail closed before dispatch rather than after executing a tool with no receipt path.

fn latest_committed_entry_seq(&self) -> Result<u64, ReceiptStoreError>

fn latest_checkpointed_entry_seq(&self) -> Result<u64, ReceiptStoreError>

fn next_checkpoint_range( &self, max_batch: u64, ) -> Result<Option<ReceiptCheckpointRange>, ReceiptStoreError>

fn receipt_checkpoint_status( &self, max_batch: Option<u64>, ) -> Result<ReceiptCheckpointStatusReport, ReceiptStoreError>

fn store_checkpoint( &self, checkpoint: &KernelCheckpoint, ) -> Result<(), ReceiptStoreError>

fn create_next_receipt_checkpoint( &self, max_batch: u64, keypair: &Keypair, ) -> Result<ReceiptCheckpointCreateReport, ReceiptStoreError>

fn load_checkpoint_by_seq( &self, checkpoint_seq: u64, ) -> Result<Option<KernelCheckpoint>, ReceiptStoreError>

fn load_latest_checkpoint( &self, ) -> Result<Option<KernelCheckpoint>, ReceiptStoreError>

fn supports_kernel_signed_checkpoints(&self) -> bool

fn enable_background_checkpoints( &self, keypair: Keypair, max_batch: u64, ) -> Result<bool, ReceiptStoreError>

Install a background checkpoint signer on stores that build their own checkpoints on the writer thread. Returns Ok(false) when the store does not support background checkpointing (default).

fn supports_retention(&self) -> bool

Whether this store actually implements retention rotation (rotate_receipts). Default false: the default rotate_receipts is a fail-closed default, so a kernel configured with retention_config uses this to refuse attaching a store that cannot rotate, rather than serving traffic under a retention policy whose background worker would only log “not supported” on every interval and never archive.

fn rotate_receipts( &self, config: &RetentionConfig, ) -> Result<u64, ReceiptStoreError>

Archive receipts that have aged out under config (day/size threshold, or an explicit cutoff). Returns the number of archived tool-receipt rows. Default: unsupported (fail-closed) for stores that do not implement retention.

fn record_retention_rotation_outcome(&self, failure: Option<&str>)

Record the outcome of a background retention rotation so a persistent failure is observable in receipt_store_health (and any health/flush report) rather than living only in logs. None clears a prior failure after a successful rotation; Some(message) records a rotation error or panic so a silently-failing background retention task marks the store unhealthy and surfaces the cause to operators and automation. Default no-op for stores without a health surface.

fn record_capability_snapshot( &self, token: &CapabilityToken, parent_capability_id: Option<&str>, ) -> Result<(), ReceiptStoreError>

fn record_capability_snapshot_with_timeout( &self, token: &CapabilityToken, parent_capability_id: Option<&str>, budget: Duration, ) -> Result<(), ReceiptStoreError>

Record a capability snapshot, failing closed with ReceiptStoreError::Timeout if the writer round trip exceeds budget. The default ignores the budget and keeps the unbounded behavior for stores without an async writer; a store with a commit actor overrides this so a writer that stalls after the pre-dispatch liveness check cannot hang the evaluation hot path inside the snapshot write.

fn get_capability_snapshot( &self, capability_id: &str, ) -> Result<Option<CapabilitySnapshot>, ReceiptStoreError>

fn get_capability_delegation_chain( &self, capability_id: &str, ) -> Result<Vec<CapabilitySnapshot>, ReceiptStoreError>

fn record_session_anchor( &self, session_id: &str, anchor_id: &str, auth_context_fingerprint: &str, issued_at: u64, supersedes_anchor_id: Option<&str>, anchor_json: &Value, ) -> Result<(), ReceiptStoreError>

Persist a serialized SessionAnchor (JSON form).

fn record_request_lineage( &self, session_id: &str, request_id: &str, parent_request_id: Option<&str>, session_anchor_id: Option<&str>, recorded_at: u64, request_fingerprint: Option<&str>, lineage_json: &Value, ) -> Result<(), ReceiptStoreError>

Persist a serialized RequestLineageRecord (JSON form).

fn record_receipt_lineage_statement( &self, child_receipt_id: &str, request_id: Option<&str>, session_id: Option<&str>, session_anchor_id: Option<&str>, parent_request_id: Option<&str>, parent_receipt_id: Option<&str>, chain_id: Option<&str>, recorded_at: u64, statement_json: &Value, ) -> Result<(), ReceiptStoreError>

Persist a serialized ReceiptLineageStatement (JSON form).

fn get_receipt_lineage_verification( &self, receipt_id: &str, ) -> Result<Option<ReceiptLineageVerification>, ReceiptStoreError>

fn list_receipt_lineage_statement_links( &self, receipt_id: &str, ) -> Result<Vec<ReceiptLineageStatementLink>, ReceiptStoreError>

fn as_any_mut(&self) -> Option<&dyn Any>

fn resolve_credit_bond( &self, bond_id: &str, ) -> Result<Option<CreditBondRow>, ReceiptStoreError>

fn append_child_receipt( &self, receipt: &ChildRequestReceipt, ) -> Result<(), ReceiptStoreError>

fn append_child_receipt_returning_seq( &self, receipt: &ChildRequestReceipt, ) -> Result<Option<u64>, ReceiptStoreError>

fn append_child_receipt_with_timeout( &self, receipt: &ChildRequestReceipt, budget: Duration, ) -> Result<Option<u64>, ReceiptStoreError>

Append a child receipt, failing closed with ReceiptStoreError::Timeout if the commit round trip exceeds budget. The default ignores the budget and keeps the unbounded behavior for stores without an async writer; a store with a commit actor overrides this so a wedged writer cannot pin the kernel-wide receipt write lock while nested-flow child receipts drain.

fn admission_projection_capabilities(&self) -> AdmissionProjectionCapabilities

fn commit_admission_projection( &self, _projection: &AdmissionTerminalProjection, ) -> Result<AdmissionTerminal, ReceiptStoreError>

fn supports_tenant_scoped_retention(&self) -> bool

Whether this store can honor a TENANT-SCOPED retention config (RetentionConfig.tenant_id set). Default false: prefix-watermark retention archives a contiguous checkpointed prefix of the WHOLE log and cannot carve out a single tenant, so a tenant-scoped rotate_receipts fails closed. A kernel configured with a tenant-scoped retention policy uses this to refuse attaching a store that could never archive under it, rather than spawning a worker that only logs “unsupported” every interval.