Struct Host 

pub struct Host { /* private fields */ }

Registers in-process, stdio, and HTTP providers behind one handle and fans queries out across them.

Implementations

impl Host

pub fn new() -> Self

A host with no providers and the default per-provider timeout.

pub fn with_timeout(per_provider_timeout: Duration) -> Self

A host with a custom per-provider timeout.

pub fn register(&mut self, provider: Box<dyn ContextProvider>)

Register an in-process provider (a built-in, e.g. the code graph).

pub async fn add_stdio( &mut self, id: impl Into<String>, program: &str, args: &[String], ) -> Result<(), HostError>

Spawn and register a child-process provider over stdio, completing the handshake (SPEC.md §3).

pub async fn add_http( &mut self, id: impl Into<String>, url: impl Into<String>, credential: Option<Credential>, ) -> Result<(), HostError>

Connect and register a remote HTTP provider, completing the handshake.

credential is an optional bearer Credential attached to every request; pass None for an unauthenticated provider. A plaintext (http://) transport to a non-loopback provider is refused before any bytes leave the host (HostError::InsecureTransport, C7), and the credential is never logged (C8).

pub fn record_consent(&mut self, record: ConsentRecord)

Record legacy boolean consent for a provider, unlocking an egress provider that declares no scopes for querying (§3.5).

pub fn record_receipt(&mut self, receipt: ConsentReceipt)

Append a scope-level ConsentReceipt to the audit ledger, authorizing one egress scope for one provider (docs/context-reuse.md §3). A provider that declares off-machine egress scopes stays gated until every such scope has a receipt.

pub fn consent(&self) -> &ConsentStore

The consent store (read-only), e.g. to persist decisions.

pub fn provider_ids(&self) -> Vec<&str>

The ids of every registered provider, in registration order.

pub fn provider(&self, id: &str) -> Option<&dyn ContextProvider>

Borrow a registered provider by id, e.g. to read its cached capabilities.

pub fn len(&self) -> usize

How many providers are registered.

pub fn is_empty(&self) -> bool

pub async fn verify_frames(&self, held: &[FrameId]) -> VerifyOutcome

Revalidate frames this host already holds, so unchanged context can be reused without re-querying it (docs/context-reuse.md §4).

Identities are grouped by provider and each capable provider is asked once. The rule is default-deny: a frame is retained only on an explicit Verdict::Valid, and every other outcome — a negative verdict, a missing digest, a provider that doesn’t support verify, an unregistered provider, a failed request — drops the frame with a reason (requirement V2). Reasons that warrant a re-query tell the host which dropped frames are worth fetching again.

This method holds no state: it neither caches frames nor tracks turn boundaries. When to re-verify is the host’s policy (§4 gives informative guidance); the protocol’s job is only to answer the question when asked. No frame body travels in either direction.

pub async fn query_provider( &self, id: &str, query: &ContextQuery, ) -> Result<ContextQueryResult, HostError>

Query a single provider by id, honoring the consent gate and the per-provider timeout. Querying an unconsented egress provider is HostError::ConsentRequired (legacy boolean) or HostError::ConsentScopeRequired (an off-machine scope with no receipt, §3), and the payload is never transmitted (§3.5).

pub async fn query_all(&self, query: &ContextQuery) -> FanOut

Fan a query out to every capability-matching provider concurrently, collecting a per-provider outcome. Each provider is consent-gated, timed out, and budget-audited independently — the crash-consistency contract means one provider’s failure never affects another (task deliverables 3 + 5).

pub async fn query_all_budgeted( &self, template: &ContextQuery, global_budget: u32, ) -> FanOut

Fan a query out under a global token budget, splitting it into a per-provider max_tokens share before building each provider’s query (issue #15). Where query_all hands the same max_tokens to every provider — so N honest providers can each spend the whole budget and the honest total is N× the intended prompt budget — this gives each capability-matching provider a slice of global_budget, so the honest legs sum to <= global_budget.

template supplies every field of the query except max_tokens, which is overwritten per provider with its share from compose::budget_split — an equal split by default, documented there as swappable for a weighted one. Only capability-matching providers (the same filter query_all applies) count toward the split and receive a query. Each leg is still consent-gated, timed out, and budget-audited exactly as in query_all, so a provider that overspends its share is dropped with a report by the existing B2 audit — the split composes with per-leg honesty rather than replacing it.

query_all stays the un-budgeted legacy path.

pub async fn shutdown(self) -> Vec<(String, Result<(), HostError>)>

Shut every provider down cleanly, consuming the host so its stdio children are reaped as they drop. Returns each provider’s shutdown result so a caller can log stragglers.

Trait Implementations

impl Default for Host

fn default() -> Self

Returns the “default value” for a type.