pub struct DataFlow {
pub reads: bool,
pub writes: bool,
pub egress: bool,
pub egress_scopes: Vec<EgressScope>,
}Expand description
Declares what a provider does with data, so a host can gate consent before ever sending it a query.
Not Copy: egress_scopes is an owned Vec, so a
DataFlow is cloned, not bit-copied.
Fields§
§reads: boolCan see workspace content via query payloads.
writes: boolThe provider durably persists data derived from what it receives — indexing query payloads, retaining request logs, and the like.
This is a consent-surface declaration, not a capability flag: it does not imply any host-callable write method, and none exists (see ADR 0004). It is kept because “you may read my workspace” and “you may durably record things about me” are different grants, and a user deserves to be told about the second one.
egress: boolSends anything off the local machine. A host MUST require explicit,
one-time consent before enabling a provider with egress: true.
egress_scopes: Vec<EgressScope>The egress scopes this provider’s served content falls
under (docs/context-reuse.md §3). Empty ⇒ the provider declares only
the boolean egress posture (the pre-scope contract). An off-machine
scope here is only consistent with egress == true
(see scopes_consistent); a scope governs
every frame the provider serves.
Implementations§
Source§impl DataFlow
impl DataFlow
Sourcepub fn off_machine_scopes(&self) -> impl Iterator<Item = &EgressScope>
pub fn off_machine_scopes(&self) -> impl Iterator<Item = &EgressScope>
The declared scopes whose content leaves the machine
(EgressScope::is_off_machine).
Sourcepub fn scopes_consistent(&self) -> bool
pub fn scopes_consistent(&self) -> bool
Whether the declared scopes are truthful and well-formed
(docs/context-reuse.md §3, requirement C5). A host holds a provider to
this at the handshake:
- every declared scope MUST be well-formed (
EgressScope::is_valid— custom scopes must be namespaced); - an off-machine scope alongside
egress: falseis a lie — a provider cannot claimlocal-onlyposture while declaring content leaves. (The converse is allowed:egress: truewith no scopes is the legacy boolean contract.)