Module host 

The Host — one uniform handle over every provider, and the fan-out router.

The host does the four jobs providers never do: routes a query to capability-matching providers (SPEC.md §5), gates consent so nothing reaches an unconsented egress provider (SPEC.md §4, C1–C2), enforces per-provider timeouts, and audits budget honesty on two axes — a provider whose frames sum above the query budget lied about token_cost (SPEC.md §7, B2), and one that returns more frames than max_frames overspent a budget the token count never captures (SPEC.md §7, B4). Either way its frames are dropped with a loud named report rather than silently trusted. Per-provider isolation is total: one provider erroring, timing out, being dropped for a budget lie, or crashing mid-query never poisons the others (task deliverable 5).

Structs

DroppedFrame

One dropped frame and why (docs/context-reuse.md §4).

FanOut

The result of fanning one query out across all capability-matching providers.

Host

Registers in-process, stdio, and HTTP providers behind one handle and fans queries out across them.

ProviderOutcome

One provider’s outcome within a FanOut.

VerifyOutcome

The result of revalidating a held frame set (docs/context-reuse.md §4).

Enums

DropReason

Why a held frame was dropped by Host::verify_frames (docs/context-reuse.md §4).

ProviderResult

What became of one provider’s leg of a fan-out — a total function over every failure mode, so no leg can abort another.