Struct SetupState 

pub struct SetupState {

    pub schema_version: u32,
    pub steps: BTreeMap<SetupStep, StepEntry>,
    pub constitution_choice: ConstitutionChoice,
    pub constitution_checkpoint_completed_for: Option<String>,
    pub constitution_language: Option<String>,
    pub constitution_source: ConstitutionSource,
    pub constitution_validity: ConstitutionValidity,
    pub constitution_authoring: Option<ConstitutionAuthoring>,
    pub constitution_preview_hash: Option<String>,
    pub constitution_preview_version: u32,
    pub runtime_posture_source: RuntimePostureSource,
    pub operate_receipts_verified: bool,
    pub inherited: bool,
    pub telemetry_notice_decided_for: Option<String>,
    pub telemetry_opt_in: bool,
}

The persisted, per-version setup-state record.

Fields

schema_version: u32

steps: BTreeMap<SetupStep, StepEntry>

Per-step status entries.

constitution_choice: ConstitutionChoice

The user’s constitution decision.

constitution_checkpoint_completed_for: Option<String>

Lane version (e.g. "0.8.67") whose constitution checkpoint the user has completed. Drives the once-per-version update checkpoint (#3794).

constitution_language: Option<String>

Language the constitution prose was authored/reviewed in.

constitution_source: ConstitutionSource

Which surface is the active user-global law.

constitution_validity: ConstitutionValidity

Validity of the active user-global constitution file.

constitution_authoring: Option<ConstitutionAuthoring>

How the active custom constitution was authored (guided deterministic vs model-drafted-then-ratified). None for bundled/deferred/inherited.

constitution_preview_hash: Option<String>

Stable content hash of the most recently previewed/accepted rendered constitution (see crate::user_constitution::UserConstitution::preview_hash).

constitution_preview_version: u32

Monotonic counter bumped each time a custom constitution is saved, so the report and /constitution can show which revision is live.

runtime_posture_source: RuntimePostureSource

Where the current runtime posture came from.

operate_receipts_verified: bool

Host-enforced Workflow dispatch and terminal receipts have been proven for this installation. Older records did not carry this proof and must deserialize false even if their Operate/Fleet card was marked Verified.

inherited: bool

True when this record was derived from existing config rather than persisted by an explicit setup run. Lets /setup and doctor explain why an updating user is not treated as a broken fresh install.

telemetry_notice_decided_for: Option<String>

TELEMETRY_NOTICE_VERSION whose telemetry notice the user has answered. None means the notice is still owed.

Never auto-completed and never deferred-completed: unlike the constitution checkpoint, which records a Deferred completion on the skip-onboarding path, a telemetry notice that was not rendered and answered leaves this None. Silence is not consent, so the failure mode of a missing notice is that nothing is ever collected.

These are fields rather than a new SetupStep variant on purpose: an unknown enum variant fails the whole record parse and silently drops the user back to derived-inherited state — including their constitution checkpoint — while unknown fields are ignored.

telemetry_opt_in: bool

The user’s answer to the notice. Only meaningful when Self::telemetry_notice_decided_for matches the current TELEMETRY_NOTICE_VERSION.

Implementations

impl SetupState

pub fn status(&self, step: SetupStep) -> StepStatus

Status for a step, defaulting to StepStatus::NotStarted.

pub fn set_step(&mut self, step: SetupStep, entry: StepEntry) -> &mut Self

Record (insert or replace) an entry for step.

pub fn first_run_ready(&self) -> bool

First-run “ready”: language verified, provider/model ready-or-needs-action, runtime posture inherited/confirmed, and an explicit constitution choice.

pub fn operate_ready(&self) -> bool

Operate/Fleet “ready”: provider credentials are verified, runtime posture has been reviewed, and the user has explicitly reviewed the Fleet/Operate on-ramp. This is intentionally separate from first_run_ready: a local-first user can be ready for ordinary first use before enabling durable multi-worker work.

pub fn update_ready(&self, version: &str) -> bool

Update “ready” for version: the constitution checkpoint for that lane is complete. Everything else is inherited from existing config.

pub fn needs_constitution_checkpoint(&self, version: &str) -> bool

Whether the once-per-version update checkpoint should still be shown.

pub fn complete_constitution_checkpoint( &mut self, version: impl Into<String>, choice: ConstitutionChoice, ) -> &mut Self

Mark the constitution checkpoint complete for version (the bundled / default path is a valid completion).

pub fn needs_telemetry_notice(&self, version: &str) -> bool

True when the telemetry notice for version has not been answered.

A decision recorded against a different notice version does not count: the content changed, so the answer is stale and is owed again.

pub fn record_telemetry_notice( &mut self, version: impl Into<String>, opt_in: bool, ) -> &mut Self

Record the user’s answer to the telemetry notice for version.

Call this only from a path where the notice was actually rendered and the user actually answered. Deferral, skip-onboarding, and any non-interactive surface must leave the record untouched.

pub fn telemetry_accepted(&self, version: &str) -> bool

True when the user was asked the current notice and said yes.

This is one half of the emit condition; the other is telemetry = true in config. Neither alone suffices, which is what makes a stale pre-existing telemetry = true — settable and inert for a long time — not consent.

pub fn telemetry_declined(&self, version: &str) -> bool

True when the user was asked the current notice and said no.

Distinct from “never asked”: only a recorded decline is an answer, and only an answer may be acted on destructively.

pub fn derive_inherited(facts: &InheritedConfigFacts) -> Self

Derive a safe inherited state for an existing user with no persisted setup_state.json. Surfaces they already configured become StepStatus::Verified; an update never looks like a fresh, broken setup. The constitution checkpoint is intentionally left incomplete so updating users still see it once.

pub fn path() -> Result<PathBuf>

Path to the setup-state sidecar under $CODEWHALE_HOME.

pub fn load() -> Result<Option<Self>>

Load the persisted setup-state from the home sidecar.

Returns Ok(None) when the file is missing or unreadable/corrupt, so callers fall back to derive_inherited rather than forcing a fresh wizard. A corrupt record is logged, never fatal.

pub fn load_from(path: &Path) -> Option<Self>

Load from an explicit path (testable). See load for the missing/corrupt fallback contract.

pub fn save(&self) -> Result<()>

Atomically persist this record to the home sidecar.

pub fn save_to(&self, path: &Path) -> Result<()>

Atomically persist to an explicit path (testable).

Trait Implementations

impl Clone for SetupState

fn clone(&self) -> SetupState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SetupState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SetupState

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SetupState

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SetupState

impl PartialEq for SetupState

fn eq(&self, other: &SetupState) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SetupState

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SetupState