Struct FleetTaskReceipt 

pub struct FleetTaskReceipt {

    pub fleet: String,
    pub schema_kind: String,
    pub schema_revision: u32,
    pub content_hash: String,
    pub member_id: String,
    pub member_role: String,
    pub posture_role: Option<String>,
    pub authority_fingerprint: Option<String>,
    pub provider: String,
    pub model: String,
    pub declared_model: Option<String>,
    pub endpoint: Option<EndpointIdentity>,
    pub requested_reasoning: String,
    pub effective_reasoning: String,
    pub provider_control: String,
    pub provider_effective_reasoning: String,
    pub selection_source: String,
    pub capability_normalized: bool,
    pub router: Option<RouterIdentity>,
    pub routing_summary: Option<RoutingDisclosure>,
    pub member_network_tool: bool,
    pub cross_provider_inference: bool,
    pub transport: String,
}

The durable, visible receipt for one exact-Fleet task launch.

This is the artifact that makes an exact Fleet auditable: it names the Fleet and the member that ran, the exact provider and canonical wire model they were frozen to, every side of the reasoning decision, and — when a Reasoning Router chose the tier — that service’s exact identity, route, and configured requested-to-provider-effective call reasoning.

No task text, no summary text, no secrets, no absolute paths. Every field is a non-sensitive id, model string, tier label, count, hash, or boolean. The Fleet is identified by qualified origin/name plus content hash rather than by where it lives on disk.

Every field added after the first shipped shape carries serde(default), so journals and events written by an older build stay readable.

Fields

fleet: String

Qualified Fleet identity, e.g. workspace/glm-pair.

schema_kind: String

exact or legacy.

schema_revision: u32

content_hash: String

Content hash of the frozen snapshot this launch resolved against.

member_id: String

Fixed member id — what addresses the roster profile.

member_role: String

Fixed semantic member role — what gates, handoffs, and records use.

posture_role: Option<String>

The runtime permission posture the member’s clamped ceiling resolved to, when it is not the same string as the semantic role.

These are two different facts and a receipt must not collapse them. The semantic role (auditor, implementer) is what an operator named and what gates key on; the posture (scout, builder, verifier) is which built-in tool surface and system prompt the clamped ceiling actually permits. Displaying the posture where the role belongs renames the operator’s member; enforcing the role where the posture belongs would hand an arbitrary role name a surface nobody granted it.

None means the two coincide, so an unchanged receipt stays unchanged.

authority_fingerprint: Option<String>

Fingerprint of the permission envelope this launch installs on the child.

Separate from posture_role on purpose, and the separation is the point: the posture is the semantic answer to “which built-in surface does this member run on”, while the fingerprint is the effective answer to “exactly which allowlist, deny list, write authority, and delegation budget were installed”. Two members can share a posture and carry different envelopes, so a receipt that recorded only the posture could not be checked against the child that actually ran.

The spawn boundary compares this against the envelope it is about to construct and refuses the launch when they differ, which is what stops the value from being a label nobody verifies. None means the launch carried no host-derived ceiling.

provider: String

Exact provider the member is frozen to.

model: String

Canonical wire model. The same value the child actually spawns with.

declared_model: Option<String>

The model string as written in the saved Fleet, when it differed from the canonical wire form.

endpoint: Option<EndpointIdentity>

Non-secret identity of the endpoint the worker’s request goes to.

requested_reasoning: String

What the saved Fleet asked for (auto included).

effective_reasoning: String

The tier the selector landed on.

provider_control: String

How much reasoning control the route actually expresses.

provider_effective_reasoning: String

What the provider is actually told — not always the selector tier.

selection_source: String

Where the decision came from.

capability_normalized: bool

Whether the route’s real capability moved the requested tier.

router: Option<RouterIdentity>

The Reasoning Router service that chose the tier, when one did.

routing_summary: Option<RoutingDisclosure>

Content-free disclosure of the bounded routing summary that left for the Router’s provider. None when no Router was called.

member_network_tool: bool

Whether the member holds a model-visible network tool. This is a tool statement, not a transport one — see transport_disclosure.

cross_provider_inference: bool

Whether a Router on a different provider than the worker saw the bounded summary.

transport: String

Plain-language statement of what actually crosses the network.

Implementations

impl FleetTaskReceipt

pub fn new( fleet: impl Into<String>, schema_kind: impl Into<String>, schema_revision: u32, content_hash: impl Into<String>, member_id: impl Into<String>, member_role: impl Into<String>, route: &PreflightedRoute, resolved: &ResolvedReasoning, routing_summary: Option<RoutingDisclosure>, member_network_tool: bool, ) -> Self

Build a receipt from a resolved decision plus the preflighted identity it was resolved for.

pub fn with_posture_role(self, posture_role: impl Into<String>) -> Self

Record the runtime permission posture this member’s clamped ceiling resolved to, alongside — never instead of — its semantic role.

A posture equal to the role is dropped: there is nothing to disclose when the two coincide, and storing it would make the field noise.

pub fn with_authority_fingerprint(self, fingerprint: impl Into<String>) -> Self

Record the fingerprint of the permission envelope this launch installs.

Unlike Self::with_posture_role nothing is dropped for coinciding with something else: the fingerprint is the value the spawn boundary checks, and an absent one means “no ceiling to enforce”, not “the obvious ceiling”.

pub fn line(&self) -> String

A single visible line summarizing the whole decision.

Trait Implementations

impl Clone for FleetTaskReceipt

fn clone(&self) -> FleetTaskReceipt

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FleetTaskReceipt

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for FleetTaskReceipt

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for FleetTaskReceipt

impl PartialEq for FleetTaskReceipt

fn eq(&self, other: &FleetTaskReceipt) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for FleetTaskReceipt

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for FleetTaskReceipt